Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com>
---
.../checks/accounts_disabled_after_expiration.xml | 24 ++++
...counts_login_shell_timeout_implemented_bash.xml | 45 ++++++++
...counts_login_shell_timeout_implemented_tcsh.xml | 25 +++++
.../input/checks/accounts_netrc_files_checked.xml | 25 +++++
.../accounts_user_dot_files_not_world_writable.xml | 33 ++++++
.../checks/libuser_login_defs_userdefaults.xml | 50 +++++++++
rhel6/src/input/profiles/common.xml | 42 +++++++-
rhel6/src/input/system/accounts/accounts.xml | 27 +++++
rhel6/src/input/system/accounts/pam.xml | 38 +++++++-
rhel6/src/input/system/accounts/physical.xml | 63 +++++++++++
.../system/accounts/restrictions/restrictions.xml | 114 ++++++++++++++++++++
rhel6/src/input/system/accounts/session.xml | 24 ++++
12 files changed, 508 insertions(+), 2 deletions(-)
create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
create mode 100644
rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
create mode 100644
rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
new file mode 100644
index 0000000..334c1dd
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
@@ -0,0 +1,24 @@
+<def-group>
+ <definition class="compliance"
id="accounts_disabled_after_expiration" version="1">
+ <metadata>
+ <title> Ensure Accounts Set to Disable After Password
Expiration</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description> Check for INACTIVE line in useradd.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="inactive set"
test_ref="test_accounts_disabled_after_expiration_inactive" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" comment="inactive set in
useradd" id="test_accounts_disabled_after_expiration_inactive"
version="1">
+ <ind:object
object_ref="object_accounts_disabled_after_expiration_inactive" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_disabled_after_expiration_inactive"
version="1">
+ <ind:path>/etc/default</ind:path>
+ <ind:filename>useradd</ind:filename>
+ <ind:pattern operation="pattern
match">^INACTIVE\=[\d{1,3}]\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
new file mode 100644
index 0000000..2f8b818
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
@@ -0,0 +1,45 @@
+<def-group>
+ <definition class="compliance"
id="accounts_login_shell_timeout_implemented_bash" version="1">
+ <metadata>
+ <title> Implement Inactivity Time-out for bash Login Shell</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-3707-7" source="CCE" />
+ <description> Check if login shells set to automatically log users out after
a certain period of inactivity.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="check readonly line"
test_ref="test_accounts_login_shell_timeout_implemented_bash_readonly" />
+ <criterion comment="check timeout line"
test_ref="test_accounts_login_shell_timeout_implemented_bash_idle" />
+ <criterion comment="check export line"
test_ref="test_accounts_login_shell_timeout_implemented_bash_export" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="readonly
timeout" id="test_accounts_login_shell_timeout_implemented_bash_readonly"
version="1">
+ <ind:object
object_ref="object_accounts_login_shell_timeout_implemented_bash_readonly"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_login_shell_timeout_implemented_bash_readonly"
version="1">
+ <ind:path>/etc/profile.d</ind:path>
+ <ind:filename>tmout.sh</ind:filename>
+ <ind:pattern operation="pattern
match">^readonly[\s]+TMOUT\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_test check="all" comment="idle timeout"
id="test_accounts_login_shell_timeout_implemented_bash_idle"
version="1">
+ <ind:object
object_ref="object_accounts_login_shell_timeout_implemented_bash_idle" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_login_shell_timeout_implemented_bash_idle"
version="1">
+ <ind:path>/etc/profile.d</ind:path>
+ <ind:filename>tmout.sh</ind:filename>
+ <ind:pattern operation="pattern
match">^TMOUT\=\d{3,5}\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_test check="all" comment="export timeout"
id="test_accounts_login_shell_timeout_implemented_bash_export"
version="1">
+ <ind:object
object_ref="object_accounts_login_shell_timeout_implemented_bash_export" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_login_shell_timeout_implemented_bash_export"
version="1">
+ <ind:path>/etc/profile.d</ind:path>
+ <ind:filename>tmout.sh</ind:filename>
+ <ind:pattern operation="pattern
match">^export[\s]+TMOUT\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
new file mode 100644
index 0000000..ce067ce
