From shawn.d.wells at gmail.com Tue Dec 4 00:45:19 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:45:19 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml Message-ID: <20121204004519.GA17837@mail.corp.redhat.com> -------------- next part -------------- >From 5a65f36a7e4a84280821d2752902d65fbf8a379b Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 1 Dec 2012 15:55:55 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml Ticket https://fedorahosted.org/scap-security-guide/ticket/140 Thanks for the copy editing! --- RHEL6/input/system/accounts/pam.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 1fcf906..ba9a285 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -332,7 +332,7 @@ The DoD requirement is 4. To check how many characters must differ during a password change, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The difok parameter will indicate how many characters must differ. -The DoD requires 4 character differ during a password change. +The DoD requires four characters differ during a password change. This would appear as difok=4. @@ -401,7 +401,7 @@ line which refers to the pam_unix.so module, as shown:
password sufficient pam_unix.so existing_options remember=24
The DoD requirement is 24 passwords. -To verify that the password reuse setting is compliant, run the following command: +To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=24
@@ -428,9 +428,9 @@ locations. In /etc/pam.d/system-auth, the password section of the file controls which PAM modules execute during a password change. Set the pam_unix.so module in the -password section to include the argument sha512, as shown here: +password section to include the argument sha512, as shown below:
password    sufficient    pam_unix.so sha512 other arguments...
-This will help ensure that when local users change their passwords, hashes for the new +This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. @@ -453,7 +453,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul Set Password Hashing Algorithm in /etc/login.defs In /etc/login.defs, add or correct the following line to ensure -that the system will use SHA-512 as the hashing algorithm: +the system will use SHA-512 as the hashing algorithm:
ENCRYPT_METHOD SHA512
@@ -472,8 +472,8 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul Set Password Hashing Algorithm in /etc/libuser.conf -In /etc/libuser.conf, add or correct the the following line in its -[defaults] section to ensure that the system will use the SHA-512 +In /etc/libuser.conf, add or correct the following line in its +[defaults] section to ensure the system will use the SHA-512 algorithm for password hashing:
crypt_style = sha512
-- 1.7.1 From shawn at redhat.com Mon Dec 3 22:47:31 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 17:47:31 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml In-Reply-To: <20121204004519.GA17837@mail.corp.redhat.com> References: <20121204004519.GA17837@mail.corp.redhat.com> Message-ID: <50BD2C03.6010505@redhat.com> On 12/3/12 7:45 PM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-acc.patch > > > From 5a65f36a7e4a84280821d2752902d65fbf8a379b Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Sat, 1 Dec 2012 15:55:55 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml > DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml > Tickethttps://fedorahosted.org/scap-security-guide/ticket/140 > Thanks for the copy editing! > > --- > RHEL6/input/system/accounts/pam.xml | 14 +++++++------- > 1 files changed, 7 insertions(+), 7 deletions(-) > > diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml > index 1fcf906..ba9a285 100644 > --- a/RHEL6/input/system/accounts/pam.xml > +++ b/RHEL6/input/system/accounts/pam.xml > @@ -332,7 +332,7 @@ The DoD requirement is 4. > To check how many characters must differ during a password change, run the following command: >
$ grep pam_cracklib /etc/pam.d/system-auth
> The difok parameter will indicate how many characters must differ. > -The DoD requires 4 character differ during a password change. > +The DoD requires four characters differ during a password change. > This would appear as difok=4. >
> > @@ -401,7 +401,7 @@ line which refers to the pam_unix.so module, as shown: >
password sufficient pam_unix.so existing_options remember=24
> The DoD requirement is 24 passwords. > > -To verify that the password reuse setting is compliant, run the following command: > +To verify the password reuse setting is compliant, run the following command: >
$ grep remember /etc/pam.d/system-auth
> The output should show the following at the end of the line: >
remember=24
> @@ -428,9 +428,9 @@ locations. > In /etc/pam.d/system-auth, the password section of > the file controls which PAM modules execute during a password change. > Set the pam_unix.so module in the > -password section to include the argument sha512, as shown here: > +password section to include the argument sha512, as shown below: >
password    sufficient    pam_unix.so sha512 other arguments...
> -This will help ensure that when local users change their passwords, hashes for the new > +This will help ensure when local users change their passwords, hashes for the new > passwords will be generated using the SHA-512 algorithm. > This is the default. > > @@ -453,7 +453,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul > Set Password Hashing Algorithm in /etc/login.defs > > In /etc/login.defs, add or correct the following line to ensure > -that the system will use SHA-512 as the hashing algorithm: > +the system will use SHA-512 as the hashing algorithm: >
ENCRYPT_METHOD SHA512
>
> > @@ -472,8 +472,8 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul > > Set Password Hashing Algorithm in /etc/libuser.conf > > -In /etc/libuser.conf, add or correct the the following line in its > -[defaults] section to ensure that the system will use the SHA-512 > +In /etc/libuser.conf, add or correct the following line in its > +[defaults] section to ensure the system will use the SHA-512 > algorithm for password hashing: >
crypt_style = sha512
>
> -- 1.7.1 Ack & pushed. The delta between original DISA FSO patch and version above is the ": to ." lines were not applied. Kept language rewording. Thanks for the editing FSO! -Shawn -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Mon Dec 3 23:54:31 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 18:54:31 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml Message-ID: <20121203235431.GA18246@mail.corp.redhat.com> In support of ticket 163 https://fedorahosted.org/scap-security-guide/ticket/163 -------------- next part -------------- >From 43c14d9a5474491d7241f105b496dafadf813403 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 20:51:52 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml DISA FSO requested updates to RHEL6/input/system/software/updating.xml Thank you FSO for the copy editing! --- RHEL6/input/system/software/updating.xml | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 4ed4123..9bb8611 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -21,20 +21,20 @@ for this reason, their use is strongly encouraged. Ensure Red Hat GPG Key Installed -To ensure that the system can cryptographically verify base software +To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them if desired), the Red Hat GPG key must properly be installed. -To ensure that the GPG key is installed, run: +To ensure the GPG key is installed, run:
# rhn_register
-To ensure that the GPG key is installed, run: +To ensure the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
-The command should return the string: +The command should return the string below:
gpg(Red Hat, Inc. (release key <security at redhat.com>)
-This key is necessary to cryptographically verify that packages +This key is necessary to cryptographically verify packages are from Red Hat. @@ -48,16 +48,16 @@ are from Red Hat. ensure they have configured an update source! --> Ensure gpgcheck Enabled In Main Yum Configuration -The gpgcheck option should be used to ensure that +The gpgcheck option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing -them, ensure that the following line appears in /etc/yum.conf in +them, ensure the following line appears in /etc/yum.conf in the [main] section:
gpgcheck=1
To determine whether yum is configured to use gpgcheck, -inspect /etc/yum.conf and ensure that the following appears in the +inspect /etc/yum.conf and ensure the following appears in the [main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a @@ -77,20 +77,20 @@ protects against malicious tampering. Ensure gpgcheck Enabled For All Yum Package Repositories -To ensure that signature checking is not disabled for +To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0
To determine whether yum has been configured to disable gpgcheck for any repos, inspect all files in -/etc/yum.repos.d and ensure that the following does not appear in any +/etc/yum.repos.d and ensure the following does not appear in any sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
-Ensuring that all packages' cryptographic signatures are valid prior to +Ensuring all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering. -- 1.7.1 From shawn at redhat.com Mon Dec 3 23:55:59 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 18:55:59 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml In-Reply-To: <20121203235431.GA18246@mail.corp.redhat.com> References: <20121203235431.GA18246@mail.corp.redhat.com> Message-ID: <50BD3C0F.7070704@redhat.com> On 12/3/12 6:54 PM, Shawn Wells wrote: > In support of ticket 163 > https://fedorahosted.org/scap-security-guide/ticket/163 > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-sof.patch > > > From 43c14d9a5474491d7241f105b496dafadf813403 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 20:51:52 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml > DISA FSO requested updates to RHEL6/input/system/software/updating.xml > Thank you FSO for the copy editing! > > --- > RHEL6/input/system/software/updating.xml | 22 +++++++++++----------- > 1 files changed, 11 insertions(+), 11 deletions(-) > > diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml > index 4ed4123..9bb8611 100644 > --- a/RHEL6/input/system/software/updating.xml > +++ b/RHEL6/input/system/software/updating.xml > @@ -21,20 +21,20 @@ for this reason, their use is strongly encouraged. > > Ensure Red Hat GPG Key Installed > > -To ensure that the system can cryptographically verify base software > +To ensure the system can cryptographically verify base software > packages come from Red Hat (and to connect to the Red Hat Network to > receive them if desired), the Red Hat GPG key must properly be installed. > -To ensure that the GPG key is installed, run: > +To ensure the GPG key is installed, run: >
# rhn_register
>
> > -To ensure that the GPG key is installed, run: > +To ensure the GPG key is installed, run: >
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
> -The command should return the string: > +The command should return the string below: >
gpg(Red Hat, Inc. (release key <security at redhat.com>)
>
> > -This key is necessary to cryptographically verify that packages > +This key is necessary to cryptographically verify packages > are from Red Hat. > > > @@ -48,16 +48,16 @@ are from Red Hat. > ensure they have configured an update source! --> > > Ensure gpgcheck Enabled In Main Yum Configuration > -The gpgcheck option should be used to ensure that > +The gpgcheck option should be used to ensure > checking of an RPM package's signature always occurs prior to its > installation. To configure yum to check package signatures before installing > -them, ensure that the following line appears in /etc/yum.conf in > +them, ensure the following line appears in /etc/yum.conf in > the [main] section: >
gpgcheck=1
>
> > To determine whether yum is configured to use gpgcheck, > -inspect /etc/yum.conf and ensure that the following appears in the > +inspect /etc/yum.conf and ensure the following appears in the > [main] section: >
gpgcheck=1
> A value of 1 indicates that gpgcheck is enabled. Absence of a > @@ -77,20 +77,20 @@ protects against malicious tampering. > > > Ensure gpgcheck Enabled For All Yum Package Repositories > -To ensure that signature checking is not disabled for > +To ensure signature checking is not disabled for > any repos, remove any lines from files in /etc/yum.repos.d of the form: >
gpgcheck=0
>
