A collection of repairs and updates to CCI references, in support of addressing all OS SRG requirements as viewed in output/table-stig-rhel6-server-flat-srgs.html.
Jeffrey Blank (8): adjusting references to DISA CCIs in services adjusting DISA CCI references in system config items rework of CCI references in SRG support file to indicate selection on DoD baselines adding creation of new SRG-complete table with CCI refs combined (vs flattened) new alt-titles for STIG Rules, CCI references updates added Rule for encrypting partitions to stig profile removing CCI refs when attached to Groups, in favor of Rules or srg_support support for adding SRG ID items to unflattened profile table
RHEL6/Makefile | 1 + RHEL6/input/auxiliary/alt-titles-stig.xml | 24 ++++-- RHEL6/input/auxiliary/srg_support.xml | 88 ++++++++++++++------- RHEL6/input/profiles/stig-rhel6-server.xml | 9 +-- RHEL6/input/services/http.xml | 4 +- RHEL6/input/services/obsolete.xml | 6 +- RHEL6/input/services/ssh.xml | 4 +- RHEL6/input/system/accounts/pam.xml | 1 - RHEL6/input/system/auditing.xml | 5 +- RHEL6/input/system/network/ipsec.xml | 2 +- RHEL6/input/system/network/iptables.xml | 5 +- RHEL6/input/system/network/ssl.xml | 4 - RHEL6/input/system/software/disk_partitioning.xml | 41 ++++++---- RHEL6/input/system/software/integrity.xml | 3 +- RHEL6/input/system/software/updating.xml | 3 +- RHEL6/transforms/table-add-srgitems.xslt | 2 +- 16 files changed, 118 insertions(+), 84 deletions(-)
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/services/http.xml | 4 ++-- RHEL6/input/services/obsolete.xml | 6 +++--- RHEL6/input/services/ssh.xml | 5 ++--- 3 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml index d1f396b..e484b12 100644 --- a/RHEL6/input/services/http.xml +++ b/RHEL6/input/services/http.xml @@ -121,7 +121,7 @@ to plan an attack on the given system. This information disclosure should be res </rationale> <ident cce="4474-3" /> <oval id="httpd_servertokens_prod" /> -<ref nist="CM-6, CM-7" disa="1124" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="httpd_serversignature_off"> @@ -139,7 +139,7 @@ to plan an attack on the given system. This information disclosure should be res </rationale> <ident cce="3756-4" /> <oval id="httpd_serversignature_off" /> -<ref nist="CM-6, CM-7" disa="1124" /> +<ref nist="CM-6, CM-7" /> </Rule>
</Group> <!-- <Group id="httpd_restrict_info_leakage"> --> diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 96ab924..49e93db 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -81,7 +81,7 @@ subject to man-in-the-middle attacks. </rationale> <ident cce="3390-2" /> <oval id="service_telnetd_disabled" /> -<ref disa="1436,196,197" /> +<ref disa="68,1436,196,197,877,888" /> <tested by="DS" on="20121026"/> </Rule>
@@ -143,7 +143,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="undefined" /> <oval id="service_rexec_disabled" /> -<ref disa="1436"/> +<ref disa="68,1436"/> <tested by="DS" on="20121026"/> </Rule>
@@ -162,7 +162,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="4141-8" /> <oval id="service_rsh_disabled" /> -<ref disa="1436" /> +<ref disa="68,1436" /> <tested by="DS" on="20121026"/> </Rule>
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 9069e30..4976568 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -8,7 +8,6 @@ implementation included with the system is called OpenSSH, and more detailed documentation is available from its website, http://www.openssh.org. Its server program is called <tt>sshd</tt> and provided by the RPM package <tt>openssh-server</tt>.</description> -<ref disa="1453,877" />
<Value id="sshd_idle_timeout_value" type="number" operator="equals" interactive="0"> @@ -59,7 +58,7 @@ certain changes should be made to the OpenSSH daemon configuration file <tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied to this file. See the <tt>sshd_config(5)</tt> man page for more detailed information.</description> -<ref disa="68,197,888,1632,779,781" /> +<ref disa="68,197,1632,779,781" />
<Rule id="sshd_allow_only_protocol2" severity="high"> <title>Allow Only SSH Protocol 2</title> @@ -82,7 +81,7 @@ should not be used. </rationale> <ident cce="4325-7" /> <oval id="sshd_protocol_2" /> -<ref disa="776,774,1135,1436" /> +<ref disa="776,774,1436" /> <tested by="DS" on="20121024"/> </Rule>
