1 - fixed a number of typos (found by FSO) 2 - began preparing content for CCE submission
David Smith (5): text fixes from DISA FSO tag escape fix turned a group into a rule removed a rule began adding CCE elements to build table of needed CCEs
RHEL6/input/services/http.xml | 3 --- RHEL6/input/services/printing.xml | 2 +- RHEL6/input/system/accounts/banners.xml | 20 +++++++++++--------- RHEL6/input/system/accounts/pam.xml | 9 ++++++--- RHEL6/input/system/accounts/physical.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 2 +- RHEL6/input/system/auditing.xml | 8 +++++++- RHEL6/input/system/network/iptables.xml | 4 ++-- RHEL6/input/system/network/ipv6.xml | 4 ++++ RHEL6/input/system/network/network.xml | 8 ++++---- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/input/system/software/integrity.xml | 2 ++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 13 files changed, 43 insertions(+), 29 deletions(-)
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/accounts/pam.xml | 9 ++++++--- RHEL6/input/system/accounts/physical.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 2 +- RHEL6/input/system/auditing.xml | 8 +++++++- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 6 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index b432083..12f2ade 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -238,6 +238,7 @@ Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is <rationale> Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. </rationale> +<ident cce="TODO" /> <ref disa="366"/> </Rule>
@@ -272,7 +273,7 @@ search space. usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each uppercase character. -Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords. +Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of an upper case character in passwords. </description> <ocil clause="ucredit is not found or not set to the required value"> To check how many uppercase characters are required in a password, run the following command: @@ -507,8 +508,8 @@ This is the default. <ocil clause="it does not"> Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and ensure that the <tt>pam_unix.so</tt> module includes the argument -<tt>sha512</tt>. -<tt>$ grep sha512 /etc/pam.d/system-auth</tt> +<tt>sha512</tt>: +<pre>$ grep sha512 /etc/pam.d/system-auth</pre> </ocil> <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. @@ -534,6 +535,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following line appears: Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> <!-- <oval id="accounts_password_hashing_algorithm" /> --> +<ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> </Rule> @@ -555,6 +557,7 @@ in the <tt>[default]</tt> section: Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> <!-- <oval id="accounts_password_hashing_algorithm" /> --> +<ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121026"/> </Rule> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 013bb0b..99c9fef 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The commands following the line below will be executed when the key sequence is A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term -loss of availability systems due to unintentional reboot. +loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Del sequence is reduced because the user will be prompted before any action is taken. diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index cc56c6d..cff8032 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -154,7 +154,7 @@ this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. </description> <ocil clause="any account other than root has a UID of 0"> -To list all password file entries for accounts with UID 0: +To list all password file entries for accounts with UID 0, run the following command: <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre> This should print only one line, for the user root. </ocil> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index c49c16b..6943c14 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -304,6 +304,7 @@ minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, <tt>keep_logs</tt> can be employed.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" /> <ref nist="AU-1(b),AU-4,AU-11" /> <tested by="DS" on="20121024"/> @@ -354,6 +355,7 @@ disk space is starting to run low: </ocil> <rationale>Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/> <ref nist="AU-1(b),AU-4" disa="140,143,1339" /> <tested by="DS" on="20121024"/> @@ -394,6 +396,7 @@ when disk space has run low: audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur. </rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" /> <ref nist="AU-1(b),AU-4" disa="140,1343" /> <tested by="DS" on="20121024"/> @@ -416,6 +419,7 @@ account when it needs to notify an administrator: </ocil> <rationale>Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" /> <ref nist="AU-1(b),AU-4" disa="139,144" /> </Rule> @@ -680,7 +684,7 @@ audited.</rationale> <Rule id="audit_logs_permissions"> <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title> <description> -Change the mode of the audit log files: +Change the mode of the audit log files with the following command: <pre># chmod 0640 <i>audit_file</i></pre> </description> <ocil clause="any are more permissive"> @@ -691,6 +695,7 @@ Audit logs must be mode 0640 or less permissive. <rationale> If users can write to audit logs, audit trails can be modified or destroyed. </rationale> +<ident cce="TODO" /> <oval id="file_permissions_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> @@ -706,6 +711,7 @@ If users can write to audit logs, audit trails can be modified or destroyed. </ocil> <rationale>Failure to give ownership of the audit log file(s) to root allows the designated owner, and unauthorized users, potential access to sensitive information.</rationale> +<ident cce="TODO" /> <oval id="file_ownership_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index d2b94ab..2d05ef2 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -86,7 +86,7 @@ on the system. Protection of this file is important for system security.</ration <Rule id="perms_group_file" severity="medium"> <title>Verify Permissions on <tt>group</tt> File</title> <description><fileperms-desc-macro file="/etc/group" perms="644"/></description> -<ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil> +<ocil><fileperms-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured on the system. Protection of this file is important for system security.</rationale> <ident cce="26954-8" /> @@ -135,7 +135,7 @@ is critical for system security.</rationale> <title>Verify User Who Owns <tt>passwd</tt> File</title> <description><fileowner-desc-macro file="/etc/passwd" owner="root"/></description> <ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil> -<rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on +<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on the system. Protection of this file is critical for system security.</rationale> <ident cce="26953-0" /> <oval id="file_owner_etc_passwd" /> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index 708e593..507238e 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -237,7 +237,7 @@ exclude-result-prefixes="xccdf xhtml dc"> <!-- convenience macros for XCCDF prose --> <xsl:template match="sysctl-desc-macro"> To set the runtime status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter, - run the following command. + run the following command: <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of select="@sysctl"/>=<xsl:value-of select="@value"/></xhtml:pre>
<!-- The following text could also be included conditionally, if the defaultness of the sysctl were indicated. --> @@ -249,7 +249,7 @@ exclude-result-prefixes="xccdf xhtml dc"> The status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried by running the following command: <xhtml:pre xml:space="preserve">$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre> - The output of the command should indicate a value of xhtml:code<xsl:value-of select="@value"/></xhtml:code>: + The output of the command should indicate a value of xhtml:code<xsl:value-of select="@value"/></xhtml:code>. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in xhtml:code/etc/sysctl.conf</xhtml:code>.
