[PATCH 1/3] M1 Incomplete Guidance - Proxy

Mike Palmiotto mpalmiotto at tresys.com
Tue Apr 10 21:24:41 UTC 2012


From: Michael Palmiotto <mpalmiotto at tresys.com>

---
 .../input/checks/service_squid_acls_configured.xml |   60 ++++
 .../service_squid_authentication_configured.xml    |   30 ++
 .../service_squid_default_insecure_changed.xml     |   60 ++++
 .../service_squid_default_secure_verified.xml      |  100 ++++++
 .../service_squid_listening_port_uncommon.xml      |   30 ++
 .../input/checks/service_squid_logs_forwarded.xml  |   30 ++
 .../checks/service_squid_privileges_lowered.xml    |   74 +++++
 rhel6/src/input/checks/system_icp_configured.xml   |   50 +++
 .../input/checks/system_proxy_access_allowed.xml   |   30 ++
 rhel6/src/input/services/squid.xml                 |  328 +++++++++++++++++++-
 10 files changed, 790 insertions(+), 2 deletions(-)
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured.xml
 create mode 100644 rhel6/src/input/checks/service_squid_authentication_configured.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_changed.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_secure_verified.xml
 create mode 100644 rhel6/src/input/checks/service_squid_listening_port_uncommon.xml
 create mode 100644 rhel6/src/input/checks/service_squid_logs_forwarded.xml
 create mode 100644 rhel6/src/input/checks/service_squid_privileges_lowered.xml
 create mode 100644 rhel6/src/input/checks/system_icp_configured.xml
 create mode 100644 rhel6/src/input/checks/system_proxy_access_allowed.xml

diff --git a/rhel6/src/input/checks/service_squid_acls_configured.xml b/rhel6/src/input/checks/service_squid_acls_configured.xml
new file mode 100644
index 0000000..a68be3d
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured.xml
@@ -0,0 +1,60 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured" version="1">
+    <metadata>
+      <title>Access Control Lists (ACLs) Tightened</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-511-2, CCE-4529-4, CCE-3610-3, CCE-4466-9, CCE-4607-8, CCE-4255-6, CCE-4127-7, CCE-4519-5, CCE-4413-1, CCE-4373-7" source="CCE" />
+      <description>ACL policies tightened.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" access_list src" test_ref="test_service_squid_acls_configured_access_list" />
+	<criterion comment=" http_access allow" test_ref="test_service_squid_acls_configured_access_list_allow" />
+	<criterion comment=" deny to_localhost" test_ref="test_service_squid_acls_configured_http_access" />
+	<criterion comment=" http_access deny all" test_ref="test_service_squid_acls_configured_deny_access" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" access_list src" id="test_service_squid_acls_configured_access_list" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_access_list" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_access_list" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+\_\_regex\_\_\(\[\\w\(\_\)\*\]\+\)[\s]+src[\s]+\_\_regex\_\_\(\\d\{2\,3\}\)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" http_access allow" id="test_service_squid_acls_configured_access_list_allow" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_access_list_allow" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_access_list_allow" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" deny to_localhost" id="test_service_squid_acls_configured_http_access" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_http_access" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_http_access" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+deny[\s]+to\_localhost\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" http_access deny all" id="test_service_squid_acls_configured_deny_access" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_deny_access" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_deny_access" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+deny[\s]+all\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_authentication_configured.xml b/rhel6/src/input/checks/service_squid_authentication_configured.xml
new file mode 100644
index 0000000..c21349c
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_authentication_configured.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_authentication_configured" version="1">
+    <metadata>
+      <title>Ensure Squid Authentication Configured (if Applicable)</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Ensure ACL Forced to Require Authentication</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" proxy_auth required" test_ref="test_service_squid_authentication_configured_acl" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" proxy_auth required" id="test_service_squid_authentication_configured_acl" version="1">
+    <ind:object object_ref="object_service_squid_authentication_configured_acl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_authentication_configured_acl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+[\w(_)*]+[\s]+proxy\_auth[\s]+REQUIRED\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_insecure_changed.xml b/rhel6/src/input/checks/service_squid_default_insecure_changed.xml
new file mode 100644
index 0000000..f11175c