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/system/auditing.xml | 6 ++-- RHEL6/input/system/network/ipsec.xml | 2 +- RHEL6/input/system/network/iptables.xml | 4 +- RHEL6/input/system/network/ssl.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 34 +++++++++++---------- RHEL6/input/system/software/integrity.xml | 2 +- 6 files changed, 26 insertions(+), 24 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9c254a0..e6ab516 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -93,7 +93,7 @@ actions will be taken if other obstacles exist. </rationale> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> -<ref nist="CM-6, CM-7" disa="169,157,172,174,1353,1462,1487,1115,1454,067,158,831,1123,1190,1312,1263,130,120" /> +<ref nist="CM-6, CM-7" disa="169,157,172,174,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120" /> <tested by="DS" on="20121024"/> </Rule>
@@ -459,7 +459,7 @@ After reviewing all the rules, reading the following sections, and editing as needed, the new rules can be activated as follows: <pre># service auditd restart</pre> </description> -<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1274,1356,374,130" /> +<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1356,374,130" />
<Group id="audit_time_rules"> <title>Records Events that Modify Date and Time Information</title> @@ -672,7 +672,7 @@ Audit logs must be mode 0640 or less permissive. If users can write to audit logs, audit trails can be modified or destroyed. </rationale> <oval id="file_permissions_var_log_audit" /> -<ref disa="166,1338" /> +<ref disa="166" /> <tested by="DS" on="20121024"/> </Rule>
diff --git a/RHEL6/input/system/network/ipsec.xml b/RHEL6/input/system/network/ipsec.xml index 02c5bde..f73e493 100644 --- a/RHEL6/input/system/network/ipsec.xml +++ b/RHEL6/input/system/network/ipsec.xml @@ -19,7 +19,7 @@ transmitted over a wide area network. </rationale> <!--<ident cce="TODO" />--> <oval id="package_openswan_installed" /> -<ref nist="AC-17, MA-4, SC-9" disa="1130,1131,1135" /> +<ref nist="AC-17, MA-4, SC-9" disa="1130,1131" /> </Rule> </Group>
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index 40f1746..d63b99f 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -60,7 +60,7 @@ capability for IPv6 and ICMPv6. </rationale> <ident cce="4167-3" /> <oval id="service_ip6tables_enabled" /> -<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/> +<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1414"/> <tested by="DS" on="20121024"/> </Rule>
@@ -76,7 +76,7 @@ capability for IPv4 and ICMP. </rationale> <ident cce="4189-7" /> <oval id="service_iptables_enabled" /> -<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,27,1117,1098,1100,1097,1123,1124,1414" /> +<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,27,1117,1098,1100,1097,1414" /> <tested by="DS" on="20121024"/> </Rule> </Group><!--<Group id="iptables_activation">--> diff --git a/RHEL6/input/system/network/ssl.xml b/RHEL6/input/system/network/ssl.xml index 77f3ecb..0c35dc7 100644 --- a/RHEL6/input/system/network/ssl.xml +++ b/RHEL6/input/system/network/ssl.xml @@ -50,7 +50,7 @@ process are: </description>
-<ref disa="1141,1148,1130,1131,1127,1128,1135,1129,1132,1142,1147,187" /> +<ref disa="1130,1131,1127,1128,1129,187" />
<Group id="network_ssl_create_ca"> <title>Create a CA to Sign Certificates</title> diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index ac3ccc9..484117b 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -125,33 +125,35 @@ users cannot trivially fill partitions used for log or audit data storage. <tested by="MM" on="20120928"/> </Rule>
-<Group id="partition_encryption" > -<title>Encrypting Partitions</title> +<Rule id="encrypt_partitions" > +<title>Encrypt Partitions</title> <description> Red Hat Enterprise Linux 6 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to -encrypt a partition is during install time. +encrypt a partition is during installation time. <br /><br /> -For manual installations, selecting the <tt>Encrypt</tt> checkbox during -partition creation is all that is needed to encrypt the partition. When this +For manual installations, select the <tt>Encrypt</tt> checkbox during +partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in -decrypting the