On 7/23/12 2:43 PM, Jeffrey Blank wrote:
Below is a list of items initially tagged in the OS SRG mapping, but
which may have additional considerations.
This email thread is to allow for further discussion on how these
requirements could be met and to drive adjustments to the OS SRG mapping.
CCI-000040: In addition to auditing use of all identified setuid
programs, would it be possible also to audit all processes with system
UIDs started by interactive UIDs? Something along the lines of
-a always,exit -F auid>=500 -F auid!=4294967295 -F uid<500
CCI-000040: It is also a good idea to audit use of the sudo(8)
command.
sudo is a SUID program, and audited through:
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item...
CCI-000048: Do not forget FTP and SSH login banners.
Agreed
& patched.
FTP:
https://fedorahosted.org/scap-security-guide/changeset/006c67f6d64bd64b43...
SSH:
https://fedorahosted.org/scap-security-guide/changeset/073e9e157e4528a1ad...
CCI-000054: Do not forget the MaxSessions configuration in
sshd_config(5).
The OS level limit supersedes services
CCI-000056: Is there a setting for the gconftool-2 command to set
mandatory screen locking enforcement?
Yes.
56 requires that the OS retains the lock until someone re-authenticates,
which is the default behavior. I created a patch to reflect this. In
regards to the gconftool commands, those were mapped to CCI-000057.
CCI-000057: This is the same as CCI-000056 with mandatory
screensaver
timeout enforcement.
Created a patch to reflect the time period component.
CCI-000060: When this check was coded for RHEL5 in OVAL, we limited
the
screensaver options to appropriate values among those included with the RPM.
IIRC,
we didn't want to open the possibility of someone replacing the
default image files with potentially classified ones. blank-mode uses
code to drape the screen in black, whereas the others (generally) tile
images.
CCI-000067: Ensure logging of all FTP and SSH sessions, as well.
OS-level accesses such as SSH will be audited natively. Daemon level
accesses (such as FTP) will be taken care of in the FTP service profile
later.
CCI-000068: Disable and remove rcmd, rsh, and rlogind services.
These aren't installed by default, the user has to manually install
them. There has been some talk about creating a "non recommended
packages" section or some such thing. Maybe this could push that
conversation over the edge?
CCI-000068: Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.
Will be addressed in a future Mail Server profile.
CCI-000085: Disable all firewire and Bluetooth facilities and
remove
them from the system.
Agreed and patched.
https://fedorahosted.org/scap-security-guide/changeset/372e07e069f015e17d...
CCI-000086: Disable all firewire and Bluetooth facilities and
remove
them from the system.
86 is within the OS SRG but not in the RHEL5 STIG. Will this
be applied
for the RHEL6 STIG as well?
CCI-000130: Enable FTP daemon logging.
Service auditing (e.g.
SMTP, FTP...) will be done in future service
profiles. Right now we're after the base OS.
CCI-000130, et seq.: Unless there is no way to configure auditd
such
that it will not capture the required information, the product does not
meet the requirement by design.
Technically the OS wouldn't meet this
requirement if auditing is turned
off, so I'll map this to both the mandatory requirement to turn on
auditing and the one to configure it. Once turned on the audit message
data will contain this information (and you can't manipulate the format
for it to be excluded).
Patch created.
CCI-000134: Enable xinetd(8) logging.
Earlier guidance states
that xinetd should not be used:
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item...
CCI-000135, et seq.: Can illustrative examples be provided?
type=CRED_ACQ msg=audit(1343129489.601:26569): user pid=4660 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred
acct="shawn" exe="/usr/sbin/sshd" hostname=10.211.55.2
addr=10.211.55.2
terminal=ssh res=success'
pid = process ID of the event originator
uid = who the process was running as
subj = selinux content type
msg = the event that happened
hostname = remote FQDN (if applicable) that caused the event
addr = remote IP address that caused the event
terminal = where did this event happen? (local console, remotely via
SSH, etc)
res = condition of the event (success/fail, etc)
CCI-000136: The system must use a remote logging host for audit
data.
Agreed and patched.
https://fedorahosted.org/scap-security-guide/changeset/18ffc6c57a99de91a9...
CCI-000160: At least two NTP servers must be configured.
Ticket created:
https://fedorahosted.org/scap-security-guide/ticket/87
CCI-000160: Unless the system is an NTP server for the local
enclave,
all its NTP servers must be in the local enclave.
What happens when the NTP servers
are corporately provided outside the
local enclave?
CCI-000166: Please provide an example.
Getting into the
non-repudiation aspects of the audit subsystem can get
pretty long. Could we piggyback on that RHEL has been common criteria
certified (which includes this)?
CCI-000171: How can "designated organizational personnel"
be identified
as such under RHEL6?
They will have access to the root (privileged) account.
CCI-000185: Are DoD certificates signed by "established
CAs"?
Yes. DoD certificates would be signed by the DoD/IC PKI CAs.
CCI-000187: How are PKI-authenticated identities mapped to user
accounts?
Defer to Willy who wrote the PKI section (or Kevin if he wants to chirp
up ;))
CCI-000196: Disabling telnet is covered in CCI-000196.
Patched.
CCI-000196: Password hashes must be generated using FIPS 140-2
approved
algorithms.
This was covered in another stanza:
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item...
Patch created to map this.
CCI-000196: There must be no .netrc files on the system.
Ticket created.
https://fedorahosted.org/scap-security-guide/ticket/88
CCI-000196: There must be no passwords stored in the ldap.conf
configuration file.
Ticket created.
https://fedorahosted.org/scap-security-guide/ticket/89
CCI-000200: The pam_unix.so module has the "remember=n"
option to
retain n generations of user passwords.
Patched
https://fedorahosted.org/scap-security-guide/changeset/41557377a28aefb677...