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_insecure_changed.xml
@@ -0,0 +1,60 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_insecure_changed" version="1">
+    <metadata>
+      <title>Verify Default Insecure Settings</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4181-4, CCE-4577-3, CCE-4344-8, CCE-4494-1" source="CCE" />
+      <description>Ensure that insecure default settings are changed</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" forwarded_for off" test_ref="test_service_squid_default_insecure_changed_forwarded" />
+	<criterion comment=" httpd_suppress_version_string on" test_ref="test_service_squid_default_insecure_changed_suppress_version_string" />
+	<criterion comment=" log_mime_hdrs on" test_ref="test_service_squid_default_insecure_changed_log_mime" />
+	<criterion comment=" allow_underscore off" test_ref="test_service_squid_default_insecure_changed_underscore" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" forwarded_for off" id="test_service_squid_default_insecure_changed_forwarded" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_changed_forwarded" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_forwarded" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^forwarded\_for[\s]+off\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" httpd_suppress_version_string on" id="test_service_squid_default_insecure_changed_suppress_version_string" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_changed_suppress_version_string" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_suppress_version_string" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^httpd\_suppress\_version\_string[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" log_mime_hdrs on" id="test_service_squid_default_insecure_changed_log_mime" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_changed_log_mime" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_log_mime" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^log\_mime\_hdrs[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" allow_underscore off" id="test_service_squid_default_insecure_changed_underscore" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_changed_underscore" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_underscore" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^allow\_underscore[\s]+off\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_secure_verified.xml b/rhel6/src/input/checks/service_squid_default_secure_verified.xml
new file mode 100644
index 0000000..1d12422
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_secure_verified.xml
@@ -0,0 +1,100 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_secure_verified" version="1">
+    <metadata>
+      <title>Verify Default Secure Settings</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4454-5, CCE-4353-9, CCE-4503-9, CCE-3585-7, CCE-4419-8, CCE-3692-1, CCE-4459-4, CCE-4476-8" source="CCE" />
+      <description>Ensure that secure settings are not changed from their default values</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" check_hostnames" test_ref="test_service_squid_default_secure_verified_check_hostnames" />
+	<criterion comment=" reply_header_max_size" test_ref="test_service_squid_default_secure_verified_reply_header" />
+	<criterion comment=" ftp_sanitycheck" test_ref="test_service_squid_default_secure_verified_sanitycheck" />
+	<criterion comment=" ftp_passive" test_ref="test_service_squid_default_secure_verified_passive" />
+	<criterion comment=" ignore_unknown_nameservers" test_ref="test_service_squid_default_secure_verified_ignore_unknown_nameservers" />
+	<criterion comment=" cache_effective_group" test_ref="test_service_squid_default_secure_verified_cache_group" />
+	<criterion comment=" request_header_max_siz" test_ref="test_service_squid_default_secure_verified_request_header" />
+	<criterion comment=" cache_effective_user" test_ref="test_service_squid_default_secure_verified_cache_user" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" check_hostnames" id="test_service_squid_default_secure_verified_check_hostnames" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_check_hostnames" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_check_hostnames" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^check\_hostnames[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" reply_header_max_size" id="test_service_squid_default_secure_verified_reply_header" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_reply_header" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_reply_header" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^reply\_header\_max\_size[\s]+20[\s]+KB\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" ftp_sanitycheck" id="test_service_squid_default_secure_verified_sanitycheck" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_sanitycheck" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_sanitycheck" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ftp\_sanitycheck[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" ftp_passive" id="test_service_squid_default_secure_verified_passive" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_passive" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_passive" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ftp\_passive[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" ignore_unknown_nameservers" id="test_service_squid_default_secure_verified_ignore_unknown_nameservers" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_ignore_unknown_nameservers" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_ignore_unknown_nameservers" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ignore\_unknown\_nameservers[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" cache_effective_group" id="test_service_squid_default_secure_verified_cache_group" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_cache_group" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_cache_group" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^cache\_effective\_group[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" request_header_max_siz" id="test_service_squid_default_secure_verified_request_header" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_request_header" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_request_header" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^request\_header\_max\_size[\s]+20[\s]+KB\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" cache_effective_user" id="test_service_squid_default_secure_verified_cache_user" version="1">
+    <ind:object object_ref="object_service_squid_default_secure_verified_cache_user" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_cache_user" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^cache\_effective\_user[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml b/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml
new file mode 100644
index 0000000..3dd12b3
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_listening_port_uncommon" version="1">
+    <metadata>
+      <title>Ensure Listen on Uncommon Port</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Ensure an arbitrary but uncommon high port to use as the Squid listening port.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" Ensure arbitrary uncommon high port for Squid listening port." test_ref="test_service_squid_listening_port_uncommon_http_port" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" Ensure arbitrary uncommon high port for Squid listening port." id="test_service_squid_listening_port_uncommon_http_port" version="1">
+    <ind:object object_ref="object_service_squid_listening_port_uncommon_http_port" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_listening_port_uncommon_http_port" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_port[\s]+\d{4}\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_logs_forwarded.xml b/rhel6/src/input/checks/service_squid_logs_forwarded.xml
new file mode 100644
index 0000000..074462f
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_logs_forwarded.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_logs_forwarded" version="1">
+    <metadata>
+      <title>Forwarded Log Messages to Syslog Daemon</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Check if Squid sends messages to syslog.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" logs forwarded" test_ref="test_service_squid_logs_forwarded_squid_opts" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" logs forwarded" id="test_service_squid_logs_forwarded_squid_opts" version="1">
+    <ind:object object_ref="object_service_squid_logs_forwarded_squid_opts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_logs_forwarded_squid_opts" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^SQUID\_OPTS\=\"\$\{SQUID\_OPTS\:\-\"\-D\"\}[\s]+\-s\"\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_privileges_lowered.xml b/rhel6/src/input/checks/service_squid_privileges_lowered.xml
new file mode 100644
index 0000000..88b4f2e
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_privileges_lowered.xml
@@ -0,0 +1,74 @@
+<def-group>
+  <definition class="compliance" id="service_squid_privileges_lowered" version="1">
+    <metadata>
+      <title>Service Entry Privileges Lowered</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Ensure service entry is modified to lower priveleges</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" squid status" test_ref="test_service_squid_privileges_lowered_status" />
+	<criterion comment=" subsys remove" test_ref="test_service_squid_privileges_lowered_rm_subsys" />
+	<criterion comment=" bin determined" test_ref="test_service_squid_privileges_lowered_determine_bin" />
+	<criterion comment=" pid changed" test_ref="test_service_squid_privileges_lowered_change_pid" />
