[PATCH 2/3] M1 Incomplete Guidance - Account and Access Control

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Apr 11 16:05:03 UTC 2012


Some issues for this patch:

1)
Does pam_ccreds exist on RHEL 6?  (I didn't think it did.) There is an
expectation that things are tested at least once (on RHEL 6) before
they're proposed for a commit.

2)
Per our brief discussion about the intent behind Rules
verify_wheel_exists and accounts_root_auditing_improved, there's too
much variation in the real world to insist that everyone call their
admin group wheel.  It may be better  as general discussion in a Group
(i.e to recommend that a group is used for all admin).

3)
The group bios_password is a nice addition, except that it's referencing
section numbers which don't exist or aren't correct (and aren't going to
be correct).  Let's avoid any references to sections via section number
in this project; in the other guide they were only made because it was
easy to keep straight by doing a \ref{} to a \label{} (in LaTeX).  (I
don't know if there is a similar facility in XCCDF / XHTML / DocBook, or
whether it's worth the trouble here).  Prior to commit, there's a
general expectation of proofreading, especially following a copy-paste
from the RHEL 5 guide.  Ditto for the section reference in Rule
login_shell_inactivity_timeout.



On 04/10/2012 05:24 PM, Mike Palmiotto wrote:
> From: Michael Palmiotto <mpalmiotto at tresys.com>
> 
> ---
>  .../checks/accounts_disabled_after_expiration.xml  |   24 +++++
>  .../accounts_login_shell_timeout_implemented.xml   |   55 +++++++++++
>  .../input/checks/accounts_netrc_files_checked.xml  |   25 +++++
>  .../checks/accounts_root_auditing_improved.xml     |   30 ++++++
>  .../accounts_user_dot_files_not_world_writable.xml |   33 +++++++
>  .../checks/libuser_login_defs_userdefaults.xml     |   50 ++++++++++
>  rhel6/src/input/system/accounts/accounts.xml       |   27 ++++++
>  rhel6/src/input/system/accounts/pam.xml            |   38 +++++++-
>  rhel6/src/input/system/accounts/physical.xml       |   41 ++++++++
>  .../system/accounts/restrictions/restrictions.xml  |   99 ++++++++++++++++++++
>  rhel6/src/input/system/accounts/session.xml        |   24 +++++
>  11 files changed, 445 insertions(+), 1 deletions(-)
>  create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
>  create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
>  create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
>  create mode 100644 rhel6/src/input/checks/accounts_root_auditing_improved.xml
>  create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
>  create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
> 
> diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
> new file mode 100644
> index 0000000..334c1dd
> --- /dev/null
> +++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
> @@ -0,0 +1,24 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_disabled_after_expiration" version="1">
> +    <metadata>
> +      <title> Ensure Accounts Set to Disable After Password Expiration</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description> Check for INACTIVE line in useradd.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="inactive set" test_ref="test_accounts_disabled_after_expiration_inactive" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" comment="inactive set in useradd" id="test_accounts_disabled_after_expiration_inactive" version="1">
> +    <ind:object object_ref="object_accounts_disabled_after_expiration_inactive" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_disabled_after_expiration_inactive" version="1">
> +    <ind:path>/etc/default</ind:path>
> +    <ind:filename>useradd</ind:filename>
> +    <ind:pattern operation="pattern match">^INACTIVE\=[\d{1,3}]\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
> new file mode 100644
> index 0000000..aa330c8
> --- /dev/null
> +++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml
> @@ -0,0 +1,55 @@
> +<def-group>
> + <!-- THIS FILE IS GENERATED by create_file_entries.py.  -->
> +  <definition class="compliance" id="accounts_login_shell_timeout_implemented" version="1">
> +    <metadata>
> +      <title> Implement Inactivity Time-out for Login Shells</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-3689-7, CCE-3707-7" source="CCE" />
> +      <description> Check if login shells set to automatically log users out after a certain period of inactivity.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="check readonly line" test_ref="test_accounts_login_shell_timeout_implemented_readonly" />
> +      <criterion comment="check timeout line" test_ref="test_accounts_login_shell_timeout_implemented_idle" />
> +      <criterion comment="check export line" test_ref="test_accounts_login_shell_timeout_implemented_export" />
