[PATCH] Rule and checks for disabling qpidd per ticket 50
Shawn Wells
shawn at redhat.com
Wed Jul 25 19:45:17 UTC 2012
On 7/25/12 1:16 PM, Kevin Spargur wrote:
> ---
> .../checks/package_qpid-cpp-server_removed.xml | 26 +++++
> RHEL6/input/checks/service_qpidd_disabled.xml | 100 ++++++++++++++++++++
> RHEL6/input/services/base.xml | 17 ++++
> 3 files changed, 143 insertions(+), 0 deletions(-)
> create mode 100644 RHEL6/input/checks/package_qpid-cpp-server_removed.xml
> create mode 100644 RHEL6/input/checks/service_qpidd_disabled.xml
>
> diff --git a/RHEL6/input/checks/package_qpid-cpp-server_removed.xml b/RHEL6/input/checks/package_qpid-cpp-server_removed.xml
> new file mode 100644
> index 0000000..9cdfe2e
> --- /dev/null
> +++ b/RHEL6/input/checks/package_qpid-cpp-server_removed.xml
> @@ -0,0 +1,26 @@
> +<def-group>
> + <definition class="inventory" id="package_qpid-cpp-server_removed"
> + version="1">
> + <metadata>
> + <title>Package qpid-cpp-server Removed</title>
> + <affected family="unix">
> + <platform>Red Hat Enterprise Linux 6</platform>
> + </affected>
> + <reference ref_id="4514-6 " source="CCE" />
> + <description>The RPM package qpid-cpp-server should be removed.</description>
> + <!--This package provides the qpidd service-->
> + </metadata>
> + <criteria>
> + <criterion comment="package qpid-cpp-server is removed"
> + test_ref="test_package_qpid-cpp-server_removed" />
> + </criteria>
> + </definition>
> + <linux:rpminfo_test check="all" check_existence="none_exist"
> + id="test_package_qpid-cpp-server_removed" version="1"
> + comment="package qpid-cpp-server is removed">
> + <linux:object object_ref="obj_package_qpid-cpp-server" />
> + </linux:rpminfo_test>
> + <linux:rpminfo_object id="obj_package_qpid-cpp-server" version="1">
> + <linux:name>qpid-cpp-server</linux:name>
> + </linux:rpminfo_object>
> +</def-group>
> diff --git a/RHEL6/input/checks/service_qpidd_disabled.xml b/RHEL6/input/checks/service_qpidd_disabled.xml
> new file mode 100644
> index 0000000..fa9004b
> --- /dev/null
> +++ b/RHEL6/input/checks/service_qpidd_disabled.xml
> @@ -0,0 +1,100 @@
> +<def-group>
> + <definition class="compliance" id="service_qpidd_disabled"
> + version="1">
> + <metadata>
> + <title>Service qpidd Disabled</title>
> + <affected family="unix">
> + <platform>Red Hat Enterprise Linux 6</platform>
> + </affected>
> + <reference ref_id="4338-0" source="CCE" />
> + <description>The qpidd service should be disabled if possible.</description>
> + <!--qpidd service is installed by the qpid-cpp-server rpm-->
> + </metadata>
> + <criteria comment="package qpidd removed or service qpidd is not configured to start" operator="OR">
> + <extend_definition comment="qpidd removed" definition_ref="package_qpid-cpp-server_removed" />
> + <criteria operator="AND" comment="service qpidd is not configured to start">
> + <criterion comment="qpidd runlevel 0" test_ref="test_runlevel0_qpidd" />
> + <criterion comment="qpidd runlevel 1" test_ref="test_runlevel1_qpidd" />
> + <criterion comment="qpidd runlevel 2" test_ref="test_runlevel2_qpidd" />
> + <criterion comment="qpidd runlevel 3" test_ref="test_runlevel3_qpidd" />
> + <criterion comment="qpidd runlevel 4" test_ref="test_runlevel4_qpidd" />
> + <criterion comment="qpidd runlevel 5" test_ref="test_runlevel5_qpidd" />
> + <criterion comment="qpidd runlevel 6" test_ref="test_runlevel6_qpidd" />
> + </criteria>
> + </criteria>
> + </definition>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel0_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel0_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel1_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel1_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel2_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel2_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel3_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel3_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel4_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel4_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel5_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel5_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_test check="all" check_existence="any_exist"
> + comment="Runlevel test" id="test_runlevel6_qpidd"
> + version="2">
> + <unix:object object_ref="obj_runlevel6_qpidd" />
> + <unix:state state_ref="state_service_qpidd_off" />
> + </unix:runlevel_test>
> + <unix:runlevel_object id="obj_runlevel0_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">0</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel1_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">1</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel2_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">2</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel3_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">3</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel4_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">4</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel5_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">5</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_object id="obj_runlevel6_qpidd" version="1">
> + <unix:service_name>qpidd</unix:service_name>
> + <unix:runlevel operation="equals">6</unix:runlevel>
> + </unix:runlevel_object>
> + <unix:runlevel_state comment="not configured to start" id="state_service_qpidd_off" version="1">
> + <unix:start datatype="boolean">false</unix:start>
> + <unix:kill datatype="boolean">true</unix:kill>
> + </unix:runlevel_state>
> +</def-group>
> diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
> index 38eb46d..4699c2a 100644
> --- a/RHEL6/input/services/base.xml
> +++ b/RHEL6/input/services/base.xml
> @@ -312,6 +312,23 @@ records.</rationale>
> <ref nist="AU-12, CM-6" />
> </Rule>
>
> +<Rule id="service_qpidd_disabled">
> +<title>Disable Apache Qpid (qpidd)</title>
> +<description>The <tt>qpidd</tt> service provides high speed, secure,
> +guaranteed delivery services. It is an implementation of the Advanced Message
> +Queuing Protocol. By default the qpidd service will bind to port 5672 and
> +listen for connection attempts.
> +<service-disable-macro service="qpidd" />
> +</description>
> +<rationale>The qpidd service is automatically installed when the "base"
> +package selection is selected during installation. The qpidd service listens
> +for network connections which increases the attack surface of the system. If
> +the system is not intended to receive AMQP traffic then the <tt>qpidd</tt>
> +service is not needed and should be disabled or removed.</rationale>
> +<ident cce="3854-7" />
> +<oval id="service_qpidd_disabled" />
> +<ref nist="CM-6, CM-7" disa="384" />
> +</Rule>
>
> <Rule id="service_quota_nld_disabled">
> <title>Disable Quota Netlink (quota_nld)</title>
Ack. Technically we don't have requirements against CCI384, but the
mapping makes sense.
More information about the scap-security-guide
mailing list