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/printing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml index 351e020..4629df5 100644 --- a/RHEL6/input/services/printing.xml +++ b/RHEL6/input/services/printing.xml @@ -59,7 +59,7 @@ capability, the machine will no longer generate or receive such broadcasts. </rationale> <ident cce="27108-0" /> <oval id="cups_disable_browsing" /> -<ref nist="CM-7" > +<ref nist="CM-7" /> </Rule>
<Rule id="cups_disable_printserver">
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/accounts/banners.xml | 20 +++++++++++--------- 1 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 5a06aed..0b22d71 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -134,7 +134,7 @@ directly to the file <tt>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml< and this file can later be edited directly if necessary. </description> <ocil clause="it does not"> -To ensure login warning banner text is properly set, run the following: +To ensure the login warning banner text is properly set, run the following: <pre>$ gconftool-2 -g /apps/gdm/simple-greeter/banner_message_text</pre> If properly configured, the proper banner text will appear within this schema. </ocil> @@ -149,7 +149,7 @@ process and facilitates possible legal action against attackers.
</Group>
-<Group id="user_list"> +<Rule id="disable_user_list"> <title>Disable the User List</title> <description>In the default graphical environment, users logging directly into the system are greeted with a login screen that displays @@ -159,16 +159,18 @@ Run the following command to disable the user list: <pre>sudo -u gdm gconftool-2 \ --type bool \ --set /apps/gdm/simple-greeter/disable_user_list true</pre> -Leaving the user list enabled is a security risk since it allows anyone -with physical access to the system to quickly enumerate known user accounts -without logging in. </description> -<Rule id="disable_user_list"> -<title>Disable the User List</title> -<description>GDM's list of previously logged in users should not be displayed.</description> +<ocil clause="it is not"> +To ensure the user list is disabled, run the following command: +<pre>$ gconftool-2 -g /apps/gdm/simple-greeter/disable_user_list</pre> +The output should be <tt>true</tt>. +</ocil> +<rationale>Leaving the user list enabled is a security risk since it allows anyone +with physical access to the system to quickly enumerate known user accounts +without logging in.</rationale> +<ident cce="TODO" /> <ref nist="AC-23" /> </Rule> -</Group>
</Group>
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/network/network.xml | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/network/network.xml b/RHEL6/input/system/network/network.xml index 8c1b171..d7e83e4 100644 --- a/RHEL6/input/system/network/network.xml +++ b/RHEL6/input/system/network/network.xml @@ -14,7 +14,7 @@ hosts, and networks. The rules can also specify which of the system's network services are available to particular hosts or networks.</description>
-<Rule id="network_disable_unused_interfaces"> +<!-- <Rule id="network_disable_unused_interfaces"> <title>Disable Unused Interfaces</title> <description>If the system does not require network communications but still needs to use the loopback interface, remove all files of the form @@ -28,10 +28,10 @@ communication over the loopback device, then disable this service. <rationale>The network interfaces expand the attack surface of a system. Although unusual, if they are not needed they should be disabled. </rationale> -<!--<ident cce="TODO" />--> -<!--TODO:MANUAL<oval id="network_disable_unused_interfaces" />--> +<ident cce="TODO" /> +-TODO:MANUAL<oval id="network_disable_unused_interfaces" /> <ref nist="CM-7" /> -</Rule> +</Rule> -->
<Rule id="network_disable_zeroconf"> <title>Disable Zeroconf Networking</title>
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/http.xml | 3 --- RHEL6/input/system/network/iptables.xml | 4 ++-- RHEL6/input/system/network/ipv6.xml | 4 ++++ RHEL6/input/system/software/integrity.xml | 2 ++ 4 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml index 6669ce2..0a2934d 100644 --- a/RHEL6/input/services/http.xml +++ b/RHEL6/input/services/http.xml @@ -119,7 +119,6 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>: Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. </rationale> -<ident cce="27123-9" /> <oval id="httpd_servertokens_prod" /> <ref nist="CM-7" /> </Rule> @@ -137,7 +136,6 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>: Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. </rationale> -<ident cce="26900-1" /> <oval id="httpd_serversignature_off" /> <ref nist="CM-7" /> </Rule> @@ -801,7 +799,6 @@ Set permissions on the web server configuration files to 640: Access to the web server's configuration files may allow an unauthorized user or