This patch introduces new 'Accounts and Access Control' section for Fedora content. Also convert four existing RHEL-6 rules from 'Protect Accounts by Restricting Password-Based Login' and include them into Fedora.
Please review.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
On 10/10/13 10:52 AM, Jan Lieskovsky wrote:
This patch introduces new 'Accounts and Access Control' section for Fedora content. Also convert four existing RHEL-6 rules from 'Protect Accounts by Restricting Password-Based Login' and include them into Fedora.
Please review.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-Fedora-Introduce-Accounts-and-Access-Control-Section.patch
From d5049e0baca827e33de5dbd7da28cf037c2eed40 Mon Sep 17 00:00:00 2001 From: Jan Lieskovskyjlieskov@redhat.com Date: Thu, 10 Oct 2013 16:40:14 +0200 Subject: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'. Convert four RHEL-6 rules from its 'Verify Proper Storage' subsection to Fedora
Signed-off-by: Jan Lieskovskyjlieskov@redhat.com
.../checks/accounts_password_all_shadowed.xml | 24 +++++ Fedora/input/checks/no_empty_passwords.xml | 22 +++++ Fedora/input/checks/no_netrc_files.xml | 22 +++++ Fedora/input/guide.xslt | 15 +++ Fedora/input/profiles/common.xml | 4 + Fedora/input/system/accounts/accounts.xml | 11 +++ .../accounts/restrictions/password_storage.xml | 107 +++++++++++++++++++++ .../system/accounts/restrictions/restrictions.xml | 13 +++ Fedora/scap-security-guide.spec | 11 ++- 9 files changed, 228 insertions(+), 1 deletion(-) create mode 100644 Fedora/input/checks/accounts_password_all_shadowed.xml create mode 100644 Fedora/input/checks/no_empty_passwords.xml create mode 100644 Fedora/input/checks/no_netrc_files.xml create mode 100644 Fedora/input/system/accounts/accounts.xml create mode 100644 Fedora/input/system/accounts/restrictions/password_storage.xml create mode 100644 Fedora/input/system/accounts/restrictions/restrictions.xml
diff --git a/Fedora/input/checks/accounts_password_all_shadowed.xml b/Fedora/input/checks/accounts_password_all_shadowed.xml new file mode 100644 index 0000000..42b7482 --- /dev/null +++ b/Fedora/input/checks/accounts_password_all_shadowed.xml @@ -0,0 +1,24 @@ +<def-group>
<definition class="compliance" id="accounts_password_all_shadowed" version="1">
<metadata>
<title>All Password Hashes Shadowed</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>All password hashes should be shadowed.</description>
</metadata>
<criteria>
<criterion comment="password hashes are shadowed" test_ref="test_accounts_password_all_shadowed" />
</criteria>
</definition>
- <unix:password_test check="all" comment="password hashes are shadowed" id="test_accounts_password_all_shadowed" version="1">
- <unix:object object_ref="object_accounts_password_all_shadowed" />
- <unix:state state_ref="state_accounts_password_all_shadowed" />
- </unix:password_test>
- <unix:password_object id="object_accounts_password_all_shadowed" version="1">
- <unix:username operation="pattern match">.*</unix:username>
- </unix:password_object>
- <unix:password_state id="state_accounts_password_all_shadowed" version="1">
- unix:passwordx</unix:password>
- </unix:password_state>
+</def-group> diff --git a/Fedora/input/checks/no_empty_passwords.xml b/Fedora/input/checks/no_empty_passwords.xml new file mode 100644 index 0000000..054d643 --- /dev/null +++ b/Fedora/input/checks/no_empty_passwords.xml @@ -0,0 +1,22 @@ +<def-group>
<definition class="compliance" id="no_empty_passwords" version="1">
<metadata>
<title>No nullok Option in /etc/pam.d/system-auth</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
</metadata>
<criteria>
<criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="test_no_empty_passwords" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="test_no_empty_passwords" version="1">
- <ind:object object_ref="object_no_empty_passwords" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_no_empty_passwords" version="1">
- ind:filepath/etc/pam.d/system-auth</ind:filepath>
- <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/Fedora/input/checks/no_netrc_files.xml b/Fedora/input/checks/no_netrc_files.xml new file mode 100644 index 0000000..740a98b --- /dev/null +++ b/Fedora/input/checks/no_netrc_files.xml @@ -0,0 +1,22 @@ +<def-group>
<definition class="compliance" id="no_netrc_files" version="1">
<metadata>
<title>Verify No netrc Files Exist</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
</metadata>
<criteria>
<criterion test_ref="test_no_netrc_files_home" negate="true" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="test_no_netrc_files_home" version="1">
