The updates validated with OSCAP, but the verify-references.py script spat it up. It looks good to me, otherwise.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
On 12/9/13, 3:38 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
The updates validated with OSCAP, but the verify-references.py script spat it up. It looks good to me, otherwise.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
0001-New-Rule-for-RHEL-06-000029-Lock-non-root-system-acc.patch
From b1043abacb74c1f87fb634e759191a30506e06e7 Mon Sep 17 00:00:00 2001 From: steinkelleland.j.steinke.ctr@mail.mil Date: Mon, 9 Dec 2013 15:11:27 -0500 Subject: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
RHEL6/input/auxiliary/stig_overlay.xml | 2 +- .../checks/locked_password_for_systemaccounts.xml | 34 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 33 +++++++++++++++++++ 3 files changed, 68 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/locked_password_for_systemaccounts.xml
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 32eb751..05075e4 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -72,7 +72,7 @@ <VMSinfo VKey="38494" SVKey="50295" VRelease="1" /> <title>The system must prevent the root account from logging in from serial consoles.</title>
</overlay> - <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000029" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="systemaccounts_locked" ownerid="RHEL-06-000029" disa="366" severity="medium"> <VMSinfo VKey="38496" SVKey="50297" VRelease="1" /> <title>Default system accounts, other than root, must be locked.</title> </overlay> diff --git a/RHEL6/input/checks/locked_password_for_systemaccounts.xml b/RHEL6/input/checks/locked_password_for_systemaccounts.xml new file mode 100644 index 0000000..e1ce5bf --- /dev/null +++ b/RHEL6/input/checks/locked_password_for_systemaccounts.xml @@ -0,0 +1,34 @@ +<def-group> + <definition class="compliance" id="locked_password_for_systemaccounts" version="1"> + <metadata> + <title>Locked System Accounts</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The root account is the only system account that should not be locked.</description> + </metadata> + <criteria> + <criterion comment="tests for the presence of unlocked passwords for system accounts in /etc/shadow file" test_ref="test_locked_password_for_systemaccounts" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of unlocked passwords for system accounts in /etc/shadow file" id="test_locked_password_for_systemaccounts" version="1"> + <ind:object object_ref="object_unlocked_systemaccounts_not_root" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_systemaccounts_not_root" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^(?!root)([^:]+):x:(?:0*[0-9]{1,2}|[1-4][0-9]{2}):.*$</ind:pattern> + <ind:instance datatype="int" operation="greater than or equal">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_object id="object_unlocked_systemaccounts_not_root" version="1"> + <ind:filepath>/etc/shadow</ind:filepath> + <ind:pattern operation="pattern match" var_ref="var_shadow_regex_systemaccounts_not_root" var_check="at least one" /> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <local_variable comment="shadow regexes of non-root system accounts" id="var_shadow_regex_systemaccounts_not_root" version="1" datatype="string"> + <concat> + <literal_component>^</literal_component> + <object_component object_ref="object_systemaccounts_not_root" item_field="subexpression" /> + <literal_component>:[^!*]</literal_component> + </concat> + </local_variable> +</def-group> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index 119931b..3a765a2 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -167,6 +167,39 @@ become inaccessible. </Rule>
+<Rule id="systemaccounts_locked" severity="medium"> +<title>Ensure that System Accounts Are Locked</title> +<description> +Some accounts are not associated with a human +user of the system, and exist to perform some administrative +function. An attacker should not be able to log into these accounts. +<br /> +Disable login access to these accounts with the command: +<pre># passwd -l <i>SYSACCT</i></pre> +</description> +<ocil clause="any system account (other than root) has a valid password hash"> +To obtain a listing of all users and the content of their shadow +password field, run the command: +<pre>$ awk -F: '{print $1 ":" $2}' /etc/shadow</pre> +Identify the system accounts from this listing. These will +primarily be the accounts with UID numbers less than 500, other +than root. +</ocil> +<rationale> +Disabling authentication for default system accounts +makes it more difficult for attackers to make use of +them to compromise a system. +</rationale> +<warning category="functionality"> +Do not perform the steps in this +section on the root account. Doing so might cause the system to +become inaccessible. +</warning> +<oval id="locked_password_for_systemaccounts" /> +<ref disa="366" /> +</Rule>
<Rule id="accounts_no_uid_except_zero" severity="medium"> <title>Verify Only Root Has UID 0</title> <description>
-- 1.7.1
It's been years since I've played with OracleDB, however when I did, we regularly sudo'd into the oracle account. It was *required* for some maintenance activities. This new rule would disable such an account, and place SysAdmins in a position where they'd need a DAA waiver to perform general system maintenance activities. This would also break RHN Satellite and (IIRC) JBoss.
Could the title explicitly say "operating system" accounts, since this is the RHEL6 STIG? Let the application guys worry about their accounts as they conform to the AppServer and App STIGs.
