OS SRG mappings -- items differing

Shawn Wells shawn at redhat.com
Wed Jul 25 04:19:10 UTC 2012


On 7/23/12 2:43 PM, Jeffrey Blank wrote:
> Below is a list of items initially tagged in the OS SRG mapping, but
> which may have additional considerations.
>
> This email thread is to allow for further discussion on how these
> requirements could be met and to drive adjustments to the OS SRG mapping.
>
>
> CCI-000040:  In addition to auditing use of all identified setuid
> programs, would it be possible also to audit all processes with system
> UIDs started by interactive UIDs?  Something along the lines of
> 	-a always,exit -F auid>=500 -F auid!=4294967295 -F uid<500



> CCI-000040:  It is also a good idea to audit use of the sudo(8) command.
sudo is a SUID program, and audited through:
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item-audit_privileged_commands


> CCI-000048:  Do not forget FTP and SSH login banners.
Agreed & patched.

FTP:
https://fedorahosted.org/scap-security-guide/changeset/006c67f6d64bd64b432862c29249d3185420d684

SSH:
https://fedorahosted.org/scap-security-guide/changeset/073e9e157e4528a1adf4eb2d817bd764e0053100


> CCI-000054:  Do not forget the MaxSessions configuration in sshd_config(5).
The OS level limit supersedes services


> CCI-000056:  Is there a setting for the gconftool-2 command to set
> mandatory screen locking enforcement?
Yes.

56 requires that the OS retains the lock until someone re-authenticates, 
which is the default behavior. I created a patch to reflect this. In 
regards to the gconftool commands, those were mapped to CCI-000057.


> CCI-000057:  This is the same as CCI-000056 with mandatory screensaver
> timeout enforcement.
Created a patch to reflect the time period component.


> CCI-000060:  When this check was coded for RHEL5 in OVAL, we limited the
> screensaver options to appropriate values among those included with the RPM.
IIRC, we didn't want to open the possibility of someone replacing the 
default image files with potentially classified ones. blank-mode uses 
code to drape the screen in black, whereas the others (generally) tile 
images.


> CCI-000067:  Ensure logging of all FTP and SSH sessions, as well.
OS-level accesses such as SSH will be audited natively. Daemon level 
accesses (such as FTP) will be taken care of in the FTP service profile 
later.


> CCI-000068:  Disable and remove rcmd, rsh, and rlogind services.
These aren't installed by default, the user has to manually install 
them. There has been some talk about creating a "non recommended 
packages" section or some such thing. Maybe this could push that 
conversation over the edge?


> CCI-000068:  Enable SNMP encryption, preferably using FIPS 140-2
> approved encryption algorithms.
Will be addressed in a future Mail Server profile.


> CCI-000085:  Disable all firewire and Bluetooth facilities and remove
> them from the system.
Agreed and patched.
https://fedorahosted.org/scap-security-guide/changeset/372e07e069f015e17d6727a6e4414d0fb1ba57ff


> CCI-000086:  Disable all firewire and Bluetooth facilities and remove
> them from the system.
86 is within the OS SRG but not in the RHEL5 STIG. Will this be applied 
for the RHEL6 STIG as well?



> CCI-000130:  Enable FTP daemon logging.
Service auditing (e.g. SMTP, FTP...) will be done in future service 
profiles. Right now we're after the base OS.


> CCI-000130, et seq.:  Unless there is no way to configure auditd such
> that it will not capture the required information, the product does not
> meet the requirement by design.
Technically the OS wouldn't meet this requirement if auditing is turned 
off, so I'll map this to both the mandatory requirement to turn on 
auditing and the one to configure it. Once turned on the audit message 
data will contain this information (and you can't manipulate the format 
for it to be excluded).

Patch created.


