OS SRG mappings -- feedback

Willy Santos wsantos at redhat.com
Tue Jul 24 14:53:03 UTC 2012


Please see in-line comments/responses.

Thanks,
-Willy


> CCI-000044 - The requirement is to allow 3 failed logons before locking the account. Need to assign a value of 3.

Value of 3 will be assigned when generating STIG specific profile.
https://fedorahosted.org/scap-security-guide/ticket/70

> CCI-000047 - The requirement is to lock the account after reaching the number of failed attempts as assigned in CCI-000044.

This is the default behaviour of the pam_faillock module in RHEL6.

> CCI-000050 - The requirement is for the banner to remain on the screen until the user takes some action, such as clicking an OK or Acknowledgement button.
> 	Is there a command which will fulfill this requirement or is it built-into the system?  We don't want the logon banner to just flash on the screen and
> 	disappear.

The banner remains on the screen until the user clicks the "OK" button.

A notable exception to this is when SSHing in, which displays the banner 
(contents of /etc/issue) before the login prompt. The accepted 
acknowledgement is when the user decides to enter their user/pass combo.

> CCI-000056 - Once the screen is locked, it can only be unlocked using password or CAC authentication.  Is there a command to enforce this?

All screen locks require re-authentication.

> CCI-000057 - The requirement is to lock the system after 15 minutes of inactivity.  Is there a command to enter which will set the time to 15 minutes?

There is already a rule that satisfies this requirement, but was 
incorrectly mapped. We'll correct this.
https://fedorahosted.org/scap-security-guide/ticket/72

> CCI-000060 - Is there a way to ensure a blank screen or display graphics while the screen is locked?  Don't want to be able to see the previous screen.

There is already a rule that satisfies this requirement, but was 
incorrectly mapped. We'll correct this.
https://fedorahosted.org/scap-security-guide/ticket/73

> CCI-000130 - Is there a command or flag to set which will ensure the system audit information contains what type of events occurred? Or is it built in and cannot be
> 	changed?

The audit system automatically records the type of event that occurred. 
No special command/flag needed and cannot be changed.

We can add wording to the audit group description to document this.
https://fedorahosted.org/scap-security-guide/ticket/85

> CCI-000131 - Is there a command or flag to set which will ensure the system audit information contains when the events occurred? Or is it built in and cannot be
> 	changed?

The audit system automatically records the time/date when event 
occurred. No special command/flag needed and cannot be changed.

We can add wording to the audit group description to document this.
https://fedorahosted.org/scap-security-guide/ticket/85

> CCI-000132 - Is there a command or flag to set which will ensure the system audit information contains where the events occurred? Or is it built in and cannot be
> 	changed?

The audit system automatically records the location of the event that 
occurred. No special command/flag needed and cannot be changed.

We can add wording to the audit group description to document this.
https://fedorahosted.org/scap-security-guide/ticket/85

> CCI-000133 - Is there a command or flag to set which will ensure the system audit information contains the source of the events? Or is it built in and cannot be
> 	changed?

The audit system automatically records the command that triggers the 
event and the uid and gid of the account that triggered the command for 
the event that occurred. No special command/flag needed and cannot be 
changed.

We can add wording to the audit group description to document this.
https://fedorahosted.org/scap-security-guide/ticket/85

> CCI-000133 - Is there a command or flag to set which will ensure the system audit information contains the success/failure of the events? Or is it built in and
> 	 cannot be changed?

The audit system automatically records the success of failure (syntax is 
"success=yes/no") of event that occurred. No special command/flag needed 
and cannot be changed.

We can add wording to the audit group description to document this.
https://fedorahosted.org/scap-security-guide/ticket/85

> CCI-000143 - The command stated in CCI-000140 should be used here also with option of Email being used.

We will add those mappings.
https://fedorahosted.org/scap-security-guide/ticket/77

> CCI-000154 - This would either be 'Products Meets this Requirement' or 'Product cannot comply with this requirement'

We will change the mapping to "Product Meets this Requirement"
https://fedorahosted.org/scap-security-guide/ticket/86

> CCI-000162 - This requirement is to define permissions on the audit data file to restrict read access by authorized personnel only.  Need a command to set read
> 	permissions	on the audit file.

Be default, ONLY the root user can read the audit log files.

> CCI-000163 - This requirement is to define permissions on the audit data file to restrict modification by authorized personnel only.  Need a command to set modify
> 	permissions	on the audit file.

