From blank at eclipse.ncsc.mil Mon Feb 6 16:05:21 2012 From: blank at eclipse.ncsc.mil (Jeffrey Blank) Date: Mon, 06 Feb 2012 11:05:21 -0500 Subject: NIST requirement mapping question In-Reply-To: References: Message-ID: <4F2FFA41.8030002@eclipse.ncsc.mil> I added a new transform to break apart comma-separated items in a particular reference document, as well as another transform to sort the resulting HTML table. See last commands in the Makerule for "table-refs" ... I think the output file rhel6-table-nistrefs-delim.html might be close to what you're looking for. There should probably be some examples/scripts to do this using lxml.etree too. Ensuring completeness wrt requirements is a lot more difficult than sorting/presenting XML elements, but hopefully this helps... On 01/26/2012 03:09 PM, Joe Nall wrote: > Has any work been done to be able to say what checks are mapped to a single NIST control? > For example: > AC-3: > userowner_shadow_file > groupowner_shadow_file > groupowner_group_file > ... > > IIUC, the current tools generate something more akin to > userowner_shadow_file: > AC-3, CM-6 > where AC-3 and CM-6 are in the same nist ref > > joe > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide at lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide From shawn at redhat.com Thu Feb 23 01:33:27 2012 From: shawn at redhat.com (Shawn Wells) Date: Wed, 22 Feb 2012 20:33:27 -0500 Subject: [1/1] 0001-22-FEB-2012-shawn-redhat.com.patch Message-ID: <4F459767.9070506@redhat.com> Do we have a formal process before committing patches? I made a few updates to audit tonight, attached. I still need to link to CCEs, ICD, etc though. -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0001-22-FEB-2012-shawn-redhat.com.patch URL: From shawn at redhat.com Wed Feb 22 01:19:45 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 20:19:45 -0500 Subject: [PATCH] 22-FEB-2012 shawn@redhat.com - Updated rhel6/src/input/system/auditing.xml to include additional DCID 6/3 and ICD checks Message-ID: --- rhel6/src/input/system/auditing.xml | 231 ++++++++++++++++++++++++++--------- 1 files changed, 175 insertions(+), 56 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 628be6a..7c37ac6 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -1,32 +1,19 @@ -System Accounting with <tt>auditd</tt> -The audit service provides substantial capabilities -for recording system activities. -By default, the service audits about -SELinux AVC denials and certain types of security-relevant events -such as system logins, account modifications, and authentication -events performed by programs such as sudo. -

-Under its default configuration, auditd has modest disk space -requirements, and should not noticeably impact system performance. -The audit service, in its default configuration, is strongly -recommended for all sites, regardless of whether they are running -SELinux. -

-Government networks often have substantial auditing -requirements and auditd can be configured to meet these -requirements. -

-Example requirements include: -

-
    -
  • Ensure Auditing is Configured to Collect Certain System Events + System Accounting with <tt>auditd</tt> + +

    The audit service provides substantial capabilities for recording system activities. By default the service audits about SELinux AVC denials and certain types of security-relevant events such as system logins, account modifications, and authentication events performed by programs such as sudo.

    + +

    Under its default configuration auditd has modest disk space requirements and should not noticeably impact system performance. The audit service, in its default configuration, is strongly recommended for all sites, regardless of whether they are running SELinux.

    + +

    Government networks often have substantial auditing requirements and auditd can be configured to meet these requirements. Example requirements include:

      -
    • Information on the Use of Print Command (unsuccessful and successful)
    • -
    • Startup and Shutdown Events (unsuccessful and successful)
    • -
  • -
  • Ensure the auditing software can record the following for each -audit event: +
  • Ensure Auditing is Configured to Collect Certain System Events +
      +
    • Information on the Use of Print Command (unsuccessful and successful)
    • +
    • Startup and Shutdown Events (unsuccessful and successful)
    • +
    +
  • +
  • Ensure the auditing software can record the following for each audit event:
    • Date and time of the event
    • Userid that initiated the event
    • @@ -66,12 +53,12 @@ data if the system is busy. Enable auditd Service -Ensure that the auditd service is enabled (this is the -default): -
      -
      -# chkconfig auditd on
      -
      + +Ensure that the auditd service is enabled (Note: auditd is enabled by default in all Red Hat Enterprise Linux 6 installations): +
      +
      +  # chkconfig auditd on
      +  
      @@ -80,6 +67,34 @@ default):
      + +Enable Auditing of Attempts to Access Audit Data +Successful and unsuccessful attempts to read information from system audit records, including any manual modifications, should be audited. The following should be added to the /etc/audit/audit.rules file: +
      +
      -w /var/log/audit -k audit_data_access_attempts
      +
      + + + + +
      + + +Enable Auditing of <tt>auditd</tt> Collection Functions +Modifications to the audit configuration that occur while the audit collection functions are operationg should be monitored. This can be enabled by including the following lines in /etc/audit/audit.rules: +
      +
      +-w /etc/audit -p wa -k audit_daemon_modifications
      +-w /etc/sysconfig/auditd -p wa -k audit_daemon_modifications
      +-w /etc/libaudit.conf -p wa -k audit_daemon_modifications
      +-w /etc/audisp/ -p wa -k audit_daemon_modifications
      +
      + + + + +
      + Enable Auditing for Processes Which Start Prior to the Audit Daemon To ensure that all processes can be audited, even @@ -147,23 +162,113 @@ editing as needed, activate the new rules: Records Events that Modify Date and Time Information -Add the following to /etc/audit/audit.rules, setting -ARCH to either b32 or b64 as appropriate for your system: +Add the following to /etc/audit/audit.rules. Note that both the arch=b32 and arch=b64 audit rules should be in place to account for both the 32 and 64 bit system calls, regardless of underlying hardware architecture.
      --a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S stime -k time-change
      --a always,exit -F arch=ARCH -S clock_settime -k time-change
      +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
      +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time-change
       -w /etc/localtime -p wa -k time-change
      Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent -upon an accurate system time. All changes to the system time should be audited. +upon an accurate system time (for example, sshd). All changes to the system time should be audited.
      + + Audit umask Changes + Add the following to /etc/audit/audit.rules to the change of umask from the command line +
      +
      +-a always,exit -F arch=b32 -S umask
      +-a always,exit -F arch=b64 -S umask
      +
      + The umask command modifies the default setting of permissive or restrictive DAC rules. As such, alterations from the default umask should be audited + + + +
      + + + Audit Encrypted Channels + Add the following to /etc/audit/audit.rules audit the creation of trusted communication channels +
      +
      +-w /usr/sbin/stunnel -p x
      +-w /etc/stunnel/stunnel.conf -k audit_encrypted_channels
      +-w /etc/stunnel/stunnel.pem -k audit_encrypted_channels
      +
      +
      + The creation of encrypted communication channels should be audited, as they could be an indication of covert communications + + + +
      + + +Audit PAM Configuration +Add the following to /etc/audit/audit.rules to audit PAM configuration changes: +
      +
      +-w /etc/pam.d/ -p wa -k audit_pam_configuration
      +-w /etc/security/access.conf -p wa -k audit_pam_configuration
      +-w /etc/security/limits.conf -p wa -k audit_pam_configuration
      +-w /etc/security/pam_env.conf -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.conf -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.d/ -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.init -p wa -k audit_pam_configuration
      +-w /etc/security/sepermit.conf -p wa -k audit_pam_configuration
      +-w /etc/security/time.conf -p wa -k audit_pam_configuation
      +PAM is the underlying mechanism for access authorizations on a Red Hat Enterprise Linux system. As such configuration changes to the PAM system should be monitored
      +
      +
      +
      +
      +
      +
      +Audit <tt>crond</tt> Configuration
      +<description>Add the following to <tt>/etc/audit/audit.rules</tt> to audit the <tt>crond</tt> configuration and scheduled jobs
      +<br />
      +<pre>
      +-w /etc/cron.allow -p wa -k audit_cron_configuration
      +-w /etc/cron.deny -p wa -k audit_cron_configuration
      +-w /etc/cron.d/ -p wa -k audit_cron_configuration
      +-w /etc/cron.daily/ -p wa -k audit_cron_configuration
      +-w /etc/cron.hourly/ -p wa -k audit_cron_configuration
      +-w /etc/cron.monthly/ -p wa -k audit_cron_configuration
      +-w /etc/crontab -p wa -k audit_cron_configuration
      +-w /var/spool/cron/root -k audit_cron_configuration</pre>
      +<rationale></rationale>
      +<ident cce="TBD" />
      +<oval id="audit_cron_configuration">
      +<ref nist="TBD" />
      +</Rule>
      +
      +<Rule id="audit_security_bindings">
      +<title>Audit User Security Attribute Binding Attempts
      +To audit the success and failure of binding user security attributes to a subject, add the following to /etc/audit/audit.rules:
      +
      +
      +-a always,exit -F arch=b32 -S clone
      +-a always,exit -F arch=b64 -S clone
      +-a always,exit -F arch=b32 -S fork -S vfork
      +-a always,exit -F arch=b64 -S fork -S vfork
      +
      +## FOR ia64 ARCHITECTURE: DISABLE THE fork AND vfork RULES ABOVE, AND
      +## ENABLE THE FOLLOWING:
      +#-a always,exit -S clone32
      + + + + +
      + + + + Record Events that Modify User/Group Information Add the following to /etc/audit/audit.rules, in order @@ -183,6 +288,22 @@ users or groups should be investigated. + +Audit Login Configuration and Information +To audit login configuration and information, add the following to /etc/audit/audit.rules: +
      +
      +-w /etc/login.defs -p wa -k audit_login_configuration
      +-w /etc/securetty -p wa -k audit_login_configuration
      +-w /var/run/faillock -p wa -k audit_login_configuration
      +-w /var/log/lastlog -p wa -k audit_login_configuration
      +-w /var/log/tallylog -p wa -k audit_login_configuration
      +
      + + + + +
      Record Events that Modify the System’s Network Environment @@ -195,6 +316,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale +-w /etc/sysconfig/network-scripts -p wa -k system-locale
      The network environment should not be modified by anything other than @@ -223,26 +345,23 @@ anything other than administrator action. All changes to MAC policy should be au -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: +Ensure <tt>auditd</tt> Collects Discretionary Access Control Permission Modification Events +At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:
      --a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      --a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
      -    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
      --a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
      -    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      +-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat +-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat +-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown +-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown + +## ENABLE THE FOLLOWING RULE ONLY IF ON i386 OR s390 +## DO NOT USE FOR x86_64, ia64, ppc, ppc64, or s390x +#-a always,exit -F arch=b32 -S fchown32 -S chown32 -S lchown32 + +-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr +-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
      -The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and -unauthorized users. +The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. @@ -304,7 +423,7 @@ loss.
      -Ensure <tt>auditd</tt> Collects Files Deletion Events by User +Ensure <tt>auditd</tt> Collects File Deletion Events At a minimum the audit system should collect file deletion events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as -- 1.7.1 --------------070904060501070307030400-- From shawn at redhat.com Thu Feb 23 03:01:06 2012 From: shawn at redhat.com (Shawn Wells) Date: Wed, 22 Feb 2012 22:01:06 -0500 Subject: [1/1] 0001-22-FEB-2012-shawn-redhat.com.patch In-Reply-To: <4F459767.9070506@redhat.com> References: <4F459767.9070506@redhat.com> Message-ID: <4F45ABF2.8030407@redhat.com> On 2/22/12 8:33 PM, Shawn Wells wrote: > Do we have a formal process before committing patches? I made a few > updates to audit tonight, attached. I still need to link to CCEs, ICD, > etc though. Good thing I didn't actually commit that patch... looks like I screwed all kinds of things up. Will fix and re-post tomorrow. From shawn at redhat.com Fri Feb 24 03:00:04 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:00:04 -0500 Subject: [PATCH 05/11] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications Message-ID: <4F46FD34.1040103@redhat.com> -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn at redhat.com (c) 443.534.0130 -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0005-Updated-audit_network_modifications-specifically-cha.patch URL: From shawn at redhat.com Wed Feb 22 03:04:22 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:04:22 -0500 Subject: [PATCH 05/11] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications Message-ID: --- rhel6/src/input/system/auditing.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 5b3a74b..045cf45 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -193,19 +193,19 @@ to capture events that modify account changes: Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
      -
      --a exit,always -F arch=ARCH -S sethostname -S setdomainname -k system-locale
      --w /etc/issue -p wa -k system-locale
      --w /etc/issue.net -p wa -k system-locale
      --w /etc/hosts -p wa -k system-locale
      --w /etc/sysconfig/network -p wa -k system-locale
      +
      # audit_network_modifications
      +-a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
      +-w /etc/issue -p wa -k audit_network_modifications
      +-w /etc/issue.net -p wa -k audit_network_modifications
      +-w /etc/hosts -p wa -k audit_network_modifications
      +-w /etc/sysconfig/network -p wa -k audit_network_modifications
       