+	<criterion comment=" new pid location" test_ref="test_service_squid_privileges_lowered_new_pid_loc" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" squid status" id="test_service_squid_privileges_lowered_status" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_status" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_status" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^status[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment=" subsys remove" id="test_service_squid_privileges_lowered_rm_subsys" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_rm_subsys" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_rm_subsys" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^rm[\s]+\-f[\s]+\/var\/lock\/subsys\/squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment=" bin determined" id="test_service_squid_privileges_lowered_determine_bin" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_determine_bin" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_determine_bin" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^\[[\s]+\-f[\s]+\/usr\/sbin\/squid[\s]+\][\s]+&amp;&amp;[\s]+SQUID\=\"sudo[\s]+\-u[\s]+squid[\s]+squid\"\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment=" pid changed" id="test_service_squid_privileges_lowered_change_pid" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_change_pid" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_change_pid" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^\[[\s]+\$RETVAL[\s]+\-eq[\s]+0[\s]+\][\s]+&amp;&amp;[\s]+touch[\s]+\/var\/lock\/subsys\/squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment=" new pid location" id="test_service_squid_privileges_lowered_new_pid_loc" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_new_pid_loc" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_new_pid_loc" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^[\w(_)*]+[\s]+\/var\/spool\/squid\/squid\.pid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/system_icp_configured.xml b/rhel6/src/input/checks/system_icp_configured.xml
new file mode 100644
index 0000000..868335c
--- /dev/null
+++ b/rhel6/src/input/checks/system_icp_configured.xml
@@ -0,0 +1,50 @@
+<def-group>
+  <definition class="compliance" id="system_icp_configured" version="1">
+    <metadata>
+      <title>Ensure Internet Cache Protocol (ICP) Configured if Necessary</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>ICP port should be disabled if Squid server is standalone</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" icp_access allow" test_ref="test_system_icp_configured_neighbor_allow" />
+	<criterion comment=" icp_access deny all" test_ref="test_system_icp_configured_deny_rest" />
+	<criterion comment=" icp_port 0" test_ref="test_system_icp_configured_icp_port" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" icp_access allow" id="test_system_icp_configured_neighbor_allow" version="1">
+    <ind:object object_ref="object_system_icp_configured_neighbor_allow" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_system_icp_configured_neighbor_allow" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^icp\_access[\s]+allow[\s]+[\w(_)*]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" icp_access deny all" id="test_system_icp_configured_deny_rest" version="1">
+    <ind:object object_ref="object_system_icp_configured_deny_rest" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_system_icp_configured_deny_rest" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^icp\_access[\s]+deny[\s]+all\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" icp_port 0" id="test_system_icp_configured_icp_port" version="1">
+    <ind:object object_ref="object_system_icp_configured_icp_port" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_system_icp_configured_icp_port" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^icp\_port[\s]+0\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/system_proxy_access_allowed.xml b/rhel6/src/input/checks/system_proxy_access_allowed.xml
new file mode 100644
index 0000000..496f2d0
--- /dev/null
+++ b/rhel6/src/input/checks/system_proxy_access_allowed.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="system_proxy_access_allowed" version="1">
+    <metadata>
+      <title>Configured iptables to Allow Access to the Proxy Server</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Check inbound access to Squid proxy service.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" inbound access to squid proxy service" test_ref="test_system_proxy_access_allowed_netwk_mask" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" inbound access to squid proxy service" id="test_system_proxy_access_allowed_netwk_mask" version="1">
+    <ind:object object_ref="object_system_proxy_access_allowed_netwk_mask" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_system_proxy_access_allowed_netwk_mask" version="1">
+    <ind:path> /etc/sysconfig</ind:path>
+    <ind:filename> iptables"</ind:filename>
+    <ind:pattern operation="pattern match">^\-A[\s]+RH\-Firewall\-1\-INPUT[\s]+\-s[\s]+netwk[\s]+\/mask[\s]+\-m[\s]+state[\s]+\-\-state[\s]+NEW[\s]+\-p[\s]+tcp[\s]+\-\-dport[\s]+\d{4}[\s]+\-j[\s]+ACCEPT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/services/squid.xml b/rhel6/src/input/services/squid.xml
index 80dc4a4..1de3a46 100644
--- a/rhel6/src/input/services/squid.xml
+++ b/rhel6/src/input/services/squid.xml
@@ -43,6 +43,330 @@ removing it provides a safeguard against its activation.
 <ident cce="4076-6" />
 <oval id="package_squid_removed" />
 </Rule>
-</Group>
-</Group>
+</Group><!--End <Group id="disabling_squid"> -->
 
+<Group id="configure_squid">
+<title> Configure Squid if Necessary</title>
+<description> 
+The Squid configuration file is /etc/squid/squid.conf. The following recommendations can be applied to this 
+file. 