partition. The passphrase will need to be entered manually +decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. <br /><br /> -For automated/unattended installations using Kickstart add the <tt>--encrypted</tt> -and <tt>--passphrase=</tt> options to the definition of each partition you want -encrypted. For example: -<pre>part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=<i>yourpassphrase</i></pre> -Where <i>yourpassphrase</i> is a passphrase of your choosing. The passphrase is -stored in the Kickstart file in clear-text. If that is of concern, leaving the -<tt>--passphrase=</tt> option off the partition definition will cause the -installer to pause and interactively ask for the passphrase during the install. +For automated/unattended installations, it is possible to use Kickstart by adding +the <tt>--encrypted</tt> and <tt>--passphrase=</tt> options to the definition of each partition to be +encrypted. For example, the following line would encrypt the root partition: +<pre>part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=<i>PASSPHRASE</i></pre> +Any <i>PASSPHRASE</i> is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. +Omitting the <tt>--passphrase=</tt> option from the partition definition will cause the +installer to pause and interactively ask for the passphrase during installation. <br /><br /> Detailed information on encrypting partitions using LUKS can be found on the Red Had Documentation web site:<br /> https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_... </description> -<ref disa="1199,1350,1200" /> -</Group> +<ocil clause="encryption must be used and is not employed"> +Determine if encryption must be used to protect data on the system. +</ocil> +<ref disa="1019,1199,1200" /> +</Rule>
</Group> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 2aa54a2..fe548f3 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -97,7 +97,7 @@ To determine that periodic AIDE execution has been scheduled, run the following By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files. </rationale> -<ref nist="CM-6, SC-28, SI-7" disa="416,1069,1166,1263"/> +<ref nist="CM-6, SC-28, SI-7" disa="416,1069,1263"/> </Rule> <!-- <Group id="aide_verify_integrity_manually">
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/auxiliary/srg_support.xml | 88 ++++++++++++++++++++++----------- 1 files changed, 59 insertions(+), 29 deletions(-)
diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml index 0682834..849e23b 100644 --- a/RHEL6/input/auxiliary/srg_support.xml +++ b/RHEL6/input/auxiliary/srg_support.xml @@ -6,11 +6,14 @@ those cases where Groups or Rules elsewhere in scap-security-guide do not clearly relate. </description>
+ +<!-- The CCI/SRG item referenced here are: + - satisfied (through design and implementation) + - selected in DoD baseline (per CNSS 1253) --> <Rule id="met_inherently"> <title>Product Meets this Requirement</title> <rationale> -Red Hat Enterprise Linux meets this requirement by design. -<!-- We could include discussion of Common Criteria Testing if so desired here. --> +Red Hat Enterprise Linux meets this requirement through design and implementation. </rationale> <ocil>RHEL6 supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding. @@ -18,15 +21,17 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="56,1084,42,66,68,135,223,131,132,133,134,85,159,1694,770,804,162,163,164,345,346,872,1493,1494,1495,226,1096,1111,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" /> -</Rule> <!-- end met_inherently --> +<ref disa="56,1084,42,66,135,223,131,132,133,134,85,159,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1674,206" /> +</Rule>
+<!-- The CCI/SRG item referenced here are: + - satisfied (through design and implementation) + - not selected in a DoD baseline --> <Rule id="met_inherently_nonselected"> <title>Product Meets this Requirement</title> <rationale> -Red Hat Enterprise Linux meets this requirement by design. -<!-- We could include discussion of Common Criteria Testing if so desired here. --> +Red Hat Enterprise Linux meets this requirement through design and implementation. </rationale> <ocil>RHEL6 supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding. @@ -34,10 +39,21 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="1086,1087,1090,1091,1424,1426,802" /> -</Rule> <!-- end met_inherently --> +<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1209,1214,1237,1269,1338,1425,1670" /> +</Rule> + + +<!-- The CCI/SRG item listed here are: + - satisfied (by Rules in the guidance, which include the reference) + - not selected in DoD baseline --> +<!-- disa="26,27,32,771,772,779,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" -->