      The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. - + -- 1.7.1 --------------080900090505020105050403-- From shawn at redhat.com Fri Feb 24 03:00:14 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:00:14 -0500 Subject: [PATCH 04/11] Minor changes to audit_account_changes Message-ID: <4F46FD3E.20304@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0004-Minor-changes-to-audit_account_changes.patch URL: From shawn at redhat.com Wed Feb 22 03:01:32 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:01:32 -0500 Subject: [PATCH 04/11] Minor changes to audit_account_changes# Message-ID: --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 23d22c5..5b3a74b 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -174,7 +174,7 @@ upon an accurate system time (such as sshd). All changes to the system time shou Add the following to /etc/audit/audit.rules, in order to capture events that modify account changes:
      -
      #audit_account_changes
      +
      # audit_account_changes
       -w /etc/group -p wa -k audit_account_changes
       -w /etc/passwd -p wa -k audit_account_changes
       -w /etc/gshadow -p wa -k audit_account_changes
      -- 
      1.7.1
      
      
      --------------080407060104070303060204--
      
      From shawn at redhat.com  Fri Feb 24 03:00:19 2012
      From: shawn at redhat.com (Shawn Wells)
      Date: Thu, 23 Feb 2012 22:00:19 -0500
      Subject: [PATCH 03/11] - Updated audit_account_changes to reflect 800-53
      	subsection
      Message-ID: <4F46FD43.5010801@redhat.com>
      
      
      -------------- next part --------------
      An embedded and charset-unspecified text was scrubbed...
      Name: 0003-Updated-audit_account_changes-to-reflect-800-53-subs.patch
      URL: 
      
      From shawn at redhat.com  Wed Feb 22 02:59:04 2012
      From: shawn at redhat.com (Shawn Wells)
      Date: Tue, 21 Feb 2012 21:59:04 -0500
      Subject: [PATCH 03/11] - Updated audit_account_changes to reflect 800-53 subsection
       - Adjusted audit rules key to -k audit_account_changes
       - Altered rationale
      Message-ID: 
      
      ---
       rhel6/src/input/system/auditing.xml |   17 ++++++++---------
       1 files changed, 8 insertions(+), 9 deletions(-)
      
      diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
      index 63dcad4..23d22c5 100644
      --- a/rhel6/src/input/system/auditing.xml
      +++ b/rhel6/src/input/system/auditing.xml
      @@ -174,18 +174,17 @@ upon an accurate system time (such as sshd). All changes to the system time shou
       Add the following to /etc/audit/audit.rules, in order
       to capture events that modify account changes:
       
