On 8/28/13 2:02 PM, leam hall wrote:
Hey Maura!
I'm using the openscap-utils rpm and the content from the Fedorahosted
zip file.
On Wed, Aug 28, 2013 at 1:05 PM, Maura Dailey <maura(a)eclipse.ncsc.mil
<mailto:maura@eclipse.ncsc.mil>> wrote:
On 08/28/2013 12:04 PM, leam hall wrote:
> Hey all,
>
> Just ran oscap with the xml files available on the website
> (Benchmark version 0.9). Here are the issues that seem to be
> false positives. Prefix everything with "RHEL-06-000". These are
> all marked as fail but the server meets the STIG.
Stupid question, but what are you running against exactly? The RPM
or the latest git checkout? I want to make sure that if I run
this, I'm seeing the same results, and I've made a lot of changes
to OVAL checks in the git repository in the past few weeks. I'm
going to run through your list, comparing it against the OVAL checks.
> 9 rhnsd can be on if configured to Satellite server or similar
Fix text definitely implies this. It's not the only service that
implies it's allowed in certain environments, but then proceeds to
only accept a value of disabled.
> 57 ucredit
STIG wants ucredit=-1, so to test:
[shawn@rhel6 checks]$ grep ucredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3 ucredit=-1
[shawn@rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export
var_password_pam_cracklib_ucredit
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ucredit.xml
external_variable with id : var_password_pam_cracklib_ucredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.
/Side note: stig-rhel6-server was inheriting
var_password_pam_cracklib_ucredit=2 from common. Created patch to set
var_password_pam_cracklib_ucredit=-1 for STIG requirements./
> 58 ocredit
[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 *ocredit=5*
[shawn@rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export
var_password_pam_cracklib_ocredit
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results
Definition oval:scap-security-guide.testing:def:117: false
Evaluation done.
[shawn@rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 *ocredit=-1*
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results
Definition oval:scap-security-guide.testing:def:117: true
Evaluation done.
/Side note: var_password_pam_cracklib_ocredit=2 inherited from common.
Updated STIG profile for var_password_pam_cracklib_ocredit=-1/
> 59 lcredit
[shawn@rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export
var_password_pam_cracklib_lcredit
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1*lcredit=5*
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results
Definition oval:scap-security-guide.testing:def:122: false
Evaluation done.
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[sudo] password for shawn:
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1 *lcredit=-1*
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1 *lcredit=-5*
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.
/Side note: var_password_pam_cracklib_lcredit=2 inherited from common.
Updated STIG profile for var_password_pam_cracklib_lcredit=-1/
For the previous 3, I'd like to see the pam_cracklib.so line
so I
can troubleshoot.
As Maura mentioned, can you send your /etc/pam.d/system-auth file? I had
trouble reproducing your results.
> 73 /etc/issue
Going back to my many many OVAL check updates, I'd like to see
your exact /etc/issue so I can debug what went wrong. If it's an
exact copy of the text from the STIG, I'll work off that.
Skipping since Maura has the regex foo for this :)
> 98 No ipv6 installed
Do you mean it's disabled on your system, but the OVAL checks are
saying it isn't?
[shawn@rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat
/etc/modprobe.d/disabled.conf ; \
./testcheck.py kernel_module_ipv6_option_disabled.xml ; \
sudo vim /etc/modprobe.d/disabled.conf ; cat
/etc/modprobe.d/disabled.conf ; \
./testcheck.py kernel_module_ipv6_option_disabled.xml
options
ipv6 disable=1
Evaluating with OVAL tempfile :
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml
Writing results to :
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results
Definition oval:scap-security-guide.testing:def:127: true
Evaluation done.
Evaluating with OVAL tempfile :
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml
Writing results to :
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results
Definition oval:scap-security-guide.testing:def:127: false
Evaluation done.
Appears working. Can you send where you disabled IPv6?
> 99 "
?
RHEL-06-000099: The system must ignore ICMPv6 redirects by default.
aka sysctl_net_ipv6_conf_default_accept_redirects.xml
[root@rhel6 checks]# sysctl -q -n -w
net.ipv6.conf.default.accept_redirects=0
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml
Writing results to :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results
Definition oval:scap-security-guide.testing:def:130: true
Evaluation done.
[root@rhel6 checks]# sysctl -q -n -w
net.ipv6.conf.default.accept_redirects=1
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml
Writing results to :
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results
Definition oval:scap-security-guide.testing:def:130: false
Evaluation done.
Can you send us the output of:
`grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and
`sysctl -a | grep net.ipv6.conf.default.accept_redirects`
> 165 adjtimex
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k
audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_adjtimexQoelxQ.xml
Writing results to : /tmp/audit_rules_time_adjtimexQoelxQ.xml-results
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Definition oval:scap-security-guide.testing:def:134: true
Evaluation done.
Since these operate on OR's, the false is checking for 32bit auditing
rules. Ultimately, this results in a pass.
Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?
> 167 settimeofday
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S settimeofday -k
audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_settimeofday.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_settimeofday9TYIqD.xml
Writing results to : /tmp/audit_rules_time_settimeofday9TYIqD.xml-results
Definition oval:scap-security-guide.testing:def:147: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
(passes)
Can you send the output of 'grep settimeofday /etc/audit/audit.rules' ?
