[PATCH v2 1/2] M1 Incomplete Guidance - Account and Access Control

Michael Palmiotto mpalmiotto at tresys.com
Wed Apr 25 13:21:35 UTC 2012


Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
---
 .../checks/accounts_disabled_after_expiration.xml  |   24 ++++
 ...counts_login_shell_timeout_implemented_bash.xml |   45 ++++++++
 ...counts_login_shell_timeout_implemented_tcsh.xml |   25 +++++
 .../input/checks/accounts_netrc_files_checked.xml  |   25 +++++
 .../accounts_user_dot_files_not_world_writable.xml |   33 ++++++
 .../checks/libuser_login_defs_userdefaults.xml     |   50 +++++++++
 rhel6/src/input/profiles/common.xml                |   42 +++++++-
 rhel6/src/input/system/accounts/accounts.xml       |   27 +++++
 rhel6/src/input/system/accounts/pam.xml            |   38 +++++++-
 rhel6/src/input/system/accounts/physical.xml       |   63 +++++++++++
 .../system/accounts/restrictions/restrictions.xml  |  114 ++++++++++++++++++++
 rhel6/src/input/system/accounts/session.xml        |   24 ++++
 12 files changed, 508 insertions(+), 2 deletions(-)
 create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
 create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
 create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
 create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
 create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
 create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml

diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
new file mode 100644
index 0000000..334c1dd
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml
@@ -0,0 +1,24 @@
+<def-group>
+  <definition class="compliance" id="accounts_disabled_after_expiration" version="1">
+    <metadata>
+      <title> Ensure Accounts Set to Disable After Password Expiration</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description> Check for INACTIVE line in useradd.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="inactive set" test_ref="test_accounts_disabled_after_expiration_inactive" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" comment="inactive set in useradd" id="test_accounts_disabled_after_expiration_inactive" version="1">
+    <ind:object object_ref="object_accounts_disabled_after_expiration_inactive" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_disabled_after_expiration_inactive" version="1">
+    <ind:path>/etc/default</ind:path>
+    <ind:filename>useradd</ind:filename>
+    <ind:pattern operation="pattern match">^INACTIVE\=[\d{1,3}]\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
new file mode 100644
index 0000000..2f8b818
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
@@ -0,0 +1,45 @@
+<def-group>
+  <definition class="compliance" id="accounts_login_shell_timeout_implemented_bash" version="1">
+    <metadata>
+      <title> Implement Inactivity Time-out for bash Login Shell</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-3707-7" source="CCE" />
+      <description> Check if login shells set to automatically log users out after a certain period of inactivity.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="check readonly line" test_ref="test_accounts_login_shell_timeout_implemented_bash_readonly" />
+      <criterion comment="check timeout line" test_ref="test_accounts_login_shell_timeout_implemented_bash_idle" />
+      <criterion comment="check export line" test_ref="test_accounts_login_shell_timeout_implemented_bash_export" />
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="readonly timeout" id="test_accounts_login_shell_timeout_implemented_bash_readonly" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_bash_readonly" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_bash_readonly" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^readonly[\s]+TMOUT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="idle timeout" id="test_accounts_login_shell_timeout_implemented_bash_idle" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_bash_idle" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_bash_idle" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^TMOUT\=\d{3,5}\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="export timeout" id="test_accounts_login_shell_timeout_implemented_bash_export" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_bash_export" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_bash_export" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>tmout.sh</ind:filename>
+    <ind:pattern operation="pattern match">^export[\s]+TMOUT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
new file mode 100644
index 0000000..ce067ce
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
@@ -0,0 +1,25 @@
+<def-group>
+  <definition class="compliance" id="accounts_login_shell_timeout_implemented_tcsh" version="1">
+    <metadata>
+      <title> Check tcsh Inactivity Time-out</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-3689-7" source="CCE" />
+      <description> Check if tcsh login shell is set to log users out after period of inactivity.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="tcsh time-out check" test_ref="test_accounts_login_shell_timeout_implemented_tcsh" />
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="tcsh" id="test_accounts_login_shell_timeout_implemented_tcsh" version="1">
+    <ind:object object_ref="object_accounts_login_shell_timeout_implemented_tcsh" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_tcsh" version="1">
+    <ind:path>/etc/profile.d</ind:path>
+    <ind:filename>autologout.csh</ind:filename>
+    <ind:pattern operation="pattern match">^set[\s]+\-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
new file mode 100644
index 0000000..2a4a6ca
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml
@@ -0,0 +1,25 @@
+<def-group>
+  <definition class="compliance" id="accounts_netrc_files_checked" version="1">
+    <metadata>
+      <title>Ensure No .netrc Files</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-TODO" source="CCE" />
+      <description>Check that .netrc files are missing from all user accounts.</description>
+    </metadata>
+    <criteria >
+      <criterion comment=".netrc files" test_ref="test_accounts_netrc_files_checked" negate="true" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_netrc_files_checked" version="1">
+    <unix:object object_ref="object_accounts_netrc_files_checked" />
+  </unix:file_test>
+  <unix:file_object comment=".netrc files" id="object_accounts_netrc_files_checked" version="1">
+    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:path operation="equals">/home</unix:path>
+    <unix:filename operation="pattern match">.netrc</unix:filename>
+  </unix:file_object>
+</def-group>
+
+
diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
new file mode 100644
index 0000000..82a9e45
--- /dev/null
+++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
@@ -0,0 +1,33 @@
+<def-group>
+  <definition class="compliance" id="accounts_user_dot_files_not_world_writable" version="1">
+    <metadata>
+      <title>Ensure User Dot Files not World Writable</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-TODO" source="CCE" />
+      <description>File permissions should be set correctly for dot-files for all user accounts.</description>
+    </metadata>
+    <criteria >
+      <criterion comment="user dot files" test_ref="test_accounts_user_dot_files_not_world_writable" negate="true" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_user_dot_files_not_world_writable" version="1">
+    <unix:object object_ref="object_accounts_user_dot_files_not_world_writable" />
+    <unix:state state_ref="state_dot_files_wrong_perm" />
+  </unix:file_test>
+  <unix:file_object comment="user dot files" id="object_accounts_user_dot_files_not_world_writable" version="1">
+    <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:path operation="equals">/home</unix:path>
+    <unix:filename operation="pattern match">.*</unix:filename>
+    <filter action="include">state_dot_files_wrong_perm</filter>
+  </unix:file_object>
+  <unix:file_state id="state_dot_files_wrong_perm" version="1" operator="OR">
+    <unix:suid datatype="boolean">true</unix:suid>
+    <unix:sgid datatype="boolean">true</unix:sgid>
+    <unix:sticky datatype="boolean">true</unix:sticky>
+    <unix:gwrite datatype="boolean">true</unix:gwrite>
+    <unix:owrite datatype="boolean">true</unix:owrite>
+  </unix:file_state>
+</def-group>
+
diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
new file mode 100644
index 0000000..66345a5
--- /dev/null
+++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
@@ -0,0 +1,50 @@
+<def-group>
+  <definition class="compliance" id="libuser_login_defs_userdefaults" version="1">
+    <metadata>
+      <title>Check if Password Parameters are Removed from libuser.conf</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description> Make sure the password password parameters are removed from libuser.conf.</description>
+    </metadata>
+    <criteria operator="AND">
+  
+      <criterion comment="shadowmin removed" test_ref="test_libuser_login_defs_removed_shadowmin" />
+      <criterion comment="shadowmax removed" test_ref="test_libuser_login_defs_removed_shadowmax" />