      -
      --w /etc/group -p wa -k identity
      --w /etc/passwd -p wa -k identity
      --w /etc/gshadow -p wa -k identity
      --w /etc/shadow -p wa -k identity
      --w /etc/security/opasswd -p wa -k identity
      +
      #audit_account_changes
      +-w /etc/group -p wa -k audit_account_changes
      +-w /etc/passwd -p wa -k audit_account_changes
      +-w /etc/gshadow -p wa -k audit_account_changes
      +-w /etc/shadow -p wa -k audit_account_changes
      +-w /etc/security/opasswd -p wa -k audit_account_changes
      -New user or group accounts need to be audited to verify that they are legitimate. Any suspect -users or groups should be investigated. +In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy. - + -- 1.7.1 --------------060800070900020403020501-- From shawn at redhat.com Fri Feb 24 03:00:25 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:00:25 -0500 Subject: [PATCH 02/11] - Updated audit_time_rules to reflect different audit rules for 32 & 64bit systems. Message-ID: <4F46FD49.4050409@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0002-Updated-audit_time_rules-to-reflect-different-audit-.patch URL: From shawn at redhat.com Wed Feb 22 02:50:07 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 21:50:07 -0500 Subject: [PATCH 02/11] - Updated audit_time_rules to reflect different audit rules for 32 & 64bit systems. - Changed key to audit_time_rules to match rule ID Message-ID: --- rhel6/src/input/system/auditing.xml | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 898645b..63dcad4 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -147,17 +147,22 @@ editing as needed, activate the new rules: Records Events that Modify Date and Time Information -Add the following to /etc/audit/audit.rules, setting -ARCH to either b32 or b64 as appropriate for your system: +On a 32-bit system, add the following to /etc/audit/audit.rules:
      -
      --a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S stime -k time-change
      --a always,exit -F arch=ARCH -S clock_settime -k time-change
      --w /etc/localtime -p wa -k time-change
      +
      # audit_time_rules
      +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -k audit_time_rules
      +-w /etc/localtime -p wa -k audit_time_rules
      +
      +On a 64-bit system, add the following to /etc/audit/audit.rules (note the lack of -S stime, which is not relevant for a 64-bit installation): +
      +
      # audit_time_rules
      +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules
      +-w /etc/localtime -p wa -k audit_time_rules
      +
      Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent -upon an accurate system time. All changes to the system time should be audited. +upon an accurate system time (such as sshd). All changes to the system time should be audited. -- 1.7.1 --------------040205050600070502060801-- From shawn at redhat.com Fri Feb 24 03:00:31 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:00:31 -0500 Subject: [PATCH 01/11] 22-FEB-2012 Updated to include NIST 800-53 sub-section number Message-ID: <4F46FD4F.5030305@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0001-22-FEB-2012-Updated-to-include-NIST-800-53-sub-secti.patch URL: From shawn at redhat.com Wed Feb 22 02:24:47 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 21:24:47 -0500 Subject: [PATCH 01/11] 22-FEB-2012 Updated to include NIST 800-53 sub-section number Message-ID: --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 628be6a..898645b 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -160,7 +160,7 @@ activites in log files as well as to confuse network services that are highly de upon an accurate system time. All changes to the system time should be audited. - +
      -- 1.7.1 --------------070008030909030400000805-- From shawn at redhat.com Fri Feb 24 03:03:43 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:03:43 -0500 Subject: [PATCH 06/11] - Updated -k to audit_mac_changes Message-ID: <4F46FE0F.3090208@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0006-Updated-k-to-audit_mac_changes.patch URL: From shawn at redhat.com Wed Feb 22 03:09:20 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:09:20 -0500 Subject: [PATCH 06/11] - Updated -k to audit_mac_changes - Included 800-53 subsection Message-ID: --- rhel6/src/input/system/auditing.xml | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 045cf45..93b95dc 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -210,19 +210,18 @@ administrator action. Any change to network parameters should be audited. -Record Events that Modify the System’s Mandatory Access -Controls +Record Events that Modify the System’s Mandatory Access Controls Add the following to /etc/audit/audit.rules:
      -
      --w /etc/selinux/ -p wa -k MAC-policy
      +
      # audit_mac_changes
      +-w /etc/selinux/ -p wa -k audit_mac_changes
      The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. - + -- 1.7.1 --------------070902090906040702030701-- From shawn at redhat.com Fri Feb 24 03:03:52 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:03:52 -0500 Subject: [PATCH 07/11] - Updated audit_dac_actions, changed -k to audit_dac_actions, - Formating fixes Message-ID: <4F46FE18.8030604@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0007-Updated-audit_dac_actions-changed-k-to-audit_dac_act.patch URL: From shawn at redhat.com Wed Feb 22 03:15:02 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:15:02 -0500 Subject: [PATCH 07/11] - Updated audit_dac_actions, changed -k to audit_dac_actions - Formating fixes Message-ID: --- rhel6/src/input/system/auditing.xml | 18 +++++++----------- 1 files changed, 7 insertions(+), 11 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 93b95dc..2e943d8 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -226,21 +226,17 @@ anything other than administrator action. All changes to MAC policy should be au -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: +Ensure <tt>auditd</tt> Collects Discretionary Access Control Policy Modification Events +At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
      -
      +
      # audit_dac_actions
       -a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      +    -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
       -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
      -    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
      +    -S lchown -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
       -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
           -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      + -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
      The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications @@ -248,7 +244,7 @@ can facilitate the identification of patterns of abuse amoung both authorized an unauthorized users. - +
      -- 1.7.1 --------------010809060305030004040409-- From shawn at redhat.com Fri Feb 24 03:03:56 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:03:56 -0500 Subject: [PATCH 08/11] - Updated audit_unsuccessful_file_access for syntax, chanced -k to audit_unsuccessful_file_access Message-ID: <4F46FE1C.3000802@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0008-Updated-audit_unsuccessful_file_access-for-syntax-ch.patch URL: From shawn at redhat.com Wed Feb 22 03:19:01 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:19:01 -0500 Subject: [PATCH 08/11] - Updated audit_unsuccessful_file_access for syntax, chanced -k to audit_unsuccessful_file_access Message-ID: --- rhel6/src/input/system/auditing.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 2e943d8..cb8360c 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -247,8 +247,8 @@ unauthorized users. - -Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful) + +Ensure <tt>auditd</tt> Collects Unauthorized (unsuccessful) Access Attempts to Files At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as @@ -256,12 +256,12 @@ appropriate for your system:
       -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \ 
      -    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
      +    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
       -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
      -    -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
      + -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
      Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. +these events could serve as evidence of malicious intent and potential system compromise. -- 1.7.1 --------------050300000207060400000007-- From shawn at redhat.com Fri Feb 24 03:04:00 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:04:00 -0500 Subject: [PATCH 09/11] - Updated 800-53 paragraph, - Included sample script to pull all priv. commands, - Included output from default RHEL6 install Message-ID: <4F46FE20.2090209@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0009-Updated-800-53-paragraph.patch URL: From shawn at redhat.com Wed Feb 22 03:45:00 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:45:00 -0500 Subject: [PATCH 09/11] - Updated 800-53 paragraph - Included sample script to pull all priv. commands - Included output from default RHEL6 install Message-ID: --- rhel6/src/input/system/auditing.xml | 45 +++++++++++++++++++++++++++++++---- 1 files changed, 40 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index cb8360c..a950096 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -269,12 +269,47 @@ these events could serve as evidence of malicious intent and potential system co Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands -At a minimum the audit system should collect the -execution of privileged commands for all users and root. Add the -following to /etc/audit/audit.rules: +At a minimum the audit system should collect the execution of privileged commands for all users and root. To find binary applications which are privileged, you can run the script included below. This script will create the audit rules needed, of which should be placed in /etc/audit/audit.rules. From a bash prompt, run the following script:
      -
      --a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
      +
      for privCommand in `find / -type f -perm -04000 2>/dev/null`
      +do 
      +  echo "-a always,exit -F path=$privCommand -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands"
      +done
      +
      +This script will give you several lines of output, and the output below is from a default install of Red Hat Enterprise Linux 6: +
      -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/at -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/umount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/fusermount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/su -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/ping6 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/ping -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/mount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +
      +Take the output of the script and place it into /etc/audit/audit.rules.
      -- 1.7.1 --------------010805090908020001060303-- From shawn at redhat.com Fri Feb 24 03:04:05 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:04:05 -0500 Subject: [PATCH 10/11] - Updated key (-k audit_kernel_module_loading), - Minor content/syntax adjustments Message-ID: <4F46FE25.4010501@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0010-Updated-key-k-audit_kernel_module_loading.patch URL: From shawn at redhat.com Wed Feb 22 04:03:23 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 23:03:23 -0500 Subject: [PATCH 10/11] - Updated key (-k audit_kernel_module_loading) - Minor content/syntax adjustments Message-ID: --- rhel6/src/input/system/auditing.xml | 17 +++++++---------- 1 files changed, 7 insertions(+), 10 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index a950096..71d70b7 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -311,15 +311,13 @@ This script will give you several lines of output, and the output below is from
      Take the output of the script and place it into /etc/audit/audit.rules.
      -
      -Ensure <tt>auditd</tt> Collects Information on Exporting to Media -(successful) +Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful) At a minimum the audit system should collect media exportation events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as @@ -374,16 +372,15 @@ of what was executed on the system as well as for accountability purposes. -Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading -and Unloading +Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading Add the following to /etc/audit/audit.rules in order to capture kernel module loading and unloading events:
      -
      --w /sbin/insmod -p x -k modules
      --w /sbin/rmmod -p x -k modules
      --w /sbin/modprobe -p x -k modules
      --a always,exit -S init_module -S delete_module -k modules
      +
      # audit_kernel_module_loading
      +-w /sbin/insmod -p x -k audit_kernel_module_loading
      +-w /sbin/rmmod -p x -k audit_kernel_module_loading
      +-w /sbin/modprobe -p x -k audit_kernel_module_loading
      +-a always,exit -S init_module -S delete_module -k audit_kernel_module_loading
      The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important -- 1.7.1 --------------000900060402000407000504-- From shawn at redhat.com Fri Feb 24 03:04:10 2012 From: shawn at redhat.com (Shawn Wells) Date: Thu, 23 Feb 2012 22:04:10 -0500 Subject: [PATCH 11/11] - Minor changes to audit_config_immutable Message-ID: <4F46FE2A.2080403@redhat.com> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0011-Minor-changes-to-audit_config_immutable.patch URL: From shawn at redhat.com Wed Feb 22 04:06:25 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 23:06:25 -0500 Subject: [PATCH 11/11] - Minor changes to audit_config_immutable Message-ID: --- rhel6/src/input/system/auditing.xml | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 71d70b7..9243d13 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -392,16 +392,14 @@ to have an audit trail of modules that have been introduced into the kernel. Make the <tt>auditd</tt> Configuration Immutable -Add the following to /etc/audit/audit.rules in order +Add the following to the bottom of your /etc/audit/audit.rules in order to make the configuration immutable:
      -
      +
      # audit_config_immutable
       -e 2
       
      -With this setting, a reboot will be required to change any -audit rules. -Making the audit configuration immutable prevents the accidential as -well as malicious modification of the audit rules. +With this setting, a reboot will be required to change any audit rules. +Making the audit configuration immutable prevents accidential as well as malicious modification of the audit rules. -- 1.7.1 --------------050903050209030209000600-- From shawn.d.wells at gmail.com Tue Feb 28 23:05:26 2012 From: shawn.d.wells at gmail.com (shawn.d.wells at gmail.com) Date: Tue, 28 Feb 2012 18:05:26 -0500 Subject: test - please ignore! Message-ID: <4F4D5DB6.6070803@gmail.com> From shawn.d.wells at gmail.com Tue Feb 28 23:21:32 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:21:32 -0500 Subject: [PATCH 01/24] 22-FEB-2012 Updated to include NIST 800-53 sub-section number Message-ID: <20120228232132.GA2577@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 02:24:47 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 21:24:47 -0500 Subject: [PATCH 01/24] 22-FEB-2012 Updated to include NIST 800-53 sub-section number Message-ID: --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 628be6a..898645b 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -160,7 +160,7 @@ activites in log files as well as to confuse network services that are highly de upon an accurate system time. All changes to the system time should be audited. - + -- 1.7.1 --zhXaljGHf11kAtnf-- From shawn.d.wells at gmail.com Tue Feb 28 23:21:43 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:21:43 -0500 Subject: [PATCH 02/24] - Updated audit_time_rules to reflect different audit rules for 32 & 64bit systems. Message-ID: <20120228232143.GA2589@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 02:50:07 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 21:50:07 -0500 Subject: [PATCH 02/24] - Updated audit_time_rules to reflect different audit rules for 32 & 64bit systems. - Changed key to audit_time_rules to match rule ID Message-ID: --- rhel6/src/input/system/auditing.xml | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 898645b..63dcad4 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -147,17 +147,22 @@ editing as needed, activate the new rules: Records Events that Modify Date and Time Information -Add the following to /etc/audit/audit.rules, setting -ARCH to either b32 or b64 as appropriate for your system: +On a 32-bit system, add the following to /etc/audit/audit.rules:
      -
      --a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S stime -k time-change
      --a always,exit -F arch=ARCH -S clock_settime -k time-change
      --w /etc/localtime -p wa -k time-change
      +
      # audit_time_rules
      +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -k audit_time_rules
      +-w /etc/localtime -p wa -k audit_time_rules
      +
      +On a 64-bit system, add the following to /etc/audit/audit.rules (note the lack of -S stime, which is not relevant for a 64-bit installation): +
      +
      # audit_time_rules
      +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules
      +-w /etc/localtime -p wa -k audit_time_rules
      +
      Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent -upon an accurate system time. All changes to the system time should be audited. +upon an accurate system time (such as sshd). All changes to the system time should be audited. -- 1.7.1 --bp/iNruPH9dso1Pn-- From shawn.d.wells at gmail.com Tue Feb 28 23:21:53 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:21:53 -0500 Subject: [PATCH 03/24] - Updated audit_account_changes to reflect 800-53 subsection Message-ID: <20120228232153.GA2595@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 02:59:04 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 21:59:04 -0500 Subject: [PATCH 03/24] - Updated audit_account_changes to reflect 800-53 subsection - Adjusted audit rules key to -k audit_account_changes - Altered rationale Message-ID: --- rhel6/src/input/system/auditing.xml | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 63dcad4..23d22c5 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -174,18 +174,17 @@ upon an accurate system time (such as sshd). All changes to the system time shou Add the following to /etc/audit/audit.rules, in order to capture events that modify account changes:
      -
      --w /etc/group -p wa -k identity
      --w /etc/passwd -p wa -k identity
      --w /etc/gshadow -p wa -k identity
      --w /etc/shadow -p wa -k identity
      --w /etc/security/opasswd -p wa -k identity
      +
      #audit_account_changes
      +-w /etc/group -p wa -k audit_account_changes
      +-w /etc/passwd -p wa -k audit_account_changes
      +-w /etc/gshadow -p wa -k audit_account_changes
      +-w /etc/shadow -p wa -k audit_account_changes
      +-w /etc/security/opasswd -p wa -k audit_account_changes
      -New user or group accounts need to be audited to verify that they are legitimate. Any suspect -users or groups should be investigated. +In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy. - +
      -- 1.7.1 --FCuugMFkClbJLl1L-- From shawn.d.wells at gmail.com Tue Feb 28 23:22:04 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:22:04 -0500 Subject: [PATCH 04/24] Minor changes to audit_account_changes# Message-ID: <20120228232204.GA2601@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 03:01:32 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:01:32 -0500 Subject: [PATCH 04/24] Minor changes to audit_account_changes# Message-ID: --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 23d22c5..5b3a74b 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -174,7 +174,7 @@ upon an accurate system time (such as sshd). All changes to the system time shou Add the following to /etc/audit/audit.rules, in order to capture events that modify account changes:
      -
      #audit_account_changes
      +
      # audit_account_changes
       -w /etc/group -p wa -k audit_account_changes
       -w /etc/passwd -p wa -k audit_account_changes
       -w /etc/gshadow -p wa -k audit_account_changes
      -- 
      1.7.1
      