> > To determine whether yum has been configured to disable > gpgcheck for any repos, inspect all files in > -/etc/yum.repos.d and ensure that the following does not appear in any > +/etc/yum.repos.d and ensure the following does not appear in any > sections: >
gpgcheck=0
> A value of 0 indicates that gpgcheck has been disabled for that repo. >
> > -Ensuring that all packages' cryptographic signatures are valid prior to > +Ensuring all packages' cryptographic signatures are valid prior to > installation ensures the provenance of the software and > protects against malicious tampering. > > -- 1.7.1 Ack and pushed -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Mon Dec 3 23:59:11 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 18:59:11 -0500 Subject: [PATCH] Renamed STIG-server to "stig-rhel6-server" Message-ID: <20121203235911.GA18270@mail.corp.redhat.com> -------------- next part -------------- >From b9549e0ddd658ee80e9d71228a2916590867ef31 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:55:27 -0500 Subject: [PATCH] Renamed STIG-server to "stig-rhel6-server" It was really bugging me how the profile was named "stig-server" yet the code was named "STIG-server." So I put everything in lowercase. This patch also changes the format to ${policy}-${software}, so in this case "stig-rhel6-server. This will become increasingly important as new content comes online over the next months, e.g. stig-rhel6-server stig-rhs-server stig-openshift I debated about ${software}-${policy}, flip flopped back and forth, and then played rock-paper-scissors-lizard-spock to sort it out. Arguments for ${software}-${policy} are more than welcome. I don't have a strong opinion on the matter. --- RHEL6/Makefile | 22 +++--- RHEL6/input/profiles/STIG-server.xml | 94 ---------------------------- RHEL6/input/profiles/stig-rhel6-server.xml | 94 ++++++++++++++++++++++++++++ RHEL6/transforms/xccdf-addprofiles.xslt | 2 +- 4 files changed, 106 insertions(+), 106 deletions(-) delete mode 100644 RHEL6/input/profiles/STIG-server.xml create mode 100644 RHEL6/input/profiles/stig-rhel6-server.xml diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 7221fe8..1e59adf 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -17,7 +17,7 @@ shorthand2xccdf: shorthand-guide xsltproc -o $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhel6-xccdf-prerefs.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml - xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-rhel6-xccdf.xml \ + xsltproc -stringparam profile "stig-rhel6-server" -o $(OUT)/unlinked-rhel6-xccdf.xml \ $(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-rhel6-xccdf-prerefs.xml # extract manual check instructions from xccdf into an ocil file xsltproc -o $(OUT)/unlinked-rhel6-ocil.xml $(TRANS)/xccdf-create-ocil.xslt $(OUT)/unlinked-rhel6-xccdf.xml @@ -78,25 +78,25 @@ table-stigs: shorthand2xccdf $(TRANS)/xccdf2table-stig.xslt \ $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml # temporarily retain an output file showing the short titles as well - xsltproc -stringparam profile "stig-server" -stringparam testinfo "y" -o $(OUT)/table-rhel6-stig-server-shorttitles.html \ + xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o $(OUT)/table-stig-rhel6-server-shorttitles.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-rhel6-xccdf.xml xsltproc -stringparam alttitles "../$(IN)/auxiliary/alt-titles-stig.xml" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \ $(TRANS)/xccdf-alt-titles.xslt \ $(OUT)/unlinked-rhel6-xccdf.xml - xsltproc -stringparam profile "stig-server" -o $(OUT)/table-rhel6-stig-server.html \ + xsltproc -stringparam profile "stig-rhel6-server" -o $(OUT)/table-stig-rhel6-server.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-stig-rhel6-xccdf.xml - xsltproc --html -o $(OUT)/table-rhel6-stig-server.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-rhel6-stig-server.html - xsltproc -stringparam profile "stig-server" -stringparam format "flat" -o $(OUT)/table-rhel6-stig-server-flat.html \ + xsltproc --html -o $(OUT)/table-stig-rhel6-server.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-stig-rhel6-server.html + xsltproc -stringparam profile "stig-rhel6-server" -stringparam format "flat" -o $(OUT)/table-stig-rhel6-server-flat.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-stig-rhel6-xccdf.xml - xsltproc --html -o $(OUT)/table-rhel6-stig-server-flat.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-rhel6-stig-server-flat.html + xsltproc --html -o $(OUT)/table-stig-rhel6-server-flat.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-stig-rhel6-server-flat.html tables: table-refs table-idents table-profilenistrefs table-srgmap table-stigs alt-titles: shorthand2xccdf - $(UTILS)/sync-alt-titles.py -p stig-server -f $(IN)/auxiliary/alt-titles-stig.xml $(OUT)/unlinked-rhel6-xccdf.xml + $(UTILS)/sync-alt-titles.py -p stig-rhel6-server -f $(IN)/auxiliary/alt-titles-stig.xml $(OUT)/unlinked-rhel6-xccdf.xml XMLLINT_INDENT="" xmllint --format --output $(IN)/auxiliary/alt-titles-stig.xml $(IN)/auxiliary/alt-titles-stig.xml content: shorthand2xccdf guide checks @@ -113,9 +113,9 @@ content-stig: shorthand2xccdf guide checks $(TRANS)/xccdf-alt-titles.xslt \ $(OUT)/unlinked-rhel6-xccdf.xml oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml $(OUT)/unlinked-rhel6-xccdf.xml - xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \ + xsltproc -stringparam profile "stig-rhel6-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \ $(TRANS)/xccdf2stigformat.xslt $(OUT)/unlinked-resolved-rhel6-xccdf.xml - xsltproc -o $(OUT)/table-rhel6-stig-server-stigformat.html \ + xsltproc -o $(OUT)/table-stig-rhel6-server-stigformat.html \ $(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-rhel6-xccdf.xml xmllint --format --output $(OUT)/unlinked-stig-rhel6-xccdf.xml $(OUT)/unlinked-stig-rhel6-xccdf.xml $(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml disa-predraft @@ -123,8 +123,8 @@ content-stig: shorthand2xccdf guide checks xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml $(OUT)/disa-predraft-stig-rhel6-xccdf.xml submission-stig-check: table-stigs - cd output; ../$(UTILS)/verify-references.py -p stig-server --rules-with-disarefs-outside-profile unlinked-rhel6-xccdf-prerefs.xml -# $(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-rhel6-xccdf.xml > $(OUT)/table-rhel6-stig.csv + cd output; ../$(UTILS)/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile unlinked-rhel6-xccdf-prerefs.xml +# $(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-rhel6-xccdf.xml > $(OUT)/table-stig.csv # content-usgcb: coming soon diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml deleted file mode 100644 index 15eedcf..0000000 --- a/RHEL6/input/profiles/STIG-server.xml +++ /dev/null @@ -1,94 +0,0 @@ - -Pre-release Draft STIG for RHEL 6 Server -This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml new file mode 100644 index 0000000..354e887 --- /dev/null +++ b/RHEL6/input/profiles/stig-rhel6-server.xml @@ -0,0 +1,94 @@ + +Pre-release Draft STIG for RHEL 6 Server +This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/RHEL6/transforms/xccdf-addprofiles.xslt b/RHEL6/transforms/xccdf-addprofiles.xslt index 1d3dadc..eb8a326 100644 --- a/RHEL6/transforms/xccdf-addprofiles.xslt +++ b/RHEL6/transforms/xccdf-addprofiles.xslt @@ -12,7 +12,7 @@ - + -- 1.7.1 From shawn.d.wells at gmail.com Tue Dec 4 00:04:49 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:04:49 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/integrity.xml Message-ID: <20121204000449.GA18313@mail.corp.redhat.com> -------------- next part -------------- >From 11f3bb586976ce7ca53414f507b818c2080be42f Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:04:03 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/integrity.xml DISA FSO requested updates to RHEL6/input/system/software/integrity.xml https://fedorahosted.org/scap-security-guide/ticket/162 --> closed --- RHEL6/input/system/software/integrity.xml | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 14730e2..54c106c 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -146,12 +146,12 @@ See the man page for rpm to see a complete explanation of each column. The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. The following command will list which -files on the system have permissions that are different from what +files on the system have permissions different from what is expected by the RPM database:
# rpm -Va | grep '^.M'
-The following command will list which files on the system have permissions that are different from what +The following command will list which files on the system have permissions different from what is expected by the RPM database:
# rpm -Va | grep '^.M'
@@ -220,7 +220,7 @@ to fulfill this role.
Inspect the system to determine if intrusion detection software has been installed. -Verify that the intrusion detection software is active. +Verify the intrusion detection software is active. @@ -256,7 +256,7 @@ Inspect the system for a cron job or system service which executes a virus scanning tool regularly.
-To verify that the McAfee command line scan tool (uvscan) is scheduled for +To verify the McAfee command line scan tool (uvscan) is scheduled for regular execution, run the following command to check for a cron job:
# grep uvscan /etc/cron* /var/spool/cron/*
This will reveal if and when the uvscan program will be run. -- 1.7.1 From shawn at redhat.com Tue Dec 4 00:06:14 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:06:14 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/integrity.xml In-Reply-To: <20121204000449.GA18313@mail.corp.redhat.com> References: <20121204000449.GA18313@mail.corp.redhat.com> Message-ID: <50BD3E76.60405@redhat.com> On 12/3/12 7:04 PM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-sof.patch > > > From 11f3bb586976ce7ca53414f507b818c2080be42f Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:04:03 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/integrity.xml > DISA FSO requested updates to RHEL6/input/system/software/integrity.xml > https://fedorahosted.org/scap-security-guide/ticket/162 --> closed > > --- > RHEL6/input/system/software/integrity.xml | 8 ++++---- > 1 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml > index 14730e2..54c106c 100644 > --- a/RHEL6/input/system/software/integrity.xml > +++ b/RHEL6/input/system/software/integrity.xml > @@ -146,12 +146,12 @@ See the man page for rpm to see a complete explanation of each column. > The RPM package management system can check file access > permissions of installed software packages, including many that are > important to system security. The following command will list which > -files on the system have permissions that are different from what > +files on the system have permissions different from what > is expected by the RPM database: >
# rpm -Va | grep '^.M'
>
> > -The following command will list which files on the system have permissions that are different from what > +The following command will list which files on the system have permissions different from what > is expected by the RPM database: >
# rpm -Va | grep '^.M'
>
> @@ -220,7 +220,7 @@ to fulfill this role. >
> > Inspect the system to determine if intrusion detection software has been installed. > -Verify that the intrusion detection software is active. > +Verify the intrusion detection software is active. > > > > @@ -256,7 +256,7 @@ Inspect the system for a cron job or system service which executes > a virus scanning tool regularly. >
> > -To verify that the McAfee command line scan tool (uvscan) is scheduled for > +To verify the McAfee command line scan tool (uvscan) is scheduled for > regular execution, run the following command to check for a cron job: >
# grep uvscan/etc/cron* /var/spool/cron/*
> This will reveal if and when the uvscan program will be run. > -- 1.7.1 Ack & pushed -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Tue Dec 4 00:08:02 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:08:02 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml Message-ID: <20121204000802.GA18332@mail.corp.redhat.com> -------------- next part -------------- >From 607ff19adc48c37d22807461f590834a5b36e2a0 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:07:22 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml --- RHEL6/input/system/software/disk_partitioning.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 0877e8b..ac3ccc9 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -28,7 +28,7 @@ detailed information on LVM.