-<Rule id="unmet_impractical_guidance"> + +<!-- The CCI/SRG item referenced here are: + - not satisfied + - not selected in a DoD baseline + - considered out of scope --> +<Rule id="unmet_nonfinding_nonselected_scope"> <title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title> <rationale> The guidance does not meet this requirement. @@ -50,37 +66,51 @@ application, policy, or service. This requirement is NA. <description> This requirement is NA. No fix is required. </description> -<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,37,221,25,28,29,30,24,1112,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1340,1352,1401,1555,1556,1150" /> -</Rule> <!-- end unmet_impractical_guidance --> +<ref disa="21,25,28,29,30,165,221,354,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1373,1374,1383,1391,1392,1395,1662" /> +</Rule> +
-<Rule id="requirement_unclear"> -<title>Implementation of the Requirement is Unclear</title> +<!-- The CCI/SRG items referenced here are: + - not satisfied + - not selected in a DoD baseline + - considered permanent findings --> +<Rule id="unmet_finding_nonselected"> +<title>Implementation of the Requirement is Not Supported</title> <rationale> -It is unclear how to satisfy this requirement. -</rationale> -<ocil> -RHEL6 does not support this requirement. This is a permanent finding. -</ocil> +RHEL6 does not support this requirement. +</rationale> +<ocil> +This is a permanent finding. +</ocil> <description> -This requirement is a permanent finding and cannot be fixed. An appropriate -mitigation for the system must be implemented but this finding cannot be +This requirement is a permanent finding and cannot be fixed. An appropriate +mitigation for the system must be implemented but this finding cannot be considered fixed. </description> -<ref disa="20,31,218,219,1158,1291,1294,1295,1428,1500" /> -</Rule> <!-- end requirement_unclear --> +<ref disa="20,31,52,53,218,219,1158,1294,1295,1500" /> +<!-- Note: CCI 52 supported for text login, but not graphical --> +</Rule>
-<Rule id="new_rule_needed"> -<title>A New Policy/Manual Rule is Needed</title> + +<!-- The CCI/SRG items referenced here are: + - not satisfied + - selected in a DoD baseline + - considered NA --> +<Rule id="unmet_nonfinding_scope"> +<title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title> <rationale> -A new Rule needs to be created in the scap-security-guide content. +The guidance does not meet this requirement. +The requirement is impractical or out of scope. </rationale> <ocil> -RHEL6 does support this requirement but the guidance is not yet written. +RHEL6 cannot support this requirement without assistance from an external +application, policy, or service. This requirement is NA. </ocil> <description> -When the guidance is written, the fix will be forthcoming. +This requirement is NA. No fix is required. </description> -<ref disa="52,53,1009,1019,1159,1125,1140,1143" /> -</Rule> <!-- end new_rule_needed --> +<ref disa="371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" /> +</Rule> +
</Group>
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/Makefile | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 02d4bdc..8457cdc 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -93,6 +93,7 @@ table-stigs: shorthand2xccdf table-srgmap $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-stig-rhel6-xccdf.xml xsltproc --novalid --html -o $(OUT)/table-stig-rhel6-server-flat-srgs.html $(TRANS)/table-add-srgitems.xslt $(OUT)/table-stig-rhel6-server-flat.html + xsltproc --novalid --html -o $(OUT)/table-stig-rhel6-server-srgs.html $(TRANS)/table-add-srgitems.xslt $(OUT)/table-stig-rhel6-server.html xsltproc --html -o $(OUT)/table-stig-rhel6-server-flat.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-stig-rhel6-server-flat.html
tables: table-refs table-idents table-profilenistrefs table-srgmap table-stigs