Hi Shawn,
Could the title explicitly say "operating system" accounts, since this is the RHEL6 STIG? Let the application guys worry about their accounts as they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Regards, -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
On 12/9/13, 6:17 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Hi Shawn,
Could the title explicitly say "operating system" accounts, since this is the RHEL6 STIG? Let the application guys worry about their accounts as they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Had a chance to read this closer. What's the reason for inclusion? This would step beyond the baseline of even USGCB.
RHEL5 CCE-3987-5: CCE-3987-5 Login access to non-root system accounts should be enabled or disabled as appropriate disabled via /etc/passwd List all users, their UIDs, and their shells by running: # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd For each identified system account SYSACCT , lock the account: # usermod -L SYSACCT and disable its shell: # usermod -s /sbin/nologin SYSACCT
Maps to RHEL6 CCE-26966-2:
Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell.
The login shell for each local account is stored in the last field of each line in|/etc/passwd|. System accounts are those user accounts with a user ID less than 500. The user ID is stored in the third field. If any system account/SYSACCT/(other than root) has a login shell, disable it with the command: # usermod -s /sbin/nologin/SYSACCT/
----- Original Message -----
From: "Shawn Wells" shawn@redhat.com To: scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 3:21:15 AM Subject: Re: FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/9/13, 6:17 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Hi Shawn,
Could the title explicitly say "operating system" accounts, since this > is the RHEL6 STIG? Let the application guys worry about their accounts > as they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Had a chance to read this closer. What's the reason for inclusion? This would step beyond the baseline of even USGCB.
RHEL5 CCE-3987-5:
CCE-3987-5 Login access to non-root system accounts should be enabled or disabled as appropriate disabled via /etc/passwd List all users, their UIDs, and their shells by running: # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd For each identified system account SYSACCT , lock the account: # usermod -L SYSACCT and disable its shell: # usermod -s /sbin/nologin SYSACCT
Maps to RHEL6 CCE-26966-2:
Yes, RHEL-6's SSG rule: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/s...
"Ensure that System Accounts Do Not Run a Shell Upon Login"
maps to RHEL5's CCE-3987-5: http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm
(fix would be to use /sbin/nologin | /bin/false | /dev/null as user's login shell in /etc/passwd).
Compared to that C-RHEL-6-000029_chk description: http://www.stigviewer.com/check/RHEL-06-000029
mentions # passwd -l [SYSACCT]
as a fix how to disable the account.
So basically these two seems to be just two different ways how to achieve the same.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell.
The login shell for each local account is stored in the last field of each line in /etc/passwd . System accounts are those user accounts with a user ID less than 500. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command: # usermod -s /sbin/nologin SYSACCT
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/10/13, 4:51 AM, Jan Lieskovsky wrote:
----- Original Message -----
From: "Shawn Wells"shawn@redhat.com To:scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 3:21:15 AM Subject: Re: FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/9/13, 6:17 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Hi Shawn,
Could the title explicitly say "operating system" accounts, since this > is the RHEL6 STIG? Let the application guys worry about their accounts > as they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Had a chance to read this closer. What's the reason for inclusion? This would step beyond the baseline of even USGCB.
RHEL5 CCE-3987-5:
CCE-3987-5 Login access to non-root system accounts should be enabled or disabled as appropriate disabled via /etc/passwd List all users, their UIDs, and their shells by running: # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd For each identified system account SYSACCT , lock the account: # usermod -L SYSACCT and disable its shell: # usermod -s /sbin/nologin SYSACCT
Maps to RHEL6 CCE-26966-2:
Yes, RHEL-6's SSG rule: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/s...
"Ensure that System Accounts Do Not Run a Shell Upon Login"
maps to RHEL5's CCE-3987-5: http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm
(fix would be to use /sbin/nologin | /bin/false | /dev/null as user's login shell in /etc/passwd).
Compared to that C-RHEL-6-000029_chk description: http://www.stigviewer.com/check/RHEL-06-000029
mentions # passwd -l [SYSACCT]
as a fix how to disable the account.
So basically these two seems to be just two different ways how to achieve the same.
Welllllll that's interesting. How did C-RHEL-6-00029 get included in the RHEL6 STIG without Red Hat and NSA signoff? ::: glances at FSO :::
So I propose a swap: Delete the existing "Ensure that System Accounts Do Not Run a Shell Upon Login" rule and replace it with this new, DISA FSO proposed, C-RHEL-6-000029.
Leland? Jeff?
----- Original Message -----
From: "Shawn Wells" shawn@redhat.com To: scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 7:43:33 PM Subject: Re: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/10/13, 4:51 AM, Jan Lieskovsky wrote:
----- Original Message -----
From: "Shawn Wells"shawn@redhat.com To:scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 3:21:15 AM Subject: Re: FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/9/13, 6:17 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Hi Shawn,
Could the title explicitly say "operating system" accounts, since this > is the RHEL6 STIG? Let the application guys worry about their accounts > as they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Had a chance to read this closer. What's the reason for inclusion? This would step beyond the baseline of even USGCB.