Ensure /tmp Located On Separate Partition The /tmp directory is a world-writable directory used -for temporary file storage. Ensure that it has its own partition or +for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM. -- 1.7.1 From shawn at redhat.com Tue Dec 4 00:09:34 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:09:34 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml In-Reply-To: <20121204000802.GA18332@mail.corp.redhat.com> References: <20121204000802.GA18332@mail.corp.redhat.com> Message-ID: <50BD3F3E.4070201@redhat.com> On 12/3/12 7:08 PM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-sof.patch > > > From 607ff19adc48c37d22807461f590834a5b36e2a0 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:07:22 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml > DISA FSO requested updates to RHEL6/input/system/software/disk_partitioning.xml > > --- > RHEL6/input/system/software/disk_partitioning.xml | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml > index 0877e8b..ac3ccc9 100644 > --- a/RHEL6/input/system/software/disk_partitioning.xml > +++ b/RHEL6/input/system/software/disk_partitioning.xml > @@ -28,7 +28,7 @@ detailed information on LVM.
> Ensure /tmp Located On Separate Partition > > The /tmp directory is a world-writable directory used > -for temporary file storage. Ensure that it has its own partition or > +for temporary file storage. Ensure it has its own partition or > logical volume at installation time, or migrate it using LVM. > > > -- 1.7.1 Ack & pushed Closing ticket 161: https://fedorahosted.org/scap-security-guide/ticket/161 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Tue Dec 4 00:13:43 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:13:43 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/selinux.xml Message-ID: <20121204001343.GA18359@mail.corp.redhat.com> -------------- next part -------------- >From 0572166a383b68ad56ef5234d0e859de8dc7af87 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:12:30 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/selinux.xml DISA FSO requested updates to RHEL6/input/system/selinux.xml Closing ticket https://fedorahosted.org/scap-security-guide/ticket/160 --- RHEL6/input/system/selinux.xml | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 58c4c5c..f46d2c2 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -117,7 +117,7 @@ Check the file /etc/selinux/config and ensure the following line appear
SELINUX=enforcing
-Setting the SELinux state to enforcing ensures that SELinux is able to confine +Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. @@ -145,7 +145,7 @@ Check the file /etc/selinux/config and ensure the following line appear
Setting the SELinux policy to targeted or a more specialized policy -ensures that the system will confine processes that are likely to be +ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. @@ -155,13 +155,12 @@ targeted for exploitation, such as network or system services. - Enable the SELinux Context Restoration Service (restorecond) The restorecond service utilizes inotify to look for the creation of new files listed in the /etc/selinux/restorecond.conf configuration file. When a file is -created, restorecond ensures that the file receives the proper SELinux +created, restorecond ensures the file receives the proper SELinux security context. -- 1.7.1 From shawn at redhat.com Tue Dec 4 00:15:00 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:15:00 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/selinux.xml In-Reply-To: <20121204001343.GA18359@mail.corp.redhat.com> References: <20121204001343.GA18359@mail.corp.redhat.com> Message-ID: <50BD4084.4040809@redhat.com> On 12/3/12 7:13 PM, Shawn Wells wrote: > > 0002-DISA-FSO-requested-updates-to-RHEL6-input-system-sel.patch > > > From 0572166a383b68ad56ef5234d0e859de8dc7af87 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:12:30 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/selinux.xml > DISA FSO requested updates to RHEL6/input/system/selinux.xml > Closing tickethttps://fedorahosted.org/scap-security-guide/ticket/160 > > --- > RHEL6/input/system/selinux.xml | 7 +++---- > 1 files changed, 3 insertions(+), 4 deletions(-) > > diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml > index 58c4c5c..f46d2c2 100644 > --- a/RHEL6/input/system/selinux.xml > +++ b/RHEL6/input/system/selinux.xml > @@ -117,7 +117,7 @@ Check the file /etc/selinux/config and ensure the following line appear >
SELINUX=enforcing
>
> > -Setting the SELinux state to enforcing ensures that SELinux is able to confine > +Setting the SELinux state to enforcing ensures SELinux is able to confine > potentially compromised processes to the security policy, which is designed to > prevent them from causing damage to the system or further elevating their > privileges. > @@ -145,7 +145,7 @@ Check the file /etc/selinux/config and ensure the following line appear > > > Setting the SELinux policy to targeted or a more specialized policy > -ensures that the system will confine processes that are likely to be > +ensures the system will confine processes that are likely to be > targeted for exploitation, such as network or system services. > > > @@ -155,13 +155,12 @@ targeted for exploitation, such as network or system services. > > > > - > > Enable the SELinux Context Restoration Service (restorecond) > The restorecond service utilizes inotify to look > for the creation of new files listed in the > /etc/selinux/restorecond.conf configuration file. When a file is > -created, restorecond ensures that the file receives the proper SELinux > +created, restorecond ensures the file receives the proper SELinux > security context. > > > -- 1.7.1 Ack & pushed -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Tue Dec 4 00:27:19 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:27:19 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml Message-ID: <20121204002719.GA18386@mail.corp.redhat.com> -------------- next part -------------- >From 7f3f41498d3872259575346c55ab023cafdba440 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:26:14 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml Closing https://fedorahosted.org/scap-security-guide/ticket/141 --- RHEL6/input/system/accounts/physical.xml | 23 ++++++++++------------- 1 files changed, 10 insertions(+), 13 deletions(-) diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 2ae7d4e..a630c58 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -78,11 +78,10 @@ parameters. Set Boot Loader Password The grub boot loader should have password protection enabled to protect boot-time settings. -To do so, select a password and then generate a hash from it by running: +To do so, select a password and then generate a hash from it by running the following command:
# grub-crypt --sha-512
-You will then be prompted to enter a password. -Insert the following line into /etc/grub.conf immediately -after the header comments. (Use the output from grub-crypt as the +When prompted to enter a password, insert the following line into /etc/grub.conf +immediately after the header comments. (Use the output from grub-crypt as the value of password-hash):
password --encrypted password-hash
@@ -93,7 +92,7 @@ The output should show the following:
password --encrypted password-hash
-Password protection on the boot loader configuration ensures that +Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. @@ -121,7 +120,7 @@ file /etc/sysconfig/init: To check if authentication is required for single-user mode, run the following command:
$ grep SINGLE /etc/sysconfig/init
-The output should be: +The output should be the following:
SINGLE=/sbin/sulogin
@@ -150,9 +149,8 @@ rebooting the system, alter that line to read as follows: To check how the system is configured to behave when Ctrl-Alt-Del is pressed, inspect the file /etc/init/control-alt-delete. -The commands following the line: +The commands following the line below will be executed when the key squence is pressed:
start on control-alt-delete
-will be executed when the key sequence is pressed.
A locally logged-in user who presses Ctrl-Alt-Del, when at the console, @@ -285,11 +283,10 @@ in the GNOME desktop after a period of inactivity: If properly configured, the output should be true. -Enabling idle activation of the screen saver ensures that the screensaver will +Enabling idle activation of the screen saver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the -following and need to be documented with the IAO: the login session does not -have administrator rights; and the display station is located in a +login session does not have administrator rights and the display station is located in a controlled-access area. @@ -314,7 +311,7 @@ If properly configured, the output should be true. Enabling the activation of the screen lock after an idle period -ensures that password entry will be required in order to +ensures password entry will be required in order to access the system, preventing access by passersby. @@ -374,7 +371,7 @@ To check whether vlock has been installed, run the following command: If vlock is available, then the terminal will lock. -Installing vlock ensures that a console locking capability is available +Installing vlock ensures a console locking capability is available for users who may need to suspend console logins. -- 1.7.1 From shawn at redhat.com Tue Dec 4 00:29:36 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:29:36 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml In-Reply-To: <20121204002719.GA18386@mail.corp.redhat.com> References: <20121204002719.GA18386@mail.corp.redhat.com> Message-ID: <50BD43F0.2050409@redhat.com> On 12/3/12 7:27 PM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-acc.patch > > > From 7f3f41498d3872259575346c55ab023cafdba440 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:26:14 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml > DISA FSO requested updates to RHEL6/input/system/accounts/physical.xml > Closinghttps://fedorahosted.org/scap-security-guide/ticket/141 > > --- > RHEL6/input/system/accounts/physical.xml | 23 ++++++++++------------- > 1 files changed, 10 insertions(+), 13 deletions(-) > > diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml > index 2ae7d4e..a630c58 100644 > --- a/RHEL6/input/system/accounts/physical.xml > +++ b/RHEL6/input/system/accounts/physical.xml > @@ -78,11 +78,10 @@ parameters. > Set Boot Loader Password > The grub boot loader should have password protection > enabled to protect boot-time settings. > -To do so, select a password and then generate a hash from it by running: > +To do so, select a password and then generate a hash from it by running the following command: >
# grub-crypt --sha-512
> -You will then be prompted to enter a password. > -Insert the following line into /etc/grub.conf immediately > -after the header comments. (Use the output from grub-crypt as the > +When prompted to enter a password, insert the following line into /etc/grub.conf > +immediately after the header comments. (Use the output from grub-crypt as the > value of password-hash): >
password --encrypted password-hash
>
> @@ -93,7 +92,7 @@ The output should show the following: >
password --encrypted password-hash
> > > -Password protection on the boot loader configuration ensures that > +Password protection on the boot loader configuration ensures > users with physical access cannot trivially alter > important bootloader settings. These include which kernel to use, > and whether to enter single-user mode. > @@ -121,7 +120,7 @@ file /etc/sysconfig/init: > > To check if authentication is required for single-user mode, run the following command: >
$ grep SINGLE /etc/sysconfig/init
> -The output should be: > +The output should be the following: >
SINGLE=/sbin/sulogin
>
> > @@ -150,9 +149,8 @@ rebooting the system, alter that line to read as follows: > > To check how the system is configured to behave when Ctrl-Alt-Del is pressed, > inspect the file /etc/init/control-alt-delete. > -The commands following the line: > +The commands following the line below will be executed when the key squence is pressed: >
start on control-alt-delete
> -will be executed when the key sequence is pressed. >
