On 10/11/13 10:54 AM, Jan Lieskovsky wrote:
This proposal converts rules from RHEL6's 'Restrict Root Logins'
section so they could be used on Fedora too. Depends on previous
typo fix (caab207a8c8a587914d9a1b318d972bbd678896c).

Common Fedora rpm Makefile rules and Fedora SSG Makefile content
rules have been tested and confirmed to work properly.

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

0001-Fedora-Convert-RHEL6-Restrict-Root-Logins-section-s-.patch

From 844d8b1e757942da57adedf8f6ad726a4771ae01 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Fri, 11 Oct 2013 16:44:31 +0200
Subject: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's
 rules to Fedora


Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 .../input/checks/accounts_no_uid_except_zero.xml   |  23 +++
 .../checks/no_shelllogin_for_systemaccounts.xml    |  22 ++
 .../input/checks/restrict_serial_port_logins.xml   |  27 +++
 .../checks/securetty_root_login_console_only.xml   |  26 +++
 Fedora/input/guide.xml                             |   2 +-
 Fedora/input/guide.xslt                            |   1 +
 Fedora/input/profiles/common.xml                   |  35 +++-
 .../system/accounts/restrictions/root_logins.xml   | 230 +++++++++++++++++++++
 Fedora/scap-security-guide.spec                    |   5 +-
 9 files changed, 359 insertions(+), 12 deletions(-)
 create mode 100644 Fedora/input/checks/accounts_no_uid_except_zero.xml
 create mode 100644 Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
 create mode 100644 Fedora/input/checks/restrict_serial_port_logins.xml
 create mode 100644 Fedora/input/checks/securetty_root_login_console_only.xml
 create mode 100644 Fedora/input/system/accounts/restrictions/root_logins.xml

diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml b/Fedora/input/checks/accounts_no_uid_except_zero.xml
new file mode 100644
index 0000000..cc337f4
--- /dev/null
+++ b/Fedora/input/checks/accounts_no_uid_except_zero.xml
@@ -0,0 +1,23 @@
+<def-group>
+  <definition class="compliance" id="accounts_no_uid_except_zero" version="1">
+    <metadata>
+      <title>UID 0 Belongs Only To Root</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>Only the root account should be assigned a user id of 0.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" test_ref="test_accounts_no_uid_except_root" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" id="test_accounts_no_uid_except_root" version="1">
+    <ind:object object_ref="object_accounts_no_uid_except_root" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_no_uid_except_root" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>passwd</ind:filename>
+    <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]:0</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
new file mode 100644
index 0000000..8f1b6f6
--- /dev/null
+++ b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
@@ -0,0 +1,22 @@
+<def-group>
+  <definition class="compliance" id="no_shelllogin_for_systemaccounts" version="1">
+    <metadata>
+      <title>System Accounts Do Not Run a Shell</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The root account is the only system account that should have a login shell.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_no_shelllogin_for_systemaccounts" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_no_shelllogin_for_systemaccounts" version="1">
+    <ind:object object_ref="object_no_shelllogin_for_systemaccounts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_no_shelllogin_for_systemaccounts" version="1">
+    <ind:filepath>/etc/passwd</ind:filepath>
+    <ind:pattern operation="pattern match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/Fedora/input/checks/restrict_serial_port_logins.xml b/Fedora/input/checks/restrict_serial_port_logins.xml
new file mode 100644
index 0000000..a1f456e
--- /dev/null
+++ b/Fedora/input/checks/restrict_serial_port_logins.xml
@@ -0,0 +1,27 @@
+<def-group>
+  <definition class="compliance" id="restrict_serial_port_logins" version="1">
+    <metadata>
+      <title>Restrict Serial Port Root Logins</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>Preventing direct root login to serial port interfaces helps
+      ensure accountability for actions taken on the system using the root
+      account.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="serial ports /etc/securetty" test_ref="test_serial_ports_etc_securetty" negate="true" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="test_serial_ports_etc_securetty" version="1">
+    <ind:object object_ref="object_serial_ports_etc_securetty" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="object_serial_ports_etc_securetty" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>securetty</ind:filename>
+    <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/Fedora/input/checks/securetty_root_login_console_only.xml b/Fedora/input/checks/securetty_root_login_console_only.xml
new file mode 100644
index 0000000..51a33de
--- /dev/null
+++ b/Fedora/input/checks/securetty_root_login_console_only.xml
@@ -0,0 +1,26 @@
+<def-group>
+  <definition class="compliance" id="securetty_root_login_console_only" version="1">
+    <metadata>
+      <title>Restrict Virtual Console Root Logins</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>Preventing direct root login to virtual console devices
+      helps ensure accountability for actions taken on the system using the
+      root account.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="virtual consoles /etc/securetty" test_ref="test_virtual_consoles_etc_securetty" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="test_virtual_consoles_etc_securetty" version="1">
+    <ind:object object_ref="object_virtual_consoles_etc_securetty" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="object_virtual_consoles_etc_securetty" version="1">
+    <ind:filepath>/etc/securetty</ind:filepath>
+    <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
index 6e276b1..8d21fe8 100644
--- a/Fedora/input/guide.xml
+++ b/Fedora/input/guide.xml
@@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other
 countries. All other names are registered trademarks or trademarks of their
 respective companies.</rear-matter>
 <platform idref="cpe:/o:fedoraproject:fedora:19" />
-<version>0.0.2</version>
+<version>0.0.3</version>
 </Benchmark>
diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
index 559042e..d99da5a 100644
--- a/Fedora/input/guide.xslt
+++ b/Fedora/input/guide.xslt
@@ -45,6 +45,7 @@
   <xsl:template match="Group[@id='accounts-restrictions']">
     <xsl:copy>
       <xsl:copy-of select="@*|node()" />
+      <xsl:apply-templates select="document('system/accounts/restrictions/root_logins.xml')" />
       <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
       <xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" />
     </xsl:copy>
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 83e3478..8997e79 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -2,15 +2,30 @@
 <title>Common Profile for General-Purpose Fedora Systems</title>
 <description>This profile contains items common to general-purpose Fedora installations.</description>
 
