[PATCH 2/4] cleanup of prose for sysctl network parameter settings * expurgated weird CCE description text * introduced usage of new macros for XCCDF sysctl description

Jeffrey Blank blank at eclipse.ncsc.mil
Sun Jun 24 20:41:04 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/system/network/kernel.xml |  242 ++++++++++++++---------------
 rhel6/src/transforms/shorthand2xccdf.xslt |   15 ++
 2 files changed, 135 insertions(+), 122 deletions(-)

diff --git a/rhel6/src/input/system/network/kernel.xml b/rhel6/src/input/system/network/kernel.xml
index 9a3baca..a9eebd8 100644
--- a/rhel6/src/input/system/network/kernel.xml
+++ b/rhel6/src/input/system/network/kernel.xml
@@ -1,46 +1,50 @@
 <Group id="network-kernel">
 <title>Kernel Parameters Which Affect Networking</title>
-<description>The <tt>sysctl</tt> utility is used to set a number of
-parameters which affect the operation of the Linux kernel. Several
-of these parameters are specific to networking, and the
-configuration options in this section are recommended.</description>
+<description>The <tt>sysctl</tt> utility is used to set
+parameters which affect the operation of the Linux kernel. Kernel parameters
+which affect networking and have security implications are described here.
+</description>
 
 <Group id="network_host_parameters">
 <title>Network Parameters for Hosts Only</title>
-<description>Is this system going to be used as a firewall or
-gateway to pass IP traffic between different networks?
-<br />If not, edit the file <tt>/etc/sysctl.conf</tt> and add or
-correct the following lines:
-<pre>net.ipv4.ip_forward = 0
-net.ipv4.conf.all.send_redirects = 0
-net.ipv4.conf.default.send_redirects = 0</pre>
-These settings disable hosts from performing network
-functionality which is only appropriate for routers.</description>
+<description>If the system is not going to be used as a router, then certain
+kernel parameters should be set to ensure that the host will not perform routing
+of network traffic.</description>
 
 <Rule id="disable_sysctl_ipv4_default_send_redirects">
-<title>Disable net.ipv4.conf.default.send_redirects Kernel Runtime Parameter</title>
-<description>The default setting for sending ICMP redirects should
-be disabled for network interfaces.</description>
-<rationale>This setting is only appropriate for routers and it should be disabled on all other systems.</rationale>
+<title>Disable Kernel Parameter for Sending ICMP Redirects by Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
+</description>
+<rationale>Sending ICMP redirects permits the system to instruct other systems
+to update their routing information.  The ability to send ICMP redirects is
+only appropriate for routers.</rationale>
 <ident cce="4151-7" />
 <oval id="sysctl_net_ipv4_conf_default_send_redirects" />
 <ref nist="AC-4, SC-5, SC-7" />
 </Rule>
 
 <Rule id="disable_sysctl_ipv4_all_send_redirects">
-<title>Disable net.ipv4.conf.all.send_redirects Kernel Runtime Parameter</title>
-<description>Sending ICMP redirects should be disabled for all interfaces.</description>
-<rationale>This setting is only appropriate for routers and it should be disabled on all other systems.</rationale>
+<title>Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
+</description>
+<rationale>Sending ICMP redirects permits the system to instruct other systems
+to update their routing information.  The ability to send ICMP redirects is
+only appropriate for routers.</rationale>
 <ident cce="4155-8" />
 <oval id="sysctl_net_ipv4_conf_all_send_redirects" />
 <ref nist="CM-6" />
 </Rule>
 
 <Rule id="disable_sysctl_ipv4_ip_forward">
-<title>Disable net.ipv4.ip_forward Kernel Runtime Parameter</title>
-<description>IP forwarding should be disabled.</description>
-<rationale>The ability to forward packets between two networks is only appropriate for routers. This setting
-should be disabled on all other systems.</rationale>
+<title>Disable Kernel Parameter for IP Forwarding</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
+</description>
+<rationale>IP forwarding permits the kernel to forward packets from one network
+interface to another. The ability to forward packets between two networks is
+only appropriate for routers.</rationale>
 <ident cce="3561-8" />
 <oval id="sysctl_net_ipv4_ip_forward" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" />
@@ -48,24 +52,10 @@ should be disabled on all other systems.</rationale>
 </Group>
 
 <Group id="network_host_and_router_parameters">
-<title>Set Network Related Kernel Runtime Parameters</title>
-<description>Edit the file <tt>/etc/sysctl.conf</tt> and add or correct the
-following lines:
-<pre>net.ipv4.conf.all.accept_source_route = 0
-net.ipv4.conf.all.accept_redirects = 0
-net.ipv4.conf.all.secure_redirects = 0
-net.ipv4.conf.all.log_martians = 1
-net.ipv4.conf.default.accept_source_route = 0
-net.ipv4.conf.default.accept_redirects = 0
-net.ipv4.conf.default.secure_redirects = 0
-net.ipv4.icmp_echo_ignore_broadcasts = 1
-net.ipv4.icmp_ignore_bogus_error_messages = 1
-net.ipv4.tcp_syncookies = 1
-net.ipv4.conf.all.rp_filter = 1
-net.ipv4.conf.default.rp_filter = 1</pre>
-These options improve Linux's ability to defend against
-certain types of IPv4 protocol attacks.
-</description>
+<title>Network Related Kernel Runtime Parameters for Hosts and Routers</title>
+<description>Certain kernel parameters should be set for systems which are
+acting as either hosts or routers to improve the system's ability defend
+against certain types of IPv4 protocol attacks.</description>
 