> > A locally logged-in user who presses Ctrl-Alt-Del, when at the console, > @@ -285,11 +283,10 @@ in the GNOME desktop after a period of inactivity: > If properly configured, the output should be true. > > > -Enabling idle activation of the screen saver ensures that the screensaver will > +Enabling idle activation of the screen saver ensures the screensaver will > be activated after the idle delay. Applications requiring continuous, > real-time screen display (such as network management products) require the > -following and need to be documented with the IAO: the login session does not > -have administrator rights; and the display station is located in a > +login session does not have administrator rights and the display station is located in a > controlled-access area. > > > @@ -314,7 +311,7 @@ If properly configured, the output should be true. > > > Enabling the activation of the screen lock after an idle period > -ensures that password entry will be required in order to > +ensures password entry will be required in order to > access the system, preventing access by passersby. > > > @@ -374,7 +371,7 @@ To check whether vlock has been installed, run the following command: > If vlock is available, then the terminal will lock. > > > -Installing vlock ensures that a console locking capability is available > +Installing vlock ensures a console locking capability is available > for users who may need to suspend console logins. > > > -- 1.7.1 Ack and pushed closing https://fedorahosted.org/scap-security-guide/ticket/141 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Tue Dec 4 00:33:25 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:33:25 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml Message-ID: <20121204003325.GA18410@mail.corp.redhat.com> -------------- next part -------------- >From 7221833ea4a7e9c1ed20187ef7cffc93efc8033b Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:32:45 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml Closing ticket https://fedorahosted.org/scap-security-guide/ticket/158 --- RHEL6/input/system/permissions/mounting.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 0e35db6..5c60da7 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -149,9 +149,9 @@ or removable media, disable the service for all runlevels:
# chkconfig --level 0123456 autofs off
-To verify that the autofs service is disabled, run the following command: +To verify the autofs service is disabled, run the following command:
chkconfig --list autofs
-If properly configured, the output should be: +If properly configured, the output should be the following:
autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off
All filesystems that are required for the successful operation of the system -- 1.7.1 From shawn at redhat.com Tue Dec 4 00:34:56 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:34:56 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml In-Reply-To: <20121204003325.GA18410@mail.corp.redhat.com> References: <20121204003325.GA18410@mail.corp.redhat.com> Message-ID: <50BD4530.7040806@redhat.com> On 12/3/12 7:33 PM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-per.patch > > > From 7221833ea4a7e9c1ed20187ef7cffc93efc8033b Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:32:45 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml > DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml > Closing tickethttps://fedorahosted.org/scap-security-guide/ticket/158 > > --- > RHEL6/input/system/permissions/mounting.xml | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml > index 0e35db6..5c60da7 100644 > --- a/RHEL6/input/system/permissions/mounting.xml > +++ b/RHEL6/input/system/permissions/mounting.xml > @@ -149,9 +149,9 @@ or removable media, disable the service for all runlevels: >
# chkconfig --level 0123456 autofs off
> > > -To verify that the autofs service is disabled, run the following command: > +To verify the autofs service is disabled, run the following command: >
chkconfig --list autofs
> -If properly configured, the output should be: > +If properly configured, the output should be the following: >
autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off
>
> All filesystems that are required for the successful operation of the system > -- 1.7.1 Ack and pushed -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Tue Dec 4 00:44:51 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Mon, 3 Dec 2012 19:44:51 -0500 Subject: [PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml Message-ID: <20121204004451.GA18433@mail.corp.redhat.com> -------------- next part -------------- >From 0ea406bcdf0e400b44047de06f991c32e3a3875e Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:43:34 -0500 Subject: [PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml DISA FSO requested updates to RHEL6/input/system/permissions/files.xml Closing ticke https://fedorahosted.org/scap-security-guide/ticket/157 --- RHEL6/input/system/permissions/files.xml | 34 ++++++++++++----------------- 1 files changed, 14 insertions(+), 20 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 14b6fcb..e714982 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -193,13 +193,10 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are -stored in: -
/lib/modules
-All files in these directories should not be -group-writable or world-writable. -If any file FILE in these directories is found -to be group-writable or world-writeable, correct its permission with the -following command: +stored in /lib/modules>. All files in these directories +should not be group-writable or world-writable. If any file in these +directories is found to be group-writable or world-writeable, correct +its permission with the following command:
# chmod go-w FILE
@@ -226,16 +223,13 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also -stored in: -
/lib/modules
-All files in these directories should be -owned by the root user. -If any file FILE in these directories is found +stored in /lib/modules. All files in these directories should be +owned by the root user. If any file in these directories is found to be owned by a user other than root, correct its ownership with the following command:
# chown root FILE
- + To find shared libraries that are not owned by root, run the following command for each directory DIR which contains shared libraries:
$ find DIR \! -user root
@@ -264,14 +258,14 @@ to be group-writable or world-writeable, correct its permission with the following command:
# chmod go-w FILE
- + To find system executables that are group-writable or world-writable, run the following command for each directory DIR which contains system executables:
$ find DIR -perm /022
-System binaries are executed by privileged users as well as system services, -and restrictive permissions are necessary to ensure that their -execution of these programs cannot be co-opted. +System binaries are executed by privileged users, as well as system services, +and restrictive permissions are necessary to ensure execution of these programs +cannot be co-opted.
@@ -414,7 +408,7 @@ cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. - + The following command will discover and print any files on local partitions which do not belong to a valid user. Run it once for each local partition PART: @@ -425,7 +419,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
@@ -452,7 +446,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
-- 1.7.1 From shawn at redhat.com Tue Dec 4 00:46:44 2012 From: shawn at redhat.com (Shawn Wells) Date: Mon, 03 Dec 2012 19:46:44 -0500 Subject: [PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml In-Reply-To: <20121204004451.GA18433@mail.corp.redhat.com> References: <20121204004451.GA18433@mail.corp.redhat.com> Message-ID: <50BD47F4.5070309@redhat.com> On 12/3/12 7:44 PM, Shawn Wells wrote: > > 0002-DISA-FSO-requested-updates-to-RHEL6-input-system-per.patch > > > From 0ea406bcdf0e400b44047de06f991c32e3a3875e Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:43:34 -0500 > Subject: [PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml > DISA FSO requested updates to RHEL6/input/system/permissions/files.xml > Closing tickehttps://fedorahosted.org/scap-security-guide/ticket/157 > > --- > RHEL6/input/system/permissions/files.xml | 34 ++++++++++++----------------- > 1 files changed, 14 insertions(+), 20 deletions(-) > > diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml > index 14b6fcb..e714982 100644 > --- a/RHEL6/input/system/permissions/files.xml > +++ b/RHEL6/input/system/permissions/files.xml > @@ -193,13 +193,10 @@ by default: > /usr/lib64 > > Kernel modules, which can be added to the kernel during runtime, are > -stored in: > -
/lib/modules
> -All files in these directories should not be > -group-writable or world-writable. > -If any file FILE in these directories is found > -to be group-writable or world-writeable, correct its permission with the > -following command: > +stored in /lib/modules>. All files in these directories > +should not be group-writable or world-writable. If any file in these > +directories is found to be group-writable or world-writeable, correct > +its permission with the following command: >
# chmod go-w FILE
> > > @@ -226,16 +223,13 @@ by default: > /usr/lib64 > > Kernel modules, which can be added to the kernel during runtime, are also > -stored in: > -
/lib/modules
> -All files in these directories should be > -owned by the root user. > -If any file FILE in these directories is found > +stored in /lib/modules. All files in these directories should be > +owned by the root user. If any file in these directories is found > to be owned by a user other than root, correct its ownership with the > following command: >
# chown root FILE
> > - > + > To find shared libraries that are not owned by root, > run the following command for each directory DIR which contains shared libraries: >
$ find DIR \! -user root
> @@ -264,14 +258,14 @@ to be group-writable or world-writeable, correct its permission with the > following command: >
# chmod go-w FILE
> > - > + > To find system executables that are group-writable or world-writable, > run the following command for each directory DIR which contains system executables: >
$ find DIR -perm /022
>
> -System binaries are executed by privileged users as well as system services, > -and restrictive permissions are necessary to ensure that their > -execution of these programs cannot be co-opted. > +System binaries are executed by privileged users, as well as system services, > +and restrictive permissions are necessary to ensure execution of these programs > +cannot be co-opted. > > > > @@ -414,7 +408,7 @@ cause of their lack of ownership should be investigated. > Following this, the files should be deleted or assigned to an > appropriate user. > > - > + > The following command will discover and print any > files on local partitions which do not belong to a valid user. > Run it once for each local partition PART: > @@ -425,7 +419,7 @@ Unowned files do not directly imply a security problem, but they are generally > a sign that something is amiss. They may > be caused by an intruder, by incorrect software installation or > draft software removal, or by failure to remove all files belonging > -to a deleted account. The files should be repaired so that they > +to a deleted account. The files should be repaired so they > will not cause problems when accounts are created in the future, > and the cause should be discovered and addressed. > > @@ -452,7 +446,7 @@ Unowned files do not directly imply a security problem, but they are generally > a sign that something is amiss. They may > be caused by an intruder, by incorrect software installation or > draft software removal, or by failure to remove all files belonging > -to a deleted account. The files should be repaired so that they > +to a deleted account. The files should be repaired so they > will not cause problems when accounts are created in the future, > and the cause should be discovered and addressed. > > -- 1.7.1 > Ack and pushed Closing https://fedorahosted.org/scap-security-guide/ticket/157 -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An HTML attachment was scrubbed... URL: From blank at eclipse.ncsc.mil Thu Dec 6 21:27:09 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Thu, 06 Dec 2012 16:27:09 -0500 Subject: [PATCH] Renamed STIG-server to "stig-rhel6-server" In-Reply-To: <20121203235911.GA18270@mail.corp.redhat.com> References: <20121203235911.GA18270@mail.corp.redhat.com> Message-ID: <50C10DAD.7010005@eclipse.ncsc.mil> Yes, please push. This was overdue. I am very impressed to hear about any additional resources for creating SCAP content. On 12/03/2012 06:59 PM, Shawn Wells wrote: > > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide at lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide From mnewman at redhat.com Fri Dec 7 00:27:39 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:39 -0500 Subject: [PATCH 01/12] Changed content as per ticket #147. Message-ID: <1354840070-40541-1-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/auditing.xml | 48 +++++++++++++++++++------------------- 1 files changed, 24 insertions(+), 24 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 67cce9a..c14f3dc 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -88,7 +88,7 @@ disk. -Ensuring that the auditd service is active ensures that +Ensuring the auditd service is active ensures audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist. @@ -100,7 +100,7 @@ actions will be taken if other obstacles exist. Enable Auditing for Processes Which Start Prior to the Audit Daemon -To ensure that all processes can be audited, even +To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument audit=1 to the kernel line in /etc/grub.conf, in the manner below:
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1
@@ -114,7 +114,7 @@ auditing is enabled at boot time. Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it -does, adding the kernel argument ensures that it is set for every +does, adding the kernel argument ensures it is set for every process during boot.
