Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/auxiliary/alt-titles-stig.xml | 6 +++
RHEL6/input/profiles/common.xml | 8 ++--
RHEL6/input/system/auditing.xml | 4 +-
RHEL6/input/system/logging.xml | 62 +++++++++++++++-------------
RHEL6/input/system/permissions/files.xml | 22 ++++++++++
5 files changed, 67 insertions(+), 35 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml
b/RHEL6/input/auxiliary/alt-titles-stig.xml
index 3b9724d..dec21ab 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -50,6 +50,12 @@ The system must have USB Mass Storage disabled unless needed.
<title rule="service_autofs_disabled" shorttitle="Disable the
Automounter">
Automated file system mounting tools must not be enabled unless needed.
</title>
+<title rule="log_files_location" shorttitle="Verify Location of Log
Files">
+Log files must be located in /var/log.
+</title>
+<title rule="perms_log_files" shorttitle="Verify Permissions on Log
Files">
+Log files must have mode 0600.
+</title>
<title rule="userowner_shadow_file" shorttitle="Verify User Who Owns
shadow File">
The /etc/shadow file must be owned by root.
</title>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index d80e69a..5be7ddf 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -24,6 +24,10 @@
<select idref="no_hashes_outside_shadow" selected="true"/>
<select idref="no_uidzero_except_root" selected="true"/>
+
+<select idref="log_files_location" selected="true"/>
+<select idref="perms_log_files" selected="true"/>
+
<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
<select idref="perms_shadow_file" selected="true"/>
@@ -45,7 +49,6 @@
<select idref="file_permissions_binary_dirs" selected="true"/>
<select idref="file_ownership_binary_dirs" selected="true"/>
-<select idref="audit_logs_permissions" selected="true"/>
<select idref="password_min_len" selected="true"/>
<select idref="password_min_age" selected="true"/>
@@ -101,9 +104,6 @@
<select idref="package_rsyslog_installed" selected="true"/>
<select idref="service_rsyslog_enabled" selected="true"/>
-<select idref="userowner_rsyslog_files" selected="true"/>
-<select idref="groupowner_rsyslog_files" selected="true"/>
-<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
<select idref="ensure_logrotate_activated" selected="true"/>
<select idref="enable_auditd_service" selected="true"/>
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index b4e54b8..f8008b0 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -681,7 +681,7 @@ audited.</rationale>
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
</Rule>
-<Rule id="audit_logs_permissions">
+<!-- <Rule id="audit_logs_permissions">
<title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
<description>
Change the mode of the audit log files with the following command:
@@ -715,7 +715,7 @@ owner, and unauthorized users, potential access to sensitive
information.</ratio
<oval id="file_ownership_var_log_audit" />
<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
<tested by="DS" on="20121024"/>
-</Rule>
+</Rule> -->
<Rule id="audit_mac_changes">
<title>Record Events that Modify the System's Mandatory Access
Controls</title>
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index 9ff9334..ffa9cbb 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -115,7 +115,7 @@ will not create it and important log messages can be lost.
<ref nist="" />
</Rule>
-<Rule id="userowner_rsyslog_files" severity="medium">
+<!-- <Rule id="userowner_rsyslog_files" severity="medium">
<title>Ensure Log Files Are Owned By Appropriate User</title>
<description>The owner of all log files written by
<tt>rsyslog</tt> should be root.
@@ -165,38 +165,28 @@ protected from unauthorized access.</rationale>
<oval id="rsyslog_files_groupownership" />
<ref nist="AC-6" disa="1314"/>
<tested by="DS" on="20121024"/>
-</Rule>
-
+</Rule> -->
-<Rule id="rsyslog_file_permissions" severity="medium">
-<title>Ensure System Log Files Have Correct Permissions</title>
-<description>The file permissions for all log files written by
-rsyslog should be set to 600, or more restrictive.
-These log files are determined by the second part of each Rule line in
-<tt>/etc/rsyslog.conf</tt> and typically all appear in
<tt>/var/log</tt>.
-For each log file <i>LOGFILE</i> referenced in
<tt>/etc/rsyslog.conf</tt>,
-run the following command to inspect the file's permissions:
-<pre>$ ls -l <i>LOGFILE</i></pre>
-If the permissions are not 600 or more restrictive,
-run the following command to correct this:
-<pre># chmod 0600 <i>LOGFILE</i></pre>
+<Rule id="log_files_location">
+<title>Verify Location of Log Files</title>
+<description>
+To configure the storage location of log files, add or correct the storage location
+for each log type listed in the second column under <tt>RULES</tt> in
<tt>/etc/rsyslog.conf</tt>.
