>From a3a7c7e986e323ba43777f7bc6c521c43e642411 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 28 Sep 2013 19:08:41 -0400 Subject: [PATCH 7/8] updated OVAL template: template_sysctl - Prior edition of sysctl template only checked runtime configuration, added checks for /etc/sysctl.conf - OVAL signoff TESTING: [root@SSG-RHEL6 output]# sudo sysctl -w kernel.exec-shield=0 kernel.exec-shield = 0 [root@SSG-RHEL6 output]# grep kernel.exec /etc/sysctl.conf [root@SSG-RHEL6 output]# ../../testcheck.py sysctl_kernel_exec_shield.xml Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml Writing results to : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml-results Definition oval:scap-security-guide.testing:def:170: false Evaluation done. [root@SSG-RHEL6 output]# sysctl -w kernel.exec-shield=1 ; ../../testcheck.py sysctl_kernel_exec_shield.xml kernel.exec-shield = 1 Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml Writing results to : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml-results Definition oval:scap-security-guide.testing:def:170: false Evaluation done. [root@SSG-RHEL6 output]# echo "kernel.exec-shield = 1" >> /etc/sysctl.conf ; ../../testcheck.py sysctl_kernel_exec_shield.xml Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml Writing results to : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml-results Definition oval:scap-security-guide.testing:def:170: true Evaluation done. --- RHEL6/input/checks/sysctl_fs_suid_dumpable.xml | 18 +++++++++++++++--- .../input/checks/sysctl_kernel_dmesg_restrict.xml | 18 +++++++++++++++--- RHEL6/input/checks/sysctl_kernel_exec_shield.xml | 19 +++++++++++++++---- .../checks/sysctl_kernel_randomize_va_space.xml | 19 +++++++++++++++---- .../sysctl_net_ipv4_conf_all_accept_redirects.xml | 19 +++++++++++++++---- ...ysctl_net_ipv4_conf_all_accept_source_route.xml | 19 +++++++++++++++---- .../sysctl_net_ipv4_conf_all_log_martians.xml | 19 +++++++++++++++---- .../checks/sysctl_net_ipv4_conf_all_rp_filter.xml | 18 +++++++++++++++--- .../sysctl_net_ipv4_conf_all_secure_redirects.xml | 19 +++++++++++++++---- .../sysctl_net_ipv4_conf_all_send_redirects.xml | 19 +++++++++++++++---- ...sctl_net_ipv4_conf_default_accept_redirects.xml | 18 +++++++++++++++--- ...l_net_ipv4_conf_default_accept_source_route.xml | 19 +++++++++++++++---- .../sysctl_net_ipv4_conf_default_rp_filter.xml | 18 +++++++++++++++--- ...sctl_net_ipv4_conf_default_secure_redirects.xml | 18 +++++++++++++++--- ...sysctl_net_ipv4_conf_default_send_redirects.xml | 19 +++++++++++++++---- ...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml | 18 +++++++++++++++--- ..._net_ipv4_icmp_ignore_bogus_error_responses.xml | 18 +++++++++++++++--- RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml | 19 +++++++++++++++---- .../checks/sysctl_net_ipv4_tcp_syncookies.xml | 18 +++++++++++++++--- .../sysctl_net_ipv6_conf_default_accept_ra.xml | 18 +++++++++++++++--- ...sctl_net_ipv6_conf_default_accept_redirects.xml | 18 +++++++++++++++--- RHEL6/input/checks/templates/template_sysctl | 18 +++++++++++++++--- 22 files changed, 330 insertions(+), 76 deletions(-) diff --git a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml index e358366..324e98f 100644 --- a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml +++ b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "fs.suid_dumpable" should be set to "0". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*fs.suid_dumpable[\s]*=[\s]*0*$ + 1 + + fs.suid_dumpable diff --git a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml index c386a1d..f92c343 100644 --- a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml +++ b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "kernel.dmesg_restrict" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1*$ + 1 + + kernel.dmesg_restrict diff --git a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml index 747de00..5567f65 100644 --- a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml +++ b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "kernel.exec-shield" should be set to "1". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*kernel.exec-shield[\s]*=[\s]*1*$ + 1 + + kernel.exec-shield diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml index 021856a..fc3ad18 100644 --- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml +++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "kernel.randomize_va_space" should be set to "2". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*kernel.randomize_va_space[\s]*=[\s]*2*$ + 1 + + kernel.randomize_va_space diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml index c013d27..c3f5397 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.all.accept_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml index e3e163b..aa59faf 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.all.accept_source_route diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml index e11092f..2697ef8 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.log_martians" should be set to "1". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*1*$ + 1 + + net.ipv4.conf.all.log_martians diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml index 4ca98cc..a88e565 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.rp_filter" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*1*$ + 1 + + net.ipv4.conf.all.rp_filter diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml index 251cb42..216dd9f 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.all.secure_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml index 55ce654..99c1482 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.all.send_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml index dc64174..c89b481 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.default.accept_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml index 28c6602..97a270e 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.default.accept_source_route diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml index 9fdd884..9e2f8d1 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.default.rp_filter" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*1*$ + 1 + + net.ipv4.conf.default.rp_filter diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml index 7b54d5e..83746db 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.default.secure_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml index 261d26a..1fb964c 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv4.conf.default.send_redirects diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml index c34f6e2..bac586d 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.icmp_echo_ignore_broadcasts" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*1*$ + 1 + + net.ipv4.icmp_echo_ignore_broadcasts diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml index 87c7d45..51e924d 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.icmp_ignore_bogus_error_responses" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*1*$ + 1 + + net.ipv4.icmp_ignore_bogus_error_responses diff --git a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml index 2203ade..914e979 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml @@ -7,18 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.ip_forward" should be set to "0". - + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0*$ + 1 + + net.ipv4.ip_forward diff --git a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml index 78f7c2d..7842f2e 100644 --- a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml +++ b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv4.tcp_syncookies" should be set to "1". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*1*$ + 1 + + net.ipv4.tcp_syncookies diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml index b0f9ce5..1c7f64c 100644 --- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml +++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to "0". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*0*$ + 1 + + net.ipv6.conf.default.accept_ra diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml index a1fd06e..a116569 100644 --- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml +++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*0*$ + 1 + + net.ipv6.conf.default.accept_redirects diff --git a/RHEL6/input/checks/templates/template_sysctl b/RHEL6/input/checks/templates/template_sysctl index e26f7b2..be623db 100644 --- a/RHEL6/input/checks/templates/template_sysctl +++ b/RHEL6/input/checks/templates/template_sysctl @@ -7,17 +7,29 @@ Red Hat Enterprise Linux 6 The kernel runtime parameter "SYSCTLVAR" should be set to "SYSCTLVAL". + - - + + + - + + + + + + + /etc/sysctl.conf + ^[\s]*SYSCTLVAR[\s]*=[\s]*SYSCTLVAL*$ + 1 + + SYSCTLVAR -- 1.7.1