> +      <criterion comment="check autologout line" test_ref="test_accounts_login_shell_timeout_implemented_implement" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" comment="readonly timeout" id="test_accounts_login_shell_timeout_implemented_readonly" version="1">
> +    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_readonly" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_readonly" version="1">
> +    <ind:path>/etc/profile.d</ind:path>
> +    <ind:filename>tmout.sh</ind:filename>
> +    <ind:pattern operation="pattern match">^readonly[\s]+TMOUT\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  <ind:textfilecontent54_test check="all" comment="idle timeout" id="test_accounts_login_shell_timeout_implemented_idle" version="1">
> +    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_idle" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_idle" version="1">
> +    <ind:path>/etc/profile.d</ind:path>
> +    <ind:filename>tmout.sh</ind:filename>
> +    <ind:pattern operation="pattern match">^TMOUT\=\d{3,5}\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  <ind:textfilecontent54_test check="all" comment="export timeout" id="test_accounts_login_shell_timeout_implemented_export" version="1">
> +    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_export" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_export" version="1">
> +    <ind:path>/etc/profile.d</ind:path>
> +    <ind:filename>tmout.sh</ind:filename>
> +    <ind:pattern operation="pattern match">^export[\s]+TMOUT\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  <ind:textfilecontent54_test check="all" comment="autologout" id="test_accounts_login_shell_timeout_implemented_implement" version="1">
> +    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_implement" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_implement" version="1">
> +    <ind:path>/etc/profile.d</ind:path>
> +    <ind:filename>autologout.csh</ind:filename>
> +    <ind:pattern operation="pattern match">^set[\s]+\-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
> new file mode 100644
> index 0000000..2a4a6ca
> --- /dev/null
> +++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
> @@ -0,0 +1,25 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_netrc_files_checked" version="1">
> +    <metadata>
> +      <title>Ensure No .netrc Files</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-TODO" source="CCE" />
> +      <description>Check that .netrc files are missing from all user accounts.</description>
> +    </metadata>
> +    <criteria >
> +      <criterion comment=".netrc files" test_ref="test_accounts_netrc_files_checked" negate="true" />
> +    </criteria>
> +  </definition>
> +  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_netrc_files_checked" version="1">
> +    <unix:object object_ref="object_accounts_netrc_files_checked" />
> +  </unix:file_test>
> +  <unix:file_object comment=".netrc files" id="object_accounts_netrc_files_checked" version="1">
> +    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
> +    <unix:path operation="equals">/home</unix:path>
> +    <unix:filename operation="pattern match">.netrc</unix:filename>
> +  </unix:file_object>
> +</def-group>
> +
> +
> diff --git a/rhel6/src/input/checks/accounts_root_auditing_improved.xml b/rhel6/src/input/checks/accounts_root_auditing_improved.xml
> new file mode 100644
> index 0000000..648bc02
> --- /dev/null
> +++ b/rhel6/src/input/checks/accounts_root_auditing_improved.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_root_auditing_improved" version="1">
> +    <metadata>
> +      <title>Verify Sudo Audit Trail</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-4044-4" source="CCE" />
> +      <description>Check if the following line appears in /etc/sudoers.</description>
> +    </metadata>
> +   
> +    <criteria operator="AND">
> +      
> +	<criterion comment="check_sudoers" test_ref="test_accounts_root_auditing_improved_sudoers" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment="check sudoers" id="test_accounts_root_auditing_improved_sudoers" version="1">
> +    <ind:object object_ref="object_accounts_root_auditing_improved_sudoers" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_root_auditing_improved_sudoers" version="1">
> +    <ind:path> /etc</ind:path>
> +    <ind:filename> sudoers</ind:filename>
> +    <ind:pattern operation="pattern match">^\%wheel[\s]+[\s]+ALL\=\(ALL\)[\s]+[\s]+ALL\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
> new file mode 100644
> index 0000000..82a9e45
> --- /dev/null
> +++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
> @@ -0,0 +1,33 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_user_dot_files_not_world_writable" version="1">
> +    <metadata>
