[PATCH 8/8] comprehensive content (and some copy) editing to XCCDF in system/ directory

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Oct 9 15:09:37 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/services/base.xml                      |    2 +-
 RHEL6/input/system/accounts/banners.xml            |   34 ++++++--
 RHEL6/input/system/accounts/pam.xml                |   75 +++++++++++------
 RHEL6/input/system/accounts/physical.xml           |   18 ++--
 .../accounts/restrictions/password_expiration.xml  |   11 +--
 .../system/accounts/restrictions/root_logins.xml   |   89 +++++---------------
 RHEL6/input/system/auditing.xml                    |   20 ++--
 RHEL6/input/system/permissions/files.xml           |   18 ++++-
 RHEL6/input/system/selinux.xml                     |   16 ++--
 RHEL6/input/system/software/integrity.xml          |    6 +-
 RHEL6/input/system/software/updating.xml           |   24 ++++--
 11 files changed, 170 insertions(+), 143 deletions(-)

diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index eba13df..d3e32a6 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -37,7 +37,7 @@ programs.
 <rationale>ACPI support is highly desirable for systems in some network roles,
 such as laptops or desktops. For other systems, such as servers, it may permit
 accidental or trivially achievable denial of service situations and disabling
-it may be prudent.</rationale>
+it is appropriate.</rationale>
 <ident cce="4298-6" />
 <oval id="service_acpid_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
index 9e3439b..eadaa41 100644
--- a/RHEL6/input/system/accounts/banners.xml
+++ b/RHEL6/input/system/accounts/banners.xml
@@ -41,19 +41,41 @@ be expressed by the '\n' character.</description>
 The contents of the file <tt>/etc/issue</tt> are
 displayed on the screen just above the login prompt for users
 logging directly into a terminal. Remote login programs such as
-SSH or FTP can be configured to display <tt>/etc/issue</tt> as well.
-Instructions for configuring these daemons are available later.
+SSH or FTP can be configured to display <tt>/etc/issue</tt>, and
+instructions for configuring these daemons is available elsewhere in this guidance.
 <br /><br />
 By default, the system will display the version of the OS,
 the kernel version, and the host name.
 <br /><br />
 Edit <tt>/etc/issue</tt>. Replace the default text with a message
 compliant with the local site policy or a legal disclaimer.
-<!--<sub idref="login_banner_text" />-->
+
+The DoD required text is either:<br/>
+You are accessing a U.S. Government (USG) Information System (IS) that is
+provided for USG-authorized use only. By using this IS (which includes any
+device attached to this IS), you consent to the following conditions: -The USG
+routinely intercepts and monitors communications on this IS for purposes
+including, but not limited to, penetration testing, COMSEC monitoring, network
+operations and defense, personnel misconduct (PM), law enforcement (LE), and
+counterintelligence (CI) investigations. -At any time, the USG may inspect and
+seize data stored on this IS. -Communications using, or data stored on, this IS
+are not private, are subject to routine monitoring, interception, and search,
+and may be disclosed or used for any USG-authorized purpose. -This IS includes
+security measures (e.g., authentication and access controls) to protect USG
+interests- -not for your personal benefit or privacy. -Notwithstanding the
+above, using this IS does not constitute consent to PM, LE or CI investigative
+searching or monitoring of the content of privileged communications, or work
+product, related to personal representation or services by attorneys,
+psychotherapists, or clergy, and their assistants. Such communications and work
+product are private and confidential. See User Agreement for details. 
+<br/>
+or:
+<br/>
+I've read &amp; consent to terms in IS user agreement.
 </description>
-<ocil clause="it does not display a message compliant with the environment">
-To ensure the system login banner is compliant with the needs of the system environment,
- run the following command:
+<ocil clause="it does not display the required banner">
+To check if the system login banner is compliant,
+run the following command:
 <pre>$ cat /etc/issue</pre>
 </ocil>
 <rationale>
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 8b6d7e0..5f10315 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -176,15 +176,21 @@ operator="equals" interactive="0">
 