+Note: If a particular tag is not present in the configuration file, Squid falls back to the default setting (which 
+is often illustrated by a comment).</description>
+
+<Rule id="select_squid_listening_port">
+<title> Listen on Uncommon Port</title>
+<description> 
+The default listening port for the Squid service is 3128. As such, it is frequently scanned by adversaries looking 
+for proxy servers. 
+Select an arbitrary (but uncommon) high port to use as the Squid listening port and make the corresponding 
+change to the configuration file: 
+<pre>http_port port </pre>
+Run the following command to add a new SELinux port mapping for the service: 
+<pre># semanage port -a -t http_cache_port_t -p tcp port</pre></description>
+<oval id="squid_listening_port_uncommon" />
+</Rule>
+
+
+<Rule id="verify_default_secure_settings">
+<title> Verify Default Secure Settings</title>
+<description> 
+Several security-enhancing settings in the Squid configuration file are enabled by default, but appear as comments 
+in the configuration file (as mentioned in Section 3.19.2). In these instances, the explicit directive is not present, 
+which means it is implicitly enabled. If you are operating with a default configuration file, this section can be 
+ignored. 
+Ensure that the following security settings are NOT explicitly changed from their default values: 
+<pre>ftp_passive on 
+ftp_sanitycheck on 
+check_hostnames on 
+request_header_max_size 20 KB 
+reply_header_max_size 20 KB 
+cache_effective_user squid 
+cache_effective_group squid 
+ignore_unknown_nameservers on 
+</pre>
+<tt>ftp passive</tt> forces FTP passive connections. 
+<tt>ftp sanitycheck</tt> performs additional sanity checks on FTP data connections. 
+<tt>check hostnames</tt> ensures that hostnames meet RFC compliance. 
+<tt>request header max size</tt> and <tt>reply header max size</tt> place an upper limit on HTTP header length, precau- 
+tions against denial-of-service and buffer overflow vulnerabilities. 
+<tt>cache effective user</tt> and <tt>cache effective group</tt> designate the EUID and EGID of Squid following initial- 
+ization (it is essential that the EUID/EGID be set to an unprivileged sandbox account). 
+<tt>ignore unknown nameservers</tt> checks to make sure that DNS responses come from the same IP the request was 
+sent to.</description>
+<ident cce="4454-5, 4353-9, 4503-9, 3585-7, 4419-8, 3692-1, 4459-4, 4476-8" />
+<oval id="service_squid_default_secure_verified" />
+</Rule>
+
+
+<Rule id="change_default_insecure_settings">
+<title> Change Default Insecure Settings</title>
+<description> 
+The default configuration settings for the following tags are considered to be weak security and NOT recom- 
+mended. 
+Add or modify the configuration file to include the following lines: 
+<pre>allow_underscore off 
+httpd_suppress_version_string on 
+forwarded_for off 
+log_mime_hdrs on 
+</pre>
+<tt>allow_underscore</tt> enforces RFC 1034 compliance on hostnames by disallowing the use of underscores. 
+<tt>httpd</tt> suppress version string prevents Squid from revealing version information in web headers and error 
+pages. 
+<tt>forwarded_for</tt> reveals proxy client IP addresses in HTTP headers and should be disabled to prevent the leakage 
+of internal network configuration details. 
+<tt>log_mime_hdrs</tt> enables logging of HTTP response/request headers.</description>
+<ident cce="4181-4, 4577-3, 4344-8, 4494-1" />
+<oval id="service_squid_default_insecure_changed" />
+</Rule>
+
+<Rule id="configure_authentication">
+<title> Configure Authentication if Applicable</title>
+<description> 
+Note: Authentication cannot be used in the case of transparent proxies due to limitations of the TCP/IP 
+protocol. 
