More mappings of current content to DISA CCI numbers. Created rule to set the maximum amount of concurrent logins per user in order to satisfy a OS SRG requirement.
Willy Santos (9): Added Rule to set the maximum amount of concurrent login sessions per user. Mapped rule to CCI-000054 which requires the operating system to limit the number of concurrent sessions for each account. Fixed placement of Value tags for max login rule. OVAL check for maximum login sessions rule. Mapped CCI-000158 to enable_auditd_service in auditing.xml Mapped CCI-000213 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000221 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000347 to auditd_configure_rules in auditing.xml Mapped CCI-000345 to met_inherently in srg_support.xml Mapped CCI-000346 to met_inherently in srg_support.xml
rhel6/src/input/auxiliary/srg_support.xml | 4 +- .../accounts_max_concurrent_login_sessions.xml | 34 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 32 ++++++++++++++++++- rhel6/src/input/system/auditing.xml | 4 +- 4 files changed, 69 insertions(+), 5 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/session.xml | 31 +++++++++++++++++++++++++++ 1 files changed, 31 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml index 00b5a8d..7a31235 100644 --- a/rhel6/src/input/system/accounts/session.xml +++ b/rhel6/src/input/system/accounts/session.xml @@ -168,6 +168,17 @@ operator="equals" interactive="0"> <value selector="077">077</value> </Value>
+<Value id="max_concurrent_login_sessions_value" type="number" +operator="equals" interactive="0"> +<title>Maximum concurrent login sessions</title> +<description>Maximum number of concurrent sessions by a user</description> +<value selector="">10</value> +<value selector="5">5</value> +<value selector="10">10</value> +<value selector="15">15</value> +<value selector="20">20</value> +</Value> + <Rule id="user_umask_bashrc"> <title> Ensure the Default Bash Umask is Set Correctly @@ -241,4 +252,24 @@ written to by unauthorized users.</rationale>
</Group>
+<Rule id="max_concurrent_login_sessions"> +<title> +Set the number of concurrent login sessions allowed per user +</title> +<description> +Limiting the number of allowed users and sessions per user can limit risks related to Denial of +Service attacks. This addresses concurrent sessions for a single account and does not address +concurrent sessions by a single user via multiple accounts. To set the number of concurrent +sessions per user add the following line in <tt>/etc/security/limits.conf</tt>: +<pre>* hard maxlogins <i>MAX</i></pre> +Where <i>MAX</i> is the maximum number of login sessions allowed. +</description> +<rationale>Limiting simultaneous user logins can insulate the system from denial of service +problems caused by excessive logins. Automated login processes operating improperly or +maliciously may result in an exceptional number of simultaneous login sessions. +</rationale> +<!-- <oval id="max_concurrent_login_sessions" value="max_concurrent_login_sessions_value" /> --> +<ref disa="54"/> +</Rule> + </Group>
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/session.xml | 23 +++++++++++------------ 1 files changed, 11 insertions(+), 12 deletions(-)
diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml index 7a31235..1dc93e2 100644 --- a/rhel6/src/input/system/accounts/session.xml +++ b/rhel6/src/input/system/accounts/session.xml @@ -168,17 +168,6 @@ operator="equals" interactive="0"> <value selector="077">077</value> </Value>
-<Value id="max_concurrent_login_sessions_value" type="number" -operator="equals" interactive="0"> -<title>Maximum concurrent login sessions</title> -<description>Maximum number of concurrent sessions by a user</description> -<value selector="">10</value> -<value selector="5">5</value> -<value selector="10">10</value> -<value selector="15">15</value> -<value selector="20">20</value> -</Value> - <Rule id="user_umask_bashrc"> <title> Ensure the Default Bash Umask is Set Correctly @@ -249,9 +238,19 @@ written to by unauthorized users.</rationale> <ref nist="CM-6, CM-7"/> </Rule>
- </Group>
+<Value id="max_concurrent_login_sessions_value" type="number" +operator="equals" interactive="0"> +<title>Maximum concurrent login sessions</title> +<description>Maximum number of concurrent sessions by a user</description> +<value selector="">10</value> +<value selector="5">5</value> +<value selector="10">10</value> +<value selector="15">15</value> +<value selector="20">20</value> +</Value> + <Rule id="max_concurrent_login_sessions"> <title> Set the number of concurrent login sessions allowed per user
Signed-off-by: Willy Santos wsantos@redhat.com --- .../accounts_max_concurrent_login_sessions.xml | 34 ++++++++++++++++++++ 1 files changed, 34 insertions(+), 0 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml
diff --git a/rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml b/rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml new file mode 100644 index 0000000..73717a5 --- /dev/null +++ b/rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml @@ -0,0 +1,34 @@ +<def-group> + <definition class="compliance" id="accounts_max_concurrent_login_sessions" version="1"> + <metadata> + <title>Set Maximum Number of Concurrent Login Sessions Per User</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TO:DO" source="CCE" /> + <description>The maximum number of concurrent login sessions per user should meet + minimum requirements.</description> + </metadata> + <criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf"> + <criterion test_ref="test_maxlogins" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="test_maxlogins" version="1"> + <ind:object object_ref="object_etc_security_limits_conf_maxlogins" /> + <ind:state state_ref="state_maxlogins" /> + </ind:textfilecontent54_test> + + <ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1"> + ind:filepath/etc/security/limits.conf</ind:filepath> + <ind:pattern operation="pattern match">^[\s]**[\s]+hard[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_state id="state_maxlogins" version="1"> + <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" /> + </ind:textfilecontent54_state> + + <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" /> + +</def-group>
