On 10/10/13 10:52 AM, Jan Lieskovsky wrote:
This patch introduces new 'Accounts and Access Control'
section
for Fedora content. Also convert four existing RHEL-6 rules from
'Protect Accounts by Restricting Password-Based Login' and include
them into Fedora.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-Fedora-Introduce-Accounts-and-Access-Control-Section.patch
From d5049e0baca827e33de5dbd7da28cf037c2eed40 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky<jlieskov(a)redhat.com>
Date: Thu, 10 Oct 2013 16:40:14 +0200
Subject: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'.
Convert four RHEL-6 rules from its 'Verify Proper Storage'
subsection to Fedora
Signed-off-by: Jan Lieskovsky<jlieskov(a)redhat.com>
---
.../checks/accounts_password_all_shadowed.xml | 24 +++++
Fedora/input/checks/no_empty_passwords.xml | 22 +++++
Fedora/input/checks/no_netrc_files.xml | 22 +++++
Fedora/input/guide.xslt | 15 +++
Fedora/input/profiles/common.xml | 4 +
Fedora/input/system/accounts/accounts.xml | 11 +++
.../accounts/restrictions/password_storage.xml | 107 +++++++++++++++++++++
.../system/accounts/restrictions/restrictions.xml | 13 +++
Fedora/scap-security-guide.spec | 11 ++-
9 files changed, 228 insertions(+), 1 deletion(-)
create mode 100644 Fedora/input/checks/accounts_password_all_shadowed.xml
create mode 100644 Fedora/input/checks/no_empty_passwords.xml
create mode 100644 Fedora/input/checks/no_netrc_files.xml
create mode 100644 Fedora/input/system/accounts/accounts.xml
create mode 100644 Fedora/input/system/accounts/restrictions/password_storage.xml
create mode 100644 Fedora/input/system/accounts/restrictions/restrictions.xml
diff --git a/Fedora/input/checks/accounts_password_all_shadowed.xml
b/Fedora/input/checks/accounts_password_all_shadowed.xml
new file mode 100644
index 0000000..42b7482
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_all_shadowed.xml
@@ -0,0 +1,24 @@
+<def-group>
+ <definition class="compliance"
id="accounts_password_all_shadowed" version="1">
+ <metadata>
+ <title>All Password Hashes Shadowed</title>
+ <affected family="unix">
+ <platform>Fedora 19</platform>
+ </affected>
+ <description>All password hashes should be shadowed.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="password hashes are shadowed"
test_ref="test_accounts_password_all_shadowed" />
+ </criteria>
+ </definition>
+ <unix:password_test check="all" comment="password hashes are
shadowed" id="test_accounts_password_all_shadowed"
version="1">
+ <unix:object object_ref="object_accounts_password_all_shadowed" />
+ <unix:state state_ref="state_accounts_password_all_shadowed" />
+ </unix:password_test>
+ <unix:password_object id="object_accounts_password_all_shadowed"
version="1">
+ <unix:username operation="pattern match">.*</unix:username>
+ </unix:password_object>
+ <unix:password_state id="state_accounts_password_all_shadowed"
version="1">
+ <unix:password>x</unix:password>
+ </unix:password_state>
+</def-group>
diff --git a/Fedora/input/checks/no_empty_passwords.xml
b/Fedora/input/checks/no_empty_passwords.xml
new file mode 100644
index 0000000..054d643
--- /dev/null
+++ b/Fedora/input/checks/no_empty_passwords.xml
@@ -0,0 +1,22 @@
+<def-group>
+ <definition class="compliance" id="no_empty_passwords"
version="1">
+ <metadata>
+ <title>No nullok Option in /etc/pam.d/system-auth</title>
+ <affected family="unix">
+ <platform>Fedora 19</platform>
+ </affected>
+ <description>The file /etc/pam.d/system-auth should not contain the nullok
option</description>
+ </metadata>
+ <criteria>
+ <criterion comment="make sure the nullok option is not used in
/etc/pam.d/system-auth" test_ref="test_no_empty_passwords" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="make sure nullok is not used in
/etc/pam.d/system-auth" id="test_no_empty_passwords"
version="1">
+ <ind:object object_ref="object_no_empty_passwords" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_no_empty_passwords"
version="1">
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+ <ind:pattern operation="pattern
match">\s*nullok\s*</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/Fedora/input/checks/no_netrc_files.xml
b/Fedora/input/checks/no_netrc_files.xml
new file mode 100644
index 0000000..740a98b
--- /dev/null
+++ b/Fedora/input/checks/no_netrc_files.xml
@@ -0,0 +1,22 @@
+<def-group>
+ <definition class="compliance" id="no_netrc_files"
version="1">
+ <metadata>
+ <title>Verify No netrc Files Exist</title>
+ <affected family="unix">
+ <platform>Fedora 19</platform>
+ </affected>
+ <description>The .netrc files contain login information used to auto-login
into FTP servers and reside in the user's home directory. Any .netrc files should be
removed.</description>
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_no_netrc_files_home"