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance"
id="accounts_login_shell_timeout_implemented_tcsh" version="1">
+ <metadata>
+ <title> Check tcsh Inactivity Time-out</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-3689-7" source="CCE" />
+ <description> Check if tcsh login shell is set to log users out after period
of inactivity.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="tcsh time-out check"
test_ref="test_accounts_login_shell_timeout_implemented_tcsh" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="tcsh"
id="test_accounts_login_shell_timeout_implemented_tcsh"
version="1">
+ <ind:object
object_ref="object_accounts_login_shell_timeout_implemented_tcsh" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_login_shell_timeout_implemented_tcsh"
version="1">
+ <ind:path>/etc/profile.d</ind:path>
+ <ind:filename>autologout.csh</ind:filename>
+ <ind:pattern operation="pattern
match">^set[\s]+\-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml
b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
new file mode 100644
index 0000000..2a4a6ca
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="accounts_netrc_files_checked"
version="1">
+ <metadata>
+ <title>Ensure No .netrc Files</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-TODO" source="CCE" />
+ <description>Check that .netrc files are missing from all user
accounts.</description>
+ </metadata>
+ <criteria >
+ <criterion comment=".netrc files"
test_ref="test_accounts_netrc_files_checked" negate="true" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all"
check_existence="at_least_one_exists" comment="home directories"
id="test_accounts_netrc_files_checked" version="1">
+ <unix:object object_ref="object_accounts_netrc_files_checked" />
+ </unix:file_test>
+ <unix:file_object comment=".netrc files"
id="object_accounts_netrc_files_checked" version="1">
+ <unix:behaviors recurse="files" recurse_direction="down"
max_depth="1" recurse_file_system="all" />
+ <unix:path operation="equals">/home</unix:path>
+ <unix:filename operation="pattern
match">.netrc</unix:filename>
+ </unix:file_object>
+</def-group>
+
+
diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
new file mode 100644
index 0000000..82a9e45
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
@@ -0,0 +1,33 @@
+<def-group>
+ <definition class="compliance"
id="accounts_user_dot_files_not_world_writable" version="1">
+ <metadata>
+ <title>Ensure User Dot Files not World Writable</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-TODO" source="CCE" />
+ <description>File permissions should be set correctly for dot-files for all
user accounts.</description>
+ </metadata>
+ <criteria >
+ <criterion comment="user dot files"
test_ref="test_accounts_user_dot_files_not_world_writable"
negate="true" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all"
check_existence="at_least_one_exists" comment="home directories"
id="test_accounts_user_dot_files_not_world_writable" version="1">
+ <unix:object
object_ref="object_accounts_user_dot_files_not_world_writable" />
+ <unix:state state_ref="state_dot_files_wrong_perm" />
+ </unix:file_test>
+ <unix:file_object comment="user dot files"
id="object_accounts_user_dot_files_not_world_writable"
version="1">
+ <unix:behaviors recurse="files" recurse_direction="down"
max_depth="1" recurse_file_system="all" />
+ <unix:path operation="equals">/home</unix:path>
+ <unix:filename operation="pattern match">.*</unix:filename>
+ <filter action="include">state_dot_files_wrong_perm</filter>
+ </unix:file_object>
+ <unix:file_state id="state_dot_files_wrong_perm" version="1"
operator="OR">
+ <unix:suid datatype="boolean">true</unix:suid>
+ <unix:sgid datatype="boolean">true</unix:sgid>
+ <unix:sticky datatype="boolean">true</unix:sticky>
+ <unix:gwrite datatype="boolean">true</unix:gwrite>
+ <unix:owrite datatype="boolean">true</unix:owrite>
+ </unix:file_state>
+</def-group>
+
diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
new file mode 100644
index 0000000..66345a5
--- /dev/null
+++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
@@ -0,0 +1,50 @@
+<def-group>
+ <definition class="compliance"
id="libuser_login_defs_userdefaults" version="1">
+ <metadata>
+ <title>Check if Password Parameters are Removed from
libuser.conf</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description> Make sure the password password parameters are removed from
libuser.conf.</description>
+ </metadata>
+ <criteria operator="AND">
+
+ <criterion comment="shadowmin removed"
test_ref="test_libuser_login_defs_removed_shadowmin" />
