[PATCH 2/2] moved/merged discussion of some services out of base services into relevant sections

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jun 4 14:59:44 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/services/cron.xml           |   13 +++++--
 rhel6/src/input/services/mail.xml           |   17 +++++++++
 rhel6/src/input/services/ntp.xml            |   45 ++++++++++++++++-------
 rhel6/src/input/system/logging.xml          |   23 +++++-------
 rhel6/src/input/system/network/iptables.xml |   22 +++++------
 rhel6/src/input/system/network/wireless.xml |   52 ++++++++++++++++++++++-----
 rhel6/src/input/system/selinux.xml          |   21 +++++++++++
 7 files changed, 142 insertions(+), 51 deletions(-)

diff --git a/rhel6/src/input/services/cron.xml b/rhel6/src/input/services/cron.xml
index f29ace1..e8a09e2 100644
--- a/rhel6/src/input/services/cron.xml
+++ b/rhel6/src/input/services/cron.xml
@@ -8,14 +8,21 @@ configured defensively.</description>
 
 <Rule id="enable_cron">
 <title>Enable cron Service</title>
-<description>The <tt>crond</tt> service should be enabled.</description>
-<rationale>The cron service allows system administrators to schedule maintenance actions to
-run at a preconfigured interval. This service should be enabled.</rationale>
+<description>The <tt>crond</tt> service is used to execute commands at
+preconfigured times.  It is required by almost all systems to perform necessary
+maintenance tasks, such as notifying root of system activity. The
+<tt>crond</tt> service can be enabled with the following command:
+<pre># chkconfig crond on</pre>
+</description>
+<rationale>Due to its usage for maintenance and security-supporting tasks,
+enabling the cron daemon is essential.
+</rationale>
 <ident cce="4324-0" />
 <oval id="service_crond_enabled" />
 <ref nist="CM-6, CM-7" />
 </Rule>
 
+
 <Rule id="disable_anacron">
 <title>Disable anacron Service</title>
 <description>The <tt>cronie-anacron</tt> package which provides anacron
diff --git a/rhel6/src/input/services/mail.xml b/rhel6/src/input/services/mail.xml
index 047d6f8..8a5747f 100644
--- a/rhel6/src/input/services/mail.xml
+++ b/rhel6/src/input/services/mail.xml
@@ -22,6 +22,23 @@ Postfix was coded with security in mind and can also be more effectively contain
 SELinux as its modular design has resulted in separate processes performing specific actions.
 More information is available on its website, http://www.postfix.org.</description>
 
+<Rule id="service_postfix_enabled">
+<title>Enable Postfix (postfix)</title>
+<description>The Postfix mail transfer agent is used for local mail delivery within
+the system. The default configuration only listens for connections to the default SMTP
+port (port 25) on the loopback interface (127.0.0.1). 
+It is recommended to leave this
+service enabled for local mail delivery.
+The <tt>postfix</tt> service can be enabled with the following command:
+<pre># chkconfig postfix on</pre>
+</description>
+<rationale>Local mail delivery is essential to some system maintenance and
+notification tasks.
+</rationale>
+<ident cce="14068-1" />
+<oval id="service_postfix_enabled" />
+<ref nist="CM-6" />
+</Rule>
 
 <Group id="postfix_client">
 <title>Configure SMTP For Mail Clients</title>
diff --git a/rhel6/src/input/services/ntp.xml b/rhel6/src/input/services/ntp.xml
index b1390ed..bef795c 100644
--- a/rhel6/src/input/services/ntp.xml
+++ b/rhel6/src/input/services/ntp.xml
@@ -31,7 +31,7 @@ internal servers.</description>
 
 <Group id="configuring_ntpd">
 <title>Configure an NTP Server</title>
-<description>The site’s NTP server contacts a central NTP server,
+<description>The site's NTP server contacts a central NTP server,
 probably either one provided by your ISP or a public time server,
 to obtain accurate time data. The server then allows other machines
 on your network to request the time data.
@@ -43,12 +43,14 @@ The NTP server configuration file is located at <tt>/etc/ntp.conf</tt>.</descrip
 