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/auxiliary/alt-titles-stig.xml | 24 ++++++++++++++++++------ RHEL6/input/auxiliary/srg_support.xml | 6 +++--- 2 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index d91f4c2..915bd1a 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -724,17 +724,29 @@ There must be no world-writable files on the system. </title> <title rule="unmet_impractical_product" shorttitle="Product Does Not Meet this Requirement Due to Impracticality or Scope"> This requirement must be satisfied via an external application or server. -</title> +</title> <title rule="unmet_impractical_guidance" shorttitle="Guidance Does Not Meet this Requirement Due to Impracticality or Scope"> This requirement must be satisfied via an external application, policy, or service. -</title> +</title> <title rule="requirement_unclear" shorttitle="Implementation of the Requirement is Unclear"> This requirement must be clarified. -</title> -<title rule="new_rule_needed" shorttitle="A New Policy/Manual? Rule is Needed."> -This rule remains to be written. -</title> +</title> <title rule="met_inherently" shorttitle="Product Meets This Requirement"> The system can not be configured not to meet this requirement. </title> +<title rule="encrypt_partitions" shorttitle="Encrypt Partitions"> +The operating system must employ cryptographic mechanisms to protect information in storage. +</title> +<title rule="set_daemon_umask" shorttitle="Set Daemon Umask"> +The system default umask for daemons must be 027 or 022. +</title> +<title rule="service_postfix_enable" shorttitle="Enable Postfix Service"> +The postfix service must be enabled for mail delivery. +</title> +<title rule="snmpd_use_newer_protocol" shorttitle="Configure SNMP Service to Use Only SNMPv3 or Newer "> +The snmpd service must use only SNMP protocol version 3 or newer. +</title> +<title rule="snmpd_not_default_password" shorttitle="Ensure Default Password Is Not Used"> +The snmpd service must not use a default password. +</title> </titles> diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml index 849e23b..7e00479 100644 --- a/RHEL6/input/auxiliary/srg_support.xml +++ b/RHEL6/input/auxiliary/srg_support.xml @@ -21,7 +21,7 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="56,1084,42,66,135,223,131,132,133,134,85,159,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1674,206" /> +<ref disa="56,130,1084,42,66,86,135,185,223,131,132,133,134,85,159,171,172,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674,206" /> </Rule>
@@ -46,7 +46,7 @@ This requirement is permanent not a finding. No fix is required. <!-- The CCI/SRG item listed here are: - satisfied (by Rules in the guidance, which include the reference) - not selected in DoD baseline --> -<!-- disa="26,27,32,771,772,779,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" --> +<!-- disa="26,27,32,771,772,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" -->
<!-- The CCI/SRG item referenced here are: @@ -66,7 +66,7 @@ application, policy, or service. This requirement is NA. <description> This requirement is NA. No fix is required. </description> -<ref disa="21,25,28,29,30,165,221,354,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1373,1374,1383,1391,1392,1395,1662" /> +<ref disa="21,25,28,29,30,165,221,354,779,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1356,1373,1374,1383,1391,1392,1395,1632,1662" /> </Rule>
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/profiles/stig-rhel6-server.xml | 9 ++------- 1 files changed, 2 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml index 5beb9a6..f5b8d6f 100644 --- a/RHEL6/input/profiles/stig-rhel6-server.xml +++ b/RHEL6/input/profiles/stig-rhel6-server.xml @@ -2,13 +2,8 @@ <title>Pre-release Draft STIG for RHEL 6 Server</title> <description>This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
-<!-- DISA wants these to show up in the stig-table HTML - file. Need to XSLT them there -<select idref="requirement_unclear" selected="true"/> -<select idref="new_rule_needed" selected="true"/> -<select idref="met_inherently" selected="true"/> -<select idref="unmet_impractical_product" selected="true"/> -<select idref="unmet_impractical_guidance" selected="true"/> --> + +<select idref="encrypt_partitions" selected="true"/>