+ <criterion comment="shadowmax removed"
test_ref="test_libuser_login_defs_removed_shadowmax" />
+ <criterion comment="shadowwarn removed"
test_ref="test_libuser_login_defs_removed_shadowwarn" />
+
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="shadowmin removed from
login.defs" id="test_libuser_login_defs_removed_shadowmin"
version="1">
+ <ind:object object_ref="object_libuser_login_defs_removed_shadowmin"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_libuser_login_defs_removed_shadowmin" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>login.defs</ind:filename>
+ <ind:pattern operation="pattern
match">^LU\_SHADOWMIN\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="shadowmax removed from
login.defs" id="test_libuser_login_defs_removed_shadowmax"
version="1">
+ <ind:object object_ref="object_libuser_login_defs_removed_shadowmax"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_libuser_login_defs_removed_shadowmax" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>login.defs</ind:filename>
+ <ind:pattern operation="pattern
match">^LU\_SHADOWMAX\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="shadowwarn removed from
login.defs" id="test_libuser_login_defs_removed_shadowwarn"
version="1">
+ <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_libuser_login_defs_removed_shadowwarn" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>login.defs</ind:filename>
+ <ind:pattern operation="pattern
match">^LU\_SHADOWWARNING\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..8ac2554 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -20,6 +20,18 @@
<select idref="selinux_unlabeled_device_files"
selected="true"/>
<select idref="restrict_root_console_logins" selected="true"/>
<select idref="restrict_serial_port_logins" selected="true"/>
+
+<select idref="verify_libuser_login_defs_import"
selected="true"/>
+<select idref="verify_libuser_login_defs_userdefaults"
selected="true"/>
+<select idref="verify_accounts_disabled_after_expiration"
selected="true"/>
+<!--<select idref="pam_ccreds_removed" selected="true"/>
-->
+<select idref="ensure_dot_files_not_world_writable"
selected="true" />
+<select idref="ensure_no_netrc_files" selected="true" />
+
+<!--<select idref="login_shell_inactivity_timeout"
selected="true"/> -->
+<select idref="login_shell_timeout_bash" selected="true"/>
+<select idref="login_shell_timeout_tcsh" selected="true"/>
+
<select idref="no_shelllogin_for_systemaccounts"
selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="no_hashes_outside_shadow" selected="true"/>
@@ -76,15 +88,26 @@
<select idref="install_openswan" selected="true"/>
<select idref="package_rsyslog_installed" selected="true"/>
<select idref="enable_rsyslog" selected="true"/>
+
+<select idref="ensure_rsyslog_messages_captured"
selected="true"/>
+
<select idref="userowner_rsyslog_files" selected="true"/>
<select idref="groupowner_rsyslog_files" selected="true"/>
<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
<!-- <select idref="rsyslog_accept_remote_messages"
selected="true"/> -->
<select idref="ensure_logrotate_activated" selected="true"/>
+
<select idref="enable_auditd_service" selected="true"/>
<select idref="enable_auditd_bootloader" selected="true"/>
+
+<select idref="configure_logwatch_on_logserver"
selected="true"/>
+<select idref="disable_logwatch_for_logserver"
selected="true"/>
+
<select idref="audit_time_rules" selected="true"/>
+<select idref="configure_auditd_data_retention"
selected="true"/>
+<!--<select idref="configure_auditd_data_retention"
selected="true"/> -->
+
<select idref="audit_account_changes" selected="true"/>
<select idref="audit_network_modifications" selected="true"/>
<select idref="audit_mac_changes" selected="true"/>
@@ -93,6 +116,10 @@
<select idref="audit_privileged_commands" selected="true"/>
<select idref="audit_media_exports" selected="true"/>
<select idref="audit_file_deletions" selected="true"/>
+
+<select idref="audit_manual_logon_edits" selected="true"/>
+<select idref="audit_manual_session_edits" selected="true"/>
+
<select idref="audit_sysadmin_actions" selected="true"/>
<select idref="audit_kernel_module_loading" selected="true"/>
<select idref="audit_config_immutable" selected="true"/>
@@ -144,7 +171,7 @@
<!-- <select idref="postfix_package_installation"
selected="true"/> -->
<select idref="postfix_network_listening" selected="true"/>
<select idref="ldap_client_tls_checkpeer" selected="true"/>
-<select idref="package_openldap-servers_removed"
selected="true"/>
+<select idref="package_openldap-servers_removed"
