1) New Rule for log file permissions 2) New Rule for log file location 3) Removed audit log permissions Rules 4) Added alt titles for the new Rules 5) Added new Rules to common.xml
David Smith (1): Log file Rule changes
RHEL6/input/auxiliary/alt-titles-stig.xml | 6 +++ RHEL6/input/profiles/common.xml | 8 ++-- RHEL6/input/system/auditing.xml | 4 +- RHEL6/input/system/logging.xml | 62 +++++++++++++++------------- RHEL6/input/system/permissions/files.xml | 22 ++++++++++ 5 files changed, 67 insertions(+), 35 deletions(-)
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/auxiliary/alt-titles-stig.xml | 6 +++ RHEL6/input/profiles/common.xml | 8 ++-- RHEL6/input/system/auditing.xml | 4 +- RHEL6/input/system/logging.xml | 62 +++++++++++++++------------- RHEL6/input/system/permissions/files.xml | 22 ++++++++++ 5 files changed, 67 insertions(+), 35 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 3b9724d..dec21ab 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -50,6 +50,12 @@ The system must have USB Mass Storage disabled unless needed. <title rule="service_autofs_disabled" shorttitle="Disable the Automounter"> Automated file system mounting tools must not be enabled unless needed. </title> +<title rule="log_files_location" shorttitle="Verify Location of Log Files"> +Log files must be located in /var/log. +</title> +<title rule="perms_log_files" shorttitle="Verify Permissions on Log Files"> +Log files must have mode 0600. +</title> <title rule="userowner_shadow_file" shorttitle="Verify User Who Owns shadow File"> The /etc/shadow file must be owned by root. </title> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index d80e69a..5be7ddf 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -24,6 +24,10 @@ <select idref="no_hashes_outside_shadow" selected="true"/> <select idref="no_uidzero_except_root" selected="true"/>
+ +<select idref="log_files_location" selected="true"/> +<select idref="perms_log_files" selected="true"/> + <select idref="userowner_shadow_file" selected="true"/> <select idref="groupowner_shadow_file" selected="true"/> <select idref="perms_shadow_file" selected="true"/> @@ -45,7 +49,6 @@ <select idref="file_permissions_binary_dirs" selected="true"/> <select idref="file_ownership_binary_dirs" selected="true"/>
-<select idref="audit_logs_permissions" selected="true"/>
<select idref="password_min_len" selected="true"/> <select idref="password_min_age" selected="true"/> @@ -101,9 +104,6 @@ <select idref="package_rsyslog_installed" selected="true"/> <select idref="service_rsyslog_enabled" selected="true"/>
-<select idref="userowner_rsyslog_files" selected="true"/> -<select idref="groupowner_rsyslog_files" selected="true"/> -<select idref="rsyslog_file_permissions" selected="true"/> <select idref="rsyslog_send_messages_to_logserver" selected="true"/> <select idref="ensure_logrotate_activated" selected="true"/> <select idref="enable_auditd_service" selected="true"/> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index b4e54b8..f8008b0 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -681,7 +681,7 @@ audited.</rationale> <ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" /> </Rule>
-<Rule id="audit_logs_permissions"> +<!-- <Rule id="audit_logs_permissions"> <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title> <description> Change the mode of the audit log files with the following command: @@ -715,7 +715,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio <oval id="file_ownership_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> -</Rule> +</Rule> -->
<Rule id="audit_mac_changes"> <title>Record Events that Modify the System's Mandatory Access Controls</title> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml index 9ff9334..ffa9cbb 100644 --- a/RHEL6/input/system/logging.xml +++ b/RHEL6/input/system/logging.xml @@ -115,7 +115,7 @@ will not create it and important log messages can be lost. <ref nist="" /> </Rule>
-<Rule id="userowner_rsyslog_files" severity="medium"> +<!-- <Rule id="userowner_rsyslog_files" severity="medium"> <title>Ensure Log Files Are Owned By Appropriate User</title> <description>The owner of all log files written by <tt>rsyslog</tt> should be root. @@ -165,38 +165,28 @@ protected from unauthorized access.</rationale> <oval id="rsyslog_files_groupownership" /> <ref nist="AC-6" disa="1314"/> <tested by="DS" on="20121024"/> -</Rule> - +</Rule> -->