      
      --mP3DRpeJDSE+ciuQ--
      
      From shawn.d.wells at gmail.com  Tue Feb 28 23:22:38 2012
      From: shawn.d.wells at gmail.com (Shawn Wells)
      Date: Tue, 28 Feb 2012 18:22:38 -0500
      Subject: [PATCH 05/24] Updated audit_network_modifications, specifically
      	changed the -k to audit_network_modifications
      Message-ID: <20120228232238.GA2609@rhel6.localdomain>
      
      
      
      From shawn at redhat.com  Wed Feb 22 03:04:22 2012
      From: shawn at redhat.com (Shawn Wells)
      Date: Tue, 21 Feb 2012 22:04:22 -0500
      Subject: [PATCH 05/24] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications
      Message-ID: 
      
      ---
       rhel6/src/input/system/auditing.xml |   14 +++++++-------
       1 files changed, 7 insertions(+), 7 deletions(-)
      
      diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
      index 5b3a74b..045cf45 100644
      --- a/rhel6/src/input/system/auditing.xml
      +++ b/rhel6/src/input/system/auditing.xml
      @@ -193,19 +193,19 @@ to capture events that modify account changes:
       Add the following to /etc/audit/audit.rules, setting
       ARCH to either b32 or b64 as appropriate for your system:
       
      -
      --a exit,always -F arch=ARCH -S sethostname -S setdomainname -k system-locale
      --w /etc/issue -p wa -k system-locale
      --w /etc/issue.net -p wa -k system-locale
      --w /etc/hosts -p wa -k system-locale
      --w /etc/sysconfig/network -p wa -k system-locale
      +
      # audit_network_modifications
      +-a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
      +-w /etc/issue -p wa -k audit_network_modifications
      +-w /etc/issue.net -p wa -k audit_network_modifications
      +-w /etc/hosts -p wa -k audit_network_modifications
      +-w /etc/sysconfig/network -p wa -k audit_network_modifications
       
      The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. - + -- 1.7.1 --0F1p//8PRICkK4MW-- From shawn.d.wells at gmail.com Tue Feb 28 23:22:47 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:22:47 -0500 Subject: [PATCH 06/24] - Updated -k to audit_mac_changes Message-ID: <20120228232246.GA2617@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 03:09:20 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:09:20 -0500 Subject: [PATCH 06/24] - Updated -k to audit_mac_changes - Included 800-53 subsection Message-ID: --- rhel6/src/input/system/auditing.xml | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 045cf45..93b95dc 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -210,19 +210,18 @@ administrator action. Any change to network parameters should be audited. -Record Events that Modify the System’s Mandatory Access -Controls +Record Events that Modify the System’s Mandatory Access Controls Add the following to /etc/audit/audit.rules:
      -
      --w /etc/selinux/ -p wa -k MAC-policy
      +
      # audit_mac_changes
      +-w /etc/selinux/ -p wa -k audit_mac_changes
      The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. - + -- 1.7.1 --x+6KMIRAuhnl3hBn-- From shawn.d.wells at gmail.com Tue Feb 28 23:22:55 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:22:55 -0500 Subject: [PATCH 07/24] - Updated audit_dac_actions, changed -k to audit_dac_actions Message-ID: <20120228232255.GA2623@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 03:15:02 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:15:02 -0500 Subject: [PATCH 07/24] - Updated audit_dac_actions, changed -k to audit_dac_actions - Formating fixes Message-ID: --- rhel6/src/input/system/auditing.xml | 18 +++++++----------- 1 files changed, 7 insertions(+), 11 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 93b95dc..2e943d8 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -226,21 +226,17 @@ anything other than administrator action. All changes to MAC policy should be au -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: +Ensure <tt>auditd</tt> Collects Discretionary Access Control Policy Modification Events +At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
      -
      +
      # audit_dac_actions
       -a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      +    -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
       -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
      -    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
      +    -S lchown -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
       -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
           -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      + -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
      The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications @@ -248,7 +244,7 @@ can facilitate the identification of patterns of abuse amoung both authorized an unauthorized users. - +
      -- 1.7.1 --liOOAslEiF7prFVr-- From shawn.d.wells at gmail.com Tue Feb 28 23:23:03 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:23:03 -0500 Subject: [PATCH 08/24] - Updated audit_unsuccessful_file_access for syntax, chanced -k to audit_unsuccessful_file_access Message-ID: <20120228232303.GA2629@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 03:19:01 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:19:01 -0500 Subject: [PATCH 08/24] - Updated audit_unsuccessful_file_access for syntax, chanced -k to audit_unsuccessful_file_access Message-ID: --- rhel6/src/input/system/auditing.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 2e943d8..cb8360c 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -247,8 +247,8 @@ unauthorized users. - -Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful) + +Ensure <tt>auditd</tt> Collects Unauthorized (unsuccessful) Access Attempts to Files At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as @@ -256,12 +256,12 @@ appropriate for your system:
       -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \ 
      -    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
      +    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
       -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
      -    -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
      + -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
      Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. +these events could serve as evidence of malicious intent and potential system compromise. -- 1.7.1 --ZGiS0Q5IWpPtfppv-- From shawn.d.wells at gmail.com Tue Feb 28 23:23:11 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:23:11 -0500 Subject: [PATCH 09/24] - Updated 800-53 paragraph Message-ID: <20120228232311.GA2635@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 03:45:00 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 22:45:00 -0500 Subject: [PATCH 09/24] - Updated 800-53 paragraph - Included sample script to pull all priv. commands - Included output from default RHEL6 install Message-ID: --- rhel6/src/input/system/auditing.xml | 45 +++++++++++++++++++++++++++++++---- 1 files changed, 40 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index cb8360c..a950096 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -269,12 +269,47 @@ these events could serve as evidence of malicious intent and potential system co Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands -At a minimum the audit system should collect the -execution of privileged commands for all users and root. Add the -following to /etc/audit/audit.rules: +At a minimum the audit system should collect the execution of privileged commands for all users and root. To find binary applications which are privileged, you can run the script included below. This script will create the audit rules needed, of which should be placed in /etc/audit/audit.rules. From a bash prompt, run the following script:
      -
      --a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
      +
      for privCommand in `find / -type f -perm -04000 2>/dev/null`
      +do 
      +  echo "-a always,exit -F path=$privCommand -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands"
      +done
      +
      +This script will give you several lines of output, and the output below is from a default install of Red Hat Enterprise Linux 6: +
      -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/at -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/umount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/fusermount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/su -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/ping6 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/ping -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +-a always,exit -F path=/bin/mount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
      +
      +Take the output of the script and place it into /etc/audit/audit.rules.
      -- 1.7.1 --Nq2Wo0NMKNjxTN9z-- From shawn.d.wells at gmail.com Tue Feb 28 23:23:33 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:23:33 -0500 Subject: [PATCH 10/24] - Updated key (-k audit_kernel_module_loading) Message-ID: <20120228232332.GA2641@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 04:03:23 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 23:03:23 -0500 Subject: [PATCH 10/24] - Updated key (-k audit_kernel_module_loading) - Minor content/syntax adjustments Message-ID: --- rhel6/src/input/system/auditing.xml | 17 +++++++---------- 1 files changed, 7 insertions(+), 10 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index a950096..71d70b7 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -311,15 +311,13 @@ This script will give you several lines of output, and the output below is from
      Take the output of the script and place it into /etc/audit/audit.rules.
      -
      -Ensure <tt>auditd</tt> Collects Information on Exporting to Media -(successful) +Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful) At a minimum the audit system should collect media exportation events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as @@ -374,16 +372,15 @@ of what was executed on the system as well as for accountability purposes. -Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading -and Unloading +Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading Add the following to /etc/audit/audit.rules in order to capture kernel module loading and unloading events:
      -
      --w /sbin/insmod -p x -k modules
      --w /sbin/rmmod -p x -k modules
      --w /sbin/modprobe -p x -k modules
      --a always,exit -S init_module -S delete_module -k modules
      +
      # audit_kernel_module_loading
      +-w /sbin/insmod -p x -k audit_kernel_module_loading
      +-w /sbin/rmmod -p x -k audit_kernel_module_loading
      +-w /sbin/modprobe -p x -k audit_kernel_module_loading
      +-a always,exit -S init_module -S delete_module -k audit_kernel_module_loading
      The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important -- 1.7.1 --BOKacYhQ+x31HxR3-- From shawn.d.wells at gmail.com Tue Feb 28 23:23:40 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:23:40 -0500 Subject: [PATCH 11/24] - Minor changes to audit_config_immutable Message-ID: <20120228232340.GA2649@rhel6.localdomain> From shawn at redhat.com Wed Feb 22 04:06:25 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 21 Feb 2012 23:06:25 -0500 Subject: [PATCH 11/24] - Minor changes to audit_config_immutable Message-ID: --- rhel6/src/input/system/auditing.xml | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 71d70b7..9243d13 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -392,16 +392,14 @@ to have an audit trail of modules that have been introduced into the kernel. Make the <tt>auditd</tt> Configuration Immutable -Add the following to /etc/audit/audit.rules in order +Add the following to the bottom of your /etc/audit/audit.rules in order to make the configuration immutable:
      -
      +
      # audit_config_immutable
       -e 2
       