 <Rule id="enable_ntpd">
 <title>Enable the NTP Daemon</title>
-<description>The <tt>ntpd</tt> service should be enabled.
+<description>The <tt>ntpd</tt> service can be enabled with the following
+command:
 <pre># chkconfig ntpd on</pre>
 </description>
-<rationale>
-Enabling the <tt>ntpd</tt> service ensures that the local system time will be the same on all computers. This is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.
-</rationale>
+<rationale> Enabling the <tt>ntpd</tt> service ensures that the local system
+time will be the same on all computers. This is essential for authentication
+services such as Kerberos, but it is also important for maintaining accurate
+logs and auditing possible security breaches.  </rationale>
 <ident cce="4376-0" />
 <oval id="service_ntpd_enabled" />
 <ref disa="160" />
@@ -57,19 +59,34 @@ Enabling the <tt>ntpd</tt> service ensures that the local system time will be th
 
 <Group id="configuring_ntpd_client">
 <title>Specify a Remote NTP Server for Time Data</title>
-<description>Find the IP address of an appropriate remote NTP server and configure <tt>ntpd</tt> to use it to obtain accurate time data. If your site does not require time data to be accurate, but merely to be synchronized among local machines, this step can be omitted, and the NTP server will default to providing time data from the local clock. However, it is a good idea to periodically synchronize the clock to some source of accurate time, even if it is not appropriate to do so automatically.</description>
+<description>Find the IP address of an appropriate remote NTP server and
+configure <tt>ntpd</tt> to use it to obtain accurate time data. If your site
+does not require time data to be accurate, but merely to be synchronized among
+local machines, this step can be omitted, and the NTP server will default to
+providing time data from the local clock. However, it is a good idea to
+periodically synchronize the clock to some source of accurate time, even if it
+is not appropriate to do so automatically.</description>
 
 <Rule id="ntpd_specify_remote_server">
 <title>Specify a Remote NTP Server for Time Data</title>
-<description>A remote NTP Server for time synchronization should be specified. Edit the file <tt>/etc/ntp.conf</tt>, and add or correct the following lines, substituting the IP address of a remote NTP server for <em>server-ip</em>:
-<pre>restrict server-ip mask 255.255.255.255 nomodify notrap noquery
-server server-ip</pre>
-This NTP server must contact a remote server to obtain accurate data, so NTP's configuration must allow that remote data to be used to modify the system clock. The restrict line changes the default access permissions for that remote server. The server line specifies the remote server as the preferred NTP server for time data. If you intend to synchronize to more than one server, specify restrict and server lines for each server.
+<description>A remote NTP Server for time synchronization should be specified.
+Edit the file <tt>/etc/ntp.conf</tt>, and add or correct the following lines,
+substituting the IP address of a remote NTP server for <em>server-ip</em>:
+<pre>restrict server-ip mask 255.255.255.255 nomodify notrap noquery server
+server-ip</pre> This NTP server must contact a remote server to obtain accurate
+data, so NTP's configuration must allow that remote data to be used to modify
+the system clock. The restrict line changes the default access permissions for
+that remote server. The server line specifies the remote server as the
+preferred NTP server for time data. If you intend to synchronize to more than
+one server, specify restrict and server lines for each server.
 <br /><br />
-Note: It would be possible to specify a hostname, rather than an IP address, for the server field. However, the restrict setting applies only to network blocks of IP addresses, so it is considered more maintainable to use the IP address in both fields.</description>
-<rationale>
-Synchonizing <tt>ntpd</tt> with an accurate clock makes it easier to collate system logs from multiple sources or correlate computer events with real time events.
-</rationale>
+Note: It would be possible to specify a hostname, rather than an IP address,
+for the server field. However, the restrict setting applies only to network
+blocks of IP addresses, so it is considered more maintainable to use the IP
+address in both fields.</description>
+<rationale> Synchonizing <tt>ntpd</tt> with an accurate clock makes it easier
+to collate system logs from multiple sources or correlate computer events with
+real time events.  </rationale>
 <ident cce="4385-1" />
 <oval id="ntp_remote_server" />
 <ref disa="160" />
diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
index d9b852d..835f306 100644
--- a/rhel6/src/input/system/logging.xml
+++ b/rhel6/src/input/system/logging.xml
@@ -35,25 +35,22 @@ system logging services.
 <ref nist="AU-2, AU-9, CM-6" />
 </Rule>
 