- <unix:object object_ref="object_no_netrc_files_home" />
- </unix:file_test>
- <unix:file_object comment="look for .netrc in /home" id="object_no_netrc_files_home" version="1">
- <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
- <unix:path operation="equals">/home</unix:path>
- <unix:filename operation="pattern match">^.netrc$</unix:filename>
- </unix:file_object>
+</def-group> diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt index a24bdd9..8bdf86e 100644 --- a/Fedora/input/guide.xslt +++ b/Fedora/input/guide.xslt @@ -24,6 +24,7 @@ xsl:copy <xsl:copy-of select="@*|node()" /> <xsl:apply-templates select="document('system/software/software.xml')" />
</xsl:template><xsl:apply-templates select="document('system/accounts/accounts.xml')" /> </xsl:copy>
@@ -34,6 +35,20 @@ </xsl:copy> </xsl:template>
- <xsl:template match="Group[@id='accounts']">
- xsl:copy
<xsl:copy-of select="@*|node()" />
<xsl:apply-templates select="document('system/accounts/restrictions/restrictions.xml')" />
- </xsl:copy>
- </xsl:template>
- <xsl:template match="Group[@id='accounts-restrictions']">
- xsl:copy
<xsl:copy-of select="@*|node()" />
<xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
- </xsl:copy>
- </xsl:template>
<!-- copy everything else through to final output -->
<xsl:template match="@*|node()"> xsl:copydiff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml index 18c8f3e..2739a33 100644 --- a/Fedora/input/profiles/common.xml +++ b/Fedora/input/profiles/common.xml @@ -4,5 +4,9 @@
<select idref="ensure_gpgcheck_globally_activated" selected="true"/> <select idref="ensure_gpgcheck_never_disabled" selected="true"/> +<select idref="no_empty_passwords" selected="true"/> +<select idref="no_hashes_outside_shadow" selected="true"/> +<select idref="gid_passwd_group_same" selected="true"/> +<select idref="no_netrc_files" selected="true"/>
</Profile> diff --git a/Fedora/input/system/accounts/accounts.xml b/Fedora/input/system/accounts/accounts.xml new file mode 100644 index 0000000..044d85d --- /dev/null +++ b/Fedora/input/system/accounts/accounts.xml @@ -0,0 +1,11 @@ +<Group id="accounts"> +<title>Account and Access Control</title> +<description>In traditional Unix security, if an attacker gains +shell access to a certain login account, they can perform any action +or access any file to which that account has access. Therefore, +making it more difficult for unauthorized people to gain shell +access to accounts, particularly to privileged accounts, is a +necessary part of securing a system. This section introduces +mechanisms for restricting access to accounts under Fedora. +</description> +</Group> diff --git a/Fedora/input/system/accounts/restrictions/password_storage.xml b/Fedora/input/system/accounts/restrictions/password_storage.xml new file mode 100644 index 0000000..d1bbcd3 --- /dev/null +++ b/Fedora/input/system/accounts/restrictions/password_storage.xml @@ -0,0 +1,107 @@ +<Group id="password_storage"> +<title>Verify Proper Storage and Existence of Password +Hashes</title> +<description> +By default, password hashes for local accounts are stored +in the second field (colon-separated) in +<tt>/etc/shadow</tt>. This file should be readable only by +processes running with root credentials, preventing users from +casually accessing others' password hashes and attempting +to crack them. +However, it remains possible to misconfigure the system +and store password hashes +in world-readable files such as <tt>/etc/passwd</tt>, or +to even store passwords themselves in plaintext on the system. +Using system-provided tools for password change/creation +should allow administrators to avoid such misconfiguration. +</description> + +<Rule id="no_empty_passwords" severity="high"> +<title>Prevent Log In to Accounts With Empty Password</title> +<description>If an account is configured for password authentication +but does not have an assigned password, it may be possible to log +into the account without authentication. Remove any instances of the <tt>nullok</tt> +option in <tt>/etc/pam.d/system-auth</tt> to +prevent logins with empty passwords. +</description> +<ocil clause="NULL passwords can be used"> +To verify that null passwords cannot be used, run the following command: +<pre># grep nullok /etc/pam.d/system-auth</pre> +If this produces any output, it may be possible to log into accounts +with empty passwords. +</ocil> +<rationale> +If an account has an empty password, anyone could log in and +run commands with the privileges of that account. Accounts with +empty passwords should never be used in operational +environments. +</rationale> +<oval id="no_empty_passwords" /> +<ref