> CCI-000134:  Enable xinetd(8) logging.
Earlier guidance states that xinetd should not be used:
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item-inetd_and_xinetd


> CCI-000135, et seq.:  Can illustrative examples be provided?
type=CRED_ACQ msg=audit(1343129489.601:26569): user pid=4660 uid=0 
auid=4294967295 ses=4294967295 
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred 
acct="shawn" exe="/usr/sbin/sshd" hostname=10.211.55.2 addr=10.211.55.2 
terminal=ssh res=success'


pid = process ID of the event originator
uid = who the process was running as
subj = selinux content type
msg = the event that happened
hostname = remote FQDN (if applicable) that caused the event
addr = remote IP address that caused the event
terminal = where did this event happen? (local console, remotely via 
SSH, etc)
res = condition of the event (success/fail, etc)


> CCI-000136:  The system must use a remote logging host for audit data.
Agreed and patched.
https://fedorahosted.org/scap-security-guide/changeset/18ffc6c57a99de91a94d386ea4fcddc257dd55b4


> CCI-000160:  At least two NTP servers must be configured.
Ticket created:
https://fedorahosted.org/scap-security-guide/ticket/87


> CCI-000160:  Unless the system is an NTP server for the local enclave,
> all its NTP servers must be in the local enclave.
What happens when the NTP servers are corporately provided outside the 
local enclave?


> CCI-000166:  Please provide an example.
Getting into the non-repudiation aspects of the audit subsystem can get 
pretty long. Could we piggyback on that RHEL has been common criteria 
certified (which includes this)?


> CCI-000171:  How can "designated organizational personnel" be identified
> as such under RHEL6?
They will have access to the root (privileged) account.


> CCI-000185:  Are DoD certificates signed by "established CAs"?
Yes. DoD certificates would be signed by the DoD/IC PKI CAs.


> CCI-000187:  How are PKI-authenticated identities mapped to user accounts?
Defer to Willy who wrote the PKI section (or Kevin if he wants to chirp 
up ;))


> CCI-000196:  Disabling telnet is covered in CCI-000196.
Patched.


> CCI-000196:  Password hashes must be generated using FIPS 140-2 approved
> algorithms.
This was covered in another stanza: 
http://10.211.55.8/scap-security-guide/RHEL6/output/rhel6-guide.html#item-sshd_use_approved_ciphers
Patch created to map this.


> CCI-000196:  There must be no .netrc files on the system.
Ticket created.
https://fedorahosted.org/scap-security-guide/ticket/88


> CCI-000196:  There must be no passwords stored in the ldap.conf
> configuration file.
Ticket created.
https://fedorahosted.org/scap-security-guide/ticket/89


> CCI-000200:  The pam_unix.so module has the "remember=n" option to
> retain n generations of user passwords.
Patched
https://fedorahosted.org/scap-security-guide/changeset/41557377a28aefb677e5df022b630cff1e9defc5


> CCI-000205:  The system must use password hashes that are computed using
> the entire password provided by the end-user.
Default behavior.


> CCI-000347:  Please provide examples.
Hardware will showup in dmesg. An example from my laptop logfiles:

> dmesg:593:e1000 0000:00:05.0: eth0: (PCI:33MHz:32-bit) 00:1c:42:a6:72:16
In this case, it's saying that something showed up using the e1000 
kernel driver, exposed itself as eth0, and had a hardware address of 
00:1c:42:a6:72:16



> CCI-000370, et seq.:  I identified these as not applicable, but a
> third-party application may satisfy these requirements (NA-DEP).
Agreed, 3rd party tools should be used. Since this is NA, could we get 
it moved to OS-SRG-NA?

> CCI-000374:  The system must utilize a file-integrity tool.
Patched.
https://fedorahosted.org/scap-security-guide/changeset/4952aa30f31e0bd22c2c64215d91cae4f12a4db7


> CCI-000382:  The SCTP, DCCP, UDP-Lite, IPX, AppleTalk, DECnet, RDS, and
> TIPC protocols must be disabled unless required.
These protocols are disabled by default. Perhaps we need a "non 
recommended protocols" section?


> CCI-000416:  Can AIDE track the addition of devices to the system
> without blowing up after system reboots?
AIDE is more about file integrity (who changed /etc/passwd?) than 
tracking devices. Devices will be tracked in the following ways:
(1) Device information will show up in the dmesg log file, such as the 
eth0 example above
(2) We audit the usage of the mount command, which would indicate 
someone is mounting a device (USB, CDROM, etc) to the system


> CCI-000764:  The system must not have special privilege accounts, such
> as shutdown and halt.
Their presence is largely legacy, I suppose we can remove them. Ticket 
created:
https://fedorahosted.org/scap-security-guide/ticket/90


> CCI-000764:  The Linux NFS Server must not have the insecure file
> locking option.
Ticket created
https://fedorahosted.org/scap-security-guide/ticket/91


> CCI-000764:  All accounts on the system must have unique user or account
> names.
Default behavior.