> +      <title>Ensure User Dot Files not World Writable</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-TODO" source="CCE" />
> +      <description>File permissions should be set correctly for dot-files for all user accounts.</description>
> +    </metadata>
> +    <criteria >
> +      <criterion comment="user dot files" test_ref="test_accounts_user_dot_files_not_world_writable" negate="true" />
> +    </criteria>
> +  </definition>
> +  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_user_dot_files_not_world_writable" version="1">
> +    <unix:object object_ref="object_accounts_user_dot_files_not_world_writable" />
> +    <unix:state state_ref="state_dot_files_wrong_perm" />
> +  </unix:file_test>
> +  <unix:file_object comment="user dot files" id="object_accounts_user_dot_files_not_world_writable" version="1">
> +    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
> +    <unix:path operation="equals">/home</unix:path>
> +    <unix:filename operation="pattern match">.*</unix:filename>
> +    <filter action="include">state_dot_files_wrong_perm</filter>
> +  </unix:file_object>
> +  <unix:file_state id="state_dot_files_wrong_perm" version="1" operator="OR">
> +    <unix:suid datatype="boolean">true</unix:suid>
> +    <unix:sgid datatype="boolean">true</unix:sgid>
> +    <unix:sticky datatype="boolean">true</unix:sticky>
> +    <unix:gwrite datatype="boolean">true</unix:gwrite>
> +    <unix:owrite datatype="boolean">true</unix:owrite>
> +  </unix:file_state>
> +</def-group>
> +
> diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
> new file mode 100644
> index 0000000..66345a5
> --- /dev/null
> +++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
> @@ -0,0 +1,50 @@
> +<def-group>
> +  <definition class="compliance" id="libuser_login_defs_userdefaults" version="1">
> +    <metadata>
> +      <title>Check if Password Parameters are Removed from libuser.conf</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description> Make sure the password password parameters are removed from libuser.conf.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +  
> +      <criterion comment="shadowmin removed" test_ref="test_libuser_login_defs_removed_shadowmin" />
> +      <criterion comment="shadowmax removed" test_ref="test_libuser_login_defs_removed_shadowmax" />
> +      <criterion comment="shadowwarn removed" test_ref="test_libuser_login_defs_removed_shadowwarn" />
> + 
> +    </criteria>
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmin removed from login.defs" id="test_libuser_login_defs_removed_shadowmin" version="1">
> +    <ind:object object_ref="object_libuser_login_defs_removed_shadowmin" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmin" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>login.defs</ind:filename>
> +    <ind:pattern operation="pattern match">^LU\_SHADOWMIN\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> + 
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmax removed from login.defs" id="test_libuser_login_defs_removed_shadowmax" version="1">
> +    <ind:object object_ref="object_libuser_login_defs_removed_shadowmax" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmax" version="1">   
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>login.defs</ind:filename>
> +    <ind:pattern operation="pattern match">^LU\_SHADOWMAX\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowwarn removed from login.defs" id="test_libuser_login_defs_removed_shadowwarn" version="1">
> +    <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowwarn" version="1">   
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>login.defs</ind:filename>
> +    <ind:pattern operation="pattern match">^LU\_SHADOWWARNING\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/input/system/accounts/accounts.xml
> index fbdeb39..e5b61a6 100644
> --- a/rhel6/src/input/system/accounts/accounts.xml
> +++ b/rhel6/src/input/system/accounts/accounts.xml
> @@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a
>  necessary part of securing a system. This section introduces
>  mechanisms for restricting access to accounts under
>  RHEL6.</description>
> +
> +<Group id="all_human_users_group">
> +<title> Create and Maintain a Group Containing All Human Users</title>
> +<description>
> +Identify all user accounts on the system which correspond to human users. Depending on your system
> +configuration, this may be all entries in <tt>/etc/passwd</tt> with UID values of at least 500. Once, you have
> +identified such a set of users, create a group named usergroup (substitute some name appropriate to your
> +environment) and populate it with each human user:
> +<pre># groupadd <i>usergroup</i>
> +# usermod -G <i>usergroup human1</i>
> +# usermod -G <i>usergroup human2</i>
> +...