-<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
-<select idref="ensure_gpgcheck_never_disabled" selected="true"/>
-<select idref="no_empty_passwords" selected="true"/>
-<select idref="no_hashes_outside_shadow" selected="true"/>
-<select idref="gid_passwd_group_same" selected="true"/>
-<select idref="no_netrc_files" selected="true"/>
-<select idref="accounts_password_minlen_login_defs" selected="true"/>
-<select idref="accounts_minimum_age_login_defs" selected="true"/>
-<select idref="accounts_maximum_age_login_defs" selected="true"/>
-<select idref="accounts_password_warn_age_login_defs" selected="true"/>
+<!-- Installing and Maintaining Software section rules -->
+  <!-- Updating Software section rules -->
+  <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
+  <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
+
+<!-- Account and Access Control section rules -->
+  <!-- Protect Accounts by Restricting Password-Based Login section rules -->
+    <!-- Restrict Root Logins section rules -->
+    <select idref="no_direct_root_logins" selected="true"/>
+    <select idref="securetty_root_login_console_only" selected="true"/>
+    <select idref="restrict_serial_port_logins" selected="true"/>
+    <select idref="no_root_webbrowsing" selected="true"/>
+    <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
+    <select idref="no_uidzero_except_root" selected="true"/>
+    <select idref="root_path_default" selected="true"/>
+    <!-- Verify Proper Storage and Existence of Password Hashes section rules -->
+    <select idref="no_empty_passwords" selected="true"/>
+    <select idref="no_hashes_outside_shadow" selected="true"/>
+    <select idref="gid_passwd_group_same" selected="true"/>
+    <select idref="no_netrc_files" selected="true"/>
+    <!-- Set Password Expiration Parameters section rules -->
+    <select idref="accounts_password_minlen_login_defs" selected="true"/>
+    <select idref="accounts_minimum_age_login_defs" selected="true"/>
+    <select idref="accounts_maximum_age_login_defs" selected="true"/>
+    <select idref="accounts_password_warn_age_login_defs" selected="true"/>
 