Be default, ONLY the root user can read the audit log files.

> CCI-000164 - This requirement is to define permissions on the audit data file to restrict deletion by authorized personnel only.  Need a command to set delete
> 	permissions	on the audit file.

Be default, ONLY the root user can read the audit log files.

> CCI-000200 - Need a command to check/fix for requirement of not using the last 24 passwords.

Value of 24 will be assigned when generating STIG specific profile.
https://fedorahosted.org/scap-security-guide/ticket/78

> CCI-000206 - Does Redhat display the password when entered or does it utilize asterisks?   If asterisks are used and cannot be changed, then this product meets the
> 	requirement.  If it must be configured to not display the password when entered, then a command needs defined.

For graphical login, RHEL uses dots instead of asterisks, but it is the 
same idea. For console/SSH login, nothing is displayed while user is 
typing the password. Will change mapping to "Product Meets this 
Requirement".

https://fedorahosted.org/scap-security-guide/ticket/79

> CCI-000213 - This requirement deals with permissions and access control.  Redhat has the capability to define permissions and controls per user basis.

We will remap this CCI to "Product Meets this Requirement"
https://fedorahosted.org/scap-security-guide/ticket/71

> CCI-000663 - Is there any way that Redhat can control access to whom installs software or patches?

By default, only root can install software or patches.

> CCI-001391 - Is there a way Redhat can display to the user after logon, how many successful logons have occurred within the last 7 days?

By default we show the information for the last login, but only when 
logging in via ssh / terminal. The data does exist within the PAM 
subsystems, however. It may be possible for developers to write software 
to expose this data to a user upon login. However I am unaware of 
parties who have the resources to commit to this and to support it over 
time. Additionally, while CCI-001391 was in the OS SRG it was not a 
requirement of the RHEL5 STIG.

> CCI-001392 - Is there a way Redhat can display to the user after logon, how many unsuccessful logons have occurred within the last 7 days?

By default we do not expose this information at login. The data does 
exist within the PAM subsystems, however. It may be possible for 
developers to write software to expose this data to a user upon login. 
However I am unaware of parties who have the resources to commit to this 
and to support it over time. Additionally, while CCI-001392 was in the 
OS SRG it was not a requirement of the RHEL5 STIG.

> CCI-001404 - Will the command that's given also provide audit information when the account is disabled?

Yes. The audit rule will log when ANY changes are made to an account.

> CCI-001405 - Will the command that's given also provide audit information when the account is terminated?

Yes. The audit rule will log when ANY changes are made to an account.

> CCI-001452 - This requirement is to define the duration for counting the invalid logon attempts, such as 3 attempts within a 15 minute timeframe.

The rule addresses the time-out requirement with the unlock_time 
argument, which specifies the time (in seconds) for which to enforce the 
lockout. In this
case the guidance reads "unlock_time=900", which will lockout the user 
for 15 minutes.

> CCI-001493 - Is there a special permission which needs set to protect access to audit tools or how does the product natively meet this requirement?

By default only root has any access to any audit tools.

> CCI-001494 - Is there a special permission which needs set to protect modification of audit tools or how does the product natively meet this requirement?

By default only root has any access to any audit tools.

> CCI-001495 - Is there a special permission which needs set to protect deletion of audit tools or how does the product natively meet this requirement?

By default only root has any access to any audit tools.

> CCI-001683 - Using the command given, will it notify individuals when accounts are created? Not just log the info.

As the audit logs are sent to a centralized facility, to be reviewed by 
System Administrators, we have considered the inclusion of useradd data 
in audit logs a notification method. If we want to expand upon that 
further, such as EMailing the new user a welcome letter, such 
functionality does not currently exist within the Operating System.


> CCI-001684 - Using the command given, will it notify individuals when accounts are modified? Not just log the info.

As the audit logs are sent to a centralized facility, to be reviewed by 
System Administrators, we have considered the inclusion of this data in 
audit logs a notification method.


> CCI-001685 - Using the command given, will it notify individuals when accounts are disabled? Not just log the info.

As the audit logs are sent to a centralized facility, to be reviewed by 
System Administrators, we have considered the inclusion of this data in 
audit logs a notification method.

> CCI-001686 - Using the command given, will it notify individuals when accounts are terminated? Not just log the info.

As the audit logs are sent to a centralized facility, to be reviewed by 
System Administrators, we have considered the inclusion of this data in 
audit logs a notification method.



More information about the scap-security-guide mailing list