 <Value id="sysctl_net_ipv4_conf_all_accept_source_route_value" type="string"
 operator="equals" interactive="0">
@@ -151,11 +141,10 @@ via broadcast/multicast</description>
 </Value>
 
 
-<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" type="string"
+<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="string"
 operator="equals" interactive="0">
-<title>net.ipv4.icmp_ignore_bogus_error_messages</title>
-<description>Enable to prevent certain types of
-attacks</description>
+<title>net.ipv4.icmp_ignore_bogus_error_responses</title>
+<description>Enable to prevent unnecessary logging</description>
 <value selector="">1</value>
 <value selector="enabled">1</value>
 <value selector="disabled">0</value>
@@ -197,11 +186,11 @@ operator="equals" interactive="0">
 </Value>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_accept_source_route">
-<title>Set net.ipv4.conf.all.accept_source_route Kernel Runtime Parameter</title>
-<description>Accepting source routed packets should be:
-<sub idref="sysctl_net_ipv4_conf_all_accept_source_route_value" />for all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
+</description>
+<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4236-6" />
 <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
@@ -209,11 +198,11 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_accept_redirects">
-<title>Set net.ipv4.conf.all.accept_redirects Kernel Runtime Parameter</title>
-<description>Accepting ICMP redirects should be:
-<sub idref="sysctl_net_ipv4_conf_all_accept_redirects_value" />for all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
+</description>
+<rationale>Accepting ICMP redirects has few legitimate
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4217-6" />
 <oval id="sysctl_net_ipv4_conf_all_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
@@ -222,26 +211,27 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 
 
 <Rule id="set_sysctl_net_ipv4_conf_all_secure_redirects">
-<title>Set net.ipv4.conf.all.secure_redirects Kernel Runtime Parameter</title>
-<description>Accepting "secure" ICMP redirects (those from gateways
-listed in the default gateways list) should be:
-<sub idref="sysctl_net_ipv4_conf_all_secure_redirects_value" />for all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
-uses. It should be disabled unless it is absolutely required.</rationale>
+<title>Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
+</description>
+<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
+default gateways) has few legitimate uses. It should be disabled unless it is
+absolutely required.</rationale>
 <ident cce="3472-8" />
 <oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
 <ref nist="CM-7, AC-4" />
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_log_martians">
-<title>Set net.ipv4.conf.all.log_martians Kernel Runtime Parameter</title>
-<description>Logging of "martian" packets (those with impossible
-addresses) should be:
-<sub idref="sysctl_net_ipv4_conf_all_log_martians_value" />for all interfaces
-as appropriate.</description>
-<rationale>The presence of suspicious packets, such as spoofed packets, source-routed packets, and redirects
-could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.</rationale>
+<title>Enable Kernel Parameter to Log Martian Packets</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
+</description>
+<rationale>The presence of "martian" packets (which have impossible addresses)
+as well as spoofed packets, source-routed packets, and redirects could be a
+sign of nefarious network activity. Logging these packets enables this activity
+to be detected.</rationale>
 <ident cce="4320-8" />
 <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
 <ref nist="CM-7" />
@@ -249,12 +239,11 @@ could be a sign of nefarious network activity. Logging these packets enables thi
 
 
 <Rule id="set_sysctl_net_ipv4_conf_default_accept_source_route">
-<title>Set net.ipv4.conf.default.accept_source_route Kernel Runtime Parameter</title>
-<description>The default setting for accepting source routed
-packets should be:
-<sub idref="sysctl_net_ipv4_conf_default_accept_source_route_value" />for all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting Source-Routed Packets By Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
+</description>
+<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4091-5" />
 <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
@@ -263,11 +252,10 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 
 
 <Rule id="set_sysctl_net_ipv4_conf_default_accept_redirects">
-<title>Set net.ipv4.conf.default.accept_redirects Kernel Runtime Parameter</title>
-<description>The default setting for accepting ICMP redirects
-should be:
-<sub idref="sysctl_net_ipv4_conf_default_accept_redirects_value" />for all interfaces
-as appropriate.</description>
+<title>Disable Kernel Parameter for Accepting ICMP Redirects By Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
+</description>
 <rationale>This feature of the IPv4 protocol has few legitimate
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4186-3" />
@@ -277,14 +265,13 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 
 
