OS SRG mappings -- items differing

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 23 18:43:33 UTC 2012


Below is a list of items initially tagged in the OS SRG mapping, but
which may have additional considerations.

This email thread is to allow for further discussion on how these
requirements could be met and to drive adjustments to the OS SRG mapping.


CCI-000040:  In addition to auditing use of all identified setuid
programs, would it be possible also to audit all processes with system
UIDs started by interactive UIDs?  Something along the lines of
	-a always,exit -F auid>=500 -F auid!=4294967295 -F uid<500

CCI-000040:  It is also a good idea to audit use of the sudo(8) command.

CCI-000048:  Do not forget FTP and SSH login banners.

CCI-000054:  Do not forget the MaxSessions configuration in sshd_config(5).

CCI-000056:  Is there a setting for the gconftool-2 command to set
mandatory screen locking enforcement?

CCI-000057:  This is the same as CCI-000056 with mandatory screensaver
timeout enforcement.

CCI-000060:  When this check was coded for RHEL5 in OVAL, we limited the
screensaver options to appropriate values among those included with the RPM.

CCI-000067:  Ensure logging of all FTP and SSH sessions, as well.

CCI-000068:  Disable and remove rcmd, rsh, and rlogind services.

CCI-000068:  Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.

CCI-000085:  Disable all firewire and Bluetooth facilities and remove
them from the system.

CCI-000086:  Disable all firewire and Bluetooth facilities and remove
them from the system.

CCI-000130:  Enable FTP daemon logging.

CCI-000130, et seq.:  Unless there is no way to configure auditd such
that it will not capture the required information, the product does not
meet the requirement by design.

CCI-000134:  Enable xinetd(8) logging.

CCI-000135, et seq.:  Can illustrative examples be provided?

CCI-000136:  The system must use a remote logging host for audit data.

CCI-000160:  At least two NTP servers must be configured.

CCI-000160:  Unless the system is an NTP server for the local enclave,
all its NTP servers must be in the local enclave.

CCI-000166:  Please provide an example.

CCI-000171:  How can "designated organizational personnel" be identified
as such under RHEL6?

CCI-000185:  Are DoD certificates signed by "established CAs"?

CCI-000187:  How are PKI-authenticated identities mapped to user accounts?

CCI-000196:  Disabling telnet is covered in CCI-000196.

CCI-000196:  Password hashes must be generated using FIPS 140-2 approved
algorithms.

CCI-000196:  There must be no .netrc files on the system.

CCI-000196:  There must be no passwords stored in the ldap.conf
configuration file.

CCI-000200:  The pam_unix.so module has the "remember=n" option to
retain n generations of user passwords.

CCI-000205:  The system must use password hashes that are computed using
the entire password provided by the end-user.

CCI-000347:  Please provide examples.

CCI-000370, et seq.:  I identified these as not applicable, but a
third-party application may satisfy these requirements (NA-DEP).

CCI-000374:  The system must utilize a file-integrity tool.

CCI-000382:  The SCTP, DCCP, UDP-Lite, IPX, AppleTalk, DECnet, RDS, and
TIPC protocols must be disabled unless required.

CCI-000416:  Can AIDE track the addition of devices to the system
without blowing up after system reboots?

CCI-000764:  The system must not have special privilege accounts, such
as shutdown and halt.

CCI-000764:  The Linux NFS Server must not have the insecure file
locking option.

CCI-000764:  All accounts on the system must have unique user or account
names.

CCI-000764:  All accounts must be assigned unique User Identification
Numbers (UIDs).

CCI-000765, et seq.:  If there is a canonical method for enabling PKI
under RHEL6, please provide it.

CCI-000770:  Direct logins must not be permitted to shared, default,
application, or utility accounts.

CCI-000770:  The root account must not be used for direct log in.

CCI-000770:  The system must prevent the root account from directly
logging in except from the system console.

CCI-000880:  Please provide examples.

CCI-001084:  Please provide examples.

CCI-001090:  Please provide examples.

CCI-001154:  The system must not have a public Instant Messaging (IM)
client installed.

CCI-001233:  The system package management tool must not automatically
obtain updates.

CCI-001297:  Please provide configuration examples.

CCI-001356:  Please provide examples of an RHEL6-included log analysis
package checking for atypical use patterns.

CCI-001436:  Disable rpcbind, X, UUCP, peer-to-peer applications, samba,
SWAT, and NIS/NIS+ over UDP, unless required.

CCI-001436:  The SSH daemon and client must use only version 2 of the
SSH protocol.

CCI-001453:  Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.

CCI-001453:  If the system is using LDAP for authentication or account
information, the system must use a TLS connection using FIPS 140-2
approved cryptographic algorithms.

CCI-001462:  Does this requirement imply session replaying?  I don't know.

CCI-001493, et seq.:  The ownerships and permissions are ostensibly
correct at startup.  Do they automatically correct themselves should
they be tampered with?

CCI-001589:  Please provide configuration examples.

CCI-001632:  This looks more like an out-of-band network management
requirement.  Does RHEL6 support VLAN functionality that would separate
management traffic?

CCI-001674:  Please explain how RHEL6 would implement the
organization-defined responses and alternative actions?



More information about the scap-security-guide mailing list