 <Rule id="password_retry">
 <title>Set Password Retry Prompts Permitted Per-session</title>
-<description>The pam_cracklib module's <tt>retry=</tt> parameter controls how many times a program
-will re-prompt a user after an incorrect password entry, on a per-session basis.  To configure this, open:
-<pre>/etc/pam.d/system-auth</pre>
-Locate the <tt>retry=</tt> parameter, the DoD required value is 3.
+<description>The pam_cracklib module's <tt>retry=</tt> parameter
+controls how many times a program will re-prompt a user after an incorrect
+password entry, on a per-session basis.  To configure this, open
+<tt>/etc/pam.d/system-auth</tt> and locate the <tt>retry=</tt> parameter for
+<tt>pam_cracklib</tt> in the <tt>password</tt> portion of the PAM stack.
+The system default is 3.  
+The DoD required value is 3.
+Add or correct<tt>retry=3</tt> after pam_cracklib.so to allow 3 retries.
 </description>
 <ocil clause="it is not the required value">
-The system must disable after three consecutive and unsuccessful login attempts.
-To ensure this is the case, run the following command:
-<pre>$ grep retry /etc/pam.d/system-auth</pre>
+To check how many retry attempts are permitted on a per-session basis, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>retry</tt> parameter will indicate how many attempts are permitted.
+The DoD required value is 3.
+This would appear as <tt>retry=3</tt>.
 </ocil>
 <rationale>
 Setting the password retry prompts that are permitted on a per-session basis to a low value
@@ -199,15 +205,18 @@ is different from account lockout, which is provided by the pam_faillock module.
 
 <Rule id="password_require_digits">
 <title>Set Password Strength Minimum Digit Characters</title>
-<description>The pam_cracklib module's <tt>dcredit=</tt> parameter controls requirements for
+<description>The pam_cracklib module's <tt>dcredit</tt> parameter controls requirements for
 usage of digits in a password. When set to a negative number, any password will be required to
 contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional
-length credit for each digit.
+length credit for each digit.  
+Add <tt>dcredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords.
 </description>
-<ocil clause="it is not the required value">
+<ocil clause="dcredit is not found or not set to the required value">
+To check how many digits are required in a password, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>dcredit</tt> parameter (as a negative number) will indicate how many digits are required.
 The DoD requires at least one digit in a password.
-To verify this requirement is being met, run the following command:
-<pre>$ grep dcredit /etc/pam.d/system-auth</pre>
+This would appear as <tt>dcredit=-1</tt>.
 </ocil>
 <rationale>
 Requiring digits makes password guessing attacks more difficult by ensuring a larger
@@ -224,11 +233,14 @@ search space.
 usage of uppercase letters in a password. When set to a negative number, any password will be required to
 contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each uppercase character.
+Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords.
 </description>
-<ocil clause="it is not the required value">
+<ocil clause="ucredit is not found or not set to the required value">
+To check how many uppercase characters are required in a password, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>ucredit</tt> parameter (as a negative number) will indicate how many uppercase characters are required.
 The DoD requires at least one uppercase character in a password.
-To verify this requirement is being met, run the following command:
-<pre>$ grep ucredit /etc/pam.d/system-auth</pre>
+This would appear as <tt>ucredit=-1</tt>.
 </ocil>
 <rationale>
 Requiring a minimum number of uppercase characters makes password guessing attacks
@@ -245,11 +257,14 @@ more difficult by ensuring a larger search space.
 usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to
 contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each special character.
+Add <tt>ocredit=-1</tt> after pam_cracklib.so to require use of a special character in passwords.
 </description>
-<ocil clause="it is not the required value">
+<ocil clause="ocredit is not found or not set to the required value">
+To check how many special characters are required in a password, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>ocredit</tt> parameter (as a negative number) will indicate how many special characters are required.
 The DoD requires at least one special character in a password.
-To verify this requirement is being met, run the following command:
-<pre>$ grep ocredit /etc/pam.d/system-auth</pre>
+This would appear as <tt>ocredit=-1</tt>.
 </ocil>
 <rationale>
 Requiring a minimum number of special characters makes password guessing attacks
@@ -266,11 +281,14 @@ more difficult by ensuring a larger search space.
 usage of lowercase letters in a password. When set to a negative number, any password will be required to
 contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each lowercase character.
+Add <tt>lcredit=-1</tt> after pam_cracklib.so to require use of a lowercase character in passwords.
 </description>
-<ocil clause="it is not the required value">
+<ocil clause="lcredit is not found or not set to the required value">
+To check how many lowercase characters are required in a password, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>lcredit</tt> parameter (as a negative number) will indicate how many special characters are required.
 The DoD requires at least one lowercase character in a password.
-To verify this requirement is being met, run the following command:
-<pre>$ grep lcredit /etc/pam.d/system-auth</pre>
+This would appear as <tt>lcredit=-1</tt>.
 </ocil>
 <rationale>
 Requiring a minimum number of lowercase characters makes password guessing attacks
@@ -283,13 +301,18 @@ more difficult by ensuring a larger search space.
 