</description>
-<ocil clause="the permissions are not correct">
-To see the permissions of a given log file, run the following command:
-<pre>$ ls -l <i>LOGFILE</i></pre>
-The permissions should be 600, or more restrictive.
+<ocil clause="all logs are not stored in /var/log/">
+To ensure all system log files are stored in /var/log/, examine the rules in the file
+<tt>/etc/rsyslog.conf</tt>. All log locations are listed in the second
column, under the
+<tt>RULES</tt> section, and should begin with
<tt>/var/log/</tt>.
</ocil>
-<rationale>Log files can contain valuable information regarding system
-configuration. If the system log files are not protected unauthorized
-users could change the logged data, eliminating their forensic value.
+<rationale>The log files generated by rsyslog contain valuable information
regarding system
+configuration, user authentication, and other such information. Log files should be
+protected from unauthorized access.
</rationale>
-<ident cce="27190-8" />
-<oval id="rsyslog_files_permissions" />
-<ref nist="" disa="1314"/>
-<tested by="DS" on="20121024"/>
+<ident cce="26821-9" />
+<ref nist="AU-9" disa="1314"/>
</Rule>
-</Group>
+</Group>
<Group id="rsyslog_sending_messages">
<title>Rsyslog Logs Sent To Remote Host</title>
<description>
@@ -231,8 +221,8 @@ Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <tt><i>loghost.example.com</i></tt> appropriately.
-The choice of protocol depends on the environment of the system;
-although TCP and RELP provide more reliable message delivery,
+The choice of protocol depends on the environment of the system;
+although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
<br/>
To use UDP for log message delivery:
@@ -264,6 +254,7 @@ place to view the status of multiple hosts within the enterprise.
<oval id="rsyslog_remote_loghost" />
<ref nist="AU-3(2),AU-9" disa="1348, 136" />
</Rule>
+
</Group>
<Group id="rsyslog_accepting_remote_messages">
@@ -431,6 +422,19 @@ the logserver.</description> -->
</Group> <!-- <Group id="configure_logwatch_on_logserver">
-->
+
+
+<!-- Ensure that <tt>logwatch.pl</tt> is run nightly from
<tt>cron</tt>. (This is the default):
+<pre># cd /etc/cron.daily
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch
+</pre>
+free disk space. Since all log monitoring is being done on the central logserver, the
disk space listing will always be
+that of the logserver, regardless of which host is being monitored. This is confusing, so
disable that service. Note
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage
information. Many workarounds are possible,
+such as running <tt>df</tt> on each host daily via <tt>cron</tt>
and sending the output to <tt>syslog</tt> so that it will be reported to
+the logserver.</description> -->
+
+
<Rule id="disable_logwatch_for_logserver">
<title> Disable Logwatch on Clients if a Logserver Exists</title>
<description>
diff --git a/RHEL6/input/system/permissions/files.xml
b/RHEL6/input/system/permissions/files.xml
index e1db8c6..84b20d1 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -17,6 +17,28 @@ need read access to the <tt>passwd</tt> file in order to
function properly, but
read access to the <tt>shadow</tt> file allows malicious attacks against
system
passwords, and should never be enabled.</description>
+<Rule id="perms_log_files" severity="medium">
+<title>Verify Permissions on Log Files</title>
+<description>The file permissions for all log files written by
+rsyslog and auditd should be set to 0600.
+For any log files with permissions other than 0600, run the following command:
+<pre># chmod 0600 <i>LOGFILE</i></pre>
+</description>
+<ocil clause="there are any files listed in the output">
+To ensure there are no log files with incorrect permissions in /var/log/,
+run the following command:
+<pre># find /var/log/ ! -perm 0600 -type f</pre>
+</ocil>
+<rationale>Log files can contain valuable information regarding system
+configuration. If the system log files are not protected unauthorized
+users could change the logged data, eliminating their forensic value.
+</rationale>
+<ident cce="27190-8" />
+<oval id="rsyslog_files_permissions" />
+<ref nist="" disa="1314"/>
+<tested by="DS" on="20121024"/>
+</Rule>
+
<Rule id="userowner_shadow_file" severity="medium">
<title>Verify User Who Owns <tt>shadow</tt> File</title>
<description><fileowner-desc-macro file="/etc/shadow"
owner="root"/></description>
--
1.7.1