 </Profile>
diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml b/Fedora/input/system/accounts/restrictions/root_logins.xml
new file mode 100644
index 0000000..48b222b
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/root_logins.xml
@@ -0,0 +1,230 @@
+<Group id="root_logins">
+<title>Restrict Root Logins</title>
+<description>
+Direct root logins should be allowed only for emergency use.
+In normal situations, the administrator should access the system
+via a unique unprivileged account, and then use <tt>su</tt> or <tt>sudo</tt> to execute
+privileged commands. Discouraging administrators from accessing the
+root account directly ensures an audit trail in organizations with
+multiple administrators. Locking down the channels through which
+root can connect directly also reduces opportunities for
+password-guessing against the root account. The <tt>login</tt> program
+uses the file <tt>/etc/securetty</tt> to determine which interfaces
+should allow root logins.
+
+The virtual devices <tt>/dev/console</tt>
+and <tt>/dev/tty*</tt> represent the system consoles (accessible via
+the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
+installation). The default securetty file also contains <tt>/dev/vc/*</tt>.
+These are likely to be deprecated in most environments, but may be retained
+for compatibility. Furthermore, <tt>/dev/hvc*</tt> represent virtio-serial
+consoles, <tt>/dev/hvsi*</tt> IBM pSeries serial consoles, and finally 
+<tt>/dev/xvc0</tt> Xen virtual console. Root should also be prohibited
+from connecting via network protocols. Other sections of this document
+include guidance describing how to prevent root from logging in via SSH.
+</description>
+
+<Rule id="no_direct_root_logins" severity="medium">
+<title>Direct root Logins Not Allowed</title>
+<description>To further limit access to the <tt>root</tt> account, administrators
+can disable root logins at the console by editing the <tt>/etc/securetty</tt> file.
+This file lists all devices the root user is allowed to login to. If the file does
+not exist at all, the root user can login through any communication device on the
+system, whether via the console or via a raw network interface. This is dangerous
+as user can login to his machine as root via Telnet, which sends the password in
+plain text over the network. By default, Fedora's <tt>/etc/securetty</tt> file
+only allows the root user to login at the console physically attached to the
+machine. To prevent root from logging in, remove the contents of this file.
+To prevent direct root logins, remove the contents of this file by typing the
+following command:
+<pre>
+echo > /etc/securetty
+</pre>
+</description>
+<ocil clause="the /etc/securetty file is not empty">
+To ensure root may not directly login to the system over physical consoles,
+run the following command:
+<pre>cat /etc/securetty</pre>
+If any output is returned, this is a finding.
+</ocil>
+<rationale>
+Disabling direct root logins ensures proper accountability and multifactor
+authentication to privileged accounts. Users will first login, then escalate
+to privileged (root) access via su / sudo. This scenario is nowadays required
+by security standards.
+</rationale>
+<ref nist="IA-2(1)" />
+</Rule>
+
+<Rule id="securetty_root_login_console_only" severity="medium">
+<title>Restrict Virtual Console Root Logins</title>
+<description>
+To restrict root logins through the (deprecated) virtual console devices,
+ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
+<pre>vc/1
+vc/2
+vc/3
+vc/4</pre>
+</description>
+<ocil clause="root login over virtual console devices is permitted">
+To check for virtual console entries which permit root login, run the
+following command:
+<pre># grep ^vc/[0-9] /etc/securetty</pre>
+If any output is returned, then root logins over virtual console devices is permitted.
+</ocil>
+<rationale>
+Preventing direct root login to virtual console devices
+helps ensure accountability for actions taken on the system
+using the root account.
+</rationale>
+<oval id="securetty_root_login_console_only" />
+<ref nist="AC-6(2)" disa="770" />
+</Rule>
+
+<Rule id="restrict_serial_port_logins">
+<title>Restrict Serial Port Root Logins</title>
+<description>To restrict root logins on serial ports,
+ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
+<pre>ttyS0
+ttyS1</pre>
+<!-- TODO: discussion/description of serial port -->
+</description>
+<ocil clause="root login over serial ports is permitted">
+To check for serial port entries which permit root login,
+run the following command:
+<pre># grep ^ttyS/[0-9] /etc/securetty</pre>
+If any output is returned, then root login over serial ports is permitted.
+</ocil>
+<rationale>
+Preventing direct root login to serial port interfaces
+helps ensure accountability for actions taken on the systems
+using the root account.
+</rationale>
+<oval id="restrict_serial_port_logins" />
+<ref nist="AC-6(2)" disa="770" />
+</Rule>
+
+<Rule id="no_root_webbrowsing">
+<title>Restrict Web Browser Use for Administrative Accounts</title>
+<description>
+Enforce policy requiring administrative accounts use web browsers only for
+local service administration.
+</description>
+<ocil clause="this is not the case">
+Check the <tt>root</tt> home directory for a <tt>.mozilla</tt> directory. If
+one exists, ensure browsing is limited to local service administration.
+</ocil>
+<rationale>
+If a browser vulnerability is exploited while running with administrative privileges,
+the entire system could be compromised. Specific exceptions for local service
