install network --bootproto static --ip 192.168.122.90 --netmask 255.255.255.0 --gateway 192.168.122.1 --nameserver 192.168.122.1 --hostname=proxy.local cdrom repo --name="Red Hat Enterprise Linux" --baseurl=file:/mnt/source --cost=100 lang en_US keyboard us zerombr clearpart --all bootloader --location mbr timezone America/New_York auth --enablemd5 --enableshadow rootpw --iscrypted $1$Zw.0A4vy$6117sRxtKCmgvDdwec5QX1 selinux --enforcing reboot firewall --enabled graphical part /boot --fstype=ext3 --size=200 part pv.01 --size=1000 --grow part swap --size=1536 --maxsize=2048 volgroup myvg pv.01 logvol / --vgname=myvg --name=rootvol --size=1000 --grow logvol /home --vgname=myvg --name=homevol --size=2048 logvol /tmp --vgname=myvg --name=tmpvol --size=1000 logvol /var --vgname=myvg --name=varvol --size=2048 logvol /var/log --vgname=myvg --name=varlogvol --size=2048 logvol /var/log/audit --vgname=myvg --name=varlogauditvol --size=1024 %packages --nobase @Core yum rhn-setup openssh-server openssh-clients httpd perl-Pod-Escapes perl-libs perl-version perl-Module-Pluggable perl-Pod-Simple perl perl-YAML-Syck perl-Date-Manip vlock mailx logwatch screen scrub aide ntp libxslt openscap openscap-utils system-config-firewall-tui openswan %end %pre %end %post --nochroot # SSG cp /mnt/source/scap-security-guide-0.1-12.el6.noarch.rpm /mnt/sysimage/tmp %post /sbin/chkconfig httpd on /sbin/chkconfig ntpd on # SSG yum localinstall -y /tmp/scap-security-guide-0.1-12.el6.noarch.rpm # Scan using SSG cd /root oscap xccdf eval --profile stig-rhel6-server --results BeforeFix-ssg-results.xml --report BeforeFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml # Generate Fix oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server BeforeFix-ssg-results.xml > /root/fix.sh # Run Fix chmod +x fix.sh /bin/bash /root/fix.sh #-------- Additional Fixes ------- # # Set varialbles for future use arch=`uname -p` if [ $arch = x86_64 ] then b="b64" else b="b32" fi # kernel_module_usb-storage_disabled cat << EOF > /etc/modprobe.d/usb-storage.conf # disable usb-storage per security requirements install usb-storage /bin/false EOF # disable_users_coredumps sed -i "s/# End of file/*\t\thard\tcore\t\t0\n# End of file/g" /etc/security/limits.conf # restrict_root_login_consoles sed -i '/^vc*/d' /etc/securetty # no_empty_passwords sed -i "s/nullok //g" /etc/pam.d/system-auth # password_min_len sed -i 's/\(^PASS_MIN_LEN\).*/\1\t14/g' /etc/login.defs # password_min_days sed -i 's/\(^PASS_MIN_DAYS\).*/\1\t1/g' /etc/login.defs # password_max_age sed -i 's/\(^PASS_MAX_DAYS\).*/\1\t60/g' /etc/login.defs # account_disable_post_pw_expiration sed -i 's/\(^INACTIVE=\).*/\135/g' /etc/default/useradd # display_login_attempts sed -i 's/pam_limits.so/pam_limits.so\nsession required pam_lastlog.so showfailed/g' /etc/pam.d/system-auth # password_require_digits sed -i 's/\(pam_cracklib.so \)/\1dcredit=-1 /' /etc/pam.d/system-auth # password_require_uppercases sed -i 's/\(pam_cracklib.so \)/\1ucredit=-1 /' /etc/pam.d/system-auth # password_require_specials sed -i 's/\(pam_cracklib.so \)/\1ocredit=-1 /' /etc/pam.d/system-auth # password_require_lowercases sed -i 's/\(pam_cracklib.so \)/\1lcredit=-1 /' /etc/pam.d/system-auth # password_require_diffchars sed -i 's/\(pam_cracklib.so \)/\1difok=4 /' /etc/pam.d/system-auth # deny_password_attempts sed -i 's/\(^auth.*pam_unix.so.*\)/\1\nauth \[default=die\] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900\nauth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900/' /etc/pam.d/system-auth # limiting_password_reuse sed -i 's/\(^password.*sufficient.*pam_unix.so.*\)/\1 remember=24/' /etc/pam.d/system-auth # set_password_hashing_algorithm_systemauth sed -i 's/\(^password.*sufficient.*pam_unix.so\)/\1 sha512/' /etc/pam.d/system-auth # set_pasword_hashing_algorithm_logindefs sed -i 's/^\(ENCRYPT_METHOD \).*/\1SHA512/' /etc/login.defs # set_password_hashing_algorithm_libuserconf sed -i 's/^\(crypt_style = \).*/\1sha512/' /etc/libuser.conf # nax_concurrent_login_sessions sed -i "s/# End of file/*\t\thard\tmaxlogins\t10\n# End of file/g" /etc/security/limits.conf # user_umask_bashrc sed -i 's/umask 002/umask 077/g' /etc/bashrc # user_umask_cshrc sed -i 's/umask 002/umask 077/g' /etc/csh.cshrc # user_umask_profile sed -i 's/umask 002/umask 077/g' /etc/profile # require_singleuser_auth sed -i 's/^\(SINGLE=\).*/\1\/sbin\/sulogin/' /etc/sysconfig/init # disable_ctrlaltdel_reboot sed -i 's/^exec.