-<Rule id="enable_rsyslog">
-<title>Configure Rsyslog</title>
-<description>
-To ensure that the rsyslog service is activated, run the following command:
-<pre>$ chkconfig --list rsyslog</pre>
-The service should be <tt>on</tt> for runlevels 2 through 5.
-<br/>
-If not, activate it with the command:
-<pre>$ chkconfig rsyslog on</pre>
+
+<Rule id="service_rsyslog_enabled">
+<title>Enable Rsyslog Daemon (rsyslog)</title>
+<description>The <tt>rsyslog</tt> service provides syslog-style logging by default on RHEL 6. 
+The <tt>rsyslog</tt> service can be activated with the following command:
+<pre># chkconfig rsyslog on</pre>
 </description>
-<rationale>
-The rsyslog service must be running in order to provide
-logging services.
+<rationale>The <tt>rsyslog</tt> service must be running in order to provide
+logging services, which are essential to system administration.
 </rationale>
 <ident cce="17698-2" />
 <oval id="service_rsyslog_enabled" />
-<ref nist="AU-2" />
+<ref nist="AU-12, CM-6" />
 </Rule>
 
+
 <Group id="ensure_rsyslog_messages_captured">
 <title> Ensure Important Messages are Captured</title>
 <description>
diff --git a/rhel6/src/input/system/network/iptables.xml b/rhel6/src/input/system/network/iptables.xml
index 29f9aca..58ab1e6 100644
--- a/rhel6/src/input/system/network/iptables.xml
+++ b/rhel6/src/input/system/network/iptables.xml
@@ -64,17 +64,16 @@ incoming udp and tcp packets with a particular destination port
 range. This is because the current Netfilter implementation for
 IPv6 lacks reliable connection-tracking functionality.</description>
 
+
+
+
 <Rule id="enable_ip6tables">
 <title>Verify ip6tables Enabled</title>
-<description>
-The <tt>ip6tables</tt> service should be enabled.
-If it is not enabled, activate it with following commands:
-<pre># service ip6tables restart
-# chkconfig ip6tables on</pre>
+<description> The <tt>ip6tables</tt> service can be enabled with the following
+command: <pre># service ip6tables restart # chkconfig ip6tables on</pre>
 </description>
-<rationale>
-The <tt>ip6tables</tt> service provides the system's host-based firewalling
-capability for IPv6 and ICMPv6.
+<rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
+capability for IPv6 and ICMPv6.  
 </rationale>
 <ident cce="4167-3" />
 <oval id="service_ip6tables_enabled" />
@@ -84,10 +83,9 @@ capability for IPv6 and ICMPv6.
 <Rule id="enable_iptables">
 <title>Verify iptables Enabled</title>
 <description>
-The <tt>iptables</tt> service should be enabled.
-If it is not enabled, activate it with following commands:
-<pre># service iptables restart
-# chkconfig iptables on</pre>
+The <tt>iptables</tt> service can be enabled with the following
+command:<!-- # service iptables restart -->
+<pre># chkconfig iptables on</pre>
 </description>
 <rationale>
 The <tt>iptables</tt> service provides the system's host-based firewalling
diff --git a/rhel6/src/input/system/network/wireless.xml b/rhel6/src/input/system/network/wireless.xml
index b69f7be..7d22256 100644
--- a/rhel6/src/input/system/network/wireless.xml
+++ b/rhel6/src/input/system/network/wireless.xml
@@ -1,7 +1,7 @@
 <Group id="network-wireless">
 <title>Wireless Networking</title>
-<description>Wireless networking (sometimes referred to as 802.11
-or WiFi) can present a security risk to sensitive or
+<description>Wireless networking, such as 802.11
+(WiFi) and Bluetooth, can present a security risk to sensitive or
 classified systems and networks. Wireless networking hardware is
 much more likely to be included in laptop or portable systems than
 desktops or servers. 
@@ -10,9 +10,9 @@ Removal of hardware provides the greatest assurance that the wireless
 capability remains disabled.  Acquisition policies often includes provisions to
 prevent the purchase of equipment that will be used in sensitive spaces and
 includes wireless capabilities.  If it is impractical to remove the wireless
-hardware, and policy permits the device to enter sensitive spaces, efforts
-should instead focus on disabling wireless capability via software.
-</description>
+hardware, and policy permits the device to enter sensitive spaces as long
+as wireless is disabled, efforts instead focus on disabling wireless capability
+via software.</description>
 
 <Group id="wireless_software">
 <title>Disable Wireless Through Software Configuration</title>
@@ -24,7 +24,7 @@ prevent malicious software or careless users from re-activating the
 devices.</description>
 