+Similar to web servers, two of the available options are Basic and Digest authentication. The other options are 
+NTLM and Negotiate authentication. As noted in Section 3.16.3.5, Basic authentication transmits passwords in 
+plain-text and is susceptible to passive monitoring. If network sniffing is a concern, basic authentication should 
+not be used. Negotiate is the newest and most secure protocol. It attempts to use Kerberos authentication and 
+falls back to NTLM if it cannot. It should be noted that Kerberos requires a third-party Key Distribution Center 
+(KDC) to function properly, whereas the other methods of authentication are two-party schemes. 
+
+Squid also offers the ability to choose a custom external authenticator. Designating an external authenticator 
+(also known as a "helper" module) allows Squid to offer pluggable third-party authentication schemes. LDAP is 
+one example of a helper module that exists and is in use today. 
+There are comments under the <tt>auth_param</tt> tag inside <tt>/etc/squid/squid.conf</tt> that provide extensive detail on how to configure each of these methods. If authentication is necessary, choose a method of authentication and 
+configure appropriately. The recommended minimum configurations illustrated for each method are acceptable. 
+To force an ACL (as discussed in Section 3.19.2.5) to require authentication, use the following directive: 
+<pre>acl <i>name-of-ACL</i> proxy_auth REQUIRED</pre>
+Note: The keyword <tt>REQUIRED</tt> can be replaced with a user or list of users to further restrict access to a smaller 
+subset of users.</description>
+<oval id="service_squid_authentication_configured" />
+</Rule>
+
+
+<Rule id="access_control_lists">
+<title> Access Control Lists (ACL)</title>
+<description> 
+Be very careful with the order of access control tags. Access control is handled top-down. The first 
+rule that matches is the only rule adhered to. The last rule on the list defines the default behavior 
+in the case of no rule match. 
+The acl and http_access tags are used in combination to allow filtering based on a series of access control lists. 
+Squid has a list of default ACLs for localhost, SSL ports, and "safe" ports. Following the definition of these 
+ACLs, a series of http access directives establish the following default filtering policy: 
+<ul>
+<li> Allow <tt>cachemgr</tt> access only from localhost </li>
+<li> Allow access to only ports in the "safe" access control list </li>
+<li> Limit <tt>CONNECT</tt> method to SSL ports only </li>
+<li> Allow access from localhost </li>
+<li> Deny all other requests </li>
+</ul>
+The default ACL policies are reasonable from a security standpoint. However, the number of ports listed as 
+"safe" could be significantly trimmed depending on the needs of your network. Out of the box, ports 21, 70, 80, 210, 280, 443, 488, 591, 777, and 1025 through 65535 are all considered safe. Some of these ports are associated
+with deprecated or rarely used protocols. As such, this list could be trimmed to further tighten filtering.
+The following actions should be taken to tighten the ACL policies:
+1.There is a filter line in the configuration file that is recommended but commented out. This line should
+be uncommented or added to prevent access to localhost from the proxy:
+<pre>http access deny to_localhost</pre>
+2.An access list should be setup for the specific network or networks that the proxy is intended to serve.
+Only this subset of IP addresses should be allowed access.
+Add these lines where the following comment appears:
+<pre>
+# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
+acl your-network-acl-name src ip-range
+http_access allow your-network-acl-name
+</pre>
+Note: <tt>ip-range</tt> is of the format xxx.xxx.xxx.xxx/xx
+3.Ensure that the final http access line to appear in the document is the following:
+<pre>http_access deny all</pre>
+This guarantees that all traffic not meeting an explicit filtering rule is denied.
+Further filters should be established to meet the specific needs of a network, explicitly allowing access
+only where necessary.
+4.Consult the chart below. Corresponding <tt>acl</tt> entries for unused protocols should be commented out and thus denied.
+<ul>
+<li>
+Port: 21<br />
+Service: <tt>ftp</tt> <br />
+File Transfer Protocol(FTP) is a widely used file transfer protocol. <br />
+ALLOW <br />
+</li>
+
+<li>
+Port: 70 <br />
+Service: <tt>gopher</tt> <br />
+The gopher protocol is a deprecated search and retrieval protocol
+that is almost extinct, with as few as 100 gopher servers present worldwide.
