[PATCH 2/3] M1 Incomplete Guidance - Account and Access Control

Mike Palmiotto mpalmiotto at tresys.com
Tue Apr 10 21:24:42 UTC 2012


From: Michael Palmiotto <mpalmiotto at tresys.com>

---
 .../checks/accounts_disabled_after_expiration.xml  |   24 +++++
 .../accounts_login_shell_timeout_implemented.xml   |   55 +++++++++++
 .../input/checks/accounts_netrc_files_checked.xml  |   25 +++++
 .../checks/accounts_root_auditing_improved.xml     |   30 ++++++
 .../accounts_user_dot_files_not_world_writable.xml |   33 +++++++
 .../checks/libuser_login_defs_userdefaults.xml     |   50 ++++++++++
 rhel6/src/input/system/accounts/accounts.xml       |   27 ++++++
 rhel6/src/input/system/accounts/pam.xml            |   38 +++++++-
 rhel6/src/input/system/accounts/physical.xml       |   41 ++++++++
 .../system/accounts/restrictions/restrictions.xml  |   99 ++++++++++++++++++++
 rhel6/src/input/system/accounts/session.xml        |   24 +++++
 11 files changed, 445 insertions(+), 1 deletions(-)
 create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
 create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
 create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
 create mode 100644 rhel6/src/input/checks/accounts_root_auditing_improved.xml
 create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
 create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml

diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
new file mode 100644
index 0000000..334c1dd
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
@@ -0,0 +1,24 @@
+<def-group>
+  <definition class="compliance" id="accounts_disabled_after_expiration" version="1">
+    <metadata>
+      <title> Ensure Accounts Set to Disable After Password Expiration</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description> Check for INACTIVE line in useradd.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="inactive set" test_ref="test_accounts_disabled_after_expiration_inactive" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" comment="inactive set in useradd" id="test_accounts_disabled_after_expiration_inactive" version="1">
+    <ind:object object_ref="object_accounts_disabled_after_expiration_inactive" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_disabled_after_expiration_inactive" version="1">
+    <ind:path>/etc/default</ind:path>
+    <ind:filename>useradd</ind:filename>
+    <ind:pattern operation="pattern match">^INACTIVE\=[\d{1,3}]\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
new file mode 100644
index 0000000..aa330c8
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
@@ -0,0 +1,55 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_file_entries.py.  -->
+  <definition class="compliance" id="accounts_login_shell_timeout_implemented" version="1">
+    <metadata>
+      <title> Implement Inactivity Time-out for Login Shells</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-3689-7, CCE-3707-7" source="CCE" />
+      <description> Check if login shells set to automatically log users out after a certain period of inactivity.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="check readonly line" test_ref="test_accounts_login_shell_timeout_implemented_readonly" />
+      <criterion comment="check timeout line" test_ref="test_accounts_login_shell_timeout_implemented_idle" />
+      <criterion comment="check export line" test_ref="test_accounts_login_shell_timeout_implemented_export" />
+      <criterion comment="check autologout line" test_ref="test_accounts_login_shell_timeout_implemented_implement" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" comment="readonly timeout" id="test_accounts_login_shell_timeout_implemented_readonly" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_readonly" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_readonly" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^readonly[\s]+TMOUT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="idle timeout" id="test_accounts_login_shell_timeout_implemented_idle" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_idle" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_idle" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^TMOUT\=\d{3,5}\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="export timeout" id="test_accounts_login_shell_timeout_implemented_export" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_export" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_export" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^export[\s]+TMOUT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="autologout" id="test_accounts_login_shell_timeout_implemented_implement" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_implement" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_implement" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>autologout.csh</ind:filename>
+    <ind:pattern operation="pattern match">^set[\s]+\-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
new file mode 100644
index 0000000..2a4a6ca
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
@@ -0,0 +1,25 @@
+<def-group>
+  <definition class="compliance" id="accounts_netrc_files_checked" version="1">
+    <metadata>
+      <title>Ensure No .netrc Files</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-TODO" source="CCE" />
+      <description>Check that .netrc files are missing from all user accounts.</description>
+    </metadata>
+    <criteria >
+      <criterion comment=".netrc files" test_ref="test_accounts_netrc_files_checked" negate="true" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_netrc_files_checked" version="1">
+    <unix:object object_ref="object_accounts_netrc_files_checked" />
+  </unix:file_test>
+  <unix:file_object comment=".netrc files" id="object_accounts_netrc_files_checked" version="1">
+    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:path operation="equals">/home</unix:path>
+    <unix:filename operation="pattern match">.netrc</unix:filename>
+  </unix:file_object>
+</def-group>
+
+
diff --git a/rhel6/src/input/checks/accounts_root_auditing_improved.xml b/rhel6/src/input/checks/accounts_root_auditing_improved.xml
new file mode 100644
index 0000000..648bc02
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_root_auditing_improved.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="accounts_root_auditing_improved" version="1">
+    <metadata>
+      <title>Verify Sudo Audit Trail</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4044-4" source="CCE" />
+      <description>Check if the following line appears in /etc/sudoers.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment="check_sudoers" test_ref="test_accounts_root_auditing_improved_sudoers" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="check sudoers" id="test_accounts_root_auditing_improved_sudoers" version="1">
+    <ind:object object_ref="object_accounts_root_auditing_improved_sudoers" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_root_auditing_improved_sudoers" version="1">
+    <ind:path> /etc</ind:path>
+    <ind:filename> sudoers</ind:filename>
+    <ind:pattern operation="pattern match">^\%wheel[\s]+[\s]+ALL\=\(ALL\)[\s]+[\s]+ALL\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
new file mode 100644
index 0000000..82a9e45
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
@@ -0,0 +1,33 @@
+<def-group>
+  <definition class="compliance" id="accounts_user_dot_files_not_world_writable" version="1">
+    <metadata>
+      <title>Ensure User Dot Files not World Writable</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-TODO" source="CCE" />
+      <description>File permissions should be set correctly for dot-files for all user accounts.</description>
+    </metadata>
+    <criteria >
+      <criterion comment="user dot files" test_ref="test_accounts_user_dot_files_not_world_writable" negate="true" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_user_dot_files_not_world_writable" version="1">
+    <unix:object object_ref="object_accounts_user_dot_files_not_world_writable" />
+    <unix:state state_ref="state_dot_files_wrong_perm" />
+  </unix:file_test>
+  <unix:file_object comment="user dot files" id="object_accounts_user_dot_files_not_world_writable" version="1">
+    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:path operation="equals">/home</unix:path>
+    <unix:filename operation="pattern match">.*</unix:filename>
+    <filter action="include">state_dot_files_wrong_perm</filter>
+  </unix:file_object>
+  <unix:file_state id="state_dot_files_wrong_perm" version="1" operator="OR">
+    <unix:suid datatype="boolean">true</unix:suid>
+    <unix:sgid datatype="boolean">true</unix:sgid>
+    <unix:sticky datatype="boolean">true</unix:sticky>
+    <unix:gwrite datatype="boolean">true</unix:gwrite>
+    <unix:owrite datatype="boolean">true</unix:owrite>
+  </unix:file_state>
+</def-group>
+
diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
new file mode 100644
index 0000000..66345a5
--- /dev/null
+++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
@@ -0,0 +1,50 @@
+<def-group>
+  <definition class="compliance" id="libuser_login_defs_userdefaults" version="1">
+    <metadata>
+      <title>Check if Password Parameters are Removed from libuser.conf</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description> Make sure the password password parameters are removed from libuser.conf.</description>
+    </metadata>
+    <criteria operator="AND">
+  
+      <criterion comment="shadowmin removed" test_ref="test_libuser_login_defs_removed_shadowmin" />
+      <criterion comment="shadowmax removed" test_ref="test_libuser_login_defs_removed_shadowmax" />
+      <criterion comment="shadowwarn removed" test_ref="test_libuser_login_defs_removed_shadowwarn" />
+ 
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmin removed from login.defs" id="test_libuser_login_defs_removed_shadowmin" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowmin" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmin" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWMIN\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+ 
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmax removed from login.defs" id="test_libuser_login_defs_removed_shadowmax" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowmax" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmax" version="1">   
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWMAX\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowwarn removed from login.defs" id="test_libuser_login_defs_removed_shadowwarn" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowwarn" version="1">   
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWWARNING\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/input/system/accounts/accounts.xml
index fbdeb39..e5b61a6 100644
--- a/rhel6/src/input/system/accounts/accounts.xml
+++ b/rhel6/src/input/system/accounts/accounts.xml
@@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a
 necessary part of securing a system. This section introduces
 mechanisms for restricting access to accounts under
 RHEL6.</description>
+
+<Group id="all_human_users_group">
+<title> Create and Maintain a Group Containing All Human Users</title>
+<description>
+Identify all user accounts on the system which correspond to human users. Depending on your system
+configuration, this may be all entries in <tt>/etc/passwd</tt> with UID values of at least 500. Once, you have
+identified such a set of users, create a group named usergroup (substitute some name appropriate to your
+environment) and populate it with each human user:
+<pre># groupadd <i>usergroup</i>
+# usermod -G <i>usergroup human1</i>
+# usermod -G <i>usergroup human2</i>
+...
+# usermod -G <i>usergroup humanN</i></pre>
+Then modify your procedure for creating new user accounts by adding <tt>-G</tt> <i>usergroup</i> to the set of flags with
+which <tt>useradd</tt> is invoked, so that new human users will be placed in the correct group by default.
+
+Creating a group of human users does not, by itself, enhance system security. However, as you work on securing
+your system, you will often find commands which never need to be run by system accounts, or which are only
+ever needed by users logged into the graphical console (which should only ever be available to human users, even
+on workstations). Once a group of users has been created, it is easy to restrict access to a given command, for
+instance <i>/path/to/graphical/command</i>, to authorized users:
+<pre># chgrp <i>usergroup /path/to/graphical/command</i>
+# chmod 750 <i>/path/graphical/command</i></pre>
+Without a group of human users, it is necessary to restrict access by somehow preventing each system account
+from running the command, which is an error-prone process even when it is possible at all.</description>
+<!-- <oval id="accounts_all_human_users_group_maintained" /> -->
+</Group>
 </Group>
diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index bc91277..0782e1d 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -309,6 +309,31 @@ prevents direct password guessing attacks.
 