 <Rule id="password_require_diffchars">
 <title>Set Password Strength Minimum Different Characters</title>
-<description>The pam_cracklib module's <tt>difok=</tt> parameter controls requirements for
+<description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
 usage of different characters during a password change.
+Add <tt>difok=<i>NUM</i></tt> after pam_cracklib.so to require differing
+characters when changing passwords, substituting <i>NUM</i> appropriately.
+The DoD requirement is 4.
 </description>
-<ocil clause="it is not the required value">
-During a password change, the DoD requires at least four characters be different between the old and new passwords.
-To verify this requirement is being met, run the following command:
-<pre>$ grep difok /etc/pam.d/system-auth</pre>
+<ocil clause="difok is not found or not set to the required value">
+To check how many characters must differ during a password change, run the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>difok</tt> parameter will indicate how many characters must differ.
+The DoD requires 4 character differ during a password change.
+This would appear as <tt>difok=4</tt>.
 </ocil>
 <rationale>
 Requiring a minimum number of different characters during password changes ensures that
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 0868d30..0696298 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -48,9 +48,9 @@ Only root should be able to modify important boot parameters.
 <description>The file <tt>/etc/grub.conf</tt> is a symbolic link to
 <tt>/boot/grub/grub.conf</tt> which should be group-owned by the <tt>root</tt>
 group to prevent destruction or modification of the file.
-<filegroupowner-desc-macro file="/boot/grub/grub.conf" owner="root"/>
+<filegroupowner-desc-macro file="/boot/grub/grub.conf" group="root"/>
 </description>
-<ocil><filegroupowner-check-macro file="/boot/grub/grub.conf" owner="root"/></ocil>
+<ocil><filegroupowner-check-macro file="/boot/grub/grub.conf" group="root"/></ocil>
 <rationale>
 The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this
 file should not have any access privileges anyway.
@@ -64,9 +64,9 @@ file should not have any access privileges anyway.
 <title>Verify /boot/grub/grub.conf Permissions</title>
 <description>File permissions for <tt>/boot/grub/grub.conf</tt> should be set to 600, which
 is the default.
-<fileperms-desc-macro file="/boot/grub/grub.conf" owner="600"/>
+<fileperms-desc-macro file="/boot/grub/grub.conf" perms="600"/>
 </description>
-<ocil><fileperms-check-macro file="/boot/grub/grub.conf" owner="-rw-------"/></ocil>
+<ocil><fileperms-check-macro file="/boot/grub/grub.conf" perms="-rw-------"/></ocil>
 <rationale>
 Proper permissions ensure that only the root user can modify important boot
 parameters.
@@ -120,7 +120,7 @@ file <tt>/etc/sysconfig/init</tt>:
 <pre>SINGLE=/sbin/sulogin</pre>
 </description>
 <ocil clause="the output is different">
-To ensure authentication is required for single-user mode, run the following command:
+To check if authentication is required for single-user mode, run the following command:
 <pre>$ grep SINGLE /etc/sysconfig/init</pre>
 The output should be:
 <pre>SINGLE=/sbin/sulogin</pre>
@@ -150,8 +150,8 @@ set of services which are started on boot.
 <ocil clause="it does not">
 To check whether interactive boot is disabled, run the following command:
 <pre>$ grep PROMPT /etc/sysconfig/init</pre>
-The output should show:
-<pre>PROMPT=yes</pre>
+If interactive boot is disabled, the output will show:
+<pre>PROMPT=no</pre>
 </ocil>
 <rationale>
 Using interactive boot,
@@ -332,7 +332,9 @@ The <tt>-a</tt> option can be used to prevent switching to other
 virtual consoles.
 </description>
 <ocil clause="there is a command not found error">
-To check whether vlock has been installed, simply invoke the <tt>vlock</tt> command.
+To check whether vlock has been installed, run the following command:
+<pre>$ vlock</pre>
+If vlock is available, then the terminal will lock.
 </ocil>
 <rationale>
 