      -With this setting, a reboot will be required to change any -audit rules. -Making the audit configuration immutable prevents the accidential as -well as malicious modification of the audit rules. +With this setting, a reboot will be required to change any audit rules. +Making the audit configuration immutable prevents accidential as well as malicious modification of the audit rules. -- 1.7.1 --wRRV7LY7NUeQGEoC-- From shawn.d.wells at gmail.com Tue Feb 28 23:23:48 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:23:48 -0500 Subject: [PATCH 12/24] Added section audit_data_accesses Message-ID: <20120228232348.GA2656@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 19:50:22 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 14:50:22 -0500 Subject: [PATCH 12/24] Added section audit_data_accesses - Added rules to monitor the /var/log/audit/ directory for access attempts (successful and unsuccessful) - Added to meet Common Criteria FAU_SAR.1, FAU_SAR.2, FMT_MTD.1 Message-ID: --- rhel6/src/input/system/auditing.xml | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 9243d13..a520e5a 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -187,6 +187,20 @@ to capture events that modify account changes: + +Audit Attempts to Access Audit Records +Successful and unsuccessful attempts to read information from the audit records should be monitored. +
      +
      # audit_data_accesses
      +-w /var/log/audit/ -k audit_data_accesses
      +
      + + + + +
      + + Record Events that Modify the System’s Network Environment -- 1.7.1 --k1lZvvs/B4yU6o8G-- From shawn.d.wells at gmail.com Tue Feb 28 23:24:01 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:24:01 -0500 Subject: [PATCH 13/24] Created audit_auditd_modifications Section Message-ID: <20120228232401.GA2662@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 19:56:11 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 14:56:11 -0500 Subject: [PATCH 13/24] Created audit_auditd_modifications Section - Attempts to modify auditd configuration during runtime need to be audited per Common Criteria sections FAU_SEL.1 and FMT_MTD.1 Message-ID: --- rhel6/src/input/system/auditing.xml | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index a520e5a..fa63f1d 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -201,6 +201,22 @@ to capture events that modify account changes: + +Audit Attempts Modify <tt>auditd</tt> +Attempts to modify audit configuration which occur while the audit collection functions are operating should be monitored. +
      +
      # audit_auditd_modifications
      +-w /etc/audit/ -p wa -k audit_auditd_modifications
      +-w /etc/sysconfig/auditd -p wa -k audit_auditd_modifications
      +-w /etc/libaudit.conf -p wa -k audit_auditd_modifications
      +-w /etc/audisp/ -p wa -k audit_auditd_modifications
      +
      +Attempts to modify the auditd subsystem while the system is operational can indicate malicious intent. + + + +
      + Record Events that Modify the System’s Network Environment -- 1.7.1 --ikeVEW9yuYc//A+q-- From shawn.d.wells at gmail.com Tue Feb 28 23:24:12 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:24:12 -0500 Subject: [PATCH 14/24] Altered audit_dac_actions for fchown32, chown32, and lchown32 on 32-bit systems Message-ID: <20120228232412.GA2668@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 20:02:23 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 15:02:23 -0500 Subject: [PATCH 14/24] Altered audit_dac_actions for fchown32, chown32, and lchown32 on 32-bit systems Message-ID: --- rhel6/src/input/system/auditing.xml | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index fa63f1d..ad28607 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -267,6 +267,9 @@ anything other than administrator action. All changes to MAC policy should be au -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \ -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
      +
      +Additionally, if you are on a 32-bit system add the following audit rule: +
      -a always,exit -F arch=b32 -S truncate64 -S ftruncate64
      The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -- 1.7.1 --wac7ysb48OaltWcw-- From shawn.d.wells at gmail.com Tue Feb 28 23:24:22 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:24:22 -0500 Subject: [PATCH 15/24] Fixed audit_dac_actions 32bit patch Message-ID: <20120228232422.GA2674@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 20:03:39 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 15:03:39 -0500 Subject: [PATCH 15/24] Fixed audit_dac_actions 32bit patch Message-ID: --- rhel6/src/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index ad28607..223c145 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -269,7 +269,7 @@ anything other than administrator action. All changes to MAC policy should be au -F auid>=500 -F auid!=4294967295 -k audit_dac_actions

      Additionally, if you are on a 32-bit system add the following audit rule: -
      -a always,exit -F arch=b32 -S truncate64 -S ftruncate64
      +
      -a always,exit -F arch=b32 -S fchown32 -S chown32 -S lchown32
      The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -- 1.7.1 --+QahgC5+KEYLbs62-- From shawn.d.wells at gmail.com Tue Feb 28 23:24:32 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:24:32 -0500 Subject: [PATCH 16/24] Created audit_login_config Message-ID: <20120228232432.GA2680@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 20:18:43 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 15:18:43 -0500 Subject: [PATCH 16/24] Created audit_login_config Added rules to monitor the modification to the login configuration of a user Message-ID: --- rhel6/src/input/system/auditing.xml | 17 +++++++++++++++++ 1 files changed, 17 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 223c145..6b249b4 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -187,6 +187,23 @@ to capture events that modify account changes: + +Audit Access to Login Configuration and Information +Add the following to /etc/audit.rules to capture attempts to alter login configuration and information. +
      +
      # audit_login_config
      +-w /etc/login.defs -p wa -k audit_login_config
      +-w /etc/securetty -p wa -k audit_login_config
      +-w /var/run/faillock -p wa -k audit_login_config
      +-w /var/log/lastlog -p wa -k audit_login_config
      +-w /var/log/tallylog -p wa -k audit_login_config
      +
      +Alterations to login configuration files could indicate malicious intent, such as automatically running an executable upon every users login. + + + +
      + Audit Attempts to Access Audit Records Successful and unsuccessful attempts to read information from the audit records should be monitored. -- 1.7.1 --VS++wcV0S1rZb1Fb-- From shawn.d.wells at gmail.com Tue Feb 28 23:24:39 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:24:39 -0500 Subject: [PATCH 17/24] Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory Message-ID: <20120228232439.GA2688@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 20:24:46 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 15:24:46 -0500 Subject: [PATCH 17/24] Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Updated audit_rules_networkconfig_modification.xml for the check as well Message-ID: --- .../audit_rules_networkconfig_modification.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 1 + 2 files changed, 7 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml index 1c6b6b2..dcdf3e6 100644 --- a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml +++ b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml @@ -113,4 +113,10 @@ ^\-w\s/etc/sysconfig/network\s\-p\swa\s\-k\ssystem\-locale$ 1 + + /etc/audit + audit.rules + ^\-w\s/etc/sysconfig/network\-scripts/\s\-p\swa\s\-k\ssystem\-locale$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 6b249b4..887b227 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -246,6 +246,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/issue.net -p wa -k audit_network_modifications -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications +-w /etc/sysconfig/network-scripts/ -p wa -k audit_network_modifications
      The network environment should not be modified by anything other than -- 1.7.1 --AqsLC8rIMeq19msA-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:00 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:00 -0500 Subject: [PATCH 18/24] Created audit_system_startup_scripts Message-ID: <20120228232500.GA2694@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 20:34:06 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 15:34:06 -0500 Subject: [PATCH 18/24] Created audit_system_startup_scripts - Need to monitor the system startup process, which would be through init Message-ID: --- rhel6/src/input/system/auditing.xml | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 887b227..bd6291c 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -441,6 +441,22 @@ to have an audit trail of modules that have been introduced into the kernel. + +Audit Alterations to System Startup Scripts +Red Hat Enterprise Linux 6 utilizes the init subsystem to boot and start/stop services. To audit the init process add the following lines to /etc/audit/audit.rules: +
      +
      # audit_system_startup_scripts
      +-w /etc/sysconfig/init -p wa -k audit_system_startup_scripts
      +-w /etc/init/ -p wa -k audit_system_startup_scripts
      +-w /etc/inittab -p wa -k audit_system_startup_scripts
      +-w /etc/rc.d/init.d/ -p wa -k audit_system_startup_scripts
      +
      +Alterations to the system boot process should be considered security relevant events, and audited. + + + +