RHEL5 CCE-3987-5:
CCE-3987-5 Login access to non-root system accounts should be enabled or disabled as appropriate disabled via /etc/passwd List all users, their UIDs, and their shells by running: # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd For each identified system account SYSACCT , lock the account: # usermod -L SYSACCT and disable its shell: # usermod -s /sbin/nologin SYSACCT
Maps to RHEL6 CCE-26966-2:
Yes, RHEL-6's SSG rule: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/s...
"Ensure that System Accounts Do Not Run a Shell Upon Login"
maps to RHEL5's CCE-3987-5: http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm
(fix would be to use /sbin/nologin | /bin/false | /dev/null as user's login shell in /etc/passwd).
Compared to that C-RHEL-6-000029_chk description: http://www.stigviewer.com/check/RHEL-06-000029
mentions # passwd -l [SYSACCT]
as a fix how to disable the account.
So basically these two seems to be just two different ways how to achieve the same.
Welllllll that's interesting. How did C-RHEL-6-00029 get included in the RHEL6 STIG without Red Hat and NSA signoff? ::: glances at FSO :::
So I propose a swap: Delete the existing "Ensure that System Accounts Do Not Run a Shell Upon Login" rule and replace it with this new, DISA FSO proposed, C-RHEL-6-000029.
+1 from me for the swap (since "Ensure that System Accounts Do Not Run a Shell Upon Login" is known to be problematic for example for PostgreSQL service and it would require rewrite anyway, better to replace it with same system semantics rule that works).
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
Leland? Jeff?
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/11/13, 8:31 AM, Jan Lieskovsky wrote:
----- Original Message -----
From: "Shawn Wells" shawn@redhat.com To: scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 7:43:33 PM Subject: Re: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/10/13, 4:51 AM, Jan Lieskovsky wrote:
----- Original Message -----
From: "Shawn Wells"shawn@redhat.com To:scap-security-guide@lists.fedorahosted.org Sent: Tuesday, December 10, 2013 3:21:15 AM Subject: Re: FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
On 12/9/13, 6:17 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Hi Shawn,
> Could the title explicitly say "operating system" accounts, since this >> is > the RHEL6 STIG? Let the application guys worry about their accounts > > as > they conform to the AppServer and App STIGs.
Done. The proposed patch is in the attached file.
Had a chance to read this closer. What's the reason for inclusion? This would step beyond the baseline of even USGCB.
RHEL5 CCE-3987-5:
CCE-3987-5 Login access to non-root system accounts should be enabled or disabled as appropriate disabled via /etc/passwd List all users, their UIDs, and their shells by running: # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd For each identified system account SYSACCT , lock the account: # usermod -L SYSACCT and disable its shell: # usermod -s /sbin/nologin SYSACCT
Maps to RHEL6 CCE-26966-2:
Yes, RHEL-6's SSG rule: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/s...
"Ensure that System Accounts Do Not Run a Shell Upon Login"
maps to RHEL5's CCE-3987-5: http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm
(fix would be to use /sbin/nologin | /bin/false | /dev/null as user's login shell in /etc/passwd).
Compared to that C-RHEL-6-000029_chk description: http://www.stigviewer.com/check/RHEL-06-000029
mentions # passwd -l [SYSACCT]
as a fix how to disable the account.
So basically these two seems to be just two different ways how to achieve the same.
Welllllll that's interesting. How did C-RHEL-6-00029 get included in the RHEL6 STIG without Red Hat and NSA signoff? ::: glances at FSO :::
So I propose a swap: Delete the existing "Ensure that System Accounts Do Not Run a Shell Upon Login" rule and replace it with this new, DISA FSO proposed, C-RHEL-6-000029.
+1 from me for the swap (since "Ensure that System Accounts Do Not Run a Shell Upon Login" is known to be problematic for example for PostgreSQL service and it would require rewrite anyway, better to replace it with same system semantics rule that works).
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
Leland? Jeff?
.....Bueller? ;)
But really, what do you think of this approach Leland (+Jeff?)?
Leland? Jeff?
.....Bueller? ;)
But really, what do you think of this approach Leland (+Jeff?)?
I submitted the patch, so I am for it. RHEL6's default operating system accounts are password-locked by default, so this just verifies what should already be in place.
Thanks, Leland
I'm jumping in here to restart this conversation. I can see that this patch was not applied, but I can also see that there was some discussion from Red Hat on whether a rule swap should take place. Leland, it seemed like you agreed with the proposed swap, but what wasn't clear was if your patch would have to be edited to match the proposed changes from Red Hat or if you were waiting for someone else to push something out.
As of right now, the Rule "Ensure that System Accounts Do Not Run a Shell Upon Login" still exists, as does the OVAL check no_shelllogin_for_systemaccounts.xml.
- Maura Dailey
On 12/16/2013 01:36 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Leland? Jeff?
.....Bueller? ;)
But really, what do you think of this approach Leland (+Jeff?)?
I submitted the patch, so I am for it. RHEL6's default operating system accounts are password-locked by default, so this just verifies what should already be in place.
Thanks, Leland
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org