 </Group>
 
+<!-- Removed: Too complicated to enforce
+<Rule id="restrict_userhelper_execution">
+<title> Restrict Execution of <tt>userhelper</tt> to Console Users</title>
+<description>
+If your environment has defined a group, <i>usergroup</i> containing all the human users of your system, restrict
+execution of the <tt>userhelper</tt> program to only that group:
+<pre># chgrp usergroup /usr/sbin/userhelper
+# chmod 4710 /usr/sbin/userhelper</pre>
+The <tt>userhelper</tt> program provides authentication for graphical services which must run with <tt>root</tt> privileges,
+such as the <tt>system-config<tt>- family of graphical configuration utilities. Only human users logged into the system
+console are likely to ever have a legitimate need to run these utilities. This step provides some protection against
+possible flaws in <tt>userhelper</tt>'s implementation, and against further privilege escalation when system accounts
+are compromised. See Section 2.3.2.2 for more information on creating a group of human users.
+The <tt>userhelper</tt> program is configured by the files in <tt>/etc/security/console.apps/</tt>. Each file specifies, for
+some program, what user the program should run as, and what program should be executed after successful
+authentication.
+Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in combination with the PAM configura-
+tion of the service defined in <tt>/etc/pam.d/</tt>. First, <tt>userhelper</tt> determines what user the service should run as.
+(Typically, this will be <tt>root</tt>.) Next, <tt>userhelper</tt> uses the PAM API to allow the user who ran the program to
+attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if the application's
+configuration requests one.</description>
+<ident cce="4185-5, 3952-9" />
+<oval id="accounts_pam_userhelper_execution_restricted" />
+</Rule>
+-->
 
 <Rule id="set_password_hashing_algorithm">
 <title>Set Password Hashing Algorithm</title>
@@ -374,7 +399,18 @@ compromised could be used yet again by an attacker.
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/>
 <ref nist="IA-5" />
 </Rule>
-</Group>
+</Group> <!-- End <Group id="limiting_password_reuse"> -->
+
+<Rule id="pam_ccreds_removed">
+<title> Remove the <tt>pam_ccreds</tt> Package if Possible</title>
+<description>
+Unless its credential caching functionality is required, remove the <tt>pam_ccreds</tt> package:
+<pre># yum erase pam_ccreds</pre>
+The <tt>pam_ccreds</tt> package contains the setuid program <tt>/usr/sbin/ccreds_validate</tt> and should be removed
+unless it provides essential functionality. Any credentials cached on a system would also be compromised if an
+attacker obtains control of the system.</description>
+<oval id="package_pam_ccreds_removed" />
+</Rule>
 
 </Group>
 
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml
index 45ad144..27441e0 100644
--- a/rhel6/src/input/system/accounts/physical.xml
+++ b/rhel6/src/input/system/accounts/physical.xml
@@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an
 attacker to quickly or undetectably modify a system from its
 console.</description>
 