      + Make the <tt>auditd</tt> Configuration Immutable Add the following to the bottom of your /etc/audit/audit.rules in order -- 1.7.1 --9amGYk9869ThD9tj-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:09 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:09 -0500 Subject: [PATCH 19/24] Added a check for /etc/modprobe.d/ to audit_kernel_module_loading Message-ID: <20120228232509.GA2700@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 21:19:19 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 16:19:19 -0500 Subject: [PATCH 19/24] Added a check for /etc/modprobe.d/ to audit_kernel_module_loading The modprobe.d directory should be watched as well, not just the binary Message-ID: --- .../checks/audit_rules_kernel_module_loading.xml | 11 ++++++++++- rhel6/src/input/system/auditing.xml | 1 + 2 files changed, 11 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml b/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml index de4990b..158bcb1 100644 --- a/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml +++ b/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml @@ -11,7 +11,8 @@ - + + @@ -39,6 +40,14 @@ ^\-w\s+/sbin/modprobe\s+\-p\s+x\s+\-k\s+[-\w]+\s*$ 1 + + + + + /etc/audit/audit.rules + ^\-w\s+/etc/modprobe.d/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index bd6291c..d4955a0 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -431,6 +431,7 @@ to capture kernel module loading and unloading events: -w /sbin/insmod -p x -k audit_kernel_module_loading -w /sbin/rmmod -p x -k audit_kernel_module_loading -w /sbin/modprobe -p x -k audit_kernel_module_loading +-w /etc/modprobe.d/ -p wa -k audit_kernel_module_loading -a always,exit -S init_module -S delete_module -k audit_kernel_module_loading
      The addition/removal of kernel modules can be used to alter the behavior of -- 1.7.1 --2oS5YaxWCcQjTEyO-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:17 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:17 -0500 Subject: [PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/ Message-ID: <20120228232517.GA2706@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 21:48:47 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 16:48:47 -0500 Subject: [PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/ Message-ID: --- .../input/checks/audit_rules_sysadmin_actions.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml index 1afd221..d0ffeec 100644 --- a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml +++ b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml @@ -14,10 +14,16 @@ + /etc/audit/audit.rules ^\-w\s+/etc/sudoers\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$ 1 + + /etc/audit/audit.rules + ^\-w\s+/etc/sudoers.d/\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index d4955a0..6a3a1f0 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -412,8 +412,9 @@ malicious processes that attempt to delete log files to conceal their presence.< administrator actions for all users and root. Add the following to /etc/audit/audit.rules:
      -
      --w /etc/sudoers -p wa -k actions
      +
      # audit_sysadmin_actions
      +-w /etc/sudoers -p wa -k audit_sysadmin_actions
      +-w /etc/sudoers.d/ -k audit_sysadmin_actions
      The actions taken by system administrators should be audited to keep a record of what was executed on the system as well as for accountability purposes. -- 1.7.1 --gBBFr7Ir9EOA20Yy-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:33 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:33 -0500 Subject: [PATCH 21/24] Created audit_sysctl_parameters Message-ID: <20120228232533.GA2712@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 21:58:21 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 16:58:21 -0500 Subject: [PATCH 21/24] Created audit_sysctl_parameters Created audit_sysctl_parameters to audit sysctl changes Need to create matching cce Message-ID: --- rhel6/src/input/system/auditing.xml | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 6a3a1f0..fc618d0 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -443,6 +443,19 @@ to have an audit trail of modules that have been introduced into the kernel.
      + +Audit Changes to Kernel Parameters +User definable kernel configuration details are held within the /etc/sysctl.conf file. To audit changes to this file, add the following to /etc/audit/audit.rules: +
      +
      # audit_sysctl_parameters 
      +-w /etc/sysctl.conf -p wa -k audit_sysctl_parameters
      +
      + + + + +
      + Audit Alterations to System Startup Scripts Red Hat Enterprise Linux 6 utilizes the init subsystem to boot and start/stop services. To audit the init process add the following lines to /etc/audit/audit.rules: -- 1.7.1 --UlVJffcvxoiEqYs2-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:43 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:43 -0500 Subject: [PATCH 22/24] Updated audit_login_config to include PAM config Message-ID: <20120228232543.GA2732@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 22:02:50 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 17:02:50 -0500 Subject: [PATCH 22/24] Updated audit_login_config to include PAM config - Updated audit_login_config to include PAM configuration files Message-ID: --- rhel6/src/input/system/auditing.xml | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index fc618d0..a8d7b67 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -196,7 +196,16 @@ to capture events that modify account changes: -w /etc/securetty -p wa -k audit_login_config -w /var/run/faillock -p wa -k audit_login_config -w /var/log/lastlog -p wa -k audit_login_config --w /var/log/tallylog -p wa -k audit_login_config
      +-w /var/log/tallylog -p wa -k audit_login_config +-w /etc/pam.d/ -p wa -k audit_login_config +-w /etc/security/access.conf -p wa -k audit_login_config +-w /etc/security/limits.conf -p wa -k audit_login_config +-w /etc/security/pam_env.conf -p wa -k audit_login_config +-w /etc/security/namespace.conf -p wa -k audit_login_config +-w /etc/security/namespace.d/ -p wa -k audit_login_config +-w /etc/security/namespace.init -p wa -k audit_login_config +-w /etc/security/sepermit.conf -p wa -k audit_login_config +-w /etc/security/time.conf -p wa -k audit_login_config
      Alterations to login configuration files could indicate malicious intent, such as automatically running an executable upon every users login. -- 1.7.1 --zhXaljGHf11kAtnf-- From shawn.d.wells at gmail.com Tue Feb 28 23:25:53 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:25:53 -0500 Subject: [PATCH 23/24] Updated audit_dac_actions to watch umask settings Message-ID: <20120228232553.GA2738@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 22:24:52 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 17:24:52 -0500 Subject: [PATCH 23/24] Updated audit_dac_actions to watch umask settings - Updated audit_dac_actions to watch for umask settings - Also updated audit_rules_dac_modification.xml for the check Message-ID: --- .../input/checks/audit_rules_dac_modification.xml | 10 ++++++++++ rhel6/src/input/system/auditing.xml | 1 + 2 files changed, 11 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_dac_modification.xml b/rhel6/src/input/checks/audit_rules_dac_modification.xml index 6227308..c5792ed 100644 --- a/rhel6/src/input/checks/audit_rules_dac_modification.xml +++ b/rhel6/src/input/checks/audit_rules_dac_modification.xml @@ -30,6 +30,16 @@ ^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+chown\s+\-S\s+fchown\s+\-S\s+fchownat\s+\-S\s+lchown\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ 1 + + + + + + /etc/audit/audit.rules + ^\-a\s+always,exit\s+\(\-F\s+arch=(b64|b32)\s+)?\-S\s+umask\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ + 1 + + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index a8d7b67..d01c5fb 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -294,6 +294,7 @@ anything other than administrator action. All changes to MAC policy should be au -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \ -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions +-a always,exit -F arch=ARCH -S umask -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
      Additionally, if you are on a 32-bit system add the following audit rule:
      -a always,exit -F arch=b32 -S fchown32 -S chown32 -S lchown32
      -- 1.7.1 --d6Gm4EdcadzBjdND-- From shawn.d.wells at gmail.com Tue Feb 28 23:26:03 2012 From: shawn.d.wells at gmail.com (Shawn Wells) Date: Tue, 28 Feb 2012 18:26:03 -0500 Subject: [PATCH 24/24] Updated audit_file_deletions to include linking and rename events Message-ID: <20120228232603.GA2746@rhel6.localdomain> From shawn at redhat.com Sat Feb 25 22:51:44 2012 From: shawn at redhat.com (Shawn Wells) Date: Sat, 25 Feb 2012 17:51:44 -0500 Subject: [PATCH 24/24] Updated audit_file_deletions to include linking and rename events Created object_audit_rules_file_link_symlink_events in audit_rules_file_deletion_events.xml to perform the check Message-ID: --- .../checks/audit_rules_file_deletion_events.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 8 +++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml index 77855fa..cbc191b 100644 --- a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml +++ b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml @@ -14,10 +14,16 @@ + /etc/audit/audit.rules ^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ 1 + + /etc/audit/audit.rules + ^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+link\s+\-S\s+linkat\s+\-S\s+symlink\s+\-S\s+symlinkat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index d01c5fb..5c59c3d 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -397,15 +397,17 @@ loss.
      -Ensure <tt>auditd</tt> Collects Files Deletion Events by User +Ensure <tt>auditd</tt> Collects File Deletion, Moving, and Linking Events by User At a minimum the audit system should collect file -deletion events for all users and root. Add the following to +deletion, moving, and linking events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
       -a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
      -    -F auid>=500 -F auid!=4294967295 -k delete
      +    -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
      +-a always,exit -F arch=ARCH -S link -S linkat -S symlink -S symlinkat \
      +    -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
       