selected="true"/>
<select idref="service_nfslock_disabled" selected="true"/>
<select idref="service_rpcgssd_disabled" selected="true"/>
<select idref="service_rpcidmapd_disabled" selected="true"/>
@@ -165,6 +192,19 @@
<select idref="disable_smb_server" selected="true"/>
<select idref="require_smb_client_signing" selected="true"/>
<select idref="require_smb_client_signing_mount.cifs"
selected="true"/>
+
+<!--<select idref="select_squid_listening_port"
selected="true"/>
+<select idref="verify_default_secure_settings"
selected="true"/>
+<select idref="change_default_insecure_settings"
selected="true"/>
+<select idref="configure_authentication" selected="true"/>
+<select idref="access_control_lists" selected="true"/>
+<select idref="configure_icp" selected="true"/>
+<select idref="allow_proxy_server_access" selected="true"/>
+<seelect idref="forward_logs_to_syslogd" selected="true"/>
+<select idref="run_squid_in_chroot_jail" selected="true"/>
+<select idref="lower_privileges" selected="true"/>
+-->
+
<select idref="disable_squid" selected="true"/>
<select idref="uninstall_squid" selected="true"/>
<select idref="disable_snmpd" selected="true"/>
diff --git a/rhel6/src/input/system/accounts/accounts.xml
b/rhel6/src/input/system/accounts/accounts.xml
index fbdeb39..e5b61a6 100644
--- a/rhel6/src/input/system/accounts/accounts.xml
+++ b/rhel6/src/input/system/accounts/accounts.xml
@@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
RHEL6.</description>
+
+<Group id="all_human_users_group">
+<title> Create and Maintain a Group Containing All Human Users</title>
+<description>
+Identify all user accounts on the system which correspond to human users. Depending on
your system
+configuration, this may be all entries in <tt>/etc/passwd</tt> with UID
values of at least 500. Once, you have
+identified such a set of users, create a group named usergroup (substitute some name
appropriate to your
+environment) and populate it with each human user:
+<pre># groupadd <i>usergroup</i>
+# usermod -G <i>usergroup human1</i>
+# usermod -G <i>usergroup human2</i>
+...
+# usermod -G <i>usergroup humanN</i></pre>
+Then modify your procedure for creating new user accounts by adding
<tt>-G</tt> <i>usergroup</i> to the set of flags with
+which <tt>useradd</tt> is invoked, so that new human users will be placed in
the correct group by default.
+
+Creating a group of human users does not, by itself, enhance system security. However, as
you work on securing
+your system, you will often find commands which never need to be run by system accounts,
or which are only
+ever needed by users logged into the graphical console (which should only ever be
available to human users, even
+on workstations). Once a group of users has been created, it is easy to restrict access
to a given command, for
+instance <i>/path/to/graphical/command</i>, to authorized users:
+<pre># chgrp <i>usergroup /path/to/graphical/command</i>
+# chmod 750 <i>/path/graphical/command</i></pre>
+Without a group of human users, it is necessary to restrict access by somehow preventing
each system account
+from running the command, which is an error-prone process even when it is possible at
all.</description>
+<!-- <oval id="accounts_all_human_users_group_maintained" /> -->
+</Group>
</Group>
diff --git a/rhel6/src/input/system/accounts/pam.xml
b/rhel6/src/input/system/accounts/pam.xml
index bc91277..34af4f9 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -309,6 +309,31 @@ prevents direct password guessing attacks.
</Group>
+<!-- Removed: Too complicated to enforce
+<Rule id="restrict_userhelper_execution">
+<title> Restrict Execution of <tt>userhelper</tt> to Console
Users</title>
+<description>
+If your environment has defined a group, <i>usergroup</i> containing all the
human users of your system, restrict
+execution of the <tt>userhelper</tt> program to only that group:
+<pre># chgrp usergroup /usr/sbin/userhelper
+# chmod 4710 /usr/sbin/userhelper</pre>
+The <tt>userhelper</tt> program provides authentication for graphical
services which must run with <tt>root</tt> privileges,
+such as the <tt>system-config<tt>- family of graphical configuration
utilities. Only human users logged into the system
+console are likely to ever have a legitimate need to run these utilities. This step
provides some protection against
+possible flaws in <tt>userhelper</tt>'s implementation, and against
further privilege escalation when system accounts
+are compromised. See Section 2.3.2.2 for more information on creating a group of human
users.