+<Group id="bios_password">
+<title>Set BIOS Password</title>
+<description>BIOS (on x86 systems) is the first code to execute during system startup and controls many important
+system parameters, including which devices the system will try to boot from, and in which order.
+Assign a password to prevent any unauthorized changes to the BIOS configuration. The exact steps will
+vary depending on your machine, but are likely to include:
+1.Reboot the machine.
+2.Press the appropriate key during the initial boot screen (F2 is typical).
+3.Navigate the BIOS configuration menu to add a password.
+The exact process will be system-specific and the system's hardware manual may provide detailed instructions.
+This password should prevent attackers with physical access from attempting to change important parameters,
+such as those described in Sections 2.5.2.2.1 and 2.2.2.2.4. However, an attacker with physical access can usually
+clear the BIOS password. The password should be written down and stored in a physically-secure location, such
+as a safe, in the event that it is forgotten and must be retrieved.
+</description>
+</Group>
+
 <Group id="bootloader">
 <title>Set Boot Loader Password</title>
 <description>During the boot process, the boot loader is
@@ -133,6 +150,30 @@ services, weakening system security.
 <ref nist="CM-7, IA-4, SC-2"/>
 </Rule>
 
+<Rule id="login_shell_inactivity_timeout">
+<title> Implement Inactivity Time-out for Login Shells</title>
+<description>
+If the system does not run X Windows, then the login shells can be configured to automatically log users out after
+a period of inactivity. The following instructions are not practical for systems which run X Windows, as they
+will close terminal windows in the X environment. For information on how to automatically lock those systems,
+see Section 2.3.5.6.
+To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt> shell, create a new file <tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with the following lines:
+<pre>TMOUT=900
+readonly TMOUT
+export TMOUT</pre>
+To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a new file <tt>autologout.csh</tt> in the directory
+<tt>/etc/profile.d</tt> with the following line:
+<pre>set -r autologout 15</pre>
+Similar actions should be taken for any other login shells used.
+The example time-out here of 15 minutes should be adjusted to whatever your security policy requires. The
+readonly line for <tt>bash</tt> and the <tt>-r</tt> option for <tt>tcsh</tt> can be omitted if policy allows users to override the value.
+The automatic shell logout only occurs when the shell is the foreground process. If, for example, a <tt>vi</tt> session is
+left idle, then automatic logout would not occur.
+When logging in through a remote connection, as with SSH, it may be more effective to set the timeout value
+directly through that service. To learn how to set automatic timeout intervals for SSH, see Section 3.5.2.3.</description>
+<ident cce="3689-7, 3707-7" />
+<oval id="accounts_login_shell_timeout_implemented" />
+</Rule>
 
 <Group id="screen_locking">
 <title>Configure Screen Locking</title>
diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
index febead6..cfee882 100644
--- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml
+++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
@@ -10,4 +10,103 @@ console. Therefore, mechanisms for accessing accounts by entering
 usernames and passwords should be restricted to those which are
 operationally necessary.</description>
 