CCI-000205: The system must use password hashes that are computed
using
the entire password provided by the end-user.
Default behavior.
CCI-000347: Please provide examples.
Hardware will showup in
dmesg. An example from my laptop logfiles:
dmesg:593:e1000 0000:00:05.0: eth0: (PCI:33MHz:32-bit)
00:1c:42:a6:72:16
In this case, it's saying that something showed up using the
e1000
kernel driver, exposed itself as eth0, and had a hardware address of
00:1c:42:a6:72:16
CCI-000370, et seq.: I identified these as not applicable, but a
third-party application may satisfy these requirements (NA-DEP).
Agreed, 3rd party
tools should be used. Since this is NA, could we get
it moved to OS-SRG-NA?
CCI-000374: The system must utilize a file-integrity tool.
Patched.
https://fedorahosted.org/scap-security-guide/changeset/4952aa30f31e0bd22c...
CCI-000382: The SCTP, DCCP, UDP-Lite, IPX, AppleTalk, DECnet, RDS,
and
TIPC protocols must be disabled unless required.
These protocols are disabled by
default. Perhaps we need a "non
recommended protocols" section?
CCI-000416: Can AIDE track the addition of devices to the system
without blowing up after system reboots?
AIDE is more about file integrity (who
changed /etc/passwd?) than
tracking devices. Devices will be tracked in the following ways:
(1) Device information will show up in the dmesg log file, such as the
eth0 example above
(2) We audit the usage of the mount command, which would indicate
someone is mounting a device (USB, CDROM, etc) to the system
CCI-000764: The system must not have special privilege accounts,
such
as shutdown and halt.
Their presence is largely legacy, I suppose we can remove
them. Ticket
created:
https://fedorahosted.org/scap-security-guide/ticket/90
CCI-000764: The Linux NFS Server must not have the insecure file
locking option.
Ticket created
https://fedorahosted.org/scap-security-guide/ticket/91
CCI-000764: All accounts on the system must have unique user or
account
names.
Default behavior.
CCI-000764: All accounts must be assigned unique User
Identification
Numbers (UIDs).
Default behavior
CCI-000765, et seq.: If there is a canonical method for enabling
PKI
under RHEL6, please provide it.
Defer to the other guys on this one. Willy, Cliff,
Jeff?
CCI-000770: Direct logins must not be permitted to shared, default,
application, or utility accounts.
There will be no shared/group accounts
CCI-000770: The root account must not be used for direct log in.
Patched
https://fedorahosted.org/scap-security-guide/changeset/72c589f4bd5393751b...
CCI-000770: The system must prevent the root account from directly
logging in except from the system console.
Patched
https://fedorahosted.org/scap-security-guide/changeset/72c589f4bd5393751b...
CCI-000880: Please provide examples.
This is default behavior.
Users are audited no matter where they login
from (console, TTY, SSH, etc).
CCI-001084: Please provide examples.
Upon review, I'd
argue that this should be mapped to met_inherently. By
default root is the only one with access to privileged commands (e.g.
security functions).
CCI-001090: Please provide examples.
Can we defer to
RHEL's common criteria certification as evidence?
CCI-001154: The system must not have a public Instant Messaging
(IM)
client installed.
The requirement directly calls out the blocking of traffic. IM
software
is not installed by default on the system.
CCI-001233: The system package management tool must not
automatically
obtain updates.
Default behavior.
CCI-001297: Please provide configuration examples.
I've
posted an example at
http://people.redhat.com/swells/SCAPexamples/aide.txt. In that I change
the /bin/cp program.
CCI-001356: Please provide examples of an RHEL6-included log
analysis
package checking for atypical use patterns.
RHEL will provide the monitoring -- aka
the raw data -- but not the
analysis. If this requirement calls for analysis we'll have to defer to
a 3rd party ISV.
CCI-001436: Disable rpcbind, X, UUCP, peer-to-peer applications,
samba,
SWAT, and NIS/NIS+ over UDP, unless required.
This software will not be installed
by default. Service level configs
(e.g. samba) will be covered in samba profiles.
CCI-001436: The SSH daemon and client must use only version 2 of
the
SSH protocol.
Default behavior of RHEL6
CCI-001453: Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.
Will be covered in a (future) SMTP profile
CCI-001453: If the system is using LDAP for authentication or
account
information, the system must use a TLS connection using FIPS 140-2
approved cryptographic algorithms.
Prose existed for this:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-gu...
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-gu...
Patched to create the mapping:
https://fedorahosted.org/scap-security-guide/changeset/f52e5d1871f5a2d21c...
CCI-001462: Does this requirement imply session replaying? I
don't know.
The requirement was interpreted at face value -- provide the
capability
capture and record. This can be accomplished by keystroke logging in RHEL6.
CCI-001493, et seq.: The ownerships and permissions are ostensibly
correct at startup. Do they automatically correct themselves should
they be tampered with?
Not through native tooling. 3rd party ISVs can accomplish
this (puppet,
RHN Satellite, Chef...).
From a RHEL perspective only authorized users can adjust access
permissions to audit logs and tooling. All those changes will be audited.
CCI-001589: Please provide configuration examples.
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-gu...
CCI-001632: This looks more like an out-of-band network management
requirement. Does RHEL6 support VLAN functionality that would separate
management traffic?
Yes, that is possible by associating the SSH daemon with a
unique
network interface dedicated to management traffic.
In the description text of the CCI it states that an "encrypted channel"
is acceptable, so 1632 was mapped to the use of SSH.
CCI-001674: Please explain how RHEL6 would implement the
organization-defined responses and alternative actions?
We interpreted this
requirement as enforcing other CCIs which required
actions to be taken on component failures; aka the "fail to secure
state" requirements. If this was not the intent further clarification is
requested.