I'm trying to understand (as an example) the following results from an evaluation on a rhel6.3 box using the stig-rhel6-server profile. And I apologize if these questions are answered in a FAQ somewhere.
1) Ensure Log Files Are Owned By Appropriate Group unknown Ensure System Log Files Have Correct Permissions unknown
2) All GIDs referenced in /etc/passwd must be defined in /etc/group notchecked Ensure All Accounts on the System Have Unique Names notchecked
I understand that the "notchecked" is because there is not an oval test defined and the "unknown" is a specific "I don't know", as in the rsyslog_files_groupownership.xml:
<ind:unknown_test check="all" comment="use extended content to evaluated this test" id="test_20155" version="1" />
So I've been reading the oval language definitions and I cannot see how to address the "unknown" tests which require parsing a file to get parts out of it (rsyslog wants defined log paths).
Q) How does one go about writing a test that takes the result from evaluating a script? What is the "extended content"??
Q) Are the "notchecked" tests because the check is too vague? Or just not written yet?
Any documents I should be reading?
Thanks.
On Sat, 9 Feb 2013 07:50:05 -0500 Gary Gapinski Gapinski@nasa.gov wrote:
SNIP of a great answer.
Nicely done. Thanks for the answer.
Yes :) However, we may be able to do a bit better, even with OVAL if we consider that the Rules:
Ensure Log Files Are Owned By Appropriate Group unknown Ensure System Log Files Have Correct Permissions unknown
may be reformulated to: Ensure Log Files Are stored in /var/log pass (if lucky)
...and I believe OVAL is capable of checking for this.
Other, existing checks for permissions on all files in /var/log should then ensure that a non-compliant system will fail.
So I ask the group: storing all log files in /var/log is a stronger requirement, but is this a problem?
(Really, the Rule for having a separate partition for /var/log is already sort of assuming that we're doing this...)
On 02/09/2013 09:26 AM, Brian Millett wrote:
On Sat, 9 Feb 2013 07:50:05 -0500 Gary Gapinski Gapinski@nasa.gov wrote:
SNIP of a great answer.
Nicely done. Thanks for the answer.
On 02/11/2013 11:26 AM, Jeffrey Blank wrote:
Yes :) However, we may be able to do a bit better, even with OVAL if we consider that the Rules:
Ensure Log Files Are Owned By Appropriate Group unknown Ensure System Log Files Have Correct Permissions unknown
may be reformulated to: Ensure Log Files Are stored in /var/log pass (if lucky)
Not the same thing. As written currently, files match rsyslog config.
...and I believe OVAL is capable of checking for this.
Possibly. Recursive descent via "behavior", and I have not tested that.
Other, existing checks for permissions on all files in /var/log should then ensure that a non-compliant system will fail.
As long as they are all root:root 0600.
Not considering extended ACLS, btw, nor is "more restrictive" easily testable.
So I ask the group: storing all log files in /var/log is a stronger requirement, but is this a problem?
Dunno about RHEL. This is not 100% the case on Ubuntu systems. The logs will usually be somewhere under /var/log.
Permissions will differ, and are determined by entries in /etc/logrotate.d.
(Really, the Rule for having a separate partition for /var/log is already sort of assuming that we're doing this...)
I don't think these are equivalent.
In any case I have been directed to relax that particular requirement (separate filesystem for /var/log) for at least single-user workstations within NASA. Such rules will be altered via <Profile> to have role="unscored", severity="low", and selected="true".
Ensure Log Files Are Owned By Appropriate Group unknown Ensure System Log Files Have Correct Permissions unknown
may be reformulated to: Ensure Log Files Are stored in /var/log pass (if lucky)
Not the same thing. As written currently, files match rsyslog config.
I'll push up a patch to demonstrate what I mean.
(Really, the Rule for having a separate partition for /var/log is already sort of assuming that we're doing this...)
I don't think these are equivalent.
What I mean is that the rationale for having /var/log on a separate partition does not exist if logfiles can live elsewhere.
In any case I have been directed to relax that particular requirement (separate filesystem for /var/log) for at least single-user workstations within NASA. Such rules will be altered via <Profile> to have role="unscored", severity="low", and selected="true".
Sounds perfectly reasonable to me. Ah -- excellent -- thanks for pointing out that it's possible for a Profile to override a Rule's severity setting.
scap-security-guide@lists.fedorahosted.org