<select idref="rpm_verify_permissions" selected="true"/> <select idref="rpm_verify_hashes" selected="true"/>
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/services/ssh.xml | 1 - RHEL6/input/system/accounts/pam.xml | 1 - RHEL6/input/system/auditing.xml | 3 +-- RHEL6/input/system/network/iptables.xml | 1 - RHEL6/input/system/network/ssl.xml | 4 ---- RHEL6/input/system/software/disk_partitioning.xml | 7 ++++++- RHEL6/input/system/software/integrity.xml | 3 +-- RHEL6/input/system/software/updating.xml | 3 +-- 8 files changed, 9 insertions(+), 14 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 4976568..901eefb 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -58,7 +58,6 @@ certain changes should be made to the OpenSSH daemon configuration file <tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied to this file. See the <tt>sshd_config(5)</tt> man page for more detailed information.</description> -<ref disa="68,197,1632,779,781" />
<Rule id="sshd_allow_only_protocol2" severity="high"> <title>Allow Only SSH Protocol 2</title> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index ba9a285..95b21c1 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -40,7 +40,6 @@ files, destroying any manually made changes and replacing them with a series of system defaults. One reference to the configuration file syntax can be found at http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-fi....</warning> -<ref disa="1391,1392" />
<Value id="password_history_retain_number" type="number" operator="equals" interactive="0"> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index e6ab516..d07d9ed 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -93,7 +93,7 @@ actions will be taken if other obstacles exist. </rationale> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> -<ref nist="CM-6, CM-7" disa="169,157,172,174,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120" /> +<ref nist="CM-6, CM-7" disa="347,169,157,172,174,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> <tested by="DS" on="20121024"/> </Rule>
@@ -459,7 +459,6 @@ After reviewing all the rules, reading the following sections, and editing as needed, the new rules can be activated as follows: <pre># service auditd restart</pre> </description> -<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1356,374,130" />
<Group id="audit_time_rules"> <title>Records Events that Modify Date and Time Information</title> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index d63b99f..cf39f23 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -18,7 +18,6 @@ the iptables and ip6tables configurations included with the system. For more complete information that may allow the construction of a sophisticated ruleset tailored to your environment, please consult the references at the end of this section.</description> -<ref disa="66,86" />
<Group id="iptables_activation"> <title>Inspect and Activate Default Rules</title> diff --git a/RHEL6/input/system/network/ssl.xml b/RHEL6/input/system/network/ssl.xml index 0c35dc7..984d4a2 100644 --- a/RHEL6/input/system/network/ssl.xml +++ b/RHEL6/input/system/network/ssl.xml @@ -49,9 +49,6 @@ process are: </ol> </description>
- -<ref disa="1130,1131,1127,1128,1129,187" /> - <Group id="network_ssl_create_ca"> <title>Create a CA to Sign Certificates</title> <description>The following instructions apply to OpenSSL since it is included @@ -137,7 +134,6 @@ To avoid this warning, and properly authenticate the servers, your CA certificat application on every client system that will be connecting to an SSL-enabled server.</description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_enable_client_support" />--> -<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" disa="185" /> </Group>
<Group id="network_ssl_add_ca_firefox"> diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 484117b..932e6e8 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -100,7 +100,7 @@ of space. </rationale> <ident cce="14171-3" /> <oval id="mount_var_log_audit_own_partition" /> -<ref nist="CM-6, AU-9" disa="137,1208"/> +<ref nist="CM-6, AU-9" disa="137,138,1208"/> <tested by="MM" on="20120928"/> </Rule>