@@ -293,7 +293,7 @@ page. These include: Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive. - + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to rotate logs when they reach their maximum size: @@ -344,7 +344,7 @@ These include: Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. - Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to email the administrator when @@ -383,7 +383,7 @@ mode for corrective action. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. - Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to switch to single user mode @@ -408,7 +408,7 @@ in /etc/audit/auditd.conf to ensure that administrators are notified via email for those situations:
action_mail_acct = root
- + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to send email to an account when it needs to notify an administrator: @@ -465,7 +465,7 @@ editing as needed, the new rules can be activated as follows: Records Events that Modify Date and Time Information Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time. All changes to the system time should be audited. @@ -484,11 +484,11 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. @@ -512,11 +512,11 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. @@ -538,11 +538,11 @@ See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. @@ -566,11 +566,11 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. @@ -587,7 +587,7 @@ The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. - + To determine if the system is configured to audit attempts to alter time via the /etc/localtime file, run the following command: @@ -595,7 +595,7 @@ command: If the system is configured to audit this activity, it will return a line. Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. @@ -616,7 +616,7 @@ to capture events that modify account changes: -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes - + To determine if the system is configured to audit account changes, run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
@@ -643,7 +643,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications - + To determine if the system is configured to audit changes to its network configuration, run the following command:
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
@@ -697,7 +697,7 @@ owner, and unauthorized users, potential access to sensitive information.Add the following to /etc/audit/audit.rules:
-w /etc/selinux/ -p wa -k MAC-policy
- + To determine if the system is configured to audit changes to its SELinux configuration files, run the following command:
# auditctl -l | grep "dir=/etc/selinux"
@@ -760,7 +760,7 @@ If the system is 64 bit then also add the following: gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. - + Note that these rules can be configured in a @@ -1233,7 +1233,7 @@ appropriate for your system: Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting as well as detecting +from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence. @@ -1252,7 +1252,7 @@ To verify that auditing is configured for system administrator actions, run the
# auditctl -l | grep "watch=/etc/sudoers"
The actions taken by system administrators should be audited to keep a record -of what was executed on the system as well as for accountability purposes. +of what was executed on the system, as well as, for accountability purposes. -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:40 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:40 -0500 Subject: [PATCH 02/12] Changing IPtables to reflect RHEL 6 style, ticket #105. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-2-git-send-email-mnewman@redhat.com> --- RHEL6/input/checks/iptables_avahi_disabled.xml | 4 ++-- RHEL6/input/checks/iptables_cupsd_disabled.xml | 4 ++-- RHEL6/input/checks/iptables_icmp_disabled.xml | 12 ++++++------ RHEL6/input/checks/iptables_ldap_enabled.xml | 8 ++++---- RHEL6/input/checks/iptables_smtp_enabled.xml | 4 ++-- RHEL6/input/checks/iptables_sshd_disabled.xml | 4 ++-- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/RHEL6/input/checks/iptables_avahi_disabled.xml b/RHEL6/input/checks/iptables_avahi_disabled.xml index 251ead0..3a7ce11 100644 --- a/RHEL6/input/checks/iptables_avahi_disabled.xml +++ b/RHEL6/input/checks/iptables_avahi_disabled.xml @@ -25,7 +25,7 @@ id="obj_180370" version="1"> /etc/sysconfig iptables - ^-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$ + ^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$ + ^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$ 1 diff --git a/RHEL6/input/checks/iptables_cupsd_disabled.xml b/RHEL6/input/checks/iptables_cupsd_disabled.xml index 3fcad1d..24197f2 100644 --- a/RHEL6/input/checks/iptables_cupsd_disabled.xml +++ b/RHEL6/input/checks/iptables_cupsd_disabled.xml @@ -23,7 +23,7 @@ id="obj_iptables_cupsd_disabled_iptables" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$ + ^-A INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$ + ^-A INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$ 1 diff --git a/RHEL6/input/checks/iptables_icmp_disabled.xml b/RHEL6/input/checks/iptables_icmp_disabled.xml index ac52e87..ec1b31e 100644 --- a/RHEL6/input/checks/iptables_icmp_disabled.xml +++ b/RHEL6/input/checks/iptables_icmp_disabled.xml @@ -33,7 +33,7 @@ id="obj_iptables_icmp_disabled_restrict_icmp_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmp\s+--icmp-type\s+any\s+-j\s+ACCEPT$ + ^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+any\s+-j\s+ACCEPT$ 1 @@ -46,7 +46,7 @@ id="obj_iptables_icmp_disabled_echo_reply_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmp\s+--icmp-type\s+echo-reply\s+-j\s+ACCEPT$ + ^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+echo-reply\s+-j\s+ACCEPT$ 1 @@ -59,7 +59,7 @@ id="obj_iptables_icmp_disabled_destication_unreachable_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmp\s+--icmp-type\s+destination-unreachable\s+-j\s+ACCEPT$ + ^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+destination-unreachable\s+-j\s+ACCEPT$ 1 @@ -72,7 +72,7 @@ id="obj_iptables_icmp_disabled_time_exceeded_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmp\s+--icmp-type\s+time-exceeded\s+-j\s+ACCEPT$ + ^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+time-exceeded\s+-j\s+ACCEPT$ 1 @@ -85,7 +85,7 @@ id="obj_iptables_icmp_disabled_drop_echo_request_ipv6" version="1"> /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+echo-request\s+-j\s+DROP$ + ^-A INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+echo-request\s+-j\s+DROP$ 1 @@ -98,7 +98,7 @@ id="obj_iptables_icmp_disabled_drop_router_advertisement_ipv6" version="1"> /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+router-advertisement\s+-j\s+DROP$ + ^-A INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+router-advertisement\s+-j\s+DROP$ 1 diff --git a/RHEL6/input/checks/iptables_ldap_enabled.xml b/RHEL6/input/checks/iptables_ldap_enabled.xml index faf8795..b95a01d 100644 --- a/RHEL6/input/checks/iptables_ldap_enabled.xml +++ b/RHEL6/input/checks/iptables_ldap_enabled.xml @@ -26,7 +26,7 @@ id="obj_20144" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j ACCEPT$ + ^-A INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j ACCEPT$ + ^-A INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j ACCEPT$ 1 /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j ACCEPT$ + ^-A INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j ACCEPT$ + ^-A INPUT -s (?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j ACCEPT$ 1 diff --git a/RHEL6/input/checks/iptables_smtp_enabled.xml b/RHEL6/input/checks/iptables_smtp_enabled.xml index 930e7c6..a84d2b0 100644 --- a/RHEL6/input/checks/iptables_smtp_enabled.xml +++ b/RHEL6/input/checks/iptables_smtp_enabled.xml @@ -23,7 +23,7 @@ id="obj_iptables_smtp_enabled_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$ + ^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$ + ^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$ 1 diff --git a/RHEL6/input/checks/iptables_sshd_disabled.xml b/RHEL6/input/checks/iptables_sshd_disabled.xml index 7310eb5..19d3e4c 100644 --- a/RHEL6/input/checks/iptables_sshd_disabled.xml +++ b/RHEL6/input/checks/iptables_sshd_disabled.xml @@ -23,7 +23,7 @@ id="obj_iptables_sshd_disabled_ipv4" version="1"> /etc/sysconfig iptables - ^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT$ + ^-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT$ 1 /etc/sysconfig ip6tables - ^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT$ + ^-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT$ 1 -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:41 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:41 -0500 Subject: [PATCH 03/12] Changed per ticket #139. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-3-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/accounts/banners.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 4961b15..782cfb4 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -64,7 +64,7 @@ product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.


-or: +OR:

I've read & consent to terms in IS user agreement. -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:43 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:43 -0500 Subject: [PATCH 05/12] Changes per ticket #137. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-5-git-send-email-mnewman@redhat.com> --- RHEL6/input/services/ssh.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 6a3025b..9069e30 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -178,7 +178,7 @@ to compromises on another. Set SSH Client Alive Count -To ensure that the SSH idle timeout occurs precisely when the ClientAliveCountMax is set, +To ensure the SSH idle timeout occurs precisely when the ClientAliveCountMax is set, edit /etc/ssh/sshd_config as follows:
ClientAliveCountMax 0
@@ -190,7 +190,7 @@ If properly configured, output should be:
ClientAliveCountMax 0
-This ensures that a user login will be terminated as soon as the ClientAliveCountMax +This ensures a user login will be terminated as soon as the ClientAliveCountMax is reached. @@ -206,7 +206,7 @@ is reached. command in allowing users to enable insecure access to their accounts via .rhosts files.

-To ensure that this behavior is disabled, add or correct the +To ensure this behavior is disabled, add or correct the following line in /etc/ssh/sshd_config:
IgnoreRhosts yes
@@ -214,7 +214,7 @@ following line in /etc/ssh/sshd_config: -SSH trust relationships mean that a compromise on one host +SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. @@ -239,7 +239,7 @@ following line: -SSH trust relationships mean that a compromise on one host +SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:42 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:42 -0500 Subject: [PATCH 04/12] Changed pet ticket #135. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-4-git-send-email-mnewman@redhat.com> --- RHEL6/input/services/smb.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml index 9d110c7..60bfe54 100644 --- a/RHEL6/input/services/smb.xml +++ b/RHEL6/input/services/smb.xml @@ -187,7 +187,7 @@ packet signing, add the following to the [global] section of the Samba configuration file:
client signing = mandatory
Requiring samba clients such as smbclient to use packet -signing ensures that they can +signing ensures they can only communicate with servers that support packet signing.
@@ -210,7 +210,7 @@ transit. Require Client SMB Packet Signing, if using mount.cifs Require packet signing of clients who mount Samba shares using the mount.cifs program (e.g., those who specify shares -in /etc/fstab). To do so, ensure that signing options (either +in /etc/fstab). To do so, ensure signing options (either sec=krb5i or sec=ntlmv2i) are used.

See the mount.cifs(8) man page for more information. A Samba -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:44 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:44 -0500 Subject: [PATCH 06/12] Changes per ticket #138. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-6-git-send-email-mnewman@redhat.com> --- RHEL6/input/services/xorg.xml | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml index c032654..7ee53e8 100644 --- a/RHEL6/input/services/xorg.xml +++ b/RHEL6/input/services/xorg.xml @@ -6,7 +6,7 @@ system is called X.org.