 <Rule id="set_sysctl_net_ipv4_conf_default_secure_redirects">
-<title>Set net.ipv4.conf.default.secure_redirects Kernel Runtime Parameter</title>
-<description>The default setting for accepting "secure" ICMP
-redirects (those from gateways listed in the default gateways list)
-should be:
-<sub idref="sysctl_net_ipv4_conf_default_secure_redirects_value" />for all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
-uses. It should be disabled unless it is absolutely required.</rationale>
+<title>Disable Kernel Parameter for Accepting Secure Redirects By Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
+</description>
+<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
+default gateways) has few legitimate uses. It should be disabled unless it is
+absolutely required.</rationale>
 <ident cce="3339-9" />
 <oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
 <ref nist="AC-4, SC-5, SC-7" />
@@ -292,62 +279,73 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 
 
 <Rule id="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts">
-<title>Set net.ipv4.icmp_echo_ignore_broadcasts Kernel Runtime Parameter</title>
-<description>Ignoring ICMP echo requests (pings) sent to broadcast
-/ multicast addresses should be:
-<sub idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting prevents attacks against the ICMP protocol.</rationale>
+<title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
+</description>
+<rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
+addresses makes the system slightly more difficult to enumerate on the network.
+</rationale>
 <ident cce="3644-2" />
 <oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" />
 </Rule>
 
 
-<Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages">
-<title>Set net.ipv4.icmp_ignore_bogus_error_messages Kernel Runtime Parameter</title>
-<description>Ignoring bogus ICMP responses to broadcasts should be:
-<sub idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting prevents attacks against the ICMP protocol.</rationale>
+<Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
+<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
+</description>
+<rationale>Ignoring bogus ICMP error responses reduces
+log size, although some activity would not be logged.</rationale>
 <ident cce="4133-5" />
-<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages" value="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" />
+<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" />
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_tcp_syncookies">
-<title>Set net.ipv4.tcp_syncookies Kernel Runtime Parameter</title>
-<description>Sending TCP syncookies should be:
-<sub idref="sysctl_net_ipv4_tcp_syncookies_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting enables a cryptographic feature called SYN cookies to allow machines to continue to
-accept legitimate connections when faced with a SYN flood attack.</rationale>
+<title>Enable Kernel Parameter to Use TCP Syncookies</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
+</description>
+<rationale> A TCP SYN flood attack can cause a denial of service by filling a
+system's TCP connection table with connections in the SYN_RCVD state.
+Syncookies can be used to track a connection when a subsequent ACK is received,
+verifying the initiator is attempting a valid connection and is not a flood
+source. This feature is activated when a flood condition is detected, and
+enables the system to continue servicing valid connection requests.
+</rationale>
 <ident cce="4265-5" />
 <oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
 <ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_rp_filter">
-<title>Set net.ipv4.conf.all.rp_filter Kernel Runtime Parameter</title>
-<description>Performing source validation by reverse path should
-be:
-<sub idref="sysctl_net_ipv4_conf_all_rp_filter_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting enables RFC-recommended source validation. It should not be used on machines which
-are routers for very complicated networks, but is helpful for end hosts and routers serving small networks.</rationale>
+<title>Enable Kernel Parameter to Use Reverse Path Filtering for All Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
+</description>
+<rationale>Enabling reverse path filtering drops packets with source addresses
+that should not have been able to be received on the interface they were
+received on. It should not be used on systems which are routers for
+complicated networks, but is helpful for end hosts and routers serving small
+networks.</rationale>
 <ident cce="4080-8" />
 <oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" />
 <ref nist="AC-4, SC-5, SC-7" />
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_default_rp_filter">
-<title>Set net.ipv4.conf.default.rp_filter Kernel Runtime Parameter</title>
-<description>The default setting for performing source validation
-by reverse path should be:
-<sub idref="sysctl_net_ipv4_conf_default_rp_filter_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting enables RFC-recommended source validation. It should not be used on machines which
-are routers for very complicated networks, but is helpful for end hosts and routers serving small networks.</rationale>
+<title>Enable Kernel Parameter to Use Reverse Path Filtering by Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
+</description>
+<rationale>Enabling reverse path filtering drops packets with source addresses
+that should not have been able to be received on the interface they were
+received on. It should not be used on systems which are routers for
+complicated networks, but is helpful for end hosts and routers serving small
+networks.</rationale>
 <ident cce="3840-6" />
 <oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" />
 <ref nist="AC-4, SC-5, SC-7" />
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt
index 0ef3222..c975973 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -162,6 +162,21 @@ exclude-result-prefixes="xccdf xhtml">
     </xsl:copy>
   </xsl:template>
 
+
+
+  <!-- convenience macros for XCCDF prose -->
+  <xsl:template match="sysctl-desc-macro">
+    The status of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried
+    by running the following command:
+    <xhtml:pre>$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>
+    The output of the command should indicate a value of <xhtml:code><xsl:value-of select="@value"/></xhtml:code>.
+  </xsl:template>
+
+  <xsl:template match="service-disable-macro">
+    The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command:
+    <xhtml:pre># chkconfig <xsl:value-of select="@service"/> off</xhtml:pre>
+  </xsl:template>
+
   <!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
   <!-- (expanding xhtml tags back into the xhtml namespace) -->
   <xsl:template match="br">
-- 
1.7.1



More information about the scap-security-guide mailing list