OS SRG mappings -- feedback

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Jul 20 16:53:41 UTC 2012


Our friends at DISA FSO have a batch of feedback/questions for the OS
SRG mappings.  I believe most of the answers are fairly clear, though a
few will require additions to the project content.

I think it is preferable to document (in auxiliary/srg_support.xml)
answers, instead of answering inline with email. (Although a few are
more appropriate for email/list response.)

For other items, we might achieve this by documenting features/behavior
more fully in Group descriptions.  This could make sense for 131-133, by
describing the audit records more fully there.



> Using this link: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-table-srgmap.html, I have reviewed the information provided and have the following comments:
> 
> CCI-000044 - The requirement is to allow 3 failed logons before locking the account. Need to assign a value of 3.
> CCI-000047 - The requirement is to lock the account after reaching the number of failed attempts as assigned in CCI-000044.
> CCI-000050 - The requirement is for the banner to remain on the screen until the user takes some action, such as clicking an OK or Acknowledgement button. 
> 	Is there a command which will fulfill this requirement or is it built-into the system?  We don't want the logon banner to just flash on the screen and
> 	disappear.
> CCI-000056 - Once the screen is locked, it can only be unlocked using password or CAC authentication.  Is there a command to enforce this?
> CCI-000057 - The requirement is to lock the system after 15 minutes of inactivity.  Is there a command to enter which will set the time to 15 minutes?
> CCI-000060 - Is there a way to ensure a blank screen or display graphics while the screen is locked?  Don't want to be able to see the previous screen.
> CCI-000130 - Is there a command or flag to set which will ensure the system audit information contains what type of events occurred? Or is it built in and cannot be
> 	changed?
> CCI-000131 - Is there a command or flag to set which will ensure the system audit information contains when the events occurred? Or is it built in and cannot be
> 	changed?
> CCI-000132 - Is there a command or flag to set which will ensure the system audit information contains where the events occurred? Or is it built in and cannot be
> 	changed?
> CCI-000133 - Is there a command or flag to set which will ensure the system audit information contains the source of the events? Or is it built in and cannot be
> 	changed?
> CCI-000133 - Is there a command or flag to set which will ensure the system audit information contains the success/failure of the events? Or is it built in and
> 	 cannot be changed?
> CCI-000143 - The command stated in CCI-000140 should be used here also with option of Email being used.
> CCI-000154 - This would either be 'Products Meets this Requirement' or 'Product cannot comply with this requirement'
> CCI-000162 - This requirement is to define permissions on the audit data file to restrict read access by authorized personnel only.  Need a command to set read
> 	permissions	on the audit file.
> CCI-000163 - This requirement is to define permissions on the audit data file to restrict modification by authorized personnel only.  Need a command to set modify
> 	permissions	on the audit file.
> CCI-000164 - This requirement is to define permissions on the audit data file to restrict deletion by authorized personnel only.  Need a command to set delete
> 	permissions	on the audit file.
> CCI-000200 - Need a command to check/fix for requirement of not using the last 24 passwords.
> CCI-000206 - Does Redhat display the password when entered or does it utilize asterisks?   If asterisks are used and cannot be changed, then this product meets the
> 	requirement.  If it must be configured to not display the password when entered, then a command needs defined.
> CCI-000213 - This requirement deals with permissions and access control.  Redhat has the capability to define permissions and controls per user basis.
> CCI-000663 - Is there any way that Redhat can control access to whom installs software or patches?
> CCI-001391 - Is there a way Redhat can display to the user after logon, how many successful logons have occurred within the last 7 days? 
> CCI-001392 - Is there a way Redhat can display to the user after logon, how many unsuccessful logons have occurred within the last 7 days?
> CCI-001404 - Will the command that's given also provide audit information when the account is disabled?
> CCI-001405 - Will the command that's given also provide audit information when the account is terminated?
> CCI-001452 - This requirement is to define the duration for counting the invalid logon attempts, such as 3 attempts within a 15 minute timeframe. 
> CCI-001493 - Is there a special permission which needs set to protect access to audit tools or how does the product natively meet this requirement?
> CCI-001494 - Is there a special permission which needs set to protect modification of audit tools or how does the product natively meet this requirement?
> CCI-001495 - Is there a special permission which needs set to protect deletion of audit tools or how does the product natively meet this requirement?
> CCI-001683 - Using the command given, will it notify individuals when accounts are created? Not just log the info.
> CCI-001684 - Using the command given, will it notify individuals when accounts are modified? Not just log the info.
> CCI-001685 - Using the command given, will it notify individuals when accounts are disabled? Not just log the info.
> CCI-001686 - Using the command given, will it notify individuals when accounts are terminated? Not just log the info.
> 
> 


More information about the scap-security-guide mailing list