> +# usermod -G <i>usergroup humanN</i></pre>
> +Then modify your procedure for creating new user accounts by adding <tt>-G</tt> <i>usergroup</i> to the set of flags with
> +which <tt>useradd</tt> is invoked, so that new human users will be placed in the correct group by default.
> +
> +Creating a group of human users does not, by itself, enhance system security. However, as you work on securing
> +your system, you will often find commands which never need to be run by system accounts, or which are only
> +ever needed by users logged into the graphical console (which should only ever be available to human users, even
> +on workstations). Once a group of users has been created, it is easy to restrict access to a given command, for
> +instance <i>/path/to/graphical/command</i>, to authorized users:
> +<pre># chgrp <i>usergroup /path/to/graphical/command</i>
> +# chmod 750 <i>/path/graphical/command</i></pre>
> +Without a group of human users, it is necessary to restrict access by somehow preventing each system account
> +from running the command, which is an error-prone process even when it is possible at all.</description>
> +<!-- <oval id="accounts_all_human_users_group_maintained" /> -->
> +</Group>
>  </Group>
> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
> index bc91277..0782e1d 100644
> --- a/rhel6/src/input/system/accounts/pam.xml
> +++ b/rhel6/src/input/system/accounts/pam.xml
> @@ -309,6 +309,31 @@ prevents direct password guessing attacks.
>  
>  </Group>
>  
> +<!-- Removed: Too complicated to enforce
> +<Rule id="restrict_userhelper_execution">
> +<title> Restrict Execution of <tt>userhelper</tt> to Console Users</title>
> +<description>
> +If your environment has defined a group, <i>usergroup</i> containing all the human users of your system, restrict
> +execution of the <tt>userhelper</tt> program to only that group:
> +<pre># chgrp usergroup /usr/sbin/userhelper
> +# chmod 4710 /usr/sbin/userhelper</pre>
> +The <tt>userhelper</tt> program provides authentication for graphical services which must run with <tt>root</tt> privileges,
> +such as the <tt>system-config<tt>- family of graphical configuration utilities. Only human users logged into the system
> +console are likely to ever have a legitimate need to run these utilities. This step provides some protection against
> +possible flaws in <tt>userhelper</tt>'s implementation, and against further privilege escalation when system accounts
> +are compromised. See Section 2.3.2.2 for more information on creating a group of human users.
> +The <tt>userhelper</tt> program is configured by the files in <tt>/etc/security/console.apps/</tt>. Each file specifies, for
> +some program, what user the program should run as, and what program should be executed after successful
> +authentication.
> +Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in combination with the PAM configura-
> +tion of the service defined in <tt>/etc/pam.d/</tt>. First, <tt>userhelper</tt> determines what user the service should run as.
> +(Typically, this will be <tt>root</tt>.) Next, <tt>userhelper</tt> uses the PAM API to allow the user who ran the program to
> +attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if the application's
> +configuration requests one.</description>
> +<ident cce="4185-5, 3952-9" />
> +<oval id="accounts_pam_userhelper_execution_restricted" />
> +</Rule>
> +-->
>  
>  <Rule id="set_password_hashing_algorithm">
>  <title>Set Password Hashing Algorithm</title>
> @@ -374,7 +399,18 @@ compromised could be used yet again by an attacker.