+The <tt>userhelper</tt> program is configured by the files in
<tt>/etc/security/console.apps/</tt>. Each file specifies, for
+some program, what user the program should run as, and what program should be executed
after successful
+authentication.
+Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in
combination with the PAM configura-
+tion of the service defined in <tt>/etc/pam.d/</tt>. First,
<tt>userhelper</tt> determines what user the service should run as.
+(Typically, this will be <tt>root</tt>.) Next,
<tt>userhelper</tt> uses the PAM API to allow the user who ran the program to
+attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if
the application's
+configuration requests one.</description>
+<ident cce="4185-5, 3952-9" />
+<oval id="accounts_pam_userhelper_execution_restricted" />
+</Rule>
+-->
<Rule id="set_password_hashing_algorithm">
<title>Set Password Hashing Algorithm</title>
@@ -374,7 +399,18 @@ compromised could be used yet again by an attacker.
<oval id="accounts_password_reuse_limit"
value="password_history_retain_number"/>
<ref nist="IA-5" />
</Rule>
-</Group>
+</Group> <!-- End <Group id="limiting_password_reuse"> -->
+<!--<Rule id="pam_ccreds_removed">
+<title> Remove the <tt>pam_ccreds</tt> Package if
Possible</title>
+<description>
+Unless its credential caching functionality is required, remove the
<tt>pam_ccreds</tt> package:
+<pre># yum erase pam_ccreds</pre>
+The <tt>pam_ccreds</tt> package contains the setuid program
<tt>/usr/sbin/ccreds_validate</tt> and should be removed
+unless it provides essential functionality. Any credentials cached on a system would also
be compromised if an
+attacker obtains control of the system.</description>
+<oval id="package_pam_ccreds_removed" />
+</Rule>
+ No longer exists in RHEL6 -->
</Group>
diff --git a/rhel6/src/input/system/accounts/physical.xml
b/rhel6/src/input/system/accounts/physical.xml
index 45ad144..b4a3e76 100644
--- a/rhel6/src/input/system/accounts/physical.xml
+++ b/rhel6/src/input/system/accounts/physical.xml
@@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an
attacker to quickly or undetectably modify a system from its
console.</description>
+<Group id="bios_password">
+<title>Set BIOS Password</title>
+<description>BIOS (on x86 systems) is the first code to execute during system
startup and controls many important
+system parameters, including which devices the system will try to boot from, and in which
order.
+Assign a password to prevent any unauthorized changes to the BIOS configuration. The
exact steps will
+vary depending on your machine, but are likely to include:
+1.Reboot the machine.
+2.Press the appropriate key during the initial boot screen (F2 is typical).
+3.Navigate the BIOS configuration menu to add a password.
+The exact process will be system-specific and the system's hardware manual may
provide detailed instructions.
+This password should prevent attackers with physical access from attempting to change
important parameters.
+However, an attacker with physical access can usually clear the BIOS password. The
password should be
+written down and stored in a physically-secure location, such as a safe, in the event
that it is forgotten
+ and must be retrieved.
+</description>
+</Group>
+
<Group id="bootloader">
<title>Set Boot Loader Password</title>
<description>During the boot process, the boot loader is
@@ -133,6 +150,52 @@ services, weakening system security.
<ref nist="CM-7, IA-4, SC-2"/>
</Rule>
+<Group id="login_shell_inactivity_timeout">
+<description>
+If the system does not run X Windows, then the login shells can be configured to
automatically log users out after
+a period of inactivity. The following instructions are not practical for systems which
run X Windows, as they
+will close terminal windows in the X environment.
+
+The example time-out here of 15 minutes should be adjusted to whatever your security
policy requires. The
+readonly line for bash and the -r option for tcsh can be omitted if policy allows users
to override the value.
+The automatic shell logout only occurs when the shell is the foreground process. If, for
example, a vi session is
+left idle, then automatic logout would not occur.
+When logging in through a remote connection, as with SSH, it may be more effective to set
the timeout value
+directly through that service. Section referenced elsewhere.</description>
+
+<Rule id="login_shell_timeout_bash">
+<title> Implement Inactivity Time-out for Login Shells</title>
+<description>
+If the system does not run X Windows, then the login shells can be configured to
automatically log users out after
+a period of inactivity. The following instructions are not practical for systems which
run X Windows, as they
+will close terminal windows in the X environment.