negate="true" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all"
check_existence="at_least_one_exists" comment="look for .netrc in
/home" id="test_no_netrc_files_home" version="1">
+ <unix:object object_ref="object_no_netrc_files_home" />
+ </unix:file_test>
+ <unix:file_object comment="look for .netrc in /home"
id="object_no_netrc_files_home" version="1">
+ <unix:behaviors recurse="directories"
recurse_direction="down" max_depth="1"
recurse_file_system="all" />
+ <unix:path operation="equals">/home</unix:path>
+ <unix:filename operation="pattern
match">^\.netrc$</unix:filename>
+ </unix:file_object>
+</def-group>
diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
index a24bdd9..8bdf86e 100644
--- a/Fedora/input/guide.xslt
+++ b/Fedora/input/guide.xslt
@@ -24,6 +24,7 @@
<xsl:copy>
<xsl:copy-of select="@*|node()" />
<xsl:apply-templates
select="document('system/software/software.xml')" />
+ <xsl:apply-templates
select="document('system/accounts/accounts.xml')" />
</xsl:copy>
</xsl:template>
@@ -34,6 +35,20 @@
</xsl:copy>
</xsl:template>
+ <xsl:template match="Group[@id='accounts']">
+ <xsl:copy>
+ <xsl:copy-of select="@*|node()" />
+ <xsl:apply-templates
select="document('system/accounts/restrictions/restrictions.xml')"
/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="Group[@id='accounts-restrictions']">
+ <xsl:copy>
+ <xsl:copy-of select="@*|node()" />
+ <xsl:apply-templates
select="document('system/accounts/restrictions/password_storage.xml')"
/>
+ </xsl:copy>
+ </xsl:template>
+
<!-- copy everything else through to final output -->
<xsl:template match="@*|node()">
<xsl:copy>
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 18c8f3e..2739a33 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -4,5 +4,9 @@
<select idref="ensure_gpgcheck_globally_activated"
selected="true"/>
<select idref="ensure_gpgcheck_never_disabled"
selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_hashes_outside_shadow" selected="true"/>
+<select idref="gid_passwd_group_same" selected="true"/>
+<select idref="no_netrc_files" selected="true"/>
</Profile>
diff --git a/Fedora/input/system/accounts/accounts.xml
b/Fedora/input/system/accounts/accounts.xml
new file mode 100644
index 0000000..044d85d
--- /dev/null
+++ b/Fedora/input/system/accounts/accounts.xml
@@ -0,0 +1,11 @@
+<Group id="accounts">
+<title>Account and Access Control</title>
+<description>In traditional Unix security, if an attacker gains
+shell access to a certain login account, they can perform any action
+or access any file to which that account has access. Therefore,
+making it more difficult for unauthorized people to gain shell
+access to accounts, particularly to privileged accounts, is a
+necessary part of securing a system. This section introduces
+mechanisms for restricting access to accounts under Fedora.
+</description>
+</Group>
diff --git a/Fedora/input/system/accounts/restrictions/password_storage.xml
b/Fedora/input/system/accounts/restrictions/password_storage.xml
new file mode 100644
index 0000000..d1bbcd3
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/password_storage.xml
@@ -0,0 +1,107 @@
+<Group id="password_storage">
+<title>Verify Proper Storage and Existence of Password
+Hashes</title>
+<description>
+By default, password hashes for local accounts are stored
+in the second field (colon-separated) in
+<tt>/etc/shadow</tt>. This file should be readable only by
+processes running with root credentials, preventing users from
+casually accessing others' password hashes and attempting
+to crack them.
+However, it remains possible to misconfigure the system
+and store password hashes
+in world-readable files such as <tt>/etc/passwd</tt>, or
+to even store passwords themselves in plaintext on the system.
+Using system-provided tools for password change/creation
+should allow administrators to avoid such misconfiguration.
+</description>
+
+<Rule id="no_empty_passwords" severity="high">
+<title>Prevent Log In to Accounts With Empty Password</title>
+<description>If an account is configured for password authentication
+but does not have an assigned password, it may be possible to log
+into the account without authentication. Remove any instances of the
<tt>nullok</tt>
+option in <tt>/etc/pam.d/system-auth</tt> to
+prevent logins with empty passwords.
+</description>
+<ocil clause="NULL passwords can be used">
+To verify that null passwords cannot be used, run the following command:
+<pre># grep nullok /etc/pam.d/system-auth</pre>
+If this produces any output, it may be possible to log into accounts
+with empty passwords.
+</ocil>
+<rationale>
+If an account has an empty password, anyone could log in and
+run commands with the privileges of that account. Accounts with
+empty passwords should never be used in operational
+environments.
