I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have
found some bugs/notes. Each of the following seems to be an issue with the OVAL
content/test.
* Ensure All Files Are Owned by a User
* This reports PASS for me, but is a false positive. Running 'find / -xdev
-nouser -print' reveals files that have a user owner that is not local to the system.
* Ensure All Files Are Owned by a Group
* This reports PASS for me, but is a false positive. Running 'find / -xdev
-nogroup -print' reveals files that have a group that is not local to the system.
* Set Daemon Umask
* The test states it is looking for a umask of 022 or 027. In my
/etc/init.d/functions, the umask is 022, but the test reports FAIL. This is a false
positive.
* Set GNOME Login Inactivity Timeout
* GNOME Desktop Screensaver Mandatory Use
* Enable Screen Lock Activation After Idle Period
* Implement Blank Screen Saver
* Enable GUI Warning Banner Text
* Each of these tests assume that the execution is on an X system. My system does
not have X installed or running, so the tests report FAIL. The test should first check if
it is applicable to the test system and if not report NOT APPLICABLE or something similar
versus FAIL.
* Modify the System Login Banner
* This test appears to check for exactly the DoD banner text. Since the verbage
states "a message compliant with the local site policy", suggest modifying the
test to check for the presence of content in /etc/issue, but perhaps not an exact match,
as not all deployments may be DoD systems.
* Ensure Host Logs Sent to Remote Host
* For TCP, this checks for the following in the rsyslog file:
*.* @(a)loghost.example.com
* Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in
general they are? In my configuration, I have *.info versus the *.* and the test reports
FAIL. I would like to understand the intent on this one so I can comply.
* Additionally, my filter portion excludes some logs marked via other ways (read in
from files) with the string "*.info;local0.none @@dest-ip" and I want to make
sure that even if my string needs to be modified to "*.*;local0.none
@@dest-ip" to comply that the test will pass. i.e. that the test is robust enough to
understand the negation in the rsyslog configuration and report the correct assessment
value.
* Configure auditd space_left Action on Low Disk Space
* Configure auditd admin_space_left Action on Low Disk Space
* For both of these, the contents of /etc/audit/auditd.conf contain the correct key
with a case-insensitive value (all caps value of one of the possible values) and the test
reports FAIL. THis is a false negative. Suggest making the test case-insensitive in the
value match portion.
* Disable Network Console (netconsole)
* Disable Network Router Discovery Daemon (rdisc)
* For both of these, the service is not active/installed, but the test reports
FAIL. This is a false negative.
* Disable SSH Support for .rhosts Files
* Disable Host-Based Authentication
* Disable SSH Root Login
* For all of these, the required value is present in its entirety, but is preceeded
by the comment character, making it inactive. The test reports PASS, which is a false
positive.
* Additionally, for the SSH Root Login test, the commented value is incorrect and
the test reports PASS.
In addition to these bugs, I found that the following items did not have any check content
ref specified in the XCCDF, thus reported NOTCHECKED. I realize some of the check cannot
be performed automatically, but each of these can be, but is not.
* Disable Ctrl-Alt-Del Reboot Activation
* Install the screen Package
* Set GUI Warning Banner Text
* Set Default IPTables Policy for Forwarded Packets
* Disable ntpdate Service (ntpdate)
* Ensure Insecure File Locking is Not Allowed
* Verify No netrc Files Exist
* Ensure All Accounts on the System Have Unique Names
* Set Password to Maximum of Three Consecutive Repeating Characters
* Set Password Hashing Algorithm in /etc/pam.d/system-auth
* Set Password Hashing Algorithm in /etc/login.defs
* Set Password Hashing Algorithm in /etc/libuser.conf
* Verify that Shared Library Files Have Restrictive Permissions
* Verify that Shared Library Files Have Root Ownership
* Verify that System Executables Have Restrictive Permissions
* Verify that System Executables Have Root Ownership
* Ensure No World-Writable Files Exist
* Each of the 5 above can be tested using one of:
* `find $dir -xdev -perm /o=w ! \( -type d -perm /o=t \) ! -type l -print`
* `find $dir -xdev ! -user root ! -type d ! -type l -print`
* Limit the Number of Concurrent Login Sessions Allowed Per User
* For this one, perhaps check that the key is present, as the value is up to the
system owner.
* Uninstall Sendmail Package
* Additionally, suggest naming this "Ensure sendmail not installed" or
something of that flavor more indicative of what the test is checking for, versus an
action.
* Enable Logging of All FTP Transactions
* Create Warning Banners for All FTP Users
* Configure SNMP Service to Use Only SNMPv3 or Newer
* Ensure Default Password Is Not Used
* For the previous 4, the test must first check applicability (much like the GNOME
tests), as my system does not have/support FTP or SNMP and should not have FAIL reported.
And the last item--each of the following reports UNKNOWN as the check-content-ref element
in the XCCDF references a non-existent id in the OVAL.
* Ensure Log Files Are Owned By Appropriate Group
* Ensure System Log Files Have Correct Permissions
* Ensure Logrotate Runs Periodically
--Logan Rodrian
Show replies by date
One more item--This test reports ERROR, but the cause of error is unknown
* Ensure No Device Files are Unlabeled by SELinux
For my own edification of the result of this test, I performed a search for ANY files that
had unlabeled_t type, which returned no results.
--Logan Rodrian