+<!--
+<Rule id="limit_su_access_to_root">
+<title> Limit <tt>su</tt> Access to the Root Account</title>
+<description>"1.Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre>
+2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line:
+<pre>auth       required        pam_wheel.so    use_uid</pre>
+The <tt>su</tt> command allows a user to gain the privileges of another user by entering the password for that user's
+account. It is desirable to restrict the root user so that only known administrators are ever allowed to access the
+root account. This restricts password-guessing against the root account by unauthorized users or by accounts
+which have been compromised. <br />
+By convention, the group <tt>wheel</tt> contains all users who are allowed to run privileged commands. The PAM
+module <tt>pam_wheel.so</tt> is used to restrict root access to this set of users.</description>
+<ident cce="14088-9, 15047-4" />
+<oval id="accounts_su_access_limited" />
+<ref nist="AC-2, AC-3, CM-6" />
+</Rule>
+-->
+
+<Group id="configure_sudo">
+<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root Access</title>
+<description>
+The <tt>sudo</tt> command allows fine-grained control over which users can execute commands using other accounts.
+The primary benefit of <tt>sudo</tt> when configured as above is that it provides an audit trail of every command run
+by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an
+established procedure that all root commands are run using <tt>sudo</tt>, then it is easy for an auditor to detect unusual
+behavior when this procedure is not followed. <br />
+</description>
+
+<warning>
+Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration error may make it impossible to access
+the root account remotely. The recommended means of editing this file is using the <tt>visudo</tt> command, which
+checks the file's syntax for correctness before allowing it to be saved. <br />
+
+Note that <tt>sudo</tt> allows any attacker who gains access to the password of an administrator account to run commands
+as root. This is a downside which must be weighed against the benefits of increased audit capability and of being
+able to heavily restrict the use of the high-value root password (which can be logistically difficult to change
+often). As a basic precaution, <i>never</i> use the <tt>NOPASSWD</tt> directive, which would allow anyone with access to an administrator account to execute commands as root without knowing the administrator's password. <br />
+</warning>
+
+<Rule id="verify_wheel_exists">
+<description>
+Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre></description>
+<oval id="accounts_wheel_exists" />
+</Rule>
+
+<Rule id="verify_sudo_audit_trail">
+<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line:
+<pre>%wheel     ALL=(ALL)       ALL</pre>
+</description>
+<oval id="accounts_root_auditing_improved" />
+</Rule>
+</Group>
+
+<Group id="remove_password_parameters">
+<title> Remove Password Parameters from <tt>libuser.conf</tt></title>
+<description>The <tt>/etc/libuser.conf</tt> file contains configuration options for the libuser library, which is intended to implement
+a standardized interface for manipulating and administering user and group accounts. By default, it sources
+password settings from <tt>/etc/login.defs</tt>, but it can override these parameters. The man page <tt>libuser.conf(5)</tt> contains more information.</description>
+
+<Rule id="verify_libuser_login_defs_import">
+<title>Verify Line Under Import Section</title>
+<description>
+Ensure the following line exists within the file <tt>/etc/libuser.conf</tt> under the <tt>[import]</tt> section.
+<pre>login_defs = /etc/login.defs</pre></description>
+<oval id="libuser_login_defs_import" />
+</Rule>
+
+<Rule id="verify_libuser_login_defs_userdefaults">
+<title>Verify Lines do not Appear in Userdefaults Section</title>
+<description>
+Ensure that no lines beginning with the following appear in the <tt>[userdefaults]</tt> section of the file, as
+these override settings from <tt>/etc/login.defs</tt>:
+<pre>LU_SHADOWMAX
+LU_SHADOWMIN
+LU_SHADOWWARNING</pre></description>
+<oval id="libuser_login_defs_userdefaults" />
+</Rule>
+</Group>
+
+
+<Rule id="verify_accounts_disabled_after_expiration">
+<title> Set Accounts to Disable After Password Expiration</title>
+<description>
+In order to automatically disable local accounts some number of <i>DAYS</i> after password expiration, add or
+modify the following line in <tt>/etc/default/useradd</tt>:
+<pre>INACTIVE=<i>DAYS</i></pre>
+For example, if <pre>INACTIVE=30</pre> and if the password is currently on the verge of expiration, then 30 days remain
+until the account is automatically disabled. If the password will not expire for another 60 days, then 90 days
+remain until the account is automatically disabled. See <tt>useradd(8)</tt> for more information.
+Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period
+of inactivity for users in your environment. Setting the timeout too low incurs support costs and also has the
+potential to impact availability of the system to legitimate users.</description>
+<oval id="accounts_disabled_after_expiration" />
+</Rule>
+
 </Group>
diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml
index 00b5a8d..f7e6530 100644
--- a/rhel6/src/input/system/accounts/session.xml
+++ b/rhel6/src/input/system/accounts/session.xml
@@ -114,6 +114,19 @@ groups or ACLs.
 <ref nist="AC-3, CM-6"/>
 </Rule>
 
+<Rule id="ensure_dot_files_not_world_writable">
+<title> Ensure that User Dot-Files are not World-writable</title>
+<description>
+For each human user <i>USER</i> of the system, view the permissions of all dot-files in the user's home directory:
+<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre>
+Ensure that none of these files are group- or world-writable. Correct each misconfigured file <i>FILE</i> by exe-
+cuting:
+<pre># chmod go-w /home/USER /FILE</pre>
+A user who can modify another user's configuration files can likely execute commands with the other user's
+privileges, including stealing data, destroying files, or launching further attacks on the system.</description>
+<oval id="accounts_user_dot_files_not_world_writable" />
+</Rule>
+
 <Group id="user_umask">
 <title>Ensure that Users Have Sensible Umask Values</title>
 <description>
@@ -168,6 +181,17 @@ operator="equals" interactive="0">
 <value selector="077">077</value>
 </Value>
 
+<Group id="ensure_no_netrc_files">
+<title> Ensure that Users do not Have <tt>.netrc</tt> Files</title>
+<description>
+For each human user <i>USER</i> of the system, ensure that the user has no <tt>.netrc</tt> file. The command:
+<pre># ls -l /home/<i>USER</i> /.netrc</pre>
+should return the error "No such file or directory". If any user has such a file, approach that user to discuss
+removing this file.
+The <tt>.netrc</tt> file is a configuration file used to make unattended logins to other systems via FTP. When this file
+exists, it frequently contains unencrypted passwords which may be used to attack other systems.</description>
+</Group>
+
 <Rule id="user_umask_bashrc">
 <title>
 Ensure the Default Bash Umask is Set Correctly
-- 
1.7.6.4



More information about the scap-security-guide mailing list