Disable X Windows Unless there is a mission-critical reason for the -system to run a graphical user interface, ensure that X is not set to start +system to run a graphical user interface, ensure X is not set to start automatically at boot and remove the X Windows software packages. There is usually no reason to run X Windows on a dedicated server machine, as it increases the system's attack surface and consumes @@ -16,12 +16,12 @@ SSH or on the text console. Disable X Windows Startup By Setting Runlevel Setting the system's runlevel to 3 will prevent automatic startup -of the X server. To do so, ensure that the following line in /etc/inittab +of the X server. To do so, ensure the following line in /etc/inittab features a 3 as shown:
id:3:initdefault:
-To verify that the default runlevel is 3, run the following command: +To verify the default runlevel is 3, run the following command:
# grep initdefault /etc/inittab
The output should show the following:
id:3:initdefault:
@@ -37,7 +37,7 @@ The output should show the following: Remove the X Windows Package Group Removing all packages which constitute the X Window System -ensures that users or malicious software cannot start X. +ensures users or malicious software cannot start X. To do so, run the following command:
# yum groupremove "X Window System"
-- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:46 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:46 -0500 Subject: [PATCH 08/12] Changes per ticket #151. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-8-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/network/iptables.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index e52a566..40f1746 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -120,7 +120,7 @@ add or correct the following line in /etc/sysconfig/iptables:
:INPUT DROP [0:0]
-Inspect the file /etc/sysconfig/iptables to determine +Inspect the file /etc/sysconfig/iptables to determine the default policy for the INPUT chain. It should be set to DROP. # grep ":INPUT" /etc/sysconfig/iptables -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:45 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:45 -0500 Subject: [PATCH 07/12] Changes per ticket #143. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-7-git-send-email-mnewman@redhat.com> --- .../accounts/restrictions/password_expiration.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index 8a6f17e..34cb775 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -151,7 +151,7 @@ The DoD requirement is 60. A value of 180 days is sufficient for many environments. -Setting the password maximum age ensures that users are required to +Setting the password maximum age ensures users are required to periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:47 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:47 -0500 Subject: [PATCH 09/12] Changes per ticket #152. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-9-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/network/ipv6.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml index 999cc58..a82325d 100644 --- a/RHEL6/input/system/network/ipv6.xml +++ b/RHEL6/input/system/network/ipv6.xml @@ -31,7 +31,7 @@ If the system is configured to prevent the loading of the ipv6 kernel module, it will contain a line of the form:
options ipv6 disable=1
-inside any file in /etc/modprobe.d or the +Such lines may be inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf. This permits insertion of the IPv6 kernel module (which other parts of the system expect to be present), but otherwise keeps it inactive. Run the following command to search for such -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:49 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:49 -0500 Subject: [PATCH 11/12] Changed "isn't" to "is not". In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-11-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/software/updating.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 4ed4123..5491ed7 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -27,7 +27,7 @@ receive them if desired), the Red Hat GPG key must properly be installed. To ensure that the GPG key is installed, run:
# rhn_register
- + To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return the string: @@ -55,7 +55,7 @@ them, ensure that the following line appears in /etc/yum.conf in the [main] section:
gpgcheck=1
- + To determine whether yum is configured to use gpgcheck, inspect /etc/yum.conf and ensure that the following appears in the [main] section: -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:50 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:50 -0500 Subject: [PATCH 12/12] Make was failing, had to escape the double ampersand. Ticket #164. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-12-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/software/integrity.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 14730e2..6e67fb6 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -181,7 +181,7 @@ OR The following command will list which files on the system have file hashes different from what is expected by the RPM database. -
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
+
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
The hash on important files like system executables should match the information given -- 1.7.1 From mnewman at redhat.com Fri Dec 7 00:27:48 2012 From: mnewman at redhat.com (Michele Newman) Date: Thu, 6 Dec 2012 19:27:48 -0500 Subject: [PATCH 10/12] Changes per ticket #155. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <1354840070-40541-10-git-send-email-mnewman@redhat.com> --- RHEL6/input/system/network/wireless.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml index e53e0f7..3246b17 100644 --- a/RHEL6/input/system/network/wireless.xml +++ b/RHEL6/input/system/network/wireless.xml @@ -95,7 +95,7 @@ the need to install such a driver first.
Disabling the bluetooth service prevents the system from attempting -connections to to Bluetooth devices, which entails some security risk. +connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range. -- 1.7.1 From blank at eclipse.ncsc.mil Fri Dec 7 15:01:03 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 07 Dec 2012 10:01:03 -0500 Subject: [PATCH 01/12] Changed content as per ticket #147. In-Reply-To: <1354840070-40541-1-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> Message-ID: <50C204AF.703@eclipse.ncsc.mil> Please push this set -- thanks. Per our conversation with some of the FSO govt folks on Monday, some of the minor style changes can be at the vendor's (your) discretion; there is a requirement to conform to certain sentence structures and phrasing (and some of these may have been identified in the copy editing patches), but colons vs periods (or other extremely minor items, presumably contractions too) are at your discretion. It's desirable to present configuration actions to admins in the format they'd expect. Thanks! On 12/06/2012 07:27 PM, Michele Newman wrote: > --- > RHEL6/input/system/auditing.xml | 48 +++++++++++++++++++------------------- > 1 files changed, 24 insertions(+), 24 deletions(-) > > diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml > index 67cce9a..c14f3dc 100644 > --- a/RHEL6/input/system/auditing.xml > +++ b/RHEL6/input/system/auditing.xml > @@ -88,7 +88,7 @@ disk. > > > > -Ensuring that the auditd service is active ensures that > +Ensuring the auditd service is active ensures > audit records generated by the kernel can be written to disk, or that appropriate > actions will be taken if other obstacles exist. > > @@ -100,7 +100,7 @@ actions will be taken if other obstacles exist. > > > Enable Auditing for Processes Which Start Prior to the Audit Daemon > -To ensure that all processes can be audited, even > +To ensure all processes can be audited, even > those which start prior to the audit daemon, add the argument > audit=1 to the kernel line in /etc/grub.conf, in the manner below: >
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1
> @@ -114,7 +114,7 @@ auditing is enabled at boot time. > Each process on the system carries an "auditable" flag which > indicates whether its activities can be audited. Although auditd > takes care of enabling this for all processes which launch after it > -does, adding the kernel argument ensures that it is set for every > +does, adding the kernel argument ensures it is set for every > process during boot. >
> > @@ -293,7 +293,7 @@ page. These include: > Set the ACTION to rotate to ensure log rotation > occurs. This is the default. The setting is case-insensitive. > > - > + > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to rotate logs when they reach their > maximum size: > @@ -344,7 +344,7 @@ These include: > Set this to email (instead of the default, > which is suspend) as it is more likely to get prompt attention. > > - disk space is starting to run low"> > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to email the administrator when > @@ -383,7 +383,7 @@ mode for corrective action. For certain systems, the need for availability > outweighs the need to log all actions, and a different setting should be > determined. > > - mode for corrective action"> > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to switch to single user mode > @@ -408,7 +408,7 @@ in /etc/audit/auditd.conf to ensure that administrators are notified > via email for those situations: >
action_mail_acct = root
> > - > + > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to send email to an > account when it needs to notify an administrator: > @@ -465,7 +465,7 @@ editing as needed, the new rules can be activated as follows: > > Records Events that Modify Date and Time Information > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time. All changes to the system > time should be audited. > > @@ -484,11 +484,11 @@ desired, but is not required. See an example of multiple combined syscalls: >
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time (such as sshd). All changes > to the system time should be audited. > > @@ -512,11 +512,11 @@ desired, but is not required. See an example of multiple combined syscalls: >
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time (such as sshd). All changes > to the system time should be audited. > > @@ -538,11 +538,11 @@ See an example of multiple combined syscalls: >
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time (such as sshd). All changes > to the system time should be audited. > > @@ -566,11 +566,11 @@ desired, but is not required. See an example of multiple combined syscalls: >
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time (such as sshd). All changes > to the system time should be audited. > > @@ -587,7 +587,7 @@ The -k option allows for the specification of a key in string form that can > be used for better reporting capability through ausearch and aureport and > should always be used. > > - > + > To determine if the system is configured to audit attempts to > alter time via the /etc/localtime file, run the following > command: > @@ -595,7 +595,7 @@ command: > If the system is configured to audit this activity, it will return a line. > > Arbitrary changes to the system time can be used to obfuscate > -nefarious activities in log files as well as to confuse network services that > +nefarious activities in log files, as well as to confuse network services that > are highly dependent upon an accurate system time (such as sshd). All changes > to the system time should be audited. > > @@ -616,7 +616,7 @@ to capture events that modify account changes: > -w /etc/shadow -p wa -k audit_account_changes > -w /etc/security/opasswd -p wa -k audit_account_changes > > - > + > To determine if the system is configured to audit account changes, > run the following command: >
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
> @@ -643,7 +643,7 @@ ARCH to either b32 or b64 as appropriate for your system: > -w /etc/hosts -p wa -k audit_network_modifications > -w /etc/sysconfig/network -p wa -k audit_network_modifications > > - > + > To determine if the system is configured to audit changes to its network configuration, > run the following command: >
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
> @@ -697,7 +697,7 @@ owner, and unauthorized users, potential access to sensitive information. Add the following to /etc/audit/audit.rules: >
-w /etc/selinux/ -p wa -k MAC-policy
>
> - > + > To determine if the system is configured to audit changes to its SELinux > configuration files, run the following command: >
# auditctl -l | grep "dir=/etc/selinux"
> @@ -760,7 +760,7 @@ If the system is 64 bit then also add the following: > gain access to information that would otherwise be disallowed. Auditing DAC modifications > can facilitate the identification of patterns of abuse among both authorized and > unauthorized users.