+      <criterion comment="shadowwarn removed" test_ref="test_libuser_login_defs_removed_shadowwarn" />
+ 
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmin removed from login.defs" id="test_libuser_login_defs_removed_shadowmin" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowmin" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmin" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWMIN\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+ 
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmax removed from login.defs" id="test_libuser_login_defs_removed_shadowmax" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowmax" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmax" version="1">   
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWMAX\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowwarn removed from login.defs" id="test_libuser_login_defs_removed_shadowwarn" version="1">
+    <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowwarn" version="1">   
+    <ind:path>/etc</ind:path>
+    <ind:filename>login.defs</ind:filename>
+    <ind:pattern operation="pattern match">^LU\_SHADOWWARNING\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..8ac2554 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -20,6 +20,18 @@
 <select idref="selinux_unlabeled_device_files" selected="true"/>
 <select idref="restrict_root_console_logins" selected="true"/>
 <select idref="restrict_serial_port_logins" selected="true"/>
+
+<select idref="verify_libuser_login_defs_import" selected="true"/>
+<select idref="verify_libuser_login_defs_userdefaults" selected="true"/>
+<select idref="verify_accounts_disabled_after_expiration" selected="true"/>
+<!--<select idref="pam_ccreds_removed" selected="true"/> -->
+<select idref="ensure_dot_files_not_world_writable" selected="true" />
+<select idref="ensure_no_netrc_files" selected="true" />
+
+<!--<select idref="login_shell_inactivity_timeout" selected="true"/> -->
+<select idref="login_shell_timeout_bash" selected="true"/>
+<select idref="login_shell_timeout_tcsh" selected="true"/>
+
 <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
 <select idref="no_empty_passwords" selected="true"/>
 <select idref="no_hashes_outside_shadow" selected="true"/>
@@ -76,15 +88,26 @@
 <select idref="install_openswan" selected="true"/>
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="enable_rsyslog" selected="true"/>
+
+<select idref="ensure_rsyslog_messages_captured" selected="true"/>
+
 <select idref="userowner_rsyslog_files" selected="true"/>
 <select idref="groupowner_rsyslog_files" selected="true"/>
 <select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
 <!-- <select idref="rsyslog_accept_remote_messages" selected="true"/> -->
 <select idref="ensure_logrotate_activated" selected="true"/>
+
 <select idref="enable_auditd_service" selected="true"/>
 <select idref="enable_auditd_bootloader" selected="true"/>
+
+<select idref="configure_logwatch_on_logserver" selected="true"/>
+<select idref="disable_logwatch_for_logserver" selected="true"/>
+
 <select idref="audit_time_rules" selected="true"/>
+<select idref="configure_auditd_data_retention" selected="true"/>
+<!--<select idref="configure_auditd_data_retention" selected="true"/> -->
+
 <select idref="audit_account_changes" selected="true"/>
 <select idref="audit_network_modifications" selected="true"/>
 <select idref="audit_mac_changes" selected="true"/>
@@ -93,6 +116,10 @@
 <select idref="audit_privileged_commands" selected="true"/>
 <select idref="audit_media_exports" selected="true"/>
 <select idref="audit_file_deletions" selected="true"/>
+
+<select idref="audit_manual_logon_edits" selected="true"/>
+<select idref="audit_manual_session_edits" selected="true"/>
+
 <select idref="audit_sysadmin_actions" selected="true"/>
 <select idref="audit_kernel_module_loading" selected="true"/>
 <select idref="audit_config_immutable" selected="true"/>
@@ -144,7 +171,7 @@
 <!-- <select idref="postfix_package_installation" selected="true"/> -->
 <select idref="postfix_network_listening" selected="true"/>
 <select idref="ldap_client_tls_checkpeer" selected="true"/>
-<select idref="package_openldap-servers_removed" selected="true"/>
+<select idref="package_openldap-servers_removed" selected="true"/> 
 <select idref="service_nfslock_disabled" selected="true"/>
 <select idref="service_rpcgssd_disabled" selected="true"/>
 <select idref="service_rpcidmapd_disabled" selected="true"/>
@@ -165,6 +192,19 @@
 <select idref="disable_smb_server" selected="true"/>
 <select idref="require_smb_client_signing" selected="true"/>
 <select idref="require_smb_client_signing_mount.cifs" selected="true"/>
+
+<!--<select idref="select_squid_listening_port" selected="true"/>
+<select idref="verify_default_secure_settings" selected="true"/>
+<select idref="change_default_insecure_settings" selected="true"/>
+<select idref="configure_authentication" selected="true"/>
+<select idref="access_control_lists" selected="true"/>
+<select idref="configure_icp" selected="true"/>
+<select idref="allow_proxy_server_access" selected="true"/>
+<seelect idref="forward_logs_to_syslogd" selected="true"/>
+<select idref="run_squid_in_chroot_jail" selected="true"/>
+<select idref="lower_privileges" selected="true"/>
+-->
+
 <select idref="disable_squid" selected="true"/>
 <select idref="uninstall_squid" selected="true"/>
 <select idref="disable_snmpd" selected="true"/>
diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/input/system/accounts/accounts.xml
index fbdeb39..e5b61a6 100644
--- a/rhel6/src/input/system/accounts/accounts.xml
+++ b/rhel6/src/input/system/accounts/accounts.xml
@@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a
 necessary part of securing a system. This section introduces
 mechanisms for restricting access to accounts under
 RHEL6.</description>
+
+<Group id="all_human_users_group">
+<title> Create and Maintain a Group Containing All Human Users</title>
+<description>
+Identify all user accounts on the system which correspond to human users. Depending on your system
+configuration, this may be all entries in <tt>/etc/passwd</tt> with UID values of at least 500. Once, you have
+identified such a set of users, create a group named usergroup (substitute some name appropriate to your
+environment) and populate it with each human user:
+<pre># groupadd <i>usergroup</i>
+# usermod -G <i>usergroup human1</i>
+# usermod -G <i>usergroup human2</i>
+...
+# usermod -G <i>usergroup humanN</i></pre>
+Then modify your procedure for creating new user accounts by adding <tt>-G</tt> <i>usergroup</i> to the set of flags with
+which <tt>useradd</tt> is invoked, so that new human users will be placed in the correct group by default.
+
+Creating a group of human users does not, by itself, enhance system security. However, as you work on securing
+your system, you will often find commands which never need to be run by system accounts, or which are only
+ever needed by users logged into the graphical console (which should only ever be available to human users, even
+on workstations). Once a group of users has been created, it is easy to restrict access to a given command, for
+instance <i>/path/to/graphical/command</i>, to authorized users:
+<pre># chgrp <i>usergroup /path/to/graphical/command</i>
+# chmod 750 <i>/path/graphical/command</i></pre>
+Without a group of human users, it is necessary to restrict access by somehow preventing each system account
+from running the command, which is an error-prone process even when it is possible at all.</description>
+<!-- <oval id="accounts_all_human_users_group_maintained" /> -->
+</Group>
 </Group>
diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index bc91277..34af4f9 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -309,6 +309,31 @@ prevents direct password guessing attacks.
 