>  <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/>
>  <ref nist="IA-5" />
>  </Rule>
> -</Group>
> +</Group> <!-- End <Group id="limiting_password_reuse"> -->
> +
> +<Rule id="pam_ccreds_removed">
> +<title> Remove the <tt>pam_ccreds</tt> Package if Possible</title>
> +<description>
> +Unless its credential caching functionality is required, remove the <tt>pam_ccreds</tt> package:
> +<pre># yum erase pam_ccreds</pre>
> +The <tt>pam_ccreds</tt> package contains the setuid program <tt>/usr/sbin/ccreds_validate</tt> and should be removed
> +unless it provides essential functionality. Any credentials cached on a system would also be compromised if an
> +attacker obtains control of the system.</description>
> +<oval id="package_pam_ccreds_removed" />
> +</Rule>
>  
>  </Group>
>  
> diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml
> index 45ad144..27441e0 100644
> --- a/rhel6/src/input/system/accounts/physical.xml
> +++ b/rhel6/src/input/system/accounts/physical.xml
> @@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an
>  attacker to quickly or undetectably modify a system from its
>  console.</description>
>  
> +<Group id="bios_password">
> +<title>Set BIOS Password</title>
> +<description>BIOS (on x86 systems) is the first code to execute during system startup and controls many important
> +system parameters, including which devices the system will try to boot from, and in which order.
> +Assign a password to prevent any unauthorized changes to the BIOS configuration. The exact steps will
> +vary depending on your machine, but are likely to include:
> +1.Reboot the machine.
> +2.Press the appropriate key during the initial boot screen (F2 is typical).
> +3.Navigate the BIOS configuration menu to add a password.
> +The exact process will be system-specific and the system's hardware manual may provide detailed instructions.
> +This password should prevent attackers with physical access from attempting to change important parameters,
> +such as those described in Sections 2.5.2.2.1 and 2.2.2.2.4. However, an attacker with physical access can usually
> +clear the BIOS password. The password should be written down and stored in a physically-secure location, such
> +as a safe, in the event that it is forgotten and must be retrieved.
> +</description>
> +</Group>
> +
>  <Group id="bootloader">
>  <title>Set Boot Loader Password</title>
>  <description>During the boot process, the boot loader is
> @@ -133,6 +150,30 @@ services, weakening system security.
>  <ref nist="CM-7, IA-4, SC-2"/>
>  </Rule>
>  
> +<Rule id="login_shell_inactivity_timeout">
> +<title> Implement Inactivity Time-out for Login Shells</title>
> +<description>
> +If the system does not run X Windows, then the login shells can be configured to automatically log users out after
> +a period of inactivity. The following instructions are not practical for systems which run X Windows, as they
> +will close terminal windows in the X environment. For information on how to automatically lock those systems,
> +see Section 2.3.5.6.
> +To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt> shell, create a new file <tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with the following lines:
> +<pre>TMOUT=900
> +readonly TMOUT
> +export TMOUT</pre>
> +To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a new file <tt>autologout.csh</tt> in the directory
> +<tt>/etc/profile.d</tt> with the following line:
> +<pre>set -r autologout 15</pre>
> +Similar actions should be taken for any other login shells used.
> +The example time-out here of 15 minutes should be adjusted to whatever your security policy requires. The
> +readonly line for <tt>bash</tt> and the <tt>-r</tt> option for <tt>tcsh</tt> can be omitted if policy allows users to override the value.
> +The automatic shell logout only occurs when the shell is the foreground process. If, for example, a <tt>vi</tt> session is
> +left idle, then automatic logout would not occur.