CCI-000158 requires the OS to provide the capability to automatically process audit records for events of interest. Using ausearch and aureport (provided by the audit system) provides this capability.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 9630fd9..199a6c9 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -70,7 +70,7 @@ actions will be taken if other obstacles exist. </rationale> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> -<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067" /> +<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067,158" /> </Rule>
<Rule id="enable_auditd_bootloader">
CCI-000213 requires the OS to enforce approved logical access to the system in accordance with applicable policy. Organizational policy varies from organization to organization and is out of the scope of this guide.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index ebe8eb1..4f50b2a 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design. The guidance does not meet this requirement. The requirement is impractical or out of scope. </description> -<ref disa="354,1094,371,372,535,537,539,780,1682,1383,370,66,37" /> +<ref disa="354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213" /> </Group> <!-- end unmet_impractical_guidance -->
<Group id="unmet_impractical_product">
CCI-000213 requires the OS to enforce security policies regarded information on interconnected systems. Organizational policy varies from organization to organization and is out of the scope of this guide.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index 4f50b2a..3e405db 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design. The guidance does not meet this requirement. The requirement is impractical or out of scope. </description> -<ref disa="354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213" /> +<ref disa="354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221" /> </Group> <!-- end unmet_impractical_guidance -->
<Group id="unmet_impractical_product">
CCI-000347 requires automated auditing mechanisms of changes to the system. auditd provides this mechanism.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 199a6c9..7762ebe 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -353,7 +353,7 @@ After reviewing all the rules, reading the following sections, and editing as needed, the new rules can be activated as follows: <pre># service auditd restart</pre> </description> -<ref disa="171,172,1115,1454,1487,1571,1589,880" /> +<ref disa="171,172,1115,1454,1487,1571,1589,880,347" />
<Rule id="audit_time_rules"> <title>Records Events that Modify Date and Time Information</title>
CCI-000345 requires enforcing logical access restrictions associated with changes to the information system. By default, RHEL6 restricts system configuration changes to only the root user.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index 3e405db..3f6699a 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -12,7 +12,7 @@ not clearly relate. Red Hat Enterprise Linux meets this requirement by design. <!-- We could include discussion of Common Criteria Testing if so desired here. --> </description> -<ref disa="131,130,132,133,134,159,1694,162,163,164" /> +<ref disa="131,130,132,133,134,159,1694,162,163,164,345" /> </Group> <!-- end met_inherently -->
<Group id="unmet_impractical_guidance">
CCI-000346 requires employing automated mechanisms to enforce access restrictions for the purpose of initiating changes, upgrades, and modifications. By default, RHEL6 restricts system configuration changes to only the root user.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index 3f6699a..3649120 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -12,7 +12,7 @@ not clearly relate. Red Hat Enterprise Linux meets this requirement by design. <!-- We could include discussion of Common Criteria Testing if so desired here. --> </description> -<ref disa="131,130,132,133,134,159,1694,162,163,164,345" /> +<ref disa="131,130,132,133,134,159,1694,162,163,164,345,346" /> </Group> <!-- end met_inherently -->
<Group id="unmet_impractical_guidance">
On 6/19/12 8:04 PM, Willy Santos wrote:
More mappings of current content to DISA CCI numbers. Created rule to set the maximum amount of concurrent logins per user in order to satisfy a OS SRG requirement.
Willy Santos (9): Added Rule to set the maximum amount of concurrent login sessions per user. Mapped rule to CCI-000054 which requires the operating system to limit the number of concurrent sessions for each account. Fixed placement of Value tags for max login rule. OVAL check for maximum login sessions rule. Mapped CCI-000158 to enable_auditd_service in auditing.xml Mapped CCI-000213 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000221 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000347 to auditd_configure_rules in auditing.xml Mapped CCI-000345 to met_inherently in srg_support.xml Mapped CCI-000346 to met_inherently in srg_support.xml
rhel6/src/input/auxiliary/srg_support.xml | 4 +- .../accounts_max_concurrent_login_sessions.xml | 34 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 32 ++++++++++++++++++- rhel6/src/input/system/auditing.xml | 4 +- 4 files changed, 69 insertions(+), 5 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml
Ack to the set.
scap-security-guide@lists.fedorahosted.org
-
Shawn Wells -
Willy Santos