--- RHEL6/input/system/accounts/pam.xml | 1 + 1 file changed, 1 insertion(+)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index ce0f202..dec081f 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -438,6 +438,7 @@ This is the default. Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and ensure that the <tt>pam_unix.so</tt> module includes the argument <tt>sha512</tt>. +<tt># grep sha512 /etc/pam.d/system-auth</tt> </ocil> <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult.
--- RHEL6/input/system/auditing.xml | 1 + 1 file changed, 1 insertion(+)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 5f35e28..df6c6b4 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -241,6 +241,7 @@ Note that values less than 2 result in no log rotation.</description> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine how many logs the system is configured to retain after rotation: <pre>num_logs = 5</pre> +<tt># grep num_logs /etc/audit/auditd.conf</tt> </ocil> <rationale>The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 1 + 1 file changed, 1 insertion(+)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 5f35e28..df6c6b4 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -241,6 +241,7 @@ Note that values less than 2 result in no log rotation.</description> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine how many logs the system is configured to retain after rotation:
<pre>num_logs = 5</pre>
+<tt># grep num_logs /etc/audit/auditd.conf</tt>
</ocil> <rationale>The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log -- 1.8.0
Drop the "<pre>num_logs... " line & ack.
No need for that since you've documented the grep command.
--- RHEL6/input/system/auditing.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index df6c6b4..9e1e1c8 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -265,6 +265,7 @@ support retention of even more audit data.</description> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine how much data the system will retain in each audit log file: <pre>max_log_file = 6</pre> +<tt># grep max_log_file /etc/audit/auditd.conf</tt> </ocil> <rationale>The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum @@ -278,7 +279,7 @@ log file size and the number of logs retained.</rationale> <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title> <description> The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken -by <tt>auditd</tt>, add or correct the line: +by <tt>auditd</tt>, add or correct the line in <tt>/etc/audit/auditd.conf</tt>: <pre>max_log_file_action = <i>ACTION</i></pre> Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page. These include: @@ -296,6 +297,7 @@ occurs. This is the default. The setting is case-insensitive. Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to rotate logs when they reach their maximum size: <pre>max_log_file_action <tt>rotate</tt></pre> +<tt># grep max_log_file_action /etc/audit/auditd.conf</tt> </ocil> <rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>) minimizes the chances of the system unexpectedly running out of disk space by @@ -347,6 +349,7 @@ Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to email the administrator when disk space is starting to run low: <pre>space_left_action email</pre> +<tt># grep space_left_action /etc/audit/auditd.conf</tt> </ocil> <rationale>Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.</rationale>
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index df6c6b4..9e1e1c8 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -265,6 +265,7 @@ support retention of even more audit data.</description> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine how much data the system will retain in each audit log file:
<pre>max_log_file = 6</pre>
+<tt># grep max_log_file /etc/audit/auditd.conf</tt>
Nack, commands should go before sample output
</ocil> <rationale>The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum @@ -278,7 +279,7 @@ log file size and the number of logs retained.</rationale> <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title> <description> The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken -by <tt>auditd</tt>, add or correct the line: +by <tt>auditd</tt>, add or correct the line in <tt>/etc/audit/auditd.conf</tt>:
Ack
<pre>max_log_file_action = <i>ACTION</i></pre>
Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page. These include: @@ -296,6 +297,7 @@ occurs. This is the default. The setting is case-insensitive. Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to rotate logs when they reach their maximum size: <pre>max_log_file_action <tt>rotate</tt></pre> +<tt># grep max_log_file_action /etc/audit/auditd.conf</tt>
Sample output should come after the command
</ocil> <rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>) minimizes the chances of the system unexpectedly running out of disk space by @@ -347,6 +349,7 @@ Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to email the administrator when disk space is starting to run low: <pre>space_left_action email</pre> +<tt># grep space_left_action /etc/audit/auditd.conf</tt>
Sample output should come after the command
</ocil> <rationale>Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.</rationale> --
--- RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9e1e1c8..832c760 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system: <ocil clause="the system isn't configured to audit changes of the network configuration"> To determine if the system is configured to audit changes to its network configuration, run the following command: -<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre> -If the system is configured to watch for account changes, a line should be returned for +<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre> +If the system is configured to watch for network configuration changes, a line should be returned for each file specified (and <tt>perm=wa</tt> should be indicated for each). </ocil> <rationale>The network environment should not be modified by anything other
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9e1e1c8..832c760 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system:
<ocil clause="the system isn't configured to audit changes of the network configuration"> To determine if the system is configured to audit changes to its network configuration, run the following command: -<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre> -If the system is configured to watch for account changes, a line should be returned for +<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre> +If the system is configured to watch for network configuration changes, a line should be returned for each file specified (and <tt>perm=wa</tt> should be indicated for each). </ocil> <rationale>The network environment should not be modified by anything other --
Ack. This was really needing to be fixed, thanks!