      Auditing file deletions will create an audit trail for files that are removed -- 1.7.1 --+HP7ph2BbKc20aGI-- From shawn at redhat.com Wed Feb 29 00:33:11 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 28 Feb 2012 19:33:11 -0500 Subject: Embarrassing question: SSH keys for commits Message-ID: <4F4D7247.2030106@redhat.com> Trying to sync the commit repo, get key failures. For the life of me I can't figure out where to upload my SSH keys to, and my google-foo is failing. Any tips? From kspargur at redhat.com Wed Feb 29 01:15:04 2012 From: kspargur at redhat.com (Kevin Spargur) Date: Tue, 28 Feb 2012 20:15:04 -0500 (EST) Subject: Embarrassing question: SSH keys for commits In-Reply-To: <4F4D7247.2030106@redhat.com> References: <4F4D7247.2030106@redhat.com> Message-ID: <6A4E633E-5D67-4597-B3F1-1AD5F5D5B48F@redhat.com> No worries, you want to add it at https://admin.fedoraproject.org/accounts On Feb 28, 2012, at 7:33 PM, Shawn Wells wrote: > Trying to sync the commit repo, get key failures. For the life of me I can't figure out where to upload my SSH keys to, and my google-foo is failing. Any tips? > _______________________________________________ > scap-security-guide mailing list > scap-security-guide at lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide From shawn at redhat.com Wed Feb 29 01:15:12 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 28 Feb 2012 20:15:12 -0500 Subject: RFC: "-F auid>=500 -F auid!=4294967295" in audit rules Message-ID: <4F4D7C20.4050708@redhat.com> I noticed many of the audit rules apply the "-F auid>=500 -F auid!=4294967295" fields, and I'm not fully sure I agree with it. It looks like these were taken from the stig.rules sample file that ships with RHEL. This presumes that system administrators are following UID naming schemes. I suppose we could create a "no UIDs < 500" check, but I'd rather eliminate the "-F auid>=500 -F auid!=4294967295" from the audit rules to ensure those with less than noble intent can't create a UID < 500 and escape auditing. By reference, all our Common Criteria profiles to not have the auid checks. What's the consensus -- keep or remove auid flags? From shawn at redhat.com Wed Feb 29 01:16:12 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 28 Feb 2012 20:16:12 -0500 Subject: RFC: -k field value Message-ID: <4F4D7C5C.4060605@redhat.com> I'd like to see the audit -k field names match whatever we call the actual check. Right now they're (fairly arbitrary) strings from the stig.rules file. Any objection to changing them to match the rule name? From shawn at redhat.com Wed Feb 29 02:39:49 2012 From: shawn at redhat.com (Shawn Wells) Date: Tue, 28 Feb 2012 21:39:49 -0500 Subject: Embarrassing question: SSH keys for commits In-Reply-To: <6A4E633E-5D67-4597-B3F1-1AD5F5D5B48F@redhat.com> References: <4F4D7247.2030106@redhat.com> <6A4E633E-5D67-4597-B3F1-1AD5F5D5B48F@redhat.com> Message-ID: <4F4D8FF5.6060307@redhat.com> Thanks Kevin. I posted that URL onto the wiki for future reference On 2/28/12 8:15 PM, Kevin Spargur wrote: > No worries, you want to add it at https://admin.fedoraproject.org/accounts > > > > > > On Feb 28, 2012, at 7:33 PM, Shawn Wells wrote: > >> Trying to sync the commit repo, get key failures. For the life of me I can't figure out where to upload my SSH keys to, and my google-foo is failing. Any tips? >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide at lists.fedorahosted.org >> https://fedorahosted.org/mailman/listinfo/scap-security-guide > _______________________________________________ > scap-security-guide mailing list > scap-security-guide at lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide From michael at eclipse.ncsc.mil Wed Feb 29 13:30:12 2012 From: michael at eclipse.ncsc.mil (Michael Moseley) Date: Wed, 29 Feb 2012 08:30:12 -0500 Subject: RFC: -k field value In-Reply-To: <4F4D7C5C.4060605@redhat.com> References: <4F4D7C5C.4060605@redhat.com> Message-ID: <4F4E2864.8060003@eclipse.ncsc.mil> Hey Shawn, I concur with your suggestion. Some of the field names I believe were carried over from older content so we have no pride of authorship. What we might want to do is modify the audit checks so that they accept an arbitrary field name. I have done this with some of the checks. Thanks, Mike MICHAEL W. MOSELEY, Capt, USAF I4221 Intern, Computer Network Operations Development Program 410-854-5173 michael at eclipse.ncsc.mil On 02/28/2012 08:16 PM, Shawn Wells wrote: > I'd like to see the audit -k field names match whatever we call the > actual check. Right now they're (fairly arbitrary) strings from the > stig.rules file. Any objection to changing them to match the rule name? > _______________________________________________ > scap-security-guide mailing list > scap-security-guide at lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide From sgrubb at redhat.com Wed Feb 29 13:31:13 2012 From: sgrubb at redhat.com (Steve Grubb) Date: Wed, 29 Feb 2012 08:31:13 -0500 Subject: RFC: "-F auid>=500 -F auid!=4294967295" in audit rules In-Reply-To: <4F4D7C20.4050708@redhat.com> References: <4F4D7C20.4050708@redhat.com> Message-ID: <201202290831.14007.sgrubb@redhat.com> On Tuesday, February 28, 2012 08:15:12 PM Shawn Wells wrote: > I noticed many of the audit rules apply the "-F auid>=500 -F > auid!=4294967295" fields, and I'm not fully sure I agree with it. It > looks like these were taken from the stig.rules sample file that ships > with RHEL. Its upstream. All linux distros ship the same rules. However, the 500 is determined by the UID_MIN it /etc/login.defs. If you normally have 1000 for the minimum, then you need to adjust these rules. > This presumes that system administrators are following UID naming > schemes. I suppose we could create a "no UIDs < 500" check, but I'd > rather eliminate the "-F auid>=500 -F auid!=4294967295" from the audit > rules to ensure those with less than noble intent can't create a UID < > 500 and escape auditing. I'd rather see analytical plugins for the audit system that spot violations of policy and then alert. The problem is that if you open the door too wide, then you drown in audit events. For your threat to be true, someone would have to create the uid - which is an auditable event. Then they would have to set the loginuid during login - that is an auditable event. Right there was 2 chances to spot a violation of policy in the audit stream. Its not that the current rules will miss things. its that a system has to be architected so that violations in policy are found while not overwhelming a system's logs. Can su, sshd, cron, gdm, kdm, xdm, or sudo pam policy be created such that logins below 500 are forbidden? :-) > By reference, all our Common Criteria profiles to not have the auid checks. The common criteria rules are "technology demonstrators". Common Criteria calls out for the existence of certain capabilities. It is not a configuration that anyone must run in. It demonstrates certain capabilities. By contrast, a security configuration like the STIG is prescriptive in that it says this is how it shall be. In that case the rules have to be a certain way because its real life and not a demonstrator. > What's the consensus -- keep or remove auid flags? We have to keep them or you will not like what happens. -Steve From sgrubb at redhat.com Wed Feb 29 13:35:49 2012 From: sgrubb at redhat.com (Steve Grubb) Date: Wed, 29 Feb 2012 08:35:49 -0500 Subject: RFC: -k field value In-Reply-To: <4F4D7C5C.4060605@redhat.com> References: <4F4D7C5C.4060605@redhat.com> Message-ID: <201202290835.49997.sgrubb@redhat.com> On Tuesday, February 28, 2012 08:16:12 PM Shawn Wells wrote: > I'd like to see the audit -k field names match whatever we call the > actual check. As they currently are, they describe the exact STIG requirement they fulfill. There is a comment above the rule and you should be able to correlate the key with the comment in every case. The purpose of the keys is so that this makes sense: aureport --start today --key --summary This is the first step in any investigation. What policy violations do I currently have? > Right now they're (fairly arbitrary) strings from the stig.rules file. Any > objection to changing them to match the rule name? Yeah. I object. What would be the proposed change? How would it make the key report any more useful than it currently is? -Steve From kspargur at redhat.com Wed Feb 29 18:49:29 2012 From: kspargur at redhat.com (Kevin Spargur) Date: Wed, 29 Feb 2012 13:49:29 -0500 Subject: [PATCH 1/3] Added two additional ldap checks, renamed one check to better differentiate same attrib. checks In-Reply-To: References: Message-ID: <1330541371-9930-1-git-send-email-kspargur@redhat.com> From: kspargur --- .../ldap_server_config_certificate_usage.xml | 79 ++++++++++++++++++++ .../checks/ldap_server_config_olcsecurity.xml | 37 --------- .../ldap_server_config_olcsecurity_simple_bind.xml | 32 ++++++++ .../checks/ldap_server_config_olcsecurity_tls.xml | 32 ++++++++ 4 files changed, 143 insertions(+), 37 deletions(-) create mode 100644 rhel6/src/input/checks/ldap_server_config_certificate_usage.xml delete mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity.xml create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml diff --git a/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml new file mode 100644 index 0000000..13f69cb --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml @@ -0,0 +1,79 @@ + + + + LDAP Server Should Use Strong Encryption + + Red Hat Enterprise Linux 6 + + + If installed, LDAP server should be configured use strong certificate based encryption using a CA Cert, Private Key, and Public Cert. + + + + + + + + + + + + + + + + /etc/pki/tls/CA/cacert.pem + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*bdb.ldif + ^[\s]*olcTLSCACertificateFile[\s]*:[\s]*(.*)$ + 1 + + + + + + + + /etc/pki/tls/ldap/servercert.pem + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*bdb.ldif + ^[\s]*olcTLSCertificateFile[\s]*:[\s]*(.*)$ + 1 + + + + + + + + /etc/pki/tls/ldap/serverkey.pem + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*bdb.ldif + ^[\s]*olcTLSCertificateKeyFile[\s]*:[\s]*(.*)$ + 1 + + diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml deleted file mode 100644 index e4bbe30..0000000 --- a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - LDAP Server Should Use TLS - - Red Hat Enterprise Linux 6 - - - If installed, LDAP server should use TLS. - - - - - - - - - - - - tls=128 - - - /etc/openldap/slapd.d/cn=config - olcDatabase.*bdb.ldif - ^[\s]*olcSecurity[\s]*:[\s]*(.*)$ - 1 - - diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml new file mode 100644 index 0000000..19bc8b7 --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml @@ -0,0 +1,32 @@ + + + + LDAP Server Should Require Protected Binds + + Red Hat Enterprise Linux 6 + + + If installed, LDAP server should require secure binds. + + + + + + + + + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*bdb.ldif + ^[\s]*olcSecurity[\s]*:[\s]*\.*simple_bind=128.* + 1 + + diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml new file mode 100644 index 0000000..99a422d --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml @@ -0,0 +1,32 @@ + + + + LDAP Server Should Use TLS + + Red Hat Enterprise Linux 6 + + + If installed, LDAP server should use TLS. + + + + + + + + + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*bdb.ldif + ^[\s]*olcSecurity[\s]*:[\s]*\.*tls=128.* + 1 + + -- 1.7.7.6 From kspargur at redhat.com Wed Feb 29 18:49:31 2012 From: kspargur at redhat.com (Kevin Spargur) Date: Wed, 29 Feb 2012 13:49:31 -0500 Subject: =?UTF-8?q?=5BPATCH=203/3=5D=20Minor=20formatting=20fix=20services/ldap=20for=20cleaner=20guide?= In-Reply-To: <1330541371-9930-1-git-send-email-kspargur@redhat.com> References: <1330541371-9930-1-git-send-email-kspargur@redhat.com> Message-ID: <1330541371-9930-3-git-send-email-kspargur@redhat.com> --- rhel6/src/input/services/ldap.xml | 20 ++++++++++---------- 1 files changed, 10 insertions(+), 10 deletions(-) diff --git a/rhel6/src/input/services/ldap.xml b/rhel6/src/input/services/ldap.xml index 8d71d1c..ea45705 100644 --- a/rhel6/src/input/services/ldap.xml +++ b/rhel6/src/input/services/ldap.xml @@ -123,7 +123,7 @@ Ensure that the configuration file has reasonable permissions: Protect configuration files containing the hashed password the same way you would protect other files, such as /etc/shadow, which contain hashed authentication data.
      - +
