Classification: UNCLASSIFIED Caveats: NONE
I'm with Leam. We use BOTH on our system, but not together. HBSS and SELinux doesn't play well together.
Additionally, the HIPS portion of HBSS only partially works with Linux. We had to implement IPTables to fix the firewall portion of HIPS.
v/r,
Randy Beavers, GSLC, CISSP Information Assurance Engineer Joint Battle Command-Platform 6000-C Technology Drive Huntsville, AL 35805 256-842-5426 (work) 256-289-6054 (cell) 256-876-2576 (fax) randall.d.beavers.ctr@mail.mil randall.d.beavers.ctr@mail.smil.mil
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of leam hall Sent: Tuesday, September 24, 2013 2:43 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: RHEL5 vs RHEL6 language on HBSS
Since HBSS and SELinux don't play well together, I'm for reverting.
Leam
On Tue, Sep 24, 2013 at 3:21 PM, Shawn Wells shawn@redhat.com wrote:
I received the following note from a colleague today, outlining the wording changes between RHEL5 and RHEL6 regarding HBSS. I searched the mailing archives, and can't figure out *why* the language was changed. - Anyone remember why? - Objections to reverting to the RHEL5 language? EMail:
from the RHEL 6 STIG: ============================ Group ID (Vulid): V-38667 Group Title: SRG-OS-000196 Rule ID: SV-50468r1_rule Severity: CAT II Rule Version (STIG-ID): RHEL-06-000285 Rule Title: The system must have a host-based intrusion detection tool installed. Vulnerability Discussion: Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of system, which may not otherwise exist in an organization's systems management regime. Check Content: Inspect the system to determine if intrusion detection software has been installed. Verify the intrusion detection software is active. If no host-based intrusion detection tools are installed, this is a finding. Fix Text: The base Red Hat platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised. Install an additional intrusion detection tool to provide complementary or duplicative monitoring, reporting, and reaction capabilities to those of the base platform. For DoD systems, the McAfee Host-based Security System is provided to fulfill this role. ======================== to look more like this from the RHEL 5 STIG: ========================= Group ID (Vulid): V-782 Group Title: GEN006480 Rule ID: SV-37746r2_rule Severity: CAT II Rule Version (STIG-ID): GEN006480 Rule Title: The system must have a host-based intrusion detection tool installed. Vulnerability Discussion: Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion detection tool can provide methods to immediately lock out detected intrusion attempts. Responsibility: System Administrator IAControls: ECID-1 Check Content: Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. The preferred intrusion detection system is McAfee HBSS available through Cybercom. If another host-based intrusion detection application, such as SELinux, is used on the system, this is not a finding. ========================= People are getting confused and SElinux and HBSS are getting installed with SElinux being disabled to make things work.
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org mailto:scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
+1
Having both SELinux and HBSS installed will often bring a system to its knees, it would be ideal to only require one or the other.
I ranVincent C. Passaro CISSP, L|PT, E|CSA, C|EH, CEPT, CPT, LPIC-3, RHCSA, Novell CLA, MCP, Security+, A+ Fotis Networks LLC Cell: 760-846-1812 Toll Free: 888.75.FOTIS Fax: 617-454-1121 Vincent.Passaro@fotisnetworks.com www.fotisnetworks.com
________________________________________ From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Beavers, Randall D. CTR (US) [randall.d.beavers.ctr@mail.mil] Sent: Tuesday, September 24, 2013 12:56 PM To: scap-security-guide@lists.fedorahosted.org Subject: RE: RHEL5 vs RHEL6 language on HBSS (UNCLASSIFIED)
Classification: UNCLASSIFIED Caveats: NONE
I'm with Leam. We use BOTH on our system, but not together. HBSS and SELinux doesn't play well together.
Additionally, the HIPS portion of HBSS only partially works with Linux. We had to implement IPTables to fix the firewall portion of HIPS.
v/r,
Randy Beavers, GSLC, CISSP Information Assurance Engineer Joint Battle Command-Platform 6000-C Technology Drive Huntsville, AL 35805 256-842-5426 (work) 256-289-6054 (cell) 256-876-2576 (fax) randall.d.beavers.ctr@mail.mil randall.d.beavers.ctr@mail.smil.mil
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of leam hall Sent: Tuesday, September 24, 2013 2:43 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: RHEL5 vs RHEL6 language on HBSS
Since HBSS and SELinux don't play well together, I'm for reverting.
Leam
On Tue, Sep 24, 2013 at 3:21 PM, Shawn Wells shawn@redhat.com wrote:
I received the following note from a colleague today, outlining the wording changes between RHEL5 and RHEL6 regarding HBSS. I searched the mailing archives, and can't figure out *why* the language was changed.
- Anyone remember why? - Objections to reverting to the RHEL5 language?
EMail:
from the RHEL 6 STIG:
============================ Group ID (Vulid): V-38667 Group Title: SRG-OS-000196 Rule ID: SV-50468r1_rule Severity: CAT II Rule Version (STIG-ID): RHEL-06-000285 Rule Title: The system must have a host-based intrusion detection tool installed.
Vulnerability Discussion: Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of system, which may not otherwise exist in an organization's systems management regime.
Check Content: Inspect the system to determine if intrusion detection software has been installed. Verify the intrusion detection software is active. If no host-based intrusion detection tools are installed, this is a finding.
Fix Text: The base Red Hat platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised.
Install an additional intrusion detection tool to provide complementary or duplicative monitoring, reporting, and reaction capabilities to those of the base platform. For DoD systems, the McAfee Host-based Security System is provided to fulfill this role. ========================
to look more like this from the RHEL 5 STIG:
========================= Group ID (Vulid): V-782 Group Title: GEN006480 Rule ID: SV-37746r2_rule Severity: CAT II Rule Version (STIG-ID): GEN006480 Rule Title: The system must have a host-based intrusion detection tool installed.
Vulnerability Discussion: Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion detection tool can provide methods to immediately lock out detected intrusion attempts.
Responsibility: System Administrator IAControls: ECID-1
Check Content: Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. The preferred intrusion detection system is McAfee HBSS available through Cybercom. If another host-based intrusion detection application, such as SELinux, is used on the system, this is not a finding. =========================
People are getting confused and SElinux and HBSS are getting installed with SElinux being disabled to make things work.
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org mailto:scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Mind on a Mission http://leamhall.blogspot.com/
Classification: UNCLASSIFIED Caveats: NONE
scap-security-guide@lists.fedorahosted.org