> +When logging in through a remote connection, as with SSH, it may be more effective to set the timeout value
> +directly through that service. To learn how to set automatic timeout intervals for SSH, see Section 3.5.2.3.</description>
> +<ident cce="3689-7, 3707-7" />
> +<oval id="accounts_login_shell_timeout_implemented" />
> +</Rule>
>  
>  <Group id="screen_locking">
>  <title>Configure Screen Locking</title>
> diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
> index febead6..cfee882 100644
> --- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml
> +++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
> @@ -10,4 +10,103 @@ console. Therefore, mechanisms for accessing accounts by entering
>  usernames and passwords should be restricted to those which are
>  operationally necessary.</description>
>  
> +<!--
> +<Rule id="limit_su_access_to_root">
> +<title> Limit <tt>su</tt> Access to the Root Account</title>
> +<description>"1.Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
> +to execute commands as root are members of that group.
> +<pre># grep ^wheel /etc/group</pre>
> +2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line:
> +<pre>auth       required        pam_wheel.so    use_uid</pre>
> +The <tt>su</tt> command allows a user to gain the privileges of another user by entering the password for that user's
> +account. It is desirable to restrict the root user so that only known administrators are ever allowed to access the
> +root account. This restricts password-guessing against the root account by unauthorized users or by accounts
> +which have been compromised. <br />
> +By convention, the group <tt>wheel</tt> contains all users who are allowed to run privileged commands. The PAM
> +module <tt>pam_wheel.so</tt> is used to restrict root access to this set of users.</description>
> +<ident cce="14088-9, 15047-4" />
> +<oval id="accounts_su_access_limited" />
> +<ref nist="AC-2, AC-3, CM-6" />
> +</Rule>
> +-->
> +
> +<Group id="configure_sudo">
> +<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root Access</title>
> +<description>
> +The <tt>sudo</tt> command allows fine-grained control over which users can execute commands using other accounts.
> +The primary benefit of <tt>sudo</tt> when configured as above is that it provides an audit trail of every command run
> +by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an
> +established procedure that all root commands are run using <tt>sudo</tt>, then it is easy for an auditor to detect unusual
> +behavior when this procedure is not followed. <br />
> +</description>
> +
> +<warning>
> +Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration error may make it impossible to access
> +the root account remotely. The recommended means of editing this file is using the <tt>visudo</tt> command, which
> +checks the file's syntax for correctness before allowing it to be saved. <br />
> +
> +Note that <tt>sudo</tt> allows any attacker who gains access to the password of an administrator account to run commands
> +as root. This is a downside which must be weighed against the benefits of increased audit capability and of being
> +able to heavily restrict the use of the high-value root password (which can be logistically difficult to change
> +often). As a basic precaution, <i>never</i> use the <tt>NOPASSWD</tt> directive, which would allow anyone with access to an administrator account to execute commands as root without knowing the administrator's password. <br />
> +</warning>
> +
> +<Rule id="verify_wheel_exists">
> +<description>
> +Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
> +to execute commands as root are members of that group.
> +<pre># grep ^wheel /etc/group</pre></description>
> +<oval id="accounts_wheel_exists" />
> +</Rule>
> +
> +<Rule id="verify_sudo_audit_trail">
> +<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line:
> +<pre>%wheel     ALL=(ALL)       ALL</pre>
> +</description>
> +<oval id="accounts_root_auditing_improved" />
> +</Rule>
> +</Group>
> +
> +<Group id="remove_password_parameters">
> +<title> Remove Password Parameters from <tt>libuser.conf</tt></title>
> +<description>The <tt>/etc/libuser.conf</tt> file contains configuration options for the libuser library, which is intended to implement
> +a standardized interface for manipulating and administering user and group accounts. By default, it sources
> +password settings from <tt>/etc/login.defs</tt>, but it can override these parameters. The man page <tt>libuser.conf(5)</tt> contains more information.</description>
> +
> +<Rule id="verify_libuser_login_defs_import">
> +<title>Verify Line Under Import Section</title>
> +<description>
> +Ensure the following line exists within the file <tt>/etc/libuser.conf</tt> under the <tt>[import]</tt> section.