attacker to access information about the web server or to alter the server's configuration files. </rationale> -<ident cce="27099-1" /> <oval id="file_permissions_httpd_server_conf_files" /> <ref nist="CM-7" /> </Rule> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index a19bfc9..5c71638 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -120,8 +120,8 @@ add or correct the following line in <pre>:INPUT DROP [0:0]</pre> </description> <ocil clause="the default policy for the INPUT chain is not set to DROP">Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine -the default policy for the INPUT chain. It should be set to DROP. -<tt> # grep ":INPUT" /etc/sysconfig/iptables</tt> +the default policy for the INPUT chain. It should be set to DROP: +<pre> # grep ":INPUT" /etc/sysconfig/iptables</pre> </ocil> <rationale>In <tt>iptables</tt> the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml index 6f2b9dd..4428f68 100644 --- a/RHEL6/input/system/network/ipv6.xml +++ b/RHEL6/input/system/network/ipv6.xml @@ -60,6 +60,7 @@ For each network interface <i>IFACE</i> , add or correct the following lines in prevention mechanism: <pre>IPV6INIT=no</pre> </description> +<ident cce="TODO" /> <ref nist="CM-7" /> <tested by="DS" on="20121024"/> </Rule> @@ -74,6 +75,7 @@ following two lines in <tt>/etc/netconfig</tt>: <pre>udp6 tpi_clts v inet6 udp - - tcp6 tpi_cots_ord v inet6 tcp - -</pre> </description> +<ident cce="TODO" /> <oval id="network_ipv6_disable_rpc" /> <ref nist="CM-7" /> </Rule> @@ -169,6 +171,7 @@ Manually assigning an IP address is preferable to accepting one from routers or from the network otherwise. The example address here is an IPv6 address reserved for documentation purposes, as defined by RFC3849. </description> +<ident cce="TODO" /> <oval id="network_ipv6_static_address" /> <ref nist="" /> </Rule> @@ -199,6 +202,7 @@ the following line (substituting your gateway IP as appropriate): Router addresses should be manually set and not accepted via any auto-configuration or router advertisement. </description> +<ident cce="TODO" /> <oval id="network_ipv6_default_gateway" /> <ref nist="" /> </Rule> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 85601e4..05f0940 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -57,6 +57,7 @@ Next, the following command to return binaries to a normal, non-prelinked state The prelinking feature can interfere with the operation of AIDE, because it changes binaries. </rationale> +<ident cce="TODO" /> <ref nist="CM-6(d),CM-6(3),SC-28, SI-7" /> </Rule>
@@ -96,6 +97,7 @@ To determine that periodic AIDE execution has been scheduled, run the following By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files. </rationale> +<ident cce="TODO" /> <ref nist="CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> <!--
On 1/15/13 5:05 PM, David Smith wrote:
-<Rule id="network_disable_unused_interfaces"> +<!-- <Rule id="network_disable_unused_interfaces">
<title>Disable Unused Interfaces</title> <description>If the system does not require network communications but still needs to use the loopback interface, remove all files of the form @@ -28,10 +28,10 @@ communication over the loopback device, then disable this service. <rationale>The network interfaces expand the attack surface of a system. Although unusual, if they are not needed they should be disabled. </rationale> -<!--<ident cce="TODO" />--> -<!--TODO:MANUAL<oval id="network_disable_unused_interfaces" />--> +<ident cce="TODO" /> +-TODO:MANUAL<oval id="network_disable_unused_interfaces" /> <ref nist="CM-7" /> -</Rule> +</Rule> -->
Nack
Deselect this from the STIG profile, via selected=false.... still should be in the broader prose guide
On 1/15/13 5:05 PM, David Smith wrote:
1 - fixed a number of typos (found by FSO) 2 - began preparing content for CCE submission
David Smith (5): text fixes from DISA FSO tag escape fix turned a group into a rule removed a rule began adding CCE elements to build table of needed CCEs
RHEL6/input/services/http.xml | 3 --- RHEL6/input/services/printing.xml | 2 +- RHEL6/input/system/accounts/banners.xml | 20 +++++++++++--------- RHEL6/input/system/accounts/pam.xml | 9 ++++++--- RHEL6/input/system/accounts/physical.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 2 +- RHEL6/input/system/auditing.xml | 8 +++++++- RHEL6/input/system/network/iptables.xml | 4 ++-- RHEL6/input/system/network/ipv6.xml | 4 ++++ RHEL6/input/system/network/network.xml | 8 ++++---- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/input/system/software/integrity.xml | 2 ++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 13 files changed, 43 insertions(+), 29 deletions(-)
Ack to the set, minus 4/5. I wasn't sure if that was indicating DISA didn't want that in the STIG, or you wanted to drop the rule entirely.
scap-security-guide@lists.fedorahosted.org