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9e1e1c8..832c760 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system:
<ocil clause="the system isn't configured to audit changes of the network configuration"> To determine if the system is configured to audit changes to its network configuration, run the following command: -<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre> -If the system is configured to watch for account changes, a line should be returned for +<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre> +If the system is configured to watch for network configuration changes, a line should be returned for each file specified (and <tt>perm=wa</tt> should be indicated for each). </ocil> <rationale>The network environment should not be modified by anything other -- 1.8.0
Ack
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 832c760..36a3972 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1204,7 +1204,7 @@ appropriate for your system: </description> <ocil clause="there is not output"> To verify that auditing is configured for all media exportation events, run the following command: -<pre># grep mount /etc/audit/audit.rules</pre> +<pre># auditctl -l | grep syscall | grep mount</pre> </ocil> <rationale>The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 832c760..36a3972 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1204,7 +1204,7 @@ appropriate for your system:
</description> <ocil clause="there is not output"> To verify that auditing is configured for all media exportation events, run the following command: -<pre># grep mount /etc/audit/audit.rules</pre> +<pre># auditctl -l | grep syscall | grep mount</pre> </ocil> <rationale>The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit -- 1.8.0
Ack
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 36a3972..e689509 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1248,7 +1248,7 @@ administrator actions for all users and root. Add the following to </description> <ocil clause="there is not output"> To verify that auditing is configured for system administrator actions, run the following command: -<pre># grep actions /etc/audit/audit.rules</pre> +<pre># auditctl -l | grep "watch=/etc/sudoers"</pre> </ocil> <rationale>The actions taken by system administrators should be audited to keep a record of what was executed on the system as well as for accountability purposes.</rationale>
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 36a3972..e689509 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1248,7 +1248,7 @@ administrator actions for all users and root. Add the following to
</description> <ocil clause="there is not output"> To verify that auditing is configured for system administrator actions, run the following command: -<pre># grep actions /etc/audit/audit.rules</pre> +<pre># auditctl -l | grep "watch=/etc/sudoers"</pre> </ocil> <rationale>The actions taken by system administrators should be audited to keep a record of what was executed on the system as well as for accountability purposes.</rationale> -- 1.8.0
Ack
--- RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index e689509..c347936 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1261,11 +1261,11 @@ of what was executed on the system as well as for accountability purposes.</rati <Rule id="audit_kernel_module_loading"> <title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title> <description>Add the following to <tt>/etc/audit/audit.rules</tt> in order -to capture kernel module loading and unloading events: +to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system: <pre>-w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules --a always,exit -S init_module -S delete_module -k modules</pre> +-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre> </description> <ocil> <audit-syscall-check-macro syscall="init_module" />
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index e689509..c347936 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1261,11 +1261,11 @@ of what was executed on the system as well as for accountability purposes.</rati
<Rule id="audit_kernel_module_loading"> <title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title> <description>Add the following to <tt>/etc/audit/audit.rules</tt> in order -to capture kernel module loading and unloading events: +to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system: <pre>-w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules --a always,exit -S init_module -S delete_module -k modules</pre> +-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre> </description> <ocil> <audit-syscall-check-macro syscall="init_module" /> -- 1.8.0
Good catch. Ack.