 </Group>
 
+<!-- Removed: Too complicated to enforce
+<Rule id="restrict_userhelper_execution">
+<title> Restrict Execution of <tt>userhelper</tt> to Console Users</title>
+<description>
+If your environment has defined a group, <i>usergroup</i> containing all the human users of your system, restrict
+execution of the <tt>userhelper</tt> program to only that group:
+<pre># chgrp usergroup /usr/sbin/userhelper
+# chmod 4710 /usr/sbin/userhelper</pre>
+The <tt>userhelper</tt> program provides authentication for graphical services which must run with <tt>root</tt> privileges,
+such as the <tt>system-config<tt>- family of graphical configuration utilities. Only human users logged into the system
+console are likely to ever have a legitimate need to run these utilities. This step provides some protection against
+possible flaws in <tt>userhelper</tt>'s implementation, and against further privilege escalation when system accounts
+are compromised. See Section 2.3.2.2 for more information on creating a group of human users.
+The <tt>userhelper</tt> program is configured by the files in <tt>/etc/security/console.apps/</tt>. Each file specifies, for
+some program, what user the program should run as, and what program should be executed after successful
+authentication.
+Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in combination with the PAM configura-
+tion of the service defined in <tt>/etc/pam.d/</tt>. First, <tt>userhelper</tt> determines what user the service should run as.
+(Typically, this will be <tt>root</tt>.) Next, <tt>userhelper</tt> uses the PAM API to allow the user who ran the program to
+attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if the application's
+configuration requests one.</description>
+<ident cce="4185-5, 3952-9" />
+<oval id="accounts_pam_userhelper_execution_restricted" />
+</Rule>
+-->
 