> +<pre>login_defs = /etc/login.defs</pre></description>
> +<oval id="libuser_login_defs_import" />
> +</Rule>
> +
> +<Rule id="verify_libuser_login_defs_userdefaults">
> +<title>Verify Lines do not Appear in Userdefaults Section</title>
> +<description>
> +Ensure that no lines beginning with the following appear in the <tt>[userdefaults]</tt> section of the file, as
> +these override settings from <tt>/etc/login.defs</tt>:
> +<pre>LU_SHADOWMAX
> +LU_SHADOWMIN
> +LU_SHADOWWARNING</pre></description>
> +<oval id="libuser_login_defs_userdefaults" />
> +</Rule>
> +</Group>
> +
> +
> +<Rule id="verify_accounts_disabled_after_expiration">
> +<title> Set Accounts to Disable After Password Expiration</title>
> +<description>
> +In order to automatically disable local accounts some number of <i>DAYS</i> after password expiration, add or
> +modify the following line in <tt>/etc/default/useradd</tt>:
> +<pre>INACTIVE=<i>DAYS</i></pre>
> +For example, if <pre>INACTIVE=30</pre> and if the password is currently on the verge of expiration, then 30 days remain
> +until the account is automatically disabled. If the password will not expire for another 60 days, then 90 days
> +remain until the account is automatically disabled. See <tt>useradd(8)</tt> for more information.
> +Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period
> +of inactivity for users in your environment. Setting the timeout too low incurs support costs and also has the
> +potential to impact availability of the system to legitimate users.</description>
> +<oval id="accounts_disabled_after_expiration" />
> +</Rule>
> +
>  </Group>
> diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml
> index 00b5a8d..f7e6530 100644
> --- a/rhel6/src/input/system/accounts/session.xml
> +++ b/rhel6/src/input/system/accounts/session.xml
> @@ -114,6 +114,19 @@ groups or ACLs.
>  <ref nist="AC-3, CM-6"/>
>  </Rule>
>  
> +<Rule id="ensure_dot_files_not_world_writable">
> +<title> Ensure that User Dot-Files are not World-writable</title>
> +<description>
> +For each human user <i>USER</i> of the system, view the permissions of all dot-files in the user's home directory:
> +<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre>
> +Ensure that none of these files are group- or world-writable. Correct each misconfigured file <i>FILE</i> by exe-
> +cuting:
> +<pre># chmod go-w /home/USER /FILE</pre>
> +A user who can modify another user's configuration files can likely execute commands with the other user's
> +privileges, including stealing data, destroying files, or launching further attacks on the system.</description>
> +<oval id="accounts_user_dot_files_not_world_writable" />
> +</Rule>
> +
>  <Group id="user_umask">
>  <title>Ensure that Users Have Sensible Umask Values</title>
>  <description>
> @@ -168,6 +181,17 @@ operator="equals" interactive="0">
>  <value selector="077">077</value>
>  </Value>
>  
> +<Group id="ensure_no_netrc_files">
> +<title> Ensure that Users do not Have <tt>.netrc</tt> Files</title>
> +<description>
> +For each human user <i>USER</i> of the system, ensure that the user has no <tt>.netrc</tt> file. The command:
> +<pre># ls -l /home/<i>USER</i> /.netrc</pre>
> +should return the error "No such file or directory". If any user has such a file, approach that user to discuss
> +removing this file.
> +The <tt>.netrc</tt> file is a configuration file used to make unattended logins to other systems via FTP. When this file
> +exists, it frequently contains unencrypted passwords which may be used to attack other systems.</description>
> +</Group>
> +
>  <Rule id="user_umask_bashrc">
>  <title>
>  Ensure the Default Bash Umask is Set Correctly


More information about the scap-security-guide mailing list