> 169 stime // Also, the STIG is wrong. There is no x86_64
stime
> syscall
The STIG actually says that stime is not necessary, which is kind
of a strange wording, but the suggested line in the fix text prose
is correct, at least. So far as OVAL checks go, I haven't gotten
to testing audit checks yet. Maybe this is broken. I'll check it
out once I've deciphered the OVAL check.
[root@rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k
audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 RHEL6]# cd input/checks/
[root@rhel6 checks]# ./testcheck.py audit_rules_time_s
audit_rules_time_settimeofday.xml audit_rules_time_stime.xml
[root@rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_stime4hUFRb.xml
Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results
Definition oval:scap-security-guide.testing:def:152: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
Can you send the output of 'grep stime /etc/audit/audit.rules' ?
> 171 clock_settime
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S clock_settime
-k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_clock_settime.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_time_clock_settime2SUHvv.xml
Writing results to : /tmp/audit_rules_time_clock_settime2SUHvv.xml-results
Definition oval:scap-security-guide.testing:def:155: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
Can you send the output of 'grep clock_settime /etc/audit/audit.rules' ?
> 184-196, 200 chmod, chown, etc...
Haven't tested audit checks yet...
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S fchmod
-S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod" >>
/etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_chmod.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml
Writing results to :
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results
Definition oval:scap-security-guide.testing:def:160: true
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchmod.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results
Definition oval:scap-security-guide.testing:def:180: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchmodat.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results
Definition oval:scap-security-guide.testing:def:185: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S fchown
-S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod" >>
/etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchown.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results
Definition oval:scap-security-guide.testing:def:165: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchownat.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_lchown.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml
Writing results to :
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results
Definition oval:scap-security-guide.testing:def:175: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
Please send relevant lines from audit.rules
> 206-211 No telnet installed or turned on
These are both automated checks. Unless the package name is wrong,
I don't know why they'd give false positives.
This is broke. I forgot who originally reported, but we still need to
update the telnet checks to use the xinet templates.
> 240 /etc/ssh/sshd_config Banner
The OVAL check was definitely working on my system when I last
tested it.
I'm able to reproduce...
[root@rhel6 checks]# cat /etc/issue
You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which
includes any device attached to this IS), you consent to the following
conditions:
-The USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM),
law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are
subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
-Notwithstanding the above, using this IS does not constitute consent to
PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy,
and their assistants. Such communications and work product are private
and confidential. See User Agreement for details.
[root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
Definition oval:scap-security-guide.testing:def:193: false
Definition oval:scap-security-guide.testing:def:191: false
Definition oval:scap-security-guide.testing:def:190: false
Evaluation done.
Maura, do you want to take a stab at this (noticed your signoff on the
OVAL)?
FWIW, if I used the USGCB banner everything worked OK.
> 271 If there are no removable partitions this is not a
finding.
Working on testing this one now...
Skipping in my testing then
> 278 If the file permissions are more restrictive then it is not
> a finding.
This pairs with rpm_verify_permissions, which has the following
criterion checks:
<criteria operator="AND">
<criterion test_ref="test_verify_all_rpms_user_ownership"
comment="user ownership of all files matches local rpm database" />
<criterion test_ref="test_verify_all_rpms_group_ownership"
comment="group ownership of all files matches local rpm database" />
<criterion test_ref="test_verify_all_rpms_mode" comment="mode of
all files matches local rpm database" />
</criteria>
Can you send what files are being reported? It should only hit on
ownership mismatches.
> 324 No X running
Agreed, the GNOME checks need to be rewritten to have extended
definitions to exclude machines that don't have X installed.
Which package(s) should we check for? xorg-x11-server-Xorg? gnome-desktop?
> 326 "
?
Same thing as 324
> 346 Finding reported on umask 022
This is DEFINITELY a bug. The check section is actually pointing
to a different check. The actual check for this rule was never
written.
The XCCDF (set_daemon_umask) points to:
<oval id="umask_for_daemons" value="var_umask_for_daemons"/>
so, to test:
[shawn@rhel6 checks]$ grep umask /etc/init.d/functions
# Make sure umask is sane
umask 022
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
Definition oval:scap-security-guide.testing:def:212: false
Evaluation done.
but then in the OVAL code, it's looking at the wrong place:
<ind:textfilecontent54_object id="object_umask_for_daemons"
version="1">
<ind:path>/etc/sysconfig</ind:path>
<ind:filename>init</ind:filename>
<ind:pattern operation="pattern
match">umask[\s]+(.*)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
verified no other XCCDF rule was using this OVAL:
[shawn@rhel6 input]$ grep -rin umask_for_daemons system/*
system/permissions/execution.xml:18:<Value id="var_umask_for_daemons"
type="string" operator="equals" interactive="0">
system/permissions/execution.xml:47:<oval id="umask_for_daemons"
value="var_umask_for_daemons"/>
.... wrote a patch to fix the pattern match expression, and file path
things seem OK now:
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
Writing results to : /tmp/umask_for_daemons394CCR.xml-results
Definition oval:scap-security-guide.testing:def:212: true
Evaluation done.
> 348 No vsftp installed, thus no file.
No OVAL check exists in SSG.
Created
https://fedorahosted.org/scap-security-guide/ticket/411 to track
> 506 "hushlogin"
This one isn't in the SSG at all.
> 507 PrintLastLog
This one isn't in the SSG at all.
Not sure how/why DISA FSO slid these in. Leland?
--
Shawn Wells
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
@shawndwells