> CCI-000764:  All accounts must be assigned unique User Identification
> Numbers (UIDs).
Default behavior


> CCI-000765, et seq.:  If there is a canonical method for enabling PKI
> under RHEL6, please provide it.
Defer to the other guys on this one. Willy, Cliff, Jeff?


> CCI-000770:  Direct logins must not be permitted to shared, default,
> application, or utility accounts.
There will be no shared/group accounts


> CCI-000770:  The root account must not be used for direct log in.
Patched
https://fedorahosted.org/scap-security-guide/changeset/72c589f4bd5393751b66231c9f0131a9fe3a6303


> CCI-000770:  The system must prevent the root account from directly
> logging in except from the system console.
Patched
https://fedorahosted.org/scap-security-guide/changeset/72c589f4bd5393751b66231c9f0131a9fe3a6303


> CCI-000880:  Please provide examples.
This is default behavior. Users are audited no matter where they login 
from (console, TTY, SSH, etc).


> CCI-001084:  Please provide examples.
Upon review, I'd argue that this should be mapped to met_inherently. By 
default root is the only one with access to privileged commands (e.g. 
security functions).


> CCI-001090:  Please provide examples.
Can we defer to RHEL's common criteria certification as evidence?


> CCI-001154:  The system must not have a public Instant Messaging (IM)
> client installed.
The requirement directly calls out the blocking of traffic. IM software 
is not installed by default on the system.



> CCI-001233:  The system package management tool must not automatically
> obtain updates.
Default behavior.


> CCI-001297:  Please provide configuration examples.
I've posted an example at 
http://people.redhat.com/swells/SCAPexamples/aide.txt. In that I change 
the /bin/cp program.


> CCI-001356:  Please provide examples of an RHEL6-included log analysis
> package checking for atypical use patterns.
RHEL will provide the monitoring -- aka the raw data -- but not the 
analysis. If this requirement calls for analysis we'll have to defer to 
a 3rd party ISV.



> CCI-001436:  Disable rpcbind, X, UUCP, peer-to-peer applications, samba,
> SWAT, and NIS/NIS+ over UDP, unless required.
This software will not be installed by default. Service level configs 
(e.g. samba) will be covered in samba profiles.



> CCI-001436:  The SSH daemon and client must use only version 2 of the
> SSH protocol.
Default behavior of RHEL6



> CCI-001453:  Enable SNMP encryption, preferably using FIPS 140-2
> approved encryption algorithms.
Will be covered in a (future) SMTP profile


> CCI-001453:  If the system is using LDAP for authentication or account
> information, the system must use a TLS connection using FIPS 140-2
> approved cryptographic algorithms.
Prose existed for this:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-ldap_client_start_tls
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-ldap_client_tls_cacertpath

Patched to create the mapping:
https://fedorahosted.org/scap-security-guide/changeset/f52e5d1871f5a2d21ceb9d793caaf6492e814a4e



> CCI-001462:  Does this requirement imply session replaying?  I don't know.
The requirement was interpreted at face value -- provide the capability 
capture and record. This can be accomplished by keystroke logging in RHEL6.


> CCI-001493, et seq.:  The ownerships and permissions are ostensibly
> correct at startup.  Do they automatically correct themselves should
> they be tampered with?
Not through native tooling. 3rd party ISVs can accomplish this (puppet, 
RHN Satellite, Chef...).

 From a RHEL perspective only authorized users can adjust access 
permissions to audit logs and tooling. All those changes will be audited.


> CCI-001589:  Please provide configuration examples.
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-auditd_configure_rules


> CCI-001632:  This looks more like an out-of-band network management
> requirement.  Does RHEL6 support VLAN functionality that would separate
> management traffic?
Yes, that is possible by associating the SSH daemon with a unique 
network interface dedicated to management traffic.

In the description text of the CCI it states that an "encrypted channel" 
is acceptable, so 1632 was mapped to the use of SSH.


> CCI-001674:  Please explain how RHEL6 would implement the
> organization-defined responses and alternative actions?
We interpreted this requirement as enforcing other CCIs which required 
actions to be taken on component failures; aka the "fail to secure 
state" requirements. If this was not the intent further clarification is 
requested.


More information about the scap-security-guide mailing list