+To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt>
shell, create a new file
+<tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with
the following lines:
+
+<pre>TMOUT=900
+readonly TMOUT
+export TMOUT</pre>
+
+
+Similar actions should be taken for any other login shells used.
+</description>
+<ident cce="3707-7" />
+<oval id="accounts_login_shell_timeout_implemented_bash" />
+</Rule>
+
+<Rule id="login_shell_timeout_tcsh">
+<title>Inactivity Time-out for <tt>tcsh</tt> Shell</title>
+<description>
+To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a
new file <tt>autologout.csh</tt>
+ in the directory <tt>/etc/profile.d</tt> with the following line:
+
+
+<pre>set -r autologout 15</pre>
+</description>
+<ident cce="3689-7" />
+<oval id="accounts_login_shell_timeout_implemented_tcsh" />
+</Rule>
+</Group>
<Group id="screen_locking">
<title>Configure Screen Locking</title>
diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml
b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
index febead6..7006bf7 100644
--- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml
+++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
@@ -10,4 +10,118 @@ console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</description>
+<!--
+<Rule id="limit_su_access_to_root">
+<title> Limit <tt>su</tt> Access to the Root Account</title>
+<description>"1.Ensure that the group <tt>wheel</tt> exists, and
that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre>
+2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line:
+<pre>auth required pam_wheel.so use_uid</pre>
+The <tt>su</tt> command allows a user to gain the privileges of another user
by entering the password for that user's
+account. It is desirable to restrict the root user so that only known administrators are
ever allowed to access the
+root account. This restricts password-guessing against the root account by unauthorized
users or by accounts
+which have been compromised. <br />
+By convention, the group <tt>wheel</tt> contains all users who are allowed to
run privileged commands. The PAM
+module <tt>pam_wheel.so</tt> is used to restrict root access to this set of
users.</description>
+<ident cce="14088-9, 15047-4" />
+<oval id="accounts_su_access_limited" />
+<ref nist="AC-2, AC-3, CM-6" />
+</Rule>
+-->
+
+<Group id="configure_sudo">
+<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root
Access</title>
+<description>
+The <tt>sudo</tt> command allows fine-grained control over which users can
execute commands using other accounts.
+The primary benefit of <tt>sudo</tt> when configured as above is that it
provides an audit trail of every command run
+by a privileged user. It is possible for a malicious administrator to circumvent this
restriction, but, if there is an
+established procedure that all root commands are run using <tt>sudo</tt>,
then it is easy for an auditor to detect unusual
+behavior when this procedure is not followed. <br />
+</description>
+
+<warning>
+Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration
error may make it impossible to access
+the root account remotely. The recommended means of editing this file is using the
<tt>visudo</tt> command, which
+checks the file's syntax for correctness before allowing it to be saved. <br
/>
+
+Note that <tt>sudo</tt> allows any attacker who gains access to the password
of an administrator account to run commands
+as root. This is a downside which must be weighed against the benefits of increased audit
capability and of being
+able to heavily restrict the use of the high-value root password (which can be
logistically difficult to change
+often). As a basic precaution, <i>never</i> use the
<tt>NOPASSWD</tt> directive, which would allow anyone with access to an
administrator account to execute commands as root without knowing the administrator's
password. <br />
+</warning>
+
+<Group id="admin_user_group">
+<title>Create and Use One Group for All Admin</title>
+<description>Ensure that a group <i>ADMINS</i> exists, and that the
usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^<i>ADMINS</i> /etc/group</pre>
+
+Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line:
+<pre>%ADMINS ALL=(ALL) ALL</pre>
+<pre>%<i>ADMINS</i> ALL=(ALL) ALL</pre>
+
+</description>
+</Group>
+
+<!--<Rule id="verify_wheel_exists">
+<description>
+Ensure that the group <tt>wheel</tt> exists, and that the usernames of all
administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre></description>
+<oval id="accounts_wheel_exists" />
+</Rule>
+
+<Rule id="verify_sudo_audit_trail">
+<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or
correct the line:
+<pre>%wheel ALL=(ALL) ALL</pre>
+</description>
+<oval id="accounts_root_auditing_improved" />
+</Rule>
+</Group>
+-->
+
+<Group id="remove_password_parameters">
+<title> Remove Password Parameters from
<tt>libuser.conf</tt></title>
+<description>The <tt>/etc/libuser.conf</tt> file contains configuration
options for the libuser library, which is intended to implement
+a standardized interface for manipulating and administering user and group accounts. By
default, it sources
+password settings from <tt>/etc/login.defs</tt>, but it can override these
parameters. The man page <tt>libuser.conf(5)</tt> contains more
information.</description>
+
+<Rule id="verify_libuser_login_defs_import">
+<title>Verify Line Under Import Section</title>
+<description>
+Ensure the following line exists within the file <tt>/etc/libuser.conf</tt>
under the <tt>[import]</tt> section.