+Support for gopher is disabled in most modern browsers.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 80<br />
+Service: <tt>http</tt><br />
+A web proxy needs to allow access to HTTP traffic. <br />
+ALLOW<br />
+</li>
+
+<li>
+Port: 210<br />
+Service: <tt>wais</tt><br />
+The Wide Area Information Server port is similar 
+to gopher, serving as a text searching system
+to scour indexes on remote machines. Today, it is
+deprecated and nearly non-existent on the Inter-
+net.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 280<br />
+Service: <tt>http-mgmt</tt><br />
+No documentation of any kind could be found on the
+obscure service that resides on this port.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 443<br />
+Service: <tt>https</tt><br />
+SSL traffic is likely (and recommended) for any
+proxy and should be allowed.<br />
+ALLOW<br />
+</li>
+
+<li>
+Port: 488<br />
+Service: <tt>gss-http</tt><br />
+No documentation of any kind could be found on
+the obscure service that resides on this port.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 591<br />
+Service: <tt>filemaker</tt><br />
+Filemaker is a database application originally offered 
+by Apple in the 1980s. Although development continues
+ and it remains in use today, it should be disabled 
+if your network does not require such traffic.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 777<br />
+Service: <tt>multiling http</tt><br />
+No documentation of any kind could be found on
+the obscure service that resides on this port.<br />
+DENY<br />
+</li>
+
+<li>
+Port: 1025-65535<br />
+Service: unregistered ports<br />
+Random high ports are used by a variety of applications
+ and should be allowed.<br />
+ALLOW<br />
+</li>
+</ul>
+</description>
+<ident cce="4511-2, 4529-4, 3610-3, 4466-9, 4607-8, 4255-6, 4127-7, 4519-5, 4413-1, 4373-7" />
+<oval id="service_squid_acls_configured" />
+</Rule>
+
+
+<Rule id="configure_icp">
+<title> Configure Internet Cache Protocol (ICP) if Necessary</title>
+<description> 
+The ICP protocol is a cache communication protocol that allows multiple Squid servers to communicate. The 
+ICP protocol was designed with no security in mind, relying on user-defined access control lists alone to determine 
+which ICP messages to allow. 
+If a Squid server is standalone, the ICP port should be disabled by adding or correcting the following line in 
+the configuration file: 
+<pre>icp_port 0 </pre>
+If the Squid server is meant to speak with peers, strict ACLs should be established to only allow ICP traffic 
+from trusted neighbors. To accomplish this, add or correct the following lines: 
+<pre>icp_access allow <i>acl-defining-trusted-neighbors</i> 
+icp_access deny all</pre></description>
+<oval id="system_icp_configured" />
+</Rule>
+
+
+<Rule id="allow_proxy_server_access">
+<title> Configure iptables to Allow Access to the Proxy Server</title>
+<description> 
+Determine an appropriate network block, <i>netwk</i>, and network mask, <i>mask</i>, representing the machines on 
+your network which should operate as clients of the proxy server. 
+Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring that it appears <i>before</i> the final <tt>LOG</tt> and 
+<tt>DROP</tt> lines for the <tt>RH-Firewall-1-INPUT</tt> chain: 
+<pre>-A RH-Firewall-1-INPUT -s <i>netwk/mask</i> -m state --state NEW -p tcp --dport <i>port</i> -j ACCEPT </pre>
+For port , use either the default 3128 or the alternate port was selected in Section 3.19.2.1. 
+The default Iptables configuration does not allow inbound access to the Squid proxy service. This modification 
+allows that access, while keeping other ports on the server in their default protected state. See Section 2.5.5 for 
+more information about Iptables.</description>
+<oval id="system_proxy_access_allowed" />
+</Rule>
+
+
+<Rule id="forward_logs_to_syslogd">
+<title> Forward Log Messages to Syslog Daemon</title>
+<description> 
+The default behavior of Squid is to record its log messages in <tt>/var/log/squid.log</tt>. This behavior can be 
+supplemented so that Squid also sends messages to syslog as well. This is useful for centralizing log data, 
+particularly in instances where multiple Squid servers are present. 
