>From f5e22e6cac45fa5cb78e72525482f6fa210e37ac Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 27 Jul 2012 08:21:12 -0400 Subject: [PATCH] Notes from DCM on 1-AUG Notes from DCM on 1-AUG --- RHEL6/input/auxiliary/transition_notes.xml | 127 ++++++++++++++++++++++++++++ 1 files changed, 127 insertions(+), 0 deletions(-) diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml index 3141809..a4aad30 100644 --- a/RHEL6/input/auxiliary/transition_notes.xml +++ b/RHEL6/input/auxiliary/transition_notes.xml @@ -123,4 +123,131 @@ NIS/NIS+/yp should be disabled, as stated in a Rule in the RHEL 6 content. NIS/NIS+/yp are obsolete and should not be running on any modern system. + +Note that sulogin may be going away in RHEL7. Shawn/Steve to followup. +Also, need to add in architecture specific details e.g. s390x + + + +Current mapping does not meet requirement as it works for passwords, not keys +Per Steve Grubb there is a patch coming to enable this through PAM, so we can map to met_inherently in RHEL 6.4 +Put more mappings +Where reqirement says "must provide.." that is a yes/no. We can map to met_inherently. +Poor CCI that can be restructured -- consider removing +Perhaps move this to OCIL as interview question + + + +Valid requirement but not applicable to STIG-server. + + + +Change check proceedure to check audit logs, not lastlog + + + +/etc/pam.d/gdm can enforce this, update the check + + + +Update guidance to say "don't change from default homedir" + + + +chmod to 550 or more restrictive, not 700 + + + +Reword to allow changes, but ensure we audit them. Language around MUST have absolute paths needs to stay. Path order must be vendor default. + + + +This is now default behavior, can be removed + + + + +For filepermission checks, defer to common criteria accepted values +Need to ensure rpm verify flags such files + + + +for all ACL content we will change to allow ACLs (via group prose) then mandate their audit (via a rule) + + + +change chkconfig off to chkconfig --del + + + +revisit polyinstantiation for RHEL7 + + + +Installation of NIS will now be a CAT I finding. NIS to be added to banned package list + + + +Language to be broadened to beyond just CAC cards per PKI-e + + + +Disablement of at service to be implimented in RHEL6 STIG + + + +News server content can be removed + + + +This requirement can be removed + + + +value of 10 is fine + + + +change value to 15 + + + +DoD - 60 +IC - 90 days + + + +Update prose to 3 + + + +pam lastlog.so noupdate showfailed +touch /etc/hushlogins + + + +disable account, not remove +set shell to nologin + + + +met_inherently + + + +change to audit dispatch not rsyslog audsp-auremote + + + +update tool listing +allow install but allow access by priv users (root, chmod 700) + + + +update to remove vendor specific language + + + +also watch for LD_AUDIT + -- 1.7.1