-<Rule id="rsyslog_file_permissions" severity="medium"> -<title>Ensure System Log Files Have Correct Permissions</title> -<description>The file permissions for all log files written by -rsyslog should be set to 600, or more restrictive. -These log files are determined by the second part of each Rule line in -<tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>. -For each log file <i>LOGFILE</i> referenced in <tt>/etc/rsyslog.conf</tt>, -run the following command to inspect the file's permissions: -<pre>$ ls -l <i>LOGFILE</i></pre> -If the permissions are not 600 or more restrictive, -run the following command to correct this: -<pre># chmod 0600 <i>LOGFILE</i></pre> +<Rule id="log_files_location"> +<title>Verify Location of Log Files</title> +<description> +To configure the storage location of log files, add or correct the storage location +for each log type listed in the second column under <tt>RULES</tt> in <tt>/etc/rsyslog.conf</tt>. </description> -<ocil clause="the permissions are not correct"> -To see the permissions of a given log file, run the following command: -<pre>$ ls -l <i>LOGFILE</i></pre> -The permissions should be 600, or more restrictive. +<ocil clause="all logs are not stored in /var/log/"> +To ensure all system log files are stored in /var/log/, examine the rules in the file +<tt>/etc/rsyslog.conf</tt>. All log locations are listed in the second column, under the +<tt>RULES</tt> section, and should begin with <tt>/var/log/</tt>. </ocil> -<rationale>Log files can contain valuable information regarding system -configuration. If the system log files are not protected unauthorized -users could change the logged data, eliminating their forensic value. +<rationale>The log files generated by rsyslog contain valuable information regarding system +configuration, user authentication, and other such information. Log files should be +protected from unauthorized access. </rationale> -<ident cce="27190-8" /> -<oval id="rsyslog_files_permissions" /> -<ref nist="" disa="1314"/> -<tested by="DS" on="20121024"/> +<ident cce="26821-9" /> +<ref nist="AU-9" disa="1314"/> </Rule> -</Group>
+</Group> <Group id="rsyslog_sending_messages"> <title>Rsyslog Logs Sent To Remote Host</title> <description> @@ -231,8 +221,8 @@ Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting <tt><i>loghost.example.com</i></tt> appropriately. -The choice of protocol depends on the environment of the system; -although TCP and RELP provide more reliable message delivery, +The choice of protocol depends on the environment of the system; +although TCP and RELP provide more reliable message delivery, they may not be supported in all environments. <br/> To use UDP for log message delivery: @@ -264,6 +254,7 @@ place to view the status of multiple hosts within the enterprise. <oval id="rsyslog_remote_loghost" /> <ref nist="AU-3(2),AU-9" disa="1348, 136" /> </Rule> + </Group>
<Group id="rsyslog_accepting_remote_messages"> @@ -431,6 +422,19 @@ the logserver.</description> -->
</Group> <!-- <Group id="configure_logwatch_on_logserver"> -->
+ + +<!-- Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): +<pre># cd /etc/cron.daily +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch +</pre> +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to +the logserver.</description> --> + + <Rule id="disable_logwatch_for_logserver"> <title> Disable Logwatch on Clients if a Logserver Exists</title> <description> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index e1db8c6..84b20d1 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -17,6 +17,28 @@ need read access to the <tt>passwd</tt> file in order to function properly, but read access to the <tt>shadow</tt> file allows malicious attacks against system passwords, and should never be enabled.</description>
+<Rule id="perms_log_files" severity="medium"> +<title>Verify Permissions on Log Files</title> +<description>The file permissions for all log files written by +rsyslog and auditd should be set to 0600. +For any log files with permissions other than 0600, run the following command: +<pre># chmod 0600 <i>LOGFILE</i></pre> +</description> +<ocil clause="there are any files listed in the output"> +To ensure there are no log files with incorrect permissions in /var/log/, +run the following command: +<pre># find /var/log/ ! -perm 0600 -type f</pre> +</ocil> +<rationale>Log files can contain valuable information regarding system +configuration. If the system log files are not protected unauthorized +users could change the logged data, eliminating their forensic value. +</rationale> +<ident cce="27190-8" /> +<oval id="rsyslog_files_permissions" /> +<ref nist="" disa="1314"/> +<tested by="DS" on="20121024"/> +</Rule> + <Rule id="userowner_shadow_file" severity="medium"> <title>Verify User Who Owns <tt>shadow</tt> File</title> <description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>
scap-security-guide@lists.fedorahosted.org