> - > + > > > Note that these rules can be configured in a > @@ -1233,7 +1233,7 @@ appropriate for your system: > > > Auditing file deletions will create an audit trail for files that are removed > -from the system. The audit trail could aid in system troubleshooting as well as detecting > +from the system. The audit trail could aid in system troubleshooting, as well as, detecting > malicious processes that attempt to delete log files to conceal their presence. > > > @@ -1252,7 +1252,7 @@ To verify that auditing is configured for system administrator actions, run the >
# auditctl -l | grep "watch=/etc/sudoers"
>
> The actions taken by system administrators should be audited to keep a record > -of what was executed on the system as well as for accountability purposes. > +of what was executed on the system, as well as, for accountability purposes. > > > -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance From blank at eclipse.ncsc.mil Sat Dec 8 00:27:01 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 07 Dec 2012 19:27:01 -0500 Subject: [PATCH 12/12] Make was failing, had to escape the double ampersand. Ticket #164. In-Reply-To: <1354840070-40541-12-git-send-email-mnewman@redhat.com> References: <1354840070-40541-1-git-send-email-mnewman@redhat.com> <1354840070-40541-12-git-send-email-mnewman@redhat.com> Message-ID: <50C28955.5070403@eclipse.ncsc.mil> There is no need to wait for an ACK for this; bugfixes should be pushed as soon as possible. I have gone ahead and pushed something similar. On 12/06/2012 07:27 PM, Michele Newman wrote: > --- > RHEL6/input/system/software/integrity.xml | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml > index 14730e2..6e67fb6 100644 > --- a/RHEL6/input/system/software/integrity.xml > +++ b/RHEL6/input/system/software/integrity.xml > @@ -181,7 +181,7 @@ OR > > The following command will list which files on the system > have file hashes different from what is expected by the RPM database. > -
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
> +
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
>
> > The hash on important files like system executables should match the information given From blank at eclipse.ncsc.mil Sat Dec 8 00:39:38 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 7 Dec 2012 19:39:38 -0500 Subject: [PATCH 1/4] added xhtml files to gitignore in output In-Reply-To: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> References: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1354927181-1645-2-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/output/.gitignore | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/RHEL6/output/.gitignore b/RHEL6/output/.gitignore index 97ea8ba..2fdb145 100644 --- a/RHEL6/output/.gitignore +++ b/RHEL6/output/.gitignore @@ -1,6 +1,7 @@ # files not to track in git *.xml *.html +*.xhtml *.pdf *.ini *.spec -- 1.7.1 From blank at eclipse.ncsc.mil Sat Dec 8 00:39:37 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 7 Dec 2012 19:39:37 -0500 Subject: [PATCH 0/4] new transform to include SRG items alongside automated Rules Message-ID: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> This transform adds rows from an SRG mapping table to the STIG rules table, so that the resulting table includes information for every SRG item. It is incomplete: it still needs to grab the correct "check" text which describes how the RHEL product satisfies (or cannot satisfy) a particular SRG requirement. In some cases, this text still needs to be written. This can be resolved in short order through changes to the output in the SRG mapping table. Jeffrey Blank (4): added xhtml files to gitignore in output new transform to add items from an SRG mapping table to a Rule table added new Rules to create Rule table, including any SRG items not tied to specific configuration action fixed characters to escape ampersand RHEL6/Makefile | 4 ++- RHEL6/input/system/software/integrity.xml | 2 +- RHEL6/output/.gitignore | 1 + RHEL6/transforms/table-add-srgitems.xslt | 56 +++++++++++++++++++++++++++++ 4 files changed, 61 insertions(+), 2 deletions(-) create mode 100644 RHEL6/transforms/table-add-srgitems.xslt From blank at eclipse.ncsc.mil Sat Dec 8 00:39:39 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 7 Dec 2012 19:39:39 -0500 Subject: [PATCH 2/4] new transform to add items from an SRG mapping table to a Rule table In-Reply-To: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> References: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1354927181-1645-3-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/transforms/table-add-srgitems.xslt | 56 ++++++++++++++++++++++++++++++ 1 files changed, 56 insertions(+), 0 deletions(-) create mode 100644 RHEL6/transforms/table-add-srgitems.xslt diff --git a/RHEL6/transforms/table-add-srgitems.xslt b/RHEL6/transforms/table-add-srgitems.xslt new file mode 100644 index 0000000..af40bb4 --- /dev/null +++ b/RHEL6/transforms/table-add-srgitems.xslt @@ -0,0 +1,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TBDmedium + + + + + + + + + +
+
+ + + + + + + + +
-- 1.7.1 From blank at eclipse.ncsc.mil Sat Dec 8 00:39:41 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 7 Dec 2012 19:39:41 -0500 Subject: [PATCH 4/4] fixed characters to escape ampersand In-Reply-To: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> References: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1354927181-1645-5-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/input/system/software/integrity.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 54c106c..2aa54a2 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -181,7 +181,7 @@ OR The following command will list which files on the system have file hashes different from what is expected by the RPM database. -
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
+
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
The hash on important files like system executables should match the information given -- 1.7.1 From blank at eclipse.ncsc.mil Sat Dec 8 00:39:40 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 7 Dec 2012 19:39:40 -0500 Subject: [PATCH 3/4] added new Rules to create Rule table, including any SRG items not tied to specific configuration action In-Reply-To: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> References: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1354927181-1645-4-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/Makefile | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 1e59adf..f805db7 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -69,8 +69,9 @@ table-srgmap: shorthand2xccdf $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml xsltproc -stringparam flat "y" -stringparam map-to-items "../$(OUT)/unlinked-rhel6-xccdf.xml" -o $(OUT)/table-rhel6-srgmap-flat.html \ $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml + xmllint --xmlout --html --output $(OUT)/table-rhel6-srgmap-flat.xhtml $(OUT)/table-rhel6-srgmap-flat.html -table-stigs: shorthand2xccdf +table-stigs: shorthand2xccdf table-srgmap xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml xsltproc --html -o $(OUT)/table-rhel5-stig-manual-ccisorted.html $(TRANS)/table-sortbyref.xslt $(OUT)/table-rhel5-stig-manual.html @@ -91,6 +92,7 @@ table-stigs: shorthand2xccdf xsltproc -stringparam profile "stig-rhel6-server" -stringparam format "flat" -o $(OUT)/table-stig-rhel6-server-flat.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-stig-rhel6-xccdf.xml + xsltproc --novalid --html -o $(OUT)/table-stig-rhel6-server-flat-srgs.html $(TRANS)/table-add-srgitems.xslt $(OUT)/table-stig-rhel6-server-flat.html xsltproc --html -o $(OUT)/table-stig-rhel6-server-flat.html $(TRANS)/table-add-vulnids.xslt $(OUT)/table-stig-rhel6-server-flat.html tables: table-refs table-idents table-profilenistrefs table-srgmap table-stigs -- 1.7.1 From blank at eclipse.ncsc.mil Sat Dec 8 00:43:07 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Fri, 07 Dec 2012 19:43:07 -0500 Subject: [PATCH 0/4] new transform to include SRG items alongside automated Rules In-Reply-To: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> References: <1354927181-1645-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <50C28D1B.7070200@eclipse.ncsc.mil> Ack & pushed. There is no time to wait. On 12/07/2012 07:39 PM, Jeffrey Blank wrote: > This transform adds rows from an SRG mapping table to the STIG rules table, so > that the resulting table includes information for every SRG item. > > It is incomplete: it still needs to grab the correct "check" text which > describes how the RHEL product satisfies (or cannot satisfy) a particular > SRG requirement. In some cases, this text still needs to be > written. > > This can be resolved in short order through changes to the output in the SRG mapping table. > > > > > Jeffrey Blank (4): > added xhtml files to gitignore in output > new transform to add items from an SRG mapping table to a Rule table > added new Rules to create Rule table, including any SRG items not > tied to specific configuration action > fixed characters to escape ampersand > > RHEL6/Makefile | 4 ++- > RHEL6/input/system/software/integrity.xml | 2 +- > RHEL6/output/.gitignore | 1 + > RHEL6/transforms/table-add-srgitems.xslt | 56 +++++++++++++++++++++++++++++ > 4 files changed, 61 insertions(+), 2 deletions(-) > create mode 100644 RHEL6/transforms/table-add-srgitems.xslt > > From blank at eclipse.ncsc.mil Mon Dec 10 21:11:55 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Mon, 10 Dec 2012 16:11:55 -0500 Subject: [PATCH 0/3] adding check content to SRG output Message-ID: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> This should take care of presenting the "check text" related to satisfying SRG items that are accompanied by a presentation of evidence and assertion that they are met/unmeetable (versus those that contain actionable guidance for admins). Jeffrey Blank (3): ensure guide generation does not trample other tempfiles include check instructions in SRG mapping tables adding new column with check instructions RHEL6/Makefile | 4 ++-- RHEL6/transforms/table-add-srgitems.xslt | 2 +- RHEL6/transforms/table-srgmap.xslt | 6 ++++++ 3 files changed, 9 insertions(+), 3 deletions(-) From blank at eclipse.ncsc.mil Mon Dec 10 21:11:56 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Mon, 10 Dec 2012 16:11:56 -0500 Subject: [PATCH 1/3] ensure guide generation does not trample other tempfiles In-Reply-To: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> References: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1355173918-6790-2-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/Makefile | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/Makefile b/RHEL6/Makefile index f805db7..02d4bdc 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -34,8 +34,8 @@ checks: guide: shorthand2xccdf # remove auxiliary Groups which are only for use in tables, and not guide output. # specifying a nonexistent profile, "allrules," to make oscap print all Rules - xsltproc -o $(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml - oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf.xml > $(OUT)/rhel6-guide.html + xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml + oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html # example, if needed: for converting XCCDF into shorthand #xccdf2shorthand: -- 1.7.1 From blank at eclipse.ncsc.mil Mon Dec 10 21:11:58 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Mon, 10 Dec 2012 16:11:58 -0500 Subject: [PATCH 3/3] adding new column with check instructions In-Reply-To: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> References: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1355173918-6790-4-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/transforms/table-add-srgitems.xslt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/transforms/table-add-srgitems.xslt b/RHEL6/transforms/table-add-srgitems.xslt index af40bb4..3f99b74 100644 --- a/RHEL6/transforms/table-add-srgitems.xslt +++ b/RHEL6/transforms/table-add-srgitems.xslt @@ -25,7 +25,7 @@ - + -- 1.7.1 From blank at eclipse.ncsc.mil Mon Dec 10 21:11:57 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Mon, 10 Dec 2012 16:11:57 -0500 Subject: [PATCH 2/3] include check instructions in SRG mapping tables In-Reply-To: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> References: <1355173918-6790-1-git-send-email-blank@eclipse.ncsc.mil> Message-ID: <1355173918-6790-3-git-send-email-blank@eclipse.ncsc.mil> Signed-off-by: Jeffrey Blank --- RHEL6/transforms/table-srgmap.xslt | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/RHEL6/transforms/table-srgmap.xslt b/RHEL6/transforms/table-srgmap.xslt index 53a3fef..872adfc 100644 --- a/RHEL6/transforms/table-srgmap.xslt +++ b/RHEL6/transforms/table-srgmap.xslt @@ -63,6 +63,7 @@ Rule ID Rule Title Rule Desc + Rule Check Rules Mapped @@ -140,6 +141,7 @@ + @@ -173,4 +175,8 @@ + + + + -- 1.7.1 From shawn.d.wells at gmail.com Tue Dec 11 10:08:49 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 11 Dec 2012 05:08:49 -0500 Subject: [PATCH 1/3] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml Message-ID: <20121211100849.GA2888@mail.corp.redhat.com> -------------- next part -------------- >From 7221833ea4a7e9c1ed20187ef7cffc93efc8033b Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:32:45 -0500 Subject: [PATCH 1/3] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml Closing ticket https://fedorahosted.org/scap-security-guide/ticket/158 --- RHEL6/input/system/permissions/mounting.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 0e35db6..5c60da7 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -149,9 +149,9 @@ or removable media, disable the service for all runlevels:
# chkconfig --level 0123456 autofs off
-To verify that the autofs service is disabled, run the following command: +To verify the autofs service is disabled, run the following command:
chkconfig --list autofs
-If properly configured, the output should be: +If properly configured, the output should be the following:
autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off
All filesystems that are required for the successful operation of the system -- 1.7.1 From shawn.d.wells at gmail.com Tue Dec 11 10:09:02 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 11 Dec 2012 05:09:02 -0500 Subject: [PATCH 2/3] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml Message-ID: <20121211100902.GA2894@mail.corp.redhat.com> -------------- next part -------------- >From 0ea406bcdf0e400b44047de06f991c32e3a3875e Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:43:34 -0500 Subject: [PATCH 2/3] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml DISA FSO requested updates to RHEL6/input/system/permissions/files.xml Closing ticke https://fedorahosted.org/scap-security-guide/ticket/157 --- RHEL6/input/system/permissions/files.xml | 34 ++++++++++++----------------- 1 files changed, 14 insertions(+), 20 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 14b6fcb..e714982 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -193,13 +193,10 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are -stored in: -
/lib/modules
-All files in these directories should not be -group-writable or world-writable. -If any file FILE in these directories is found -to be group-writable or world-writeable, correct its permission with the -following command: +stored in /lib/modules>. All files in these directories +should not be group-writable or world-writable. If any file in these +directories is found to be group-writable or world-writeable, correct +its permission with the following command:
# chmod go-w FILE
@@ -226,16 +223,13 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also -stored in: -
/lib/modules
-All files in these directories should be -owned by the root user. -If any file FILE in these directories is found +stored in /lib/modules. All files in these directories should be +owned by the root user. If any file in these directories is found to be owned by a user other than root, correct its ownership with the following command:
# chown root FILE
- + To find shared libraries that are not owned by root, run the following command for each directory DIR which contains shared libraries:
$ find DIR \! -user root
@@ -264,14 +258,14 @@ to be group-writable or world-writeable, correct its permission with the following command:
# chmod go-w FILE
- + To find system executables that are group-writable or world-writable, run the following command for each directory DIR which contains system executables:
$ find DIR -perm /022
-System binaries are executed by privileged users as well as system services, -and restrictive permissions are necessary to ensure that their -execution of these programs cannot be co-opted. +System binaries are executed by privileged users, as well as system services, +and restrictive permissions are necessary to ensure execution of these programs +cannot be co-opted.
