[PATCH] brought WiFi prose into the present day * removed disabling WiFi from common Profile, added to server Profile * also added many line breaks

Jeffrey Blank blank at eclipse.ncsc.mil
Thu May 24 23:10:21 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/profiles/common.xml         |    1 -
 rhel6/src/input/profiles/server.xml         |    1 +
 rhel6/src/input/system/network/network.xml  |   36 +++++++++++++++++-----
 rhel6/src/input/system/network/wireless.xml |   43 +++++++++++++++++---------
 4 files changed, 56 insertions(+), 25 deletions(-)

diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index e7b3fe3..a28794e 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -63,7 +63,6 @@
 <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
-<select idref="deactivate_wireless_interfaces" selected="true"/>
 <select idref="disable_ipv6_module_loading" selected="true"/>
 <select idref="set_sysctl_ipv6_default_accept_redirects" selected="true"/>
 <select idref="enable_ip6tables" selected="true"/>
diff --git a/rhel6/src/input/profiles/server.xml b/rhel6/src/input/profiles/server.xml
index ad808a7..c119ddb 100644
--- a/rhel6/src/input/profiles/server.xml
+++ b/rhel6/src/input/profiles/server.xml
@@ -1,6 +1,7 @@
 <Profile id="server" extends="common" xmlns="http://checklists.nist.gov/xccdf/1.1" >
 <title>Server Baseline</title>
 <description>This profile is for RHEL 6 acting as a server.</description>
+<select idref="deactivate_wireless_interfaces" selected="true"/>
 <select idref="disable_xwindows_with_runlevel" selected="true"/>
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <select idref="disable_dhcp_client" selected="true"/>
diff --git a/rhel6/src/input/system/network/network.xml b/rhel6/src/input/system/network/network.xml
index ad07930..a90b142 100644
--- a/rhel6/src/input/system/network/network.xml
+++ b/rhel6/src/input/system/network/network.xml
@@ -16,23 +16,37 @@ networks.</description>
 
 <Rule id="network_disable_unused_interfaces">
 <title>Disable Unused Interfaces</title>
-<description>If the system does not require network communications but still needs to use the loopback interface, remove all files of the form <tt>ifcfg-interface</tt> except for <tt>ifcfg-lo</tt> from <tt>/etc/sysconfig/network-scripts</tt>:
+<description>If the system does not require network communications but still
+needs to use the loopback interface, remove all files of the form
+<tt>ifcfg-interface</tt> except for <tt>ifcfg-lo</tt> from
+<tt>/etc/sysconfig/network-scripts</tt>:
 <pre># rm /etc/sysconfig/network-scripts/ifcfg-interface</pre>
-If the system is a standalone machine with no need for network access or even communication over the loopback device, then disable this service with the following:
+If the system is a standalone machine with no need for network access or even
+communication over the loopback device, then disable this service with the
+following command:
 <pre># chkconfig network off</pre>
 </description>
-<rationale>The network interfaces expand the attack surface of a system. If they are not needed they should be disabled.</rationale>
+<rationale>The network interfaces expand the attack surface of a system.
+Although unusual, if they are not needed they should be disabled.
+</rationale>
 <!--<ident cce="TODO" />-->
 <!--TODO:MANUAL<oval id="network_disable_unused_interfaces" />-->
-<ref nist="CM-6, CM-7" />
-</Rule>
+<ref nist="CM-6, CM-7" /> </Rule>
 
 <Rule id="network_disable_zeroconf">
 <title>Disable Zeroconf Networking</title>
-<description>Zeroconf networking allows the system to assign itself an IP address and engage in IP communication without a statically-assigned address or even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not recommended. To disable Zeroconf automatic route assignment in the 169.245.0.0 subnet, add or correct the following line in <tt>/etc/sysconfig/network</tt>:
+<description>Zeroconf networking allows the system to assign itself an IP
+address and engage in IP communication without a statically-assigned address or
+even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not
+recommended. To disable Zeroconf automatic route assignment in the 169.245.0.0
+subnet, add or correct the following line in <tt>/etc/sysconfig/network</tt>:
 <pre>NOZEROCONF=yes</pre>
 </description>
-<rationale>Zeroconf addresses are in the network 169.254.0.0. The networking scripts add entries to the system’s routing table for these addresses. Zeroconf address assignment commonly occurs when the system is configured to use DHCP but fails to receive an address assignment from the DHCP server.</rationale>
+<rationale>Zeroconf addresses are in the network 169.254.0.0. The networking
+scripts add entries to the system’s routing table for these addresses. Zeroconf
+address assignment commonly occurs when the system is configured to use DHCP
+but fails to receive an address assignment from the DHCP server.
+</rationale>
 <ident cce="CCE-14054-1" />
 <oval id="sysconfig_nozeroconf_yes" />
 <ref nist="CM-6, CM-7" />
@@ -40,10 +54,14 @@ If the system is a standalone machine with no need for network access or even co
 
 <Rule id="network_sniffer_disabled">
 <title>Ensure System is Not Acting as a Network Sniffer</title>
-<description>The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected.  Run the following to determine if any interface is running in promiscuous mode:
+<description>The system should not be acting as a network sniffer, which can
+capture all traffic on the network to which it is connected.  Run the following
+to determine if any interface is running in promiscuous mode:
 <pre>$ ip link | grep PROMISC</pre>
 </description>
-<rationale>If any results are returned then a sniffing process (such as tcpdump or wireshark) is likely to be using the interface and this should be investigated.
+<rationale>If any results are returned then a sniffing process (such as tcpdump
+or wireshark) is likely to be using the interface and this should be
+investigated.
 </rationale>
 <ident cce="CCE-15013-6" />
 <oval id="network_sniffer_disabled" />
diff --git a/rhel6/src/input/system/network/wireless.xml b/rhel6/src/input/system/network/wireless.xml
index 923212a..b69f7be 100644
--- a/rhel6/src/input/system/network/wireless.xml
+++ b/rhel6/src/input/system/network/wireless.xml
@@ -1,22 +1,18 @@
 <Group id="network-wireless">
 <title>Wireless Networking</title>
 <description>Wireless networking (sometimes referred to as 802.11
-or Wi-Fi) presents a serious security risk to sensitive or
+or WiFi) can present a security risk to sensitive or
 classified systems and networks. Wireless networking hardware is
 much more likely to be included in laptop or portable systems than
-desktops or servers. See Section 3.3.14 for information on
-Bluetooth wireless support. Bluetooth serves a different purpose
-and possesses a much shorter range, but it still presents serious
-security risks.
+desktops or servers. 
 <br /><br />
-Removal of hardware is the only way to absolutely ensure that
-the wireless capability remains disabled. If it is completely
-impractical to remove the wireless hardware, and site policy still
-allows the device to enter sensitive spaces, every effort to
-disable the capability via software should be made. In general,
-acquisition policy should include provisions to prevent the
-purchase of equipment that will be used in sensitive spaces and
-includes wireless capabilities.</description>
+Removal of hardware provides the greatest assurance that the wireless
+capability remains disabled.  Acquisition policies often includes provisions to
+prevent the purchase of equipment that will be used in sensitive spaces and
+includes wireless capabilities.  If it is impractical to remove the wireless
+hardware, and policy permits the device to enter sensitive spaces, efforts
+should instead focus on disabling wireless capability via software.
+</description>
 
 <Group id="wireless_software">
 <title>Disable Wireless Through Software Configuration</title>
@@ -29,7 +25,14 @@ devices.</description>
 
 <Rule id="wireless_disable_in_bios">
 <title>Disable Wireless in BIOS</title>
-<description>Some systems that include built-in wireless support offer the ability to disable the device through the BIOS. This is system-specific; consult your hardware manual or explore the BIOS setup during boot.</description>
+<description>Some systems that include built-in wireless support offer the
+ability to disable the device through the BIOS. This is system-specific;
+consult your hardware manual or explore the BIOS setup during
+boot.</description>
+<rationale>Disabling wireless support in the BIOS prevents easy
+activation of the wireless interface, generally requiring administrators
+to reboot the system first.
+</rationale>
 <ident cce="3628-5" />
 <!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
 <ref nist="CM-7" />
@@ -56,6 +59,10 @@ disable the interface for future boots, remove the appropriate
 interface file from <tt>/etc/sysconfig/network-scripts</tt>:
 <pre># rm /etc/sysconfig/network-scripts/ifcfg-interface</pre>
 </description>
+<rationale>Wireless networking allows attackers within physical proximity to
+launch network-based attacks against systems, including those against local LAN
+protocols which were not designed with security in mind.
+</rationale>
 <ident cce="4276-2" />
 <oval id="wireless_disable_interfaces" />
 <ref nist="CM-7" />
@@ -63,9 +70,15 @@ interface file from <tt>/etc/sysconfig/network-scripts</tt>:
 
 <Rule id="wireless_disable_drivers">
 <title>Disable Wireless Drivers</title>
-<description>Removing the kernel drivers that provide support for wireless Ethernet devices will prevent users from easily activating the devices. To remove the wireless drivers from the system:
+<description>Removing the kernel drivers that provide support for wireless
+Ethernet devices will prevent users from easily activating the devices. To
+remove the wireless drivers from the system:
 <pre># rm -r /lib/modules/<i>kernelversion(s)</i>/kernel/drivers/net/wireless</pre>
 </description>
+<rationale>Removing the wireless kernel drivers makes it slightly more difficult for
+an administrator or malware to activate a wireless interface, by introducing
+the need to install such a driver first.
+</rationale>
 <warning category="general">This command must also be repeated every time the kernel is upgraded.</warning>
 <ident cce="4170-7" />
 <oval id="wireless_disable_drivers" />
-- 
1.7.1



More information about the scap-security-guide mailing list