Which of these be added to STIG profile?

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Dec 14 18:57:33 UTC 2012


Possibly none of them.
Here is the question you are actually posing:
"Why aren't we adding all Rules in the entire project to the STIG profile?"

Here is why you are asking it:
You are seeing that all items in the entire project got tagged with the
generic "best practice" CCI.  This occurred in an automated way in
transforms/xccdf-addrefs.xslt; check out its comments.

The original intention was to add the "best practices" CCI reference to
only those Rules that are selected for the STIG profile as "best
practice" (and vetted through the consensus process), but openscap's
XCCDF resolve operation had some issues with the content at the time
which prevented me from writing a simple transform to add references to
only the Rules in that Profile (since it _extends_ another one).  By
now, it might, and I should probably check.

So instead I simply added the CCI reference to all Rules, and then we
deselect the ones that aren't in the STIG Profile to create the STIG
tables.

The most recent transform (table-addsrgitems.xslt), which creates a
table with all the OS SRG requirements and also all of the Rules which
we assert satisfy them, addresses this concern, by showing all the OS
SRG requirements along with the Rules which are intended to satisfy
them.  The concern is totally reasonable -- that we've tagged something
with an CCI that's in the OS SRG but somehow forgotten to include it in
a Profile.  (We're also hard at work on the output of that table today.)

So, you may wonder if the verify-references.py script is useful at all.
 Why thank you for asking.  It makes sense to run that script on:
unlinked-rhel6-xccdf-prerefs.xml
which will catch any items that had been manually tagged with CCI IDs
(indicating a clear intent for inclusion into the STIG) but which may
have been overlooked for inclusion into the STIG Profile.  There may yet
be a small number of things which were tagged with CCIs, but which
caused howling at consensus meetings, or which were possibly just
blithely tagged with CCIs.

The next iteration of this toolset (likely for RHEL 7) should be much
simpler and better documented.  The current set of moving parts was a
bit too complex for me to have handled this in the right way.



On 12/14/2012 12:21 PM, Shawn Wells wrote:
> $ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p
> stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml
> 
> 
> These ones seem to make sense, and many are mapped to actual CCI/SRG:
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_prelink
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: aide_build_database
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mountopt_nodev_on_nonroot_partitions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mountopt_nodev_on_removable_partitions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mountopt_nosuid_on_removable_partitions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_tmp_nodev
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_tmp_noexec
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_tmp_nosuid
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_dev_shm_nodev
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_dev_shm_noexec
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_dev_shm_nosuid
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: mount_option_var_tmp_bind_var
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: console_device_restrict_access_desktop
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: console_device_restrict_access_server
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: bootloader_nousb_argument
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: bios_disable_usb_boot
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: gconf_gnome_disable_automount
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_cramfs
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_freevxfs
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_jffs2
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_hfs
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_hfsplus
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_squashfs
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_module_udf
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_gnome_thumbnailers
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: no_unpackaged_sgid_files
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: no_unpackaged_suid_files
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_setuid_coredumps
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: bios_enable_execution_restrictions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_restorecond_enabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: selinux_confinement_of_daemons
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: root_path_no_dot
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: root_path_no_groupother_writable
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: homedir_perms_no_groupwrite_worldread
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_user_list
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_disable_unused_interfaces
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_disable_zeroconf
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_sniffer_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: wireless_disable_in_bios
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: deactivate_wireless_interfaces
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_disable_interfaces
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_disable_rpc
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: set_sysctl_net_ipv6_conf_default_accept_ra
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_static_address
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_privacy_extensions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_default_gateway
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: network_ipv6_limit_requests
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: rsyslog_logfiles_exist
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: rsyslog_accept_remote_messages_none
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: rsyslog_accept_remote_messages_tcp
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: rsyslog_accept_remote_messages_udp
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: configure_logwatch_hostlimit
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: configure_logwatch_splithosts
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_logwatch_for_logserver
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: audit_logs_rootowner
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: audit_manual_logon_edits
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: audit_manual_session_edits
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: audit_config_immutable
> 
> 
> I'm not terribly in favor of specifying what services people can/can't
> run without an
> incredibly good reason, and I do not see a valid policy requirement to
> get this included
> into the STIG. Perhaps we should remove the CCI reference (it's the
> generic catch all)?
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_acpid_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_certmonger_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_cgconfig_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_cgred_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_cpuspeed_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_haldaemon_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_irqbalance_enabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_kdump_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_mdmonitor_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_messagebus_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_portreserve_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_psacct_enabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_quota_nld_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_rhsmcertd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_saslauthd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_smartd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_sysstat_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_anacron
> 
> 
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ssh_server_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ssh_server_iptables_exception
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: sshd_limit_user_access
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: avahi_ip_only
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: avahi_check_ttl
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: avahi_prevent_port_sharing
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: avahi_disable_publishing
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_cups_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: iptables_cupsd_disabled
> 
> 
> 
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: cups_disable_browsing
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: cups_disable_printserver
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_dhcp_server
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_dhcp_server
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dhcp_server_disable_ddns
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dhcp_server_deny_decline
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dhcp_server_deny_bootp
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dhcp_server_configure_logging
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ntpd_specify_multiple_servers
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: iptables_smtp_enabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_logging
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_install_ssl_cert
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_server_denial_of_service
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_server_banner
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_server_mail_relay_set_trusted_networks
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_server_mail_relay_for_trusted_networks
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server:
> postfix_server_mail_relay_smtp_auth_for_untrusted_networks
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: postfix_server_mail_relay_require_tls_for_smtp_auth
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_olcsuffix
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_bdb_file_security
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_olcrootpw
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_certificate_files
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_olcaccess
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_directory_file_security
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: iptables_ldap_enabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ldap_server_config_logging
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_nfslock_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_rpcgssd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_rpcidmapd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_netfs_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_rpcbind_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: nfs_fixed_lockd_tcp_port
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: nfs_fixed_lockd_udp_port
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: nfs_fixed_statd_port
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: nfs_fixed_mountd_port
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_nfs_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: service_rpcsvcgssd_disabled
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: use_root_squashing_all_exports
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: restrict_nfs_clients_to_privileged_ports
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_dns_server
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_bind
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dns_server_chroot
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dns_server_disable_dynamic_updates
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_vsftpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_vsftpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: install_vsftpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ftp_restrict_to_anon
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ftp_disable_uploads
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: ftp_home_partition
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_httpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_httpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_servertokens_prod
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_serversignature_off
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_digest_authentication
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_mod_rewrite
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_ldap_support
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_server_side_includes
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_mime_magic
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_webdav
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_server_activity_status
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_server_configuration_display
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_url_correction
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_proxy_support
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_cache_support
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_cgi_support
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_restrict_root_directory
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_restrict_web_directory
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_restrict_critical_directories
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_limit_available_methods
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_install_mod_ssl
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_install_mod_security
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_logs_permissions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_conf_dir_permissions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: httpd_conf_files_permissions
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_dovecot
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_dovecot
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dovecot_support_necessary_protocols
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dovecot_enable_ssl
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dovecot_configure_ssl_cert
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dovecot_configure_ssl_key
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: dovecot_disable_plaintext_auth
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_smb_server
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: smb_server_disable_root
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: smb_set_auth_levels
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_squid
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_squid
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: disable_snmpd
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: uninstall_net-snmp
> XCCDF Rule found with DISA CCI reference outside Profile
> stig-rhel6-server: snmpd_configuration_guidance
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list