@@ -414,7 +408,7 @@ cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. - + The following command will discover and print any files on local partitions which do not belong to a valid user. Run it once for each local partition PART: @@ -425,7 +419,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. @@ -452,7 +446,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. -- 1.7.1 From shawn.d.wells at gmail.com Tue Dec 11 10:09:26 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 11 Dec 2012 05:09:26 -0500 Subject: [PATCH 3/3] Bugfix Message-ID: <20121211100926.GA2900@mail.corp.redhat.com> -------------- next part -------------- >From 34a039c9593afa9237371e49fa2afd9ca09f6b21 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 11 Dec 2012 05:07:34 -0500 Subject: [PATCH 3/3] Bugfix: Typos in input/system/permissions/files.xml Fixes the following errors: $ make all cd RHEL6 && make make[1]: Entering directory `/var/www/html/scap-security-guide/RHEL6' xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml input/system/permissions/files.xml:196: parser error : expected '>' stored in /lib/modules>. All files in these directories ^ input/system/permissions/files.xml:196: parser error : Opening and ending tag mismatch: tt line 196 and unparseable stored in /lib/modules>. All files in these directories ^ input/system/permissions/files.xml:196: parser error : Opening and ending tag mismatch: description line 187 and tt stored in /lib/modules>. All files in these directories ^ input/system/permissions/files.xml:201: parser error : Opening and ending tag mismatch: Rule line 185 and description ^ input/system/permissions/files.xml:213: parser error : Opening and ending tag mismatch: Group line 176 and Rule
^ input/system/permissions/files.xml:304: parser error : Extra content at the end of the document ^ --- RHEL6/input/system/permissions/files.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index e714982..8453eff 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -193,7 +193,7 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are -stored in /lib/modules>. All files in these directories +stored in /lib/modules. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writeable, correct its permission with the following command: -- 1.7.1 From shawn at redhat.com Wed Dec 12 16:16:14 2012 From: shawn at redhat.com (Shawn Wells) Date: Wed, 12 Dec 2012 11:16:14 -0500 Subject: [PATCH 2/3] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml In-Reply-To: <20121211100902.GA2894@mail.corp.redhat.com> References: <20121211100902.GA2894@mail.corp.redhat.com> Message-ID: <50C8ADCE.1060006@redhat.com> On 12/11/12 5:09 AM, Shawn Wells wrote: > +stored in /lib/modules>. All files in these directories > +should not be group-writable or world-writable. If any file in these Caught this typo (which I introduced), patched in 3/3. Ack. From shawn at redhat.com Wed Dec 12 16:17:24 2012 From: shawn at redhat.com (Shawn Wells) Date: Wed, 12 Dec 2012 11:17:24 -0500 Subject: [PATCH 1/3] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml In-Reply-To: <20121211100849.GA2888@mail.corp.redhat.com> References: <20121211100849.GA2888@mail.corp.redhat.com> Message-ID: <50C8AE14.2040209@redhat.com> On 12/11/12 5:08 AM, Shawn Wells wrote: > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-per.patch > > > From 7221833ea4a7e9c1ed20187ef7cffc93efc8033b Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 19:32:45 -0500 > Subject: [PATCH 1/3] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml > DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml > Closing tickethttps://fedorahosted.org/scap-security-guide/ticket/158 > > --- > RHEL6/input/system/permissions/mounting.xml | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml > index 0e35db6..5c60da7 100644 > --- a/RHEL6/input/system/permissions/mounting.xml > +++ b/RHEL6/input/system/permissions/mounting.xml > @@ -149,9 +149,9 @@ or removable media, disable the service for all runlevels: >
# chkconfig --level 0123456 autofs off
> > > -To verify that the autofs service is disabled, run the following command: > +To verify the autofs service is disabled, run the following command: >
chkconfig --list autofs
> -If properly configured, the output should be: > +If properly configured, the output should be the following: >
autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off
>
> All filesystems that are required for the successful operation of the system > -- 1.7.1 Ack -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn at redhat.com Wed Dec 12 16:17:40 2012 From: shawn at redhat.com (Shawn Wells) Date: Wed, 12 Dec 2012 11:17:40 -0500 Subject: [PATCH 3/3] Bugfix In-Reply-To: <20121211100926.GA2900@mail.corp.redhat.com> References: <20121211100926.GA2900@mail.corp.redhat.com> Message-ID: <50C8AE24.3050703@redhat.com> On 12/11/12 5:09 AM, Shawn Wells wrote: > > 0003-Bugfix-Typos-in-input-system-permissions-files.xml.patch > > > From 34a039c9593afa9237371e49fa2afd9ca09f6b21 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Tue, 11 Dec 2012 05:07:34 -0500 > Subject: [PATCH 3/3] Bugfix: Typos in input/system/permissions/files.xml > Fixes the following errors: > $ make all > cd RHEL6 && make > make[1]: Entering directory `/var/www/html/scap-security-guide/RHEL6' > xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml > input/system/permissions/files.xml:196: parser error : expected '>' > stored in /lib/modules>. All files in these directories > ^ > input/system/permissions/files.xml:196: parser error : Opening and ending tag mismatch: tt line 196 and unparseable > stored in /lib/modules>. All files in these directories > ^ > input/system/permissions/files.xml:196: parser error : Opening and ending tag mismatch: description line 187 and tt > stored in /lib/modules>. All files in these directories > ^ > input/system/permissions/files.xml:201: parser error : Opening and ending tag mismatch: Rule line 185 and description > > ^ > input/system/permissions/files.xml:213: parser error : Opening and ending tag mismatch: Group line 176 and Rule >
> ^ > input/system/permissions/files.xml:304: parser error : Extra content at the end of the document > > ^ > > --- > RHEL6/input/system/permissions/files.xml | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml > index e714982..8453eff 100644 > --- a/RHEL6/input/system/permissions/files.xml > +++ b/RHEL6/input/system/permissions/files.xml > @@ -193,7 +193,7 @@ by default: > /usr/lib64 > > Kernel modules, which can be added to the kernel during runtime, are > -stored in /lib/modules>. All files in these directories > +stored in /lib/modules. All files in these directories > should not be group-writable or world-writable. If any file in these > directories is found to be group-writable or world-writeable, correct > its permission with the following command: > -- 1.7.1 Pushing as bugfix -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawn.d.wells at gmail.com Fri Dec 14 02:49:21 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Thu, 13 Dec 2012 21:49:21 -0500 Subject: [PTCH 1/28] Housekeeping of OVAL references Message-ID: <20121214024921.GA5457@mail.corp.redhat.com> -------------- next part -------------- >From 5b69c93d2bb4fd62e87c2ee93236d261a1c6ac72 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 13 Dec 2012 19:44:16 -0500 Subject: [PATCH 01/28] Housekeeping of OVAL references These rules didn't actually have OVAL counterparts, moving them "TODO" --- RHEL6/input/services/http.xml | 8 ++++---- RHEL6/input/services/nfs.xml | 16 ++++++++-------- RHEL6/input/system/accounts/banners.xml | 2 +- RHEL6/input/system/logging.xml | 2 +- RHEL6/input/system/permissions/mounting.xml | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml index d1f396b..02fca5c 100644 --- a/RHEL6/input/services/http.xml +++ b/RHEL6/input/services/http.xml @@ -120,7 +120,7 @@ Information disclosed to clients about the configuration of the web server and s to plan an attack on the given system. This information disclosure should be restricted to a minimum. - + @@ -138,7 +138,7 @@ Information disclosed to clients about the configuration of the web server and s to plan an attack on the given system. This information disclosure should be restricted to a minimum. - + @@ -648,7 +648,7 @@ content is transmitted in plain text which could be passively monitored and acce unauthorized parties. - + @@ -679,7 +679,7 @@ enabling the administrator to implement content access policies and filters at t application layer. - + diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml index c67abd0..858aa9e 100644 --- a/RHEL6/input/services/nfs.xml +++ b/RHEL6/input/services/nfs.xml @@ -213,7 +213,7 @@ Restrict service to always use a given port, so that firewalling can be done effectively. - + @@ -230,7 +230,7 @@ your network. Restrict service to always use a given port, so that firewalling can be done effectively. - + @@ -245,7 +245,7 @@ Where statd-port is a port which is not used by any other service on yo Restrict service to always use a given port, so that firewalling can be done effectively. - + @@ -260,7 +260,7 @@ Where mountd-port is a port which is not used by any other service on y Restrict service to always use a given port, so that firewalling can be done effectively. - + @@ -451,7 +451,7 @@ Ensure that no line in /etc/exports contains the option no_root_squ If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system. - + @@ -467,7 +467,7 @@ Ensure that no line in /etc/exports contains the option insecure - + @@ -490,8 +490,8 @@ To verify insecure file locking has been disabled, run the following command. Allowing insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user. - - + + diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 4961b15..e4f886c 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -143,7 +143,7 @@ Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. -