@@ -153,6 +153,11 @@ https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_... <ocil clause="encryption must be used and is not employed"> Determine if encryption must be used to protect data on the system. </ocil> +<rationale> +The risk of a system's physical compromise, particularly mobile systems such as +laptops, places its data at risk of compromise. Encrypting this data mitigates +the risk of its loss if the system is lost. +</rationale> <ref disa="1019,1199,1200" /> </Rule>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index fe548f3..9be9221 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -23,7 +23,6 @@ database should be created immediately after your system is built, and before the system is connected to any network. AIDE is highly configurable, with further configuration information located in <tt>/usr/share/doc/aide-<i>VERSION</i></tt></description> -<ref disa="374,1069,1297,1589"/>
<Rule id="install_aide" severity="medium"> @@ -97,7 +96,7 @@ To determine that periodic AIDE execution has been scheduled, run the following By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files. </rationale> -<ref nist="CM-6, SC-28, SI-7" disa="416,1069,1263"/> +<ref nist="CM-6, SC-28, SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> <!-- <Group id="aide_verify_integrity_manually"> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 00e44e7..2bd9fa4 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -16,7 +16,6 @@ with the Installed Software Catalog to ensure all system metadata is accurate with regard to installed software and security patches, and for this reason, their use is strongly encouraged. </description> -<ref disa="1233" />
<Rule id="ensure_redhat_gpgkey_installed" severity="high"> <title>Ensure Red Hat GPG Key Installed</title> @@ -124,7 +123,7 @@ to determine if the system is missing applicable updates. Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. </rationale> -<ref nist="SI-2" disa="1227"/> +<ref nist="SI-2" disa="1227,1233"/> <tested by="MM" on="20120928"/> </Rule> </Group>
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/transforms/table-add-srgitems.xslt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/transforms/table-add-srgitems.xslt b/RHEL6/transforms/table-add-srgitems.xslt index 3f99b74..116191b 100644 --- a/RHEL6/transforms/table-add-srgitems.xslt +++ b/RHEL6/transforms/table-add-srgitems.xslt @@ -18,7 +18,7 @@ <xsl:variable name="cci_id" select="td[2]"/> <xsl:variable name="title" select="td[3]"/>
- <xsl:if test="not($ruletable/tr[td[7]=$srg_id])" > + <xsl:if test="not($ruletable/tr[contains(td[7],$srg_id)])" > <tr> <td>TBD</td> <td>medium</td> <!-- based ONLY on the fact that all OS SRG items have "medium" severity -->
(these have already been pushed, in the interest of speed)
On 12/17/2012 09:15 AM, Jeffrey Blank wrote:
A collection of repairs and updates to CCI references, in support of addressing all OS SRG requirements as viewed in output/table-stig-rhel6-server-flat-srgs.html.
Jeffrey Blank (8): adjusting references to DISA CCIs in services adjusting DISA CCI references in system config items rework of CCI references in SRG support file to indicate selection on DoD baselines adding creation of new SRG-complete table with CCI refs combined (vs flattened) new alt-titles for STIG Rules, CCI references updates added Rule for encrypting partitions to stig profile removing CCI refs when attached to Groups, in favor of Rules or srg_support support for adding SRG ID items to unflattened profile table
RHEL6/Makefile | 1 + RHEL6/input/auxiliary/alt-titles-stig.xml | 24 ++++-- RHEL6/input/auxiliary/srg_support.xml | 88 ++++++++++++++------- RHEL6/input/profiles/stig-rhel6-server.xml | 9 +-- RHEL6/input/services/http.xml | 4 +- RHEL6/input/services/obsolete.xml | 6 +- RHEL6/input/services/ssh.xml | 4 +- RHEL6/input/system/accounts/pam.xml | 1 - RHEL6/input/system/auditing.xml | 5 +- RHEL6/input/system/network/ipsec.xml | 2 +- RHEL6/input/system/network/iptables.xml | 5 +- RHEL6/input/system/network/ssl.xml | 4 - RHEL6/input/system/software/disk_partitioning.xml | 41 ++++++---- RHEL6/input/system/software/integrity.xml | 3 +- RHEL6/input/system/software/updating.xml | 3 +- RHEL6/transforms/table-add-srgitems.xslt | 2 +- 16 files changed, 118 insertions(+), 84 deletions(-)
scap-security-guide@lists.fedorahosted.org
-
Jeffrey Blank