 <Rule id="wireless_disable_in_bios">
-<title>Disable Wireless in BIOS</title>
+<title>Disable WiFi or Bluetooth BIOS</title>
 <description>Some systems that include built-in wireless support offer the
 ability to disable the device through the BIOS. This is system-specific;
 consult your hardware manual or explore the BIOS setup during
@@ -39,8 +39,8 @@ to reboot the system first.
 </Rule>
 
 <Rule id="deactivate_wireless_interfaces">
-<title>Deactivate Wireless Interfaces</title>
-<description>Deactivating the wireless interfaces should prevent
+<title>Deactivate Wireless Network Interfaces</title>
+<description>Deactivating wireless network interfaces should prevent
 normal usage of the wireless capability.
 <br /><br />
 First, identify the interfaces available with the command:
@@ -69,7 +69,7 @@ protocols which were not designed with security in mind.
 </Rule>
 
 <Rule id="wireless_disable_drivers">
-<title>Disable Wireless Drivers</title>
+<title>Disable Wireless Network Drivers</title>
 <description>Removing the kernel drivers that provide support for wireless
 Ethernet devices will prevent users from easily activating the devices. To
 remove the wireless drivers from the system:
@@ -85,5 +85,39 @@ the need to install such a driver first.
 <ref nist="CM-7" />
 </Rule>
 
+<Rule id="service_bluetooth_disabled">
+<title>Disable Bluetooth Service</title>
+<description> The <tt>bluetooth</tt> service can be disabled with the following
+command:
+<pre># chkconfig bluetooth off</pre>
+</description>
+<rationale> Disabling the <tt>bluetooth</tt> service prevents the system from attempting
+connections to to Bluetooth devices, which entails some security risk.
+Nevertheless, variation in this risk decision may be expected due to the
+utility of Bluetooth connectivity and its limited range.</rationale>
+<ident cce="4355-4" />
+<oval id="service_bluetooth_disabled" />
+<ref nist="AC-18, CM-6, CM-7" />
+</Rule>
+
+<Rule id="kernel_module_bluetooth_disabled">
+<title>Disable Bluetooth Kernel Modules</title>
+<description>The kernel's module loading system can be configured to prevent
+loading of the Bluetooth module.  Add the following to
+<tt>/etc/modprobe.conf</tt> or a file inside the directory <tt>/etc/modprobe.d</tt>
+to prevent the loading of the Bluetooth module:
+<pre>install net-pf-31 /bin/true
+install bluetooth /bin/true</pre>
+</description>
+<rationale>If Bluetooth functionality must be disabled, preventing the kernel
+from loading the kernel module provides an additional safeguard against its
+activation.</rationale>
+<ident cce="14948-4" />
+<oval id="kernel_module_bluetooth_disabled" />
+<ref nist="AC-18, CM-6, CM-7" />
+</Rule>
+
+
+
 </Group><!--<Group id="wireless_software">-->
 </Group><!--<Group id="network-wireless">-->
diff --git a/rhel6/src/input/system/selinux.xml b/rhel6/src/input/system/selinux.xml
index 76449d1..803cdf9 100644
--- a/rhel6/src/input/system/selinux.xml
+++ b/rhel6/src/input/system/selinux.xml
@@ -138,6 +138,27 @@ targeted for exploitation, such as network services or system services.
 <ref nist="CM-6, CM-7" />
 </Rule>
 </Group>
+
+
+<Rule id="service_restorecond_enabled">
+<title>Enable the SELinux Context Restoration Service (restorecond)</title>
+<description>The <tt>restorecond</tt> service utilizes <tt>inotify</tt> to look
+for the creation of new files listed in the
+<tt>/etc/selinux/restorecond.conf</tt> configuration file.  When a file is
+created, <tt>restorecond</tt> ensures that the file receives the proper SELinux
+security context.  The <tt>restorecond</tt> service can be enabled with the
+following command:
+<pre># chkconfig restorecond on</pre>
+</description>
+<rationale>The <tt>restorecond</tt> service helps ensure that the default SELinux
+file context is applied to files.  This allows automatic correction
+of file contexts created by some programs.</rationale>
+<ident cce="4129-3" />
+<oval id="service_restorecond_enabled" />
+<ref nist="AC-3, CM-6" />
+</Rule>
+
+
 <!--
 <Group id="selinux_daemons">
 <title>Disable Unnecessary SELinux Daemons</title>
-- 
1.7.1



More information about the scap-security-guide mailing list