--- RHEL6/input/services/ssh.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 9320999..8347b0e 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -207,7 +207,7 @@ command in allowing users to enable insecure access to their accounts via <tt>.rhosts</tt> files. <br /><br /> To ensure that this behavior is disabled, add or correct the -following line: +following line, in <tt>/etc/ssh/sshd_config</tt>: <pre>IgnoreRhosts yes</pre> </description> <ocil>
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/services/ssh.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 9320999..8347b0e 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -207,7 +207,7 @@ command in allowing users to enable insecure access to their accounts via <tt>.rhosts</tt> files. <br /><br /> To ensure that this behavior is disabled, add or correct the -following line: +following line, in <tt>/etc/ssh/sshd_config</tt>:
<pre>IgnoreRhosts yes</pre>
</description> <ocil> -- 1.8.0
The comma isn't needed
--- RHEL6/input/services/ssh.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 8347b0e..99aa9bd 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -353,7 +353,7 @@ The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers. <ocil clause="that is not the case"> Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: -<pre>$ grep Ciphers /etc/ssh/sshd_config</pre> +<pre># grep Ciphers /etc/ssh/sshd_config</pre> The output should contain only those ciphers which are FIPS-approved. </ocil> <rationale>
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/services/ssh.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 8347b0e..99aa9bd 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -353,7 +353,7 @@ The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers.
<ocil clause="that is not the case"> Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: -<pre>$ grep Ciphers /etc/ssh/sshd_config</pre> +<pre># grep Ciphers /etc/ssh/sshd_config</pre> The output should contain only those ciphers which are FIPS-approved. </ocil> <rationale> -- 1.8.0
Great catch, ack
--- RHEL6/input/system/accounts/banners.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 243ccf9..8e44a80 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -105,8 +105,8 @@ To display a banner, this setting must be enabled and then banner text must also be set. </description> <ocil clause="it is not"> -To ensure a login warning banner is enabled, open the following file: -<pre>/etc/gconf/schemas/gdm-simple-greeter.schemas</pre> +To ensure a login warning banner is enabled, run the following: +<pre># gconftool-2 -g /apps/gdm/simple-greeter/banner_message_enable</pre> Search for the <tt>banner_message_enable</tt> schema. If properly configured, the <tt>default</tt> value should be <tt>true</tt>. </ocil> @@ -134,8 +134,8 @@ directly to the file <tt>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml< and this file can later be edited directly if necessary. </description> <ocil clause="it does not"> -To ensure login warning banner text is properly set, open the following file: -<pre>/etc/gconf/schemas/gdm-simple-greeter.schemas</pre> +To ensure login warning banner text is properly set, run the following: +<pre># gconftool-2 -g /apps/gdm/simple-greeter/banner_message_text</pre> Search for the <tt>banner_message_text</tt> schema. If properly configured, the proper banner text will appear within this schema. </ocil>
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/accounts/banners.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 243ccf9..8e44a80 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -105,8 +105,8 @@ To display a banner, this setting must be enabled and then banner text must also be set.
</description> <ocil clause="it is not"> -To ensure a login warning banner is enabled, open the following file: -<pre>/etc/gconf/schemas/gdm-simple-greeter.schemas</pre> +To ensure a login warning banner is enabled, run the following: +<pre># gconftool-2 -g /apps/gdm/simple-greeter/banner_message_enable</pre>
Can this be ran unprivileged?
Search for the <tt>banner_message_enable</tt> schema. If properly configured, the <tt>default</tt> value should be <tt>true</tt>.
</ocil> @@ -134,8 +134,8 @@ directly to the file <tt>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml< and this file can later be edited directly if necessary. </description> <ocil clause="it does not"> -To ensure login warning banner text is properly set, open the following file: -<pre>/etc/gconf/schemas/gdm-simple-greeter.schemas</pre> +To ensure login warning banner text is properly set, run the following: +<pre># gconftool-2 -g /apps/gdm/simple-greeter/banner_message_text</pre>
Ack to this piece
Search for the <tt>banner_message_text</tt> schema.
Should this line be deleted now?
If properly configured, the proper banner text will appear within this schema.
</ocil>
Could you also update the OCIL clause text to this, vs the "it does not" language?
On 11/2/12 12:25 AM, Michele Newman wrote:
RHEL6/input/system/accounts/pam.xml | 1 + 1 file changed, 1 insertion(+)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index ce0f202..dec081f 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -438,6 +438,7 @@ This is the default. Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and ensure that the <tt>pam_unix.so</tt> module includes the argument <tt>sha512</tt>. +<tt># grep sha512 /etc/pam.d/system-auth</tt>
</ocil> <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. -- 1.8.0
Swap that to a non-privileged shell symbol & ack (these files are globally readable)
scap-security-guide@lists.fedorahosted.org
-
Michele Newman -
Shawn Wells