+administration should be documented in site-defined policy.
+</rationale>
+</Rule>
+
+<Rule id="no_shelllogin_for_systemaccounts" severity="medium">
+<title>Ensure that System Accounts Do Not Run a Shell Upon Login</title>
+<description>
+Some accounts are not associated with a human
+user of the system, and exist to perform some administrative
+function. Should an attacker be able to log into these accounts,
+they should not be granted access to a shell.
+<br /><br />
+The login shell for each local account is stored in the last field of each line
+in <tt>/etc/passwd</tt>. System accounts are those user accounts with a user ID less than
+500. The user ID is stored in the third field.
+If any system account <i>SYSACCT</i> (other than root) has a login shell,
+disable it with the command:
+<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
+</description>
+<ocil clause="any system account (other than root) has a login shell">
+To obtain a listing of all users,
+their UIDs, and their shells, run the command:
+<pre>$ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd</pre>
+Identify the system accounts from this listing. These will
+primarily be the accounts with UID numbers less than 500, other
+than root.
+</ocil>
+<rationale>
+Ensuring shells are not given to system accounts upon login
+makes it more difficult for attackers to make use of
+system accounts.
+</rationale>
+<warning category="functionality">
+Do not perform the steps in this
+section on the root account. Doing so might cause the system to
+become inaccessible.
+</warning>
+<oval id="no_shelllogin_for_systemaccounts" />
+<ref nist="" disa="178" />
+</Rule>
+
+<Rule id="no_uidzero_except_root" severity="medium">
+<title>Verify Only Root Has UID 0</title>
+<description>
+If any account other than root has a UID of 0,
+this misconfiguration should be investigated and the
+accounts other than root should be removed or have their UID changed.
+</description>
+<ocil clause="any account other than root has a UID of 0">
+To list all password file entries for accounts with UID 0, run the following command:
+<pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
+This should print only one line, for the user root.
+</ocil>
+<rationale>
+An account has root authority if it has a UID of 0. Multiple accounts
+with a UID of 0 afford more opportunity for potential intruders to
+guess a password for a privileged account. Proper configuration of
+sudo is recommended to afford multiple system administrators
+access to root privileges in an accountable manner.
+</rationale>
+<oval id="accounts_no_uid_except_zero" />
+<ref nist="AC-6,IA-2(1)" disa="366" />
+</Rule>
+
+<Rule id="root_path_default">
+<title>Root Path Must Be Vendor Default</title>
+<description>
+Assuming root shell is bash, edit the following files:
+<pre>~/.profile</pre>
+<pre>~/.bashrc</pre>
+Change any <tt>PATH</tt> variables to the vendor default for root and remove any
+empty <tt>PATH</tt> entries or references to relative paths.
+</description>
+<ocil clause="any of these conditions are not met">
+To view the root user's <tt>PATH</tt>, run the following command:
+<pre># env | grep PATH</pre>
+If correctly configured, the <tt>PATH</tt> must: use vendor default settings,
+have no empty entries, and have no entries beginning with a character
+other than a slash (/).
+</ocil>
+<rationale>
+The root account's executable search path must be the vendor default, and must
+contain only absolute paths.
+</rationale>
+</Rule>
+
+<!--
+     This is redundant to the previous rule, which insists that the
+     root path is the vendor default.
+
+<Rule id="root_path_no_wwdir">
+<title>Root Path Must Not Contain World-Writable Directories</title>
+<description>
+If a world-writable directory is found in the <tt>PATH</tt>, remove the 
+world-writable permission for that directory with the following command:
+<pre># chmod o-w <i>/dir</i></pre>
+Alternately, remove the world-writable directory from the <tt>PATH</tt>.
+</description>
+<ocil clause="any world-writable directories are found">
+World-writable permissions on directories in root's path can be checked 
+with the following command:
+<pre># ls -ld 'echo $PATH | sed "s/:/ /g"'</pre>
+</ocil>
+<rationale>
+If the root search path contains a world-writable directory, malicious software 
+could be placed in the path.
+</rationale>
+<ref disa="366" />
+</Rule> -->
+
+</Group>
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 1abe666..a2db950 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global	fedorassgrelease	2.rc3
+%global	fedorassgrelease	2.rc4
 
 Name:		scap-security-guide
 Version:	0.1
@@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/xml/scap/ssg/fedora/19/*
 
 %changelog
+* Fri Oct 11 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc4
+- Convert RHEL6 'Restrict Root Logins' section's rules to Fedora
+
 * Thu Oct 10 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc3
 - Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
 
-- 1.7.11.7

Consider updating the <ind:path> and <ind:filename> elements to use <ind:filepath>, .e.g:

old:
+    <ind:path>/etc</ind:path>
+    <ind:filename>securetty</ind:filename>

new:
+    <ind:filepath>/etc/securetty</ind:filepath>

Functionally the same thing. Many of the legacy OVAL checks that were inherited in RHEL6 use <filename>, we're slowly going through and updating to <filepath>. Not important enough to warrant a nack as these tags will be updated in the future (though some TBD process), but something to consider doing now.

Ack otherwise!