nist="IA-5(b),IA-5(c),IA-5(1)(a)" /> +</Rule> + +<Rule id="no_hashes_outside_shadow" severity="medium"> +<title>Verify All Account Password Hashes are Shadowed</title> +<description> +If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field, +instead of an <tt>x</tt>), the cause of this misconfiguration should be +investigated. The account should have its password reset and the hash should be +properly stored, or the account should be deleted entirely. +</description> +<ocil clause="any stored hashes are found in /etc/passwd"> +To check that no password hashes are stored in +<tt>/etc/passwd</tt>, run the following command: +<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre> +If it produces any output, then a password hash is +stored in <tt>/etc/passwd</tt>. +</ocil> +<rationale> +The hashes for all user account passwords should be stored in +the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>, +which is readable by all users. +</rationale> +<oval id="accounts_password_all_shadowed" /> +<ref nist="IA-5(h)" disa="201" /> +</Rule> + +<Rule id="gid_passwd_group_same"> +<title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title> +<description> +Add a group to the system for each GID referenced without a corresponding group. +</description> +<ocil clause="there is output"> +To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>, +run the following command: +<pre># pwck -qr</pre> +There should be no output. +</ocil> +<rationale> +Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights. +</rationale> +<ref disa="366" /> +</Rule> + +<Rule id="no_netrc_files" severity="medium"> +<title>Verify No netrc Files Exist</title> +<description>The <tt>.netrc</tt> files contain login information +used to auto-login into FTP servers and reside in the user's home +directory. These files may contain unencrypted passwords to +remote FTP servers making them susceptible to access by unauthorized +users and should not be used. Any <tt>.netrc</tt> files should be removed. +</description> +<ocil clause="any .netrc files exist"> +To check the system for the existence of any <tt>.netrc</tt> files, +run the following command: +<pre># find /home -xdev -name .netrc</pre> +<!-- needs fixup to limit search to home dirs --> +</ocil> +<rationale> +Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt> +files. DoD policy requires passwords be encrypted in storage and not used +in access scripts. +</rationale> +<oval id="no_netrc_files" /> +<ref nist="IA-5(h)" disa="196" /> +</Rule> + +</Group> diff --git a/Fedora/input/system/accounts/restrictions/restrictions.xml b/Fedora/input/system/accounts/restrictions/restrictions.xml new file mode 100644 index 0000000..febead6 --- /dev/null +++ b/Fedora/input/system/accounts/restrictions/restrictions.xml @@ -0,0 +1,13 @@ +<Group id="accounts-restrictions"> +<title>Protect Accounts by Restricting Password-Based Login</title> +<description>Conventionally, Unix shell accounts are accessed by +providing a username and password to a login program, which tests +these values for correctness using the <tt>/etc/passwd</tt> and +<tt>/etc/shadow</tt> files. Password-based login is vulnerable to +guessing of weak passwords, and to sniffing and man-in-the-middle +attacks against passwords entered over a network or at an insecure +console. Therefore, mechanisms for accessing accounts by entering +usernames and passwords should be restricted to those which are +operationally necessary.</description> + +</Group> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec index 4ef3713..73eab57 100644 --- a/Fedora/scap-security-guide.spec +++ b/Fedora/scap-security-guide.spec @@ -5,7 +5,7 @@ # file one level up - in the main scap-security-guide directory (instead of # this one).
-%global fedorassgrelease 2.rc1 +%global fedorassgrelease 2.rc2
Name: scap-security-guide Version: 0.1 @@ -50,6 +50,15 @@ rm -rf $RPM_BUILD_ROOT %{_datadir}/xml/scap/ssg/fedora/19/*
%changelog +* Thu Oct 10 2013 Jan iankko Lieskovskyjlieskov@redhat.com 0.1-2.rc2 +- Introduce 'Account and Access Control' section +- Convert following "Verify Proper Storage and Existence of Password Hashes" section
- rules to Fedora:
- Prevent Log In to Accounts With Empty Password
- Verify All Account Password Hashes are Shadowed
- All GIDs referenced in /etc/passwd must be defined in /etc/group
- Verify No netrc Files Exist
- Wed Oct 02 2013 Jan iankko Lieskovskyjlieskov@redhat.com 0.1-2.rc1
- Set proper name of the build directory in the spec's %setup macro.
- Replace hard-wired paths with macros. Preserve attributes when copying files.
-- 1.7.11.7
ack
scap-security-guide@lists.fedorahosted.org