+<pre>login_defs = /etc/login.defs</pre></description>
+<oval id="libuser_login_defs_import" />
+</Rule>
+
+<Rule id="verify_libuser_login_defs_userdefaults">
+<title>Verify Lines do not Appear in Userdefaults Section</title>
+<description>
+Ensure that no lines beginning with the following appear in the
<tt>[userdefaults]</tt> section of the file, as
+these override settings from <tt>/etc/login.defs</tt>:
+<pre>LU_SHADOWMAX
+LU_SHADOWMIN
+LU_SHADOWWARNING</pre></description>
+<oval id="libuser_login_defs_userdefaults" />
+</Rule>
+</Group>
+
+
+<Rule id="verify_accounts_disabled_after_expiration">
+<title> Set Accounts to Disable After Password Expiration</title>
+<description>
+In order to automatically disable local accounts some number of <i>DAYS</i>
after password expiration, add or
+modify the following line in <tt>/etc/default/useradd</tt>:
+<pre>INACTIVE=<i>DAYS</i></pre>
+For example, if <pre>INACTIVE=30</pre> and if the password is currently on
the verge of expiration, then 30 days remain
+until the account is automatically disabled. If the password will not expire for another
60 days, then 90 days
+remain until the account is automatically disabled. See <tt>useradd(8)</tt>
for more information.
+Determining the inactivity timeout must be done with careful consideration of the length
of a "normal" period
+of inactivity for users in your environment. Setting the timeout too low incurs support
costs and also has the
+potential to impact availability of the system to legitimate users.</description>
+<oval id="accounts_disabled_after_expiration" />
+</Rule>
+
+</Group>
</Group>
diff --git a/rhel6/src/input/system/accounts/session.xml
b/rhel6/src/input/system/accounts/session.xml
index 00b5a8d..f7e6530 100644
--- a/rhel6/src/input/system/accounts/session.xml
+++ b/rhel6/src/input/system/accounts/session.xml
@@ -114,6 +114,19 @@ groups or ACLs.
<ref nist="AC-3, CM-6"/>
</Rule>
+<Rule id="ensure_dot_files_not_world_writable">
+<title> Ensure that User Dot-Files are not World-writable</title>
+<description>
+For each human user <i>USER</i> of the system, view the permissions of all
dot-files in the user's home directory:
+<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre>
+Ensure that none of these files are group- or world-writable. Correct each misconfigured
file <i>FILE</i> by exe-
+cuting:
+<pre># chmod go-w /home/USER /FILE</pre>
+A user who can modify another user's configuration files can likely execute commands
with the other user's
+privileges, including stealing data, destroying files, or launching further attacks on
the system.</description>
+<oval id="accounts_user_dot_files_not_world_writable" />
+</Rule>
+
<Group id="user_umask">
<title>Ensure that Users Have Sensible Umask Values</title>
<description>
@@ -168,6 +181,17 @@ operator="equals" interactive="0">
<value selector="077">077</value>
</Value>
+<Group id="ensure_no_netrc_files">
+<title> Ensure that Users do not Have <tt>.netrc</tt>
Files</title>
+<description>
+For each human user <i>USER</i> of the system, ensure that the user has no
<tt>.netrc</tt> file. The command:
+<pre># ls -l /home/<i>USER</i> /.netrc</pre>
+should return the error "No such file or directory". If any user has such a
file, approach that user to discuss
+removing this file.
+The <tt>.netrc</tt> file is a configuration file used to make unattended
logins to other systems via FTP. When this file
+exists, it frequently contains unencrypted passwords which may be used to attack other
systems.</description>
+</Group>
+
<Rule id="user_umask_bashrc">
<title>
Ensure the Default Bash Umask is Set Correctly
--
1.7.6.5