*/exec \/usr\/bin\/logger -p security.info "Control-Alt-Delete pressed"/' /etc/init/control-alt-delete.conf # disable_interactive_boot sed -i 's/^\(PROMPT=\).*/\1no/' /etc/sysconfig/init # set_system_login_banner # Note: the banner is set already as part of the oscap fix.sh script # - we just need to remove extra characters. sed -i 's/\[[^]]*\]/ /g' /etc/issue; sed -i 's/+//g' /etc/issue; sed -i 's/\\//g' /etc/issue; sed -i 's/\*//g' /etc/issue; sed -i 's/ - /\n-/g' /etc/issue # disable_sysctl_ipv4_default_send_redirects # Set run-time sysctl -w net.ipv4.conf.default.send_redirects=0 cat << EOF >> /etc/sysctl.conf # Set net.ipv4.conf.default.send_redirects to 0 per security requirements net.ipv4.conf.default.send_redirects = 0 EOF # disable_sysctl_ipv4_all_send_redirects # Set run-time sysctl -w net.ipv4.conf.all.send_redirects=0 cat << EOF >> /etc/sysctl.conf # Set net.ipv4.conf.all.send_redirects to 0 per security requirements net.ipv4.conf.all.send_redirects = 0 EOF # kernel_module_bluetooth_disabled cat << EOF > /etc/modprobe.d/bluetooth.conf # disable bluetooth per security requirements install net-pf-31 /bin/false install bluetooth /bin/false EOF # disable_ipv6_module_loading cat << EOF > /etc/modprobe.d/disabled.conf # disable ipv6 module per security requirements options ipv6 disable=1 EOF # set_sysctl_ipv6_default_accept_redirects # Set run-time sysctl -w et.ipv6.conf.default.accept_redirects=0 cat << EOF >> /etc/sysctl.conf # Set net.ipv6.conf.default.accept_redirects to 0 per security requirements net.ipv6.conf.default.accept_redirects = 0 EOF # set_iptables_default_rule sed -i 's/\(^:INPUT \).*/\1DROP \[0:0\]/' /etc/sysconfig/iptables # set_iptables_default_rule_forward sed -i 's/\(^:FORWARD \).*/\1DROP \[0:0\]/' /etc/sysconfig/iptables # disable_protocol_dccp cat << EOF > /etc/modprobe.d/dccp.conf # disable dccp protocol per security requirements install dccp /bin/false EOF # disable_protocol_sctp cat << EOF > /etc/modprobe.d/sctp.conf # disable sctp protocol per security requirements install sctp /bin/false EOF # disable_protocol_rds cat << EOF > /etc/modprobe.d/rds.conf # disable rds protocol per security requirements install rds /bin/false EOF # disable_protocol_tipc cat << EOF > /etc/modprobe.d/tipc.conf # disable tipc protocol per security requirements install tipc /bin/false EOF # enable_auditd_bootloader sed -i '/^\tkernel/ s/$/ audit=1/g' /boot/grub/grub.conf # configure_auditd_space_left_action sed -i 's/\(^space_left_action =\).*/\1 EMAIL/' /etc/audit/auditd.conf # configure_auditd_admin_space_left_action sed -i 's/\(^admin_space_left_action =\).*/\1 SINGLE/' /etc/audit/auditd.conf # audit_rules_time_adjtimex cat << EOF >> /etc/audit/audit.rules # audit_time_rules -a always,exit -F arch=$b -S adjtimex -k audit_time_rules EOF # audit_rules_time_settimeofday cat << EOF >> /etc/audit/audit.rules # audit_settimeofday_rules -a always,exit -F arch=$b -S settimeofday -k audit_time_rules EOF # audit_rules_time_clock_settime cat << EOF >> /etc/audit/audit.rules # audit_clock_settime_rules -a always,exit -F arch=$b -S clock_settime -k audit_time_rules EOF # audit_rules_time_watch_localtime cat << EOF >> /etc/audit/audit.rules # watch localtime -w /etc/localtime -p wa -k audit_time_rules EOF # audit_account_changes cat << EOF >> /etc/audit/audit.rules # audit_account_changes -w /etc/group -p wa -k audit_account_changes -w /etc/passwd -p wa -k audit_account_changes -w /etc/gshadow -p wa -k audit_account_changes -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes EOF # audit_network_modifications cat << EOF >> /etc/audit/audit.rules # audit_network_modifications -a exit,always -F arch=$b -S sethostname -S setdomainname -k audit_network_modifications -w /etc/issue -p wa -k audit_network_modifications -w /etc/issue.net -p wa -k audit_network_modifications -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications EOF # audit_mac_changes cat << EOF >> /etc/audit/audit.rules # watch MAC Changes -w /etc/selinux -p wa -k MAC-policy EOF # audit_rules_dac_modification_chmod cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (chmod) for all users and root -a always,exit -F arch=$b -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_chown cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (chown) for all users and root -a always,exit -F arch=$b -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fchmod cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fchmod) for all users and root -a always,exit -F arch=$b -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fchmodat cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fchmodat) for all users and root -a always,exit -F arch=$b -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fchown cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fchown) for all users and root -a always,exit -F arch=$b -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fchownat cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fchownat) for all users and root -a always,exit -F arch=$b -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fremovexattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fremovexattr) for all users and root -a always,exit -F arch=$b -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_fsetxattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (fsetxattr) for all users and root -a always,exit -F arch=$b -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_lchown cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (lchown) for all users and root -a always,exit -F arch=$b -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_lremovexattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (lremovexattr) for all users and root -a always,exit -F arch=$b -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_lsetxattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (lsetxattr) for all users and root -a always,exit -F arch=$b -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_removexattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (removexattr) for all users and root -a always,exit -F arch=$b -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_rules_dac_modification_setxattr cat << EOF >> /etc/audit/audit.rules # Collect file permissions changes (setxattr) for all users and root -a always,exit -F arch=$b -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod EOF # audit_file_access cat << EOF >> /etc/audit/audit.rules # Collect unauthorized file access for all users and root -a always,exit -F arch=$b -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=$b -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access EOF # audit_privileged_commands cat << EOF >> /etc/audit/audit.rules # Collect execution of privileged commands for all users and root EOF for i in `find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null`; do echo "-a always,exit -F path=$i -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged">> /etc/audit/audit.rules; done; # audit_media_exports cat << EOF >> /etc/audit/audit.rules # Collect media exportation events for all users and root -a always,exit -F arch=$b -S mount -F auid>=500 -F auid!=4294967295 -k export EOF # audit_file_deletions cat << EOF >> /etc/audit/audit.rules # Collect media file deletion events for all users and root -a always,exit -F arch=$b -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete EOF # audit_sysadmin_actions cat << EOF >> /etc/audit/audit.rules # Collect administrator actions for all users and root -w /etc/sudoers -p wa -k actions EOF # audit_kernel_module_loading cat << EOF >> /etc/audit/audit.rules # Capture kernel module loading and unloading events -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F arch=$b -S init_module -S delete_module -k modules EOF # service_rhnsd_disabled chkconfig rhnsd off # sshd_set_idle_timeout sed -i 's/^#\(ClientAliveInterval \).*/\1900/' /etc/ssh/sshd_config # sshd_set_keepalive sed -i 's/^#\(ClientAliveCountMax \).*/\10/' /etc/ssh/sshd_config # sshd_disable_empty_passwords sed -i 's/^#\(PermitEmptyPasswords \).*/\1no/' /etc/ssh/sshd_config # sshd_enable_warning_banner sed -i 's/# no default banner path/# banner path/' sshd_config sed -i 's/^#\(Banner \).*/\1\/etc\/issue/' /etc/ssh/sshd_config # sshd_do_not_permit_user_env sed -i 's/^#\(PermitUserEnvironment \).*/\1no/' /etc/ssh/sshd_config # sshd_use_approved_ciphers cat << EOF >> /etc/ssh/sshd_config # Approved Ciphers Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc EOF #-------- Re-Scan Server ------- # # After completing the reconfiguration of the server, # we want to Re-scan the server and save another report # after the reconfiguration. oscap xccdf eval --profile stig-rhel6-server --results AfterFix-ssg-results.xml --report AfterFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml %end