Our friends at DISA FSO have a batch of feedback/questions for the OS
SRG mappings. I believe most of the answers are fairly clear, though a
few will require additions to the project content.
I think it is preferable to document (in auxiliary/srg_support.xml)
answers, instead of answering inline with email. (Although a few are
more appropriate for email/list response.)
For other items, we might achieve this by documenting features/behavior
more fully in Group descriptions. This could make sense for 131-133, by
describing the audit records more fully there.
Using this link:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-ta...,
I have reviewed the information provided and have the following comments:
CCI-000044 - The requirement is to allow 3 failed logons before locking the account. Need
to assign a value of 3.
CCI-000047 - The requirement is to lock the account after reaching the number of failed
attempts as assigned in CCI-000044.
CCI-000050 - The requirement is for the banner to remain on the screen until the user
takes some action, such as clicking an OK or Acknowledgement button.
Is there a command which will fulfill this requirement or is it built-into the system?
We don't want the logon banner to just flash on the screen and
disappear.
CCI-000056 - Once the screen is locked, it can only be unlocked using password or CAC
authentication. Is there a command to enforce this?
CCI-000057 - The requirement is to lock the system after 15 minutes of inactivity. Is
there a command to enter which will set the time to 15 minutes?
CCI-000060 - Is there a way to ensure a blank screen or display graphics while the screen
is locked? Don't want to be able to see the previous screen.
CCI-000130 - Is there a command or flag to set which will ensure the system audit
information contains what type of events occurred? Or is it built in and cannot be
changed?
CCI-000131 - Is there a command or flag to set which will ensure the system audit
information contains when the events occurred? Or is it built in and cannot be
changed?
CCI-000132 - Is there a command or flag to set which will ensure the system audit
information contains where the events occurred? Or is it built in and cannot be
changed?
CCI-000133 - Is there a command or flag to set which will ensure the system audit
information contains the source of the events? Or is it built in and cannot be
changed?
CCI-000133 - Is there a command or flag to set which will ensure the system audit
information contains the success/failure of the events? Or is it built in and
cannot be changed?
CCI-000143 - The command stated in CCI-000140 should be used here also with option of
Email being used.
CCI-000154 - This would either be 'Products Meets this Requirement' or
'Product cannot comply with this requirement'
CCI-000162 - This requirement is to define permissions on the audit data file to restrict
read access by authorized personnel only. Need a command to set read
permissions on the audit file.
CCI-000163 - This requirement is to define permissions on the audit data file to restrict
modification by authorized personnel only. Need a command to set modify
permissions on the audit file.
CCI-000164 - This requirement is to define permissions on the audit data file to restrict
deletion by authorized personnel only. Need a command to set delete
permissions on the audit file.
CCI-000200 - Need a command to check/fix for requirement of not using the last 24
passwords.
CCI-000206 - Does Redhat display the password when entered or does it utilize asterisks?
If asterisks are used and cannot be changed, then this product meets the
requirement. If it must be configured to not display the password when entered, then a
command needs defined.
CCI-000213 - This requirement deals with permissions and access control. Redhat has the
capability to define permissions and controls per user basis.
CCI-000663 - Is there any way that Redhat can control access to whom installs software or
patches?
CCI-001391 - Is there a way Redhat can display to the user after logon, how many
successful logons have occurred within the last 7 days?
CCI-001392 - Is there a way Redhat can display to the user after logon, how many
unsuccessful logons have occurred within the last 7 days?
CCI-001404 - Will the command that's given also provide audit information when the
account is disabled?
CCI-001405 - Will the command that's given also provide audit information when the
account is terminated?
CCI-001452 - This requirement is to define the duration for counting the invalid logon
attempts, such as 3 attempts within a 15 minute timeframe.
CCI-001493 - Is there a special permission which needs set to protect access to audit
tools or how does the product natively meet this requirement?
CCI-001494 - Is there a special permission which needs set to protect modification of
audit tools or how does the product natively meet this requirement?
CCI-001495 - Is there a special permission which needs set to protect deletion of audit
tools or how does the product natively meet this requirement?
CCI-001683 - Using the command given, will it notify individuals when accounts are
created? Not just log the info.
CCI-001684 - Using the command given, will it notify individuals when accounts are
modified? Not just log the info.
CCI-001685 - Using the command given, will it notify individuals when accounts are
disabled? Not just log the info.
CCI-001686 - Using the command given, will it notify individuals when accounts are
terminated? Not just log the info.