+</rationale>
+<oval id="no_empty_passwords" />
+<ref nist="IA-5(b),IA-5(c),IA-5(1)(a)" />
+</Rule>
+
+<Rule id="no_hashes_outside_shadow" severity="medium">
+<title>Verify All Account Password Hashes are Shadowed</title>
+<description>
+If any password hashes are stored in <tt>/etc/passwd</tt> (in the second
field,
+instead of an <tt>x</tt>), the cause of this misconfiguration should be
+investigated. The account should have its password reset and the hash should be
+properly stored, or the account should be deleted entirely.
+</description>
+<ocil clause="any stored hashes are found in /etc/passwd">
+To check that no password hashes are stored in
+<tt>/etc/passwd</tt>, run the following command:
+<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
+If it produces any output, then a password hash is
+stored in <tt>/etc/passwd</tt>.
+</ocil>
+<rationale>
+The hashes for all user account passwords should be stored in
+the file <tt>/etc/shadow</tt> and never in
<tt>/etc/passwd</tt>,
+which is readable by all users.
+</rationale>
+<oval id="accounts_password_all_shadowed" />
+<ref nist="IA-5(h)" disa="201" />
+</Rule>
+
+<Rule id="gid_passwd_group_same">
+<title>All GIDs referenced in /etc/passwd must be defined in
/etc/group</title>
+<description>
+Add a group to the system for each GID referenced without a corresponding group.
+</description>
+<ocil clause="there is output">
+To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in
<tt>/etc/group</tt>,
+run the following command:
+<pre># pwck -qr</pre>
+There should be no output.
+</ocil>
+<rationale>
+Inconsistency in GIDs between <tt>/etc/passwd</tt> and
<tt>/etc/group</tt> could lead to a user having unintended rights.
+</rationale>
+<ref disa="366" />
+</Rule>
+
+<Rule id="no_netrc_files" severity="medium">
+<title>Verify No netrc Files Exist</title>
+<description>The <tt>.netrc</tt> files contain login information
+used to auto-login into FTP servers and reside in the user's home
+directory. These files may contain unencrypted passwords to
+remote FTP servers making them susceptible to access by unauthorized
+users and should not be used. Any <tt>.netrc</tt> files should be removed.
+</description>
+<ocil clause="any .netrc files exist">
+To check the system for the existence of any <tt>.netrc</tt> files,
+run the following command:
+<pre># find /home -xdev -name .netrc</pre>
+<!-- needs fixup to limit search to home dirs -->
+</ocil>
+<rationale>
+Unencrypted passwords for remote FTP servers may be stored in
<tt>.netrc</tt>
+files. DoD policy requires passwords be encrypted in storage and not used
+in access scripts.
+</rationale>
+<oval id="no_netrc_files" />
+<ref nist="IA-5(h)" disa="196" />
+</Rule>
+
+</Group>
diff --git a/Fedora/input/system/accounts/restrictions/restrictions.xml
b/Fedora/input/system/accounts/restrictions/restrictions.xml
new file mode 100644
index 0000000..febead6
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/restrictions.xml
@@ -0,0 +1,13 @@
+<Group id="accounts-restrictions">
+<title>Protect Accounts by Restricting Password-Based Login</title>
+<description>Conventionally, Unix shell accounts are accessed by
+providing a username and password to a login program, which tests
+these values for correctness using the <tt>/etc/passwd</tt> and
+<tt>/etc/shadow</tt> files. Password-based login is vulnerable to
+guessing of weak passwords, and to sniffing and man-in-the-middle
+attacks against passwords entered over a network or at an insecure
+console. Therefore, mechanisms for accessing accounts by entering
+usernames and passwords should be restricted to those which are
+operationally necessary.</description>
+
+</Group>
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 4ef3713..73eab57 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
# file one level up - in the main scap-security-guide directory (instead of
# this one).
-%global fedorassgrelease 2.rc1
+%global fedorassgrelease 2.rc2
Name: scap-security-guide
Version: 0.1
@@ -50,6 +50,15 @@ rm -rf $RPM_BUILD_ROOT
%{_datadir}/xml/scap/ssg/fedora/19/*
%changelog
+* Thu Oct 10 2013 Jan iankko Lieskovsky<jlieskov(a)redhat.com> 0.1-2.rc2
+- Introduce 'Account and Access Control' section
+- Convert following "Verify Proper Storage and Existence of Password Hashes"
section
+ rules to Fedora:
+ * Prevent Log In to Accounts With Empty Password
+ * Verify All Account Password Hashes are Shadowed
+ * All GIDs referenced in /etc/passwd must be defined in /etc/group
+ * Verify No netrc Files Exist
+
* Wed Oct 02 2013 Jan iankko Lieskovsky<jlieskov(a)redhat.com> 0.1-2.rc1
- Set proper name of the build directory in the spec's %setup macro.
- Replace hard-wired paths with macros. Preserve attributes when copying files.
-- 1.7.11.7
ack