      @@ -148,7 +148,7 @@ Be sure to select a secure password for the LDAP root user, since this user has LDAP data, so a compromise of the LDAP root password will probably enable a full compromise of your site. In addition, be sure to use a reasonably strong hash function. The default hash function should be used. The default hash function is a salted SHA-1 algorith which is FIPS 160-1 compliant. Insecure schemes such as crypt should not be used. - + @@ -204,7 +204,7 @@ o: Organization Description This is a placeholder for the root of the domain’s LDAP tree. Without this entry, LDAP will not be able to find any other entries for the domain. - + @@ -225,7 +225,7 @@ objectClass: organizationalUnit Posix users and groups are the two top-level items which will be needed in order to use LDAP for authentication. These organizational units are used to identify the two categories within LDAP. - + @@ -257,7 +257,7 @@ You should not create entries for the root account or for system accounts which but only for user accounts which are to be shared across machines, and which have authentication information (such as a password) associated with them. - + @@ -282,7 +282,7 @@ be familiar to administrators, since it is identical to the handling of the /etc Do not create entries for the root group or for system groups, but only for groups which contain human users or which are shared across systems. - + @@ -307,7 +307,7 @@ in an authenticated bind to some internal groupOfUniqueNames. If you do not spec group, then all LDAP management will need to be done using the LDAP root user (Manager). For reasons of auditing and error detection, it is recommended that LDAP administrators have unique identities. - + @@ -340,7 +340,7 @@ shadowLastChange attribute is a timestamp, and is only critical if your site imp your site does not have an LDAP administrators group, the LDAP root user (called Manager in this guide) will be able to change data without an explicit access statement. - + @@ -376,7 +376,7 @@ Note: Even if the LDAP server restricts connections so that only encrypted queri be necessary to allow traffic to the default port 389. This is true because many LDAP clients implement encryption by connecting to the primary port and issuing the STARTTLS command. - + @@ -414,7 +414,7 @@ every time an LDAP query is made. (This may be appropriate, depending on your si In order to capture only slapd startup messages, specify loglevel none. See slapd.conf(5) for detailed information about the loglevel parameter. - + -- 1.7.7.6 From kspargur at redhat.com Wed Feb 29 18:49:30 2012 From: kspargur at redhat.com (Kevin Spargur) Date: Wed, 29 Feb 2012 13:49:30 -0500 Subject: =?UTF-8?q?=5BPATCH=202/3=5D=20Added=20two=20ldap=20checks=20and=20updated=20ldap=20services=20doc=20w/=20controls?= In-Reply-To: <1330541371-9930-1-git-send-email-kspargur@redhat.com> References: <1330541371-9930-1-git-send-email-kspargur@redhat.com> Message-ID: <1330541371-9930-2-git-send-email-kspargur@redhat.com> --- .../ldap_server_config_directory_file_security.xml | 23 ++ .../input/checks/ldap_server_config_olcaccess.xml | 57 +++++ rhel6/src/input/services/ldap.xml | 239 +++++++++++++++++++- 3 files changed, 313 insertions(+), 6 deletions(-) create mode 100644 rhel6/src/input/checks/ldap_server_config_directory_file_security.xml create mode 100644 rhel6/src/input/checks/ldap_server_config_olcaccess.xml diff --git a/rhel6/src/input/checks/ldap_server_config_directory_file_security.xml b/rhel6/src/input/checks/ldap_server_config_directory_file_security.xml new file mode 100644 index 0000000..a3bade4 --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_directory_file_security.xml @@ -0,0 +1,23 @@ + + + + LDAP Configuration File Security + + Red Hat Enterprise Linux 6 + + + Directory files should be secured such that anauthorized + users cannot access or change them. + + + + + + + + diff --git a/rhel6/src/input/checks/ldap_server_config_olcaccess.xml b/rhel6/src/input/checks/ldap_server_config_olcaccess.xml new file mode 100644 index 0000000..a9bcd59 --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_olcaccess.xml @@ -0,0 +1,57 @@ + + + + Configure slapd to Protect Authentication Information + + Red Hat Enterprise Linux 6 + + + Protect the user’s password by allowing the user himself or the LDAP administrators to change it, allowing the anonymous user to authenticate against it, and allowing no other access. + + + + + + + + + + + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*db.ldif + [\s]*olcAccess[\s]*:[\s]*to attrs=.*userPassword.*[\n\s]*by self write[\n\s]*by group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by anonymous auth[\n\s]*by \* none + 1 + + + + + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*db.ldif + [\s]*olcAccess[\s]*:[\s]*to attrs=.*shadowLastChange.*[\n\s]*by self write[\n\s]*by group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by \* read + 1 + + + + + + + + /etc/openldap/slapd.d/cn=config + olcDatabase.*db.ldif + [\s]*olcAccess[\s]*:[\s]*to \*[\n\s]*by group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by \* read + 1 + + + + diff --git a/rhel6/src/input/services/ldap.xml b/rhel6/src/input/services/ldap.xml index ab45246..8d71d1c 100644 --- a/rhel6/src/input/services/ldap.xml +++ b/rhel6/src/input/services/ldap.xml @@ -7,7 +7,6 @@ authentication information from an LDAP server. If your network uses LDAP for authentication, be sure to configure both clients and servers securely. - Configure OpenLDAP Clients This guide recommends configuring OpenLDAP clients by @@ -27,9 +26,6 @@ LDAP client, ensure that a working LDAP server is present on the network. See Section 3.12.3 for instructions on configuring an LDAP server. - - - LDAP Uses TLS For All Transactions @@ -82,6 +78,7 @@ intended for use as an LDAP Server it should be removed. + @@ -106,6 +103,7 @@ LDAP’s privileged user, who is allowed to read or write all data managed by th + @@ -125,8 +123,9 @@ Ensure that the configuration file has reasonable permissions: Protect configuration files containing the hashed password the same way you would protect other files, such as /etc/shadow, which contain hashed authentication data. - + + @@ -151,6 +150,7 @@ In addition, be sure to use a reasonably strong hash function. The default hash + @@ -186,11 +186,238 @@ that certificate is encrypted, and to the public certificate file belonging to t for the key to be protected further, so that processes running as ldap could not read it. If this were done, the LDAP server process would need to be restarted manually whenever the server rebooted. - + + + + + +Create Top-level LDAP Structure for Domain +Create a structure for the domain itself with at least the following attributes: +
      +dn: dc=example,dc=com
      +objectClass: dcObject
      +objectClass: organization
      +dc: example
      +o: Organization Description
      +
      +This is a placeholder for the root of the domain’s LDAP tree. Without this entry, LDAP will not be able to find +any other entries for the domain. +
      + + + +
      + + +Create LDAP Structures for Users and Groups +Create LDAP structures for people (users) and for groups with at least the following attributes: +
      +dn: ou=people,dc=example,dc=com
      +ou: people
      +structuralObjectClass: organizationalUnit
      +objectClass: organizationalUnit
      +dn: ou=groups,dc=example,dc=com
      +ou: groups
      +structuralObjectClass: organizationalUnit
      +objectClass: organizationalUnit
      +
      +Posix users and groups are the two top-level items which will be needed in order to use LDAP for authentication. +These organizational units are used to identify the two categories within LDAP. +
      + + + +
      + + +Create Unix Accounts +For each Unix user, create an LDAP entry with at least the following attributes (others may be appropriate +for your site as well), using variable values appropriate to that user. +
      +dn: uid=username ,ou=people,dc=example,dc=com
      +structuralObjectClass: inetOrgPerson
      +objectClass: inetOrgPerson
      +objectClass: posixAccount
      +objectClass: shadowAccount
      +cn: fullname
      +sn: surname
      +gecos: fullname
      +gidNumber: primary-group-id
      +homeDirectory: /home/username
      +loginShell: /path/to/shell
      +uid: username
      +uidNumber: uid
      +userPassword: {MD5}md5-hashed-password
      +shadowMax: N
      +
      +In general, the LDAP schemas for users use uid to refer to the text username, and uidNumber for the numeric +UID. This usage may be slightly confusing when compared to the standard Unix usage. +You should not create entries for the root account or for system accounts which are unique to individual systems, +but only for user accounts which are to be shared across machines, and which have authentication information +(such as a password) associated with them. +
      + + + +
      + + +Create Unix Groups +For each Unix group, create an LDAP entry with at least the following attributes: +
      +dn: cn=groupname ,ou=groups,dc=example,dc=com
      +cn: groupname
      +structuralObjectClass: posixGroup
      +objectClass: posixGroup
      +gidNumber: gid
      +memberUid: username1
      +memberUid: username2
      +...
      +memberUid: usernameN
      +
      +Note that each user has a primary group, identified by the gidNumber field in the user’s account entry. That +group must be created, but it is not necessary to list the user as a memberUid of the group. This behavior should +be familiar to administrators, since it is identical to the handling of the /etc/passwd and /etc/group files. +Do not create entries for the root group or for system groups, but only for groups which contain human users +or which are shared across systems. +
      + + + +
      + + +Create Groups to Administer LDAP +If a group of LDAP administrators, admins , is desired, that group must be created somewhat differently. +The specification should have these attributes: +
      +dn: cn=admins ,ou=groups,dc=example,dc=com
      +cn: admins
      +structuralObjectClass: groupOfUniqueNames
      +objectClass: groupOfUniqueNames
      +uniqueMember: cn=Manager,dc=example,dc=com
      +uniqueMember: uid=admin1-username ,ou=people,dc=example,dc=com
      +uniqueMember: uid=admin2-username ,ou=people,dc=example,dc=com
      +...
      +uniqueMember: uid=adminN-username ,ou=people,dc=example,dc=com
      +
      +LDAP cannot use Posix groups for its own internal authentication — it needs to compare the username specified +in an authenticated bind to some internal groupOfUniqueNames. If you do not specify an LDAP administrators’ +group, then all LDAP management will need to be done using the LDAP root user (Manager). For reasons of +auditing and error detection, it is recommended that LDAP administrators have unique identities. +
      + + +
      + +Configure slapd to Protect Authentication Information +Use ldapmodify to add these entries to the database. Add or correct the following access specifications: +1. Protect the user’s password by allowing the user himself or the LDAP administrators to change it, +allowing the anonymous user to authenticate against it, and allowing no other access: +
      +olcAccess: to attrs=userPassword
      +    by self write
      +    by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
      +    by anonymous auth
      +    by * none
      +olcAccess: to attrs=shadowLastChange
      +    by self write
      +    by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
      +    by * read
      +
      +2. Allow anyone to read other information, and allow the administrators to change it: +
      +olcAccess: to *
      +    by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
      +    by * read
      +
      +Access rules are applied in the order encountered, so more specific rules should appear first. In particular, +the rule restricting access to userPassword must appear before the rule allowing access to all data. The +shadowLastChange attribute is a timestamp, and is only critical if your site implements password expiration. If +your site does not have an LDAP administrators group, the LDAP root user (called Manager in this guide) will +be able to change data without an explicit access statement. +
      + + + +
      + +Correct Permissions on LDAP Server Files +Correct the permissions on the ldap server’s files: +
      +# chown ldap:root /var/lib/ldap/*
      +
      +Some manual methods of inserting information into the LDAP database may leave these files with incorrect +permissions. This will prevent slapd from starting correctly. +
      + + + +
      + + +Configure iptables to Allow Access to the LDAP Server +Determine an appropriate network block, netwk , and network mask, mask , representing the machines on +your network which will synchronize to this server. +Edit /etc/sysconfig/iptables. Add the following lines, ensuring that they appear before the final LOG and +DROP lines for the RH-Firewall-1-INPUT chain: +
      +-A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW -p tcp --dport 389 -j ACCEPT
      +-A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW -p tcp --dport 636 -j ACCEPT
      +
      +The default Iptables configuration does not allow inbound access to any services. These modifications allow +access to the LDAP primary (389) and encrypted-only (636) ports, while keeping all other ports on the server +in their default protected state. +Note: Even if the LDAP server restricts connections so that only encrypted queries are allowed, it will probably +be necessary to allow traffic to the default port 389. This is true because many LDAP clients implement +encryption by connecting to the primary port and issuing the STARTTLS command. +
      + + + +
      + + +Configure Logging for LDAP + +1. Edit the file /etc/syslog.conf. Add or correct the following line: +
      +local4.*
      +
      +2. Create the log file with safe permissions: +
      +# touch /var/log/ldap.log
      +# chown root:root /var/log/ldap.log
      +# chmod 0600 /var/log/ldap.log
      +
      +3. Edit the file /etc/logrotate.d/syslog and add the pathname +
      +/var/log/ldap.log
      +
      +to the space-separated list in the first line. + +4. Edit the LDAP configuration file /etc/openldap/slapd.conf and set a reasonable set of default log +parameters, such as: +
      +loglevel stats2
      +
      +OpenLDAP sends its log data to the syslog facility local4 at priority debug. By default, RHEL5 does not store +this facility at all. The syslog configuration suggested here will store any output logged by slapd in the file +/var/log/ldap.log, and will include that file in the standard log rotation for syslog files. +By default, LDAP’s logging is quite verbose. The loglevel parameter is a space-separated list of items to be +logged. Specifying stats2 will reduce the log output somewhat, but this level will still produce some logging +every time an LDAP query is made. (This may be appropriate, depending on your site’s auditing requirements.) +In order to capture only slapd startup messages, specify loglevel none. +See slapd.conf(5) for detailed information about the loglevel parameter. +
      + + + +
      -- 1.7.7.6