I thought there had already been a patch addressing the SELinux severity, but it was still showing as 'high' on my end. This patch addresses the issue (again?), as well as some minor text corrections.
David Smith (3): slight modification of text corrected severity listing for SELinux slight text modification
RHEL6/input/system/accounts/pam.xml | 2 +- .../accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/selinux.xml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 4cd8a9d..ce0f202 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -376,7 +376,7 @@ attempts using <tt>pam_faillock.so</tt>: Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt>: <pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900</pre> <pre>auth required pam_faillock.so authsucc deny=3 unlock_time=900</pre> -The DoD requirement is three failed attempts. +The DoD requirement is 3 failed attempts. </description> <ocil clause="that is not the case"> To ensure the failed password attempt policy is configured correctly, run the following command:
On 10/31/12 1:46 PM, David Smith wrote:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil
RHEL6/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 4cd8a9d..ce0f202 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -376,7 +376,7 @@ attempts using <tt>pam_faillock.so</tt>: Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt>:
<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900</pre>
<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=900</pre>
-The DoD requirement is three failed attempts. +The DoD requirement is 3 failed attempts.
</description> <ocil clause="that is not the case"> To ensure the failed password attempt policy is configured correctly, run the following command:
Ack
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/selinux.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 54c66f5..7a88b58 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -82,7 +82,7 @@ and to protect the boot process. <value selector="mls">mls</value> </Value>
-<Rule id="enable_selinux_bootloader" severity="high"> +<Rule id="enable_selinux_bootloader" severity="medium"> <title>Ensure SELinux Not Disabled in /etc/grub.conf</title> <description>SELinux can be disabled at boot time by an argument in <tt>/etc/grub.conf</tt>. @@ -146,7 +146,7 @@ Check the file <tt>/etc/selinux/config</tt> and ensure the following line appear <rationale> Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy ensures that the system will confine processes that are likely to be -targeted for exploitation, such as network services or system services. +targeted for exploitation, such as network or system services. </rationale> <ident cce="3624-4" /> <oval id="selinux_policytype" value="var_selinux_policy_name"/>
On 10/31/12 1:46 PM, David Smith wrote:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil
RHEL6/input/system/selinux.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 54c66f5..7a88b58 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -82,7 +82,7 @@ and to protect the boot process. <value selector="mls">mls</value>
</Value>
-<Rule id="enable_selinux_bootloader" severity="high"> +<Rule id="enable_selinux_bootloader" severity="medium">
<title>Ensure SELinux Not Disabled in /etc/grub.conf</title> <description>SELinux can be disabled at boot time by an argument in <tt>/etc/grub.conf</tt>. @@ -146,7 +146,7 @@ Check the file <tt>/etc/selinux/config</tt> and ensure the following line appear <rationale> Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy ensures that the system will confine processes that are likely to be -targeted for exploitation, such as network services or system services. +targeted for exploitation, such as network or system services. </rationale> <ident cce="3624-4" /> <oval id="selinux_policytype" value="var_selinux_policy_name"/>
Good catch. Forgot SELinux was called out in multiple places.
Ack
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- .../accounts/restrictions/password_storage.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 153a2d6..8222f67 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -31,7 +31,7 @@ If this produces any output, it may be possible to log into accounts with empty passwords. </ocil> <rationale> -If an account has an empty password, anybody may log in and +If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
On 10/31/12 1:46 PM, David Smith wrote:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil
.../accounts/restrictions/password_storage.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 153a2d6..8222f67 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -31,7 +31,7 @@ If this produces any output, it may be possible to log into accounts with empty passwords.
</ocil> <rationale> -If an account has an empty password, anybody may log in and +If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Ack
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/auxiliary/alt-titles-stig.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 55e8de2..b7f36d5 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -186,7 +186,7 @@ The system must disable accounts after three consecutive unsuccessful login atte The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. </title> <title rule="limiting_password_reuse" shorttitle="Limit Password Reuse"> -The system must prohibit the reuse of passwords within five iterations. +The system must prohibit the reuse of passwords within 24 iterations. </title> <title rule="max_concurrent_login_sessions" shorttitle="Limit the Number of Concurrent Login Sessions Allowed Per User"> The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. @@ -702,7 +702,7 @@ All files must be owned by a group. All GIDs referenced in /etc/passwd must be defined in /etc/group </title> <title rule="account_unique_name" shorttitle="All Accounts on the System Must Have Unique User or Account Names"> -All Accounts on the System Must Have Unique User or Account Names +All accounts on the system must have unique user or account names </title> <title rule="password_require_consecrepeat" shorttitle="Set Password to Maximum of Three Consecutive Repeating Characters"> The system must require passwords contain no more than three consecutive repeating characters.
On 10/31/12 1:46 PM, David Smith wrote:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil
RHEL6/input/auxiliary/alt-titles-stig.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 55e8de2..b7f36d5 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -186,7 +186,7 @@ The system must disable accounts after three consecutive unsuccessful login atte The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.
</title> <title rule="limiting_password_reuse" shorttitle="Limit Password Reuse"> -The system must prohibit the reuse of passwords within five iterations. +The system must prohibit the reuse of passwords within 24 iterations. </title> <title rule="max_concurrent_login_sessions" shorttitle="Limit the Number of Concurrent Login Sessions Allowed Per User"> The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. @@ -702,7 +702,7 @@ All files must be owned by a group. All GIDs referenced in /etc/passwd must be defined in /etc/group </title> <title rule="account_unique_name" shorttitle="All Accounts on the System Must Have Unique User or Account Names"> -All Accounts on the System Must Have Unique User or Account Names +All accounts on the system must have unique user or account names </title> <title rule="password_require_consecrepeat" shorttitle="Set Password to Maximum of Three Consecutive Repeating Characters"> The system must require passwords contain no more than three consecutive repeating characters.
Ack
scap-security-guide@lists.fedorahosted.org