+Squid provides a command line argument to enable syslog forwarding. Modify the <tt>SQUID_OPTS</tt> line in 
+<tt>/etc/init.d/squid</tt> to include the <tt>-s</tt> option: 
+<pre>SQUID_OPTS="${SQUID_OPTS:-"-D"} -s"</pre></description>
+<oval id="service_squid_logs_forwarded" />
+</Rule>
+
+
+<Group id="disallow_squid_root">
+<title> Do Not Run as Root</title>
+<description> 
+Since Squid is loaded by the system's <tt>service</tt> utility, it starts as root and then changes its effective UID to the 
+UID specified by the <tt>cache_effective_user</tt> directive. However, since it was still executed by root, the program 
+maintains a saved UID of root even after changing its effective UID. 
+To prevent this undesired behavior, Squid must either be configured to run in a chroot environment or it must 
+be executed by a non-privileged user in non-daemon mode (the <tt>service</tt> utility must not be used).</description>
+
+<Rule id="run_squid_in_chroot_jail">
+<title> Run Squid in a <tt>chroot</tt> Jail</title>
+<description> 
+Chrooting Squid can be a very complicated task. Documentation for the process is vague and a great deal 
+of trial and error may be required to determine all the files that need to be transitioned over to the chroot 
+environment. Therefore, this guide recommends instead the method detailed in Section 3.19.2.9.2 to lower 
+privileges. If chrooting Squid is still desired, it can be enabled with the following directive in the configuration 
+file: 
+<pre>chroot <i>chroot-path</i></pre>
+Then, all the necessary files used by Squid must be copied into the <i>chroot-path</i> directory. The specifics of this 
+step cannot be covered in this guide because they are highly dependent on the external programs used in the 
+Squid configuration. 
+Note: The <tt>strace</tt> utility is a valuable resource for discovering the files needed for the chroot environment.</description>
+<oval id="service_squid_chroot_jailed" />
+</Rule>
+
+
+<Rule id="lower_privileges">
+<title> Modify Service Entry to Lower Privileges</title>
+<description> 
+The following modification to <tt>/etc/init.d/squid</tt> forces the <tt>service</tt> utility to execute Squid as the squid
+user instead of the root user: 
+<pre># determine the name of the squid binary 
+[ -f /usr/sbin/squid ] &amp;&amp; SQUID="sudo -u squid squid" </pre>
+Making this change prevents Squid from writing its pid to <tt>/var/run</tt>. This pid file is used by <tt>service</tt> to 
+check to see if the program started successfully. Therefore, a new location must be chosen for this pid file 
+that the squid user has access to, and the corresponding references in <tt>/etc/init.d/squid</tt> must be altered 
+to point to it. 
+Make the following modification to the Squid configuration file: 
+<pre>pid_filename /var/spool/squid/squid.pid</pre>
+Edit the file <tt>/etc/init.d/squid</tt> by changing all occurrences of <tt>/var/run/squid.pid</tt> to <tt>/var/spool/squid/squid.pid</tt>
+Also modify the following line in <tt>/etc/init.d/squid</tt>: 
+<pre>[ $RETVAL -eq 0 ] &amp;&amp; touch /var/lock/subsys/squid</pre>
+and add the following lines immediately after it: 
+<pre>rm -f /var/lock/subsys/squid 
+status squid
+</pre></description>
+<oval id="service_squid_privileges_lowered" />
+</Rule>
+</Group> <!-- End <Group id="disallow_squid_root"> -->
+</Group> <!-- End <Group id="configure_squid"> -->
+</Group> <!-- End <Group id="proxy"> -->
-- 
1.7.6.4



More information about the scap-security-guide mailing list