 <Rule id="set_password_hashing_algorithm">
 <title>Set Password Hashing Algorithm</title>
@@ -374,7 +399,18 @@ compromised could be used yet again by an attacker.
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/>
 <ref nist="IA-5" />
 </Rule>
-</Group>
+</Group> <!-- End <Group id="limiting_password_reuse"> -->
 
+<!--<Rule id="pam_ccreds_removed">
+<title> Remove the <tt>pam_ccreds</tt> Package if Possible</title>
+<description>
+Unless its credential caching functionality is required, remove the <tt>pam_ccreds</tt> package:
+<pre># yum erase pam_ccreds</pre>
+The <tt>pam_ccreds</tt> package contains the setuid program <tt>/usr/sbin/ccreds_validate</tt> and should be removed
+unless it provides essential functionality. Any credentials cached on a system would also be compromised if an
+attacker obtains control of the system.</description>
+<oval id="package_pam_ccreds_removed" />
+</Rule>
+ No longer exists in RHEL6 -->
 </Group>
 
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml
index 45ad144..b4a3e76 100644
--- a/rhel6/src/input/system/accounts/physical.xml
+++ b/rhel6/src/input/system/accounts/physical.xml
@@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an
 attacker to quickly or undetectably modify a system from its
 console.</description>
 
+<Group id="bios_password">
+<title>Set BIOS Password</title>
+<description>BIOS (on x86 systems) is the first code to execute during system startup and controls many important
+system parameters, including which devices the system will try to boot from, and in which order.
+Assign a password to prevent any unauthorized changes to the BIOS configuration. The exact steps will
+vary depending on your machine, but are likely to include:
+1.Reboot the machine.
+2.Press the appropriate key during the initial boot screen (F2 is typical).
+3.Navigate the BIOS configuration menu to add a password.
+The exact process will be system-specific and the system's hardware manual may provide detailed instructions.
+This password should prevent attackers with physical access from attempting to change important parameters. 
+However, an attacker with physical access can usually clear the BIOS password. The password should be 
+written down and stored in a physically-secure location, such as a safe, in the event that it is forgotten
+ and must be retrieved.
+</description>
+</Group>
+
 <Group id="bootloader">
 <title>Set Boot Loader Password</title>
 <description>During the boot process, the boot loader is
@@ -133,6 +150,52 @@ services, weakening system security.
 <ref nist="CM-7, IA-4, SC-2"/>
 </Rule>
 
+<Group id="login_shell_inactivity_timeout">
+<description>
+If the system does not run X Windows, then the login shells can be configured to automatically log users out after
+a period of inactivity. The following instructions are not practical for systems which run X Windows, as they
+will close terminal windows in the X environment. 
+
+The example time-out here of 15 minutes should be adjusted to whatever your security policy requires. The
+readonly line for bash and the -r option for tcsh can be omitted if policy allows users to override the value.
+The automatic shell logout only occurs when the shell is the foreground process. If, for example, a vi session is
+left idle, then automatic logout would not occur.
+When logging in through a remote connection, as with SSH, it may be more effective to set the timeout value
+directly through that service. Section referenced elsewhere.</description>
+
+<Rule id="login_shell_timeout_bash">
+<title> Implement Inactivity Time-out for Login Shells</title>
+<description>
+If the system does not run X Windows, then the login shells can be configured to automatically log users out after
+a period of inactivity. The following instructions are not practical for systems which run X Windows, as they
+will close terminal windows in the X environment. 
+To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt> shell, create a new file 
+<tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with the following lines:
+
+<pre>TMOUT=900
+readonly TMOUT
+export TMOUT</pre>
+
+
+Similar actions should be taken for any other login shells used.
+</description>
+<ident cce="3707-7" />
+<oval id="accounts_login_shell_timeout_implemented_bash" />
+</Rule>
+
+<Rule id="login_shell_timeout_tcsh">
+<title>Inactivity Time-out for <tt>tcsh</tt> Shell</title>
+<description>
+To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a new file <tt>autologout.csh</tt>
+ in the directory <tt>/etc/profile.d</tt> with the following line:
+
+
+<pre>set -r autologout 15</pre>
+</description>
+<ident cce="3689-7" />
+<oval id="accounts_login_shell_timeout_implemented_tcsh" />
+</Rule>
+</Group>
 
 <Group id="screen_locking">
 <title>Configure Screen Locking</title>
diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
index febead6..7006bf7 100644
--- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml
+++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml
@@ -10,4 +10,118 @@ console. Therefore, mechanisms for accessing accounts by entering
 usernames and passwords should be restricted to those which are
 operationally necessary.</description>
 
+<!--
+<Rule id="limit_su_access_to_root">
+<title> Limit <tt>su</tt> Access to the Root Account</title>
+<description>"1.Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre>
+2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line:
+<pre>auth       required        pam_wheel.so    use_uid</pre>
+The <tt>su</tt> command allows a user to gain the privileges of another user by entering the password for that user's
+account. It is desirable to restrict the root user so that only known administrators are ever allowed to access the
+root account. This restricts password-guessing against the root account by unauthorized users or by accounts
+which have been compromised. <br />
+By convention, the group <tt>wheel</tt> contains all users who are allowed to run privileged commands. The PAM
+module <tt>pam_wheel.so</tt> is used to restrict root access to this set of users.</description>
+<ident cce="14088-9, 15047-4" />
+<oval id="accounts_su_access_limited" />
+<ref nist="AC-2, AC-3, CM-6" />
+</Rule>
+-->
+
+<Group id="configure_sudo">
+<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root Access</title>
+<description>
+The <tt>sudo</tt> command allows fine-grained control over which users can execute commands using other accounts.
+The primary benefit of <tt>sudo</tt> when configured as above is that it provides an audit trail of every command run
+by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an
+established procedure that all root commands are run using <tt>sudo</tt>, then it is easy for an auditor to detect unusual
+behavior when this procedure is not followed. <br />
+</description>
+
+<warning>
+Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration error may make it impossible to access
+the root account remotely. The recommended means of editing this file is using the <tt>visudo</tt> command, which
+checks the file's syntax for correctness before allowing it to be saved. <br />
+
+Note that <tt>sudo</tt> allows any attacker who gains access to the password of an administrator account to run commands
+as root. This is a downside which must be weighed against the benefits of increased audit capability and of being
+able to heavily restrict the use of the high-value root password (which can be logistically difficult to change
+often). As a basic precaution, <i>never</i> use the <tt>NOPASSWD</tt> directive, which would allow anyone with access to an administrator account to execute commands as root without knowing the administrator's password. <br />
+</warning>
+
+<Group id="admin_user_group">
+<title>Create and Use One Group for All Admin</title>
+<description>Ensure that a group <i>ADMINS</i> exists, and that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^<i>ADMINS</i> /etc/group</pre>
+
+Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line:
+<pre>%ADMINS     ALL=(ALL)       ALL</pre>
+<pre>%<i>ADMINS</i>     ALL=(ALL)       ALL</pre>
+
+</description>
+</Group>
+
+<!--<Rule id="verify_wheel_exists">
+<description>
+Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed
+to execute commands as root are members of that group.
+<pre># grep ^wheel /etc/group</pre></description>
+<oval id="accounts_wheel_exists" />
+</Rule>
+
+<Rule id="verify_sudo_audit_trail">
+<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line:
+<pre>%wheel     ALL=(ALL)       ALL</pre>
+</description>
+<oval id="accounts_root_auditing_improved" />
+</Rule>
+</Group>
+-->
+
+<Group id="remove_password_parameters">
+<title> Remove Password Parameters from <tt>libuser.conf</tt></title>
+<description>The <tt>/etc/libuser.conf</tt> file contains configuration options for the libuser library, which is intended to implement
+a standardized interface for manipulating and administering user and group accounts. By default, it sources
+password settings from <tt>/etc/login.defs</tt>, but it can override these parameters. The man page <tt>libuser.conf(5)</tt> contains more information.</description>
+
+<Rule id="verify_libuser_login_defs_import">
+<title>Verify Line Under Import Section</title>
+<description>
+Ensure the following line exists within the file <tt>/etc/libuser.conf</tt> under the <tt>[import]</tt> section.
+<pre>login_defs = /etc/login.defs</pre></description>
+<oval id="libuser_login_defs_import" />
+</Rule>
+
+<Rule id="verify_libuser_login_defs_userdefaults">
+<title>Verify Lines do not Appear in Userdefaults Section</title>
+<description>
+Ensure that no lines beginning with the following appear in the <tt>[userdefaults]</tt> section of the file, as
+these override settings from <tt>/etc/login.defs</tt>:
+<pre>LU_SHADOWMAX
+LU_SHADOWMIN
+LU_SHADOWWARNING</pre></description>
+<oval id="libuser_login_defs_userdefaults" />
+</Rule>
+</Group>
+
+
+<Rule id="verify_accounts_disabled_after_expiration">
+<title> Set Accounts to Disable After Password Expiration</title>
+<description>
+In order to automatically disable local accounts some number of <i>DAYS</i> after password expiration, add or
+modify the following line in <tt>/etc/default/useradd</tt>:
+<pre>INACTIVE=<i>DAYS</i></pre>
+For example, if <pre>INACTIVE=30</pre> and if the password is currently on the verge of expiration, then 30 days remain
+until the account is automatically disabled. If the password will not expire for another 60 days, then 90 days
+remain until the account is automatically disabled. See <tt>useradd(8)</tt> for more information.
+Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period
+of inactivity for users in your environment. Setting the timeout too low incurs support costs and also has the
+potential to impact availability of the system to legitimate users.</description>
+<oval id="accounts_disabled_after_expiration" />
+</Rule>
+
+</Group>
 </Group>
diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml
index 00b5a8d..f7e6530 100644
--- a/rhel6/src/input/system/accounts/session.xml
+++ b/rhel6/src/input/system/accounts/session.xml
@@ -114,6 +114,19 @@ groups or ACLs.
 <ref nist="AC-3, CM-6"/>
 </Rule>
 
+<Rule id="ensure_dot_files_not_world_writable">
+<title> Ensure that User Dot-Files are not World-writable</title>
+<description>
+For each human user <i>USER</i> of the system, view the permissions of all dot-files in the user's home directory:
+<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre>
+Ensure that none of these files are group- or world-writable. Correct each misconfigured file <i>FILE</i> by exe-
+cuting:
+<pre># chmod go-w /home/USER /FILE</pre>
+A user who can modify another user's configuration files can likely execute commands with the other user's
+privileges, including stealing data, destroying files, or launching further attacks on the system.</description>
+<oval id="accounts_user_dot_files_not_world_writable" />
+</Rule>
+
 <Group id="user_umask">
 <title>Ensure that Users Have Sensible Umask Values</title>
 <description>
@@ -168,6 +181,17 @@ operator="equals" interactive="0">
 <value selector="077">077</value>
 </Value>
 
+<Group id="ensure_no_netrc_files">
+<title> Ensure that Users do not Have <tt>.netrc</tt> Files</title>
+<description>
+For each human user <i>USER</i> of the system, ensure that the user has no <tt>.netrc</tt> file. The command:
+<pre># ls -l /home/<i>USER</i> /.netrc</pre>
+should return the error "No such file or directory". If any user has such a file, approach that user to discuss
+removing this file.
+The <tt>.netrc</tt> file is a configuration file used to make unattended logins to other systems via FTP. When this file
+exists, it frequently contains unencrypted passwords which may be used to attack other systems.</description>
+</Group>
+
 <Rule id="user_umask_bashrc">
 <title>
 Ensure the Default Bash Umask is Set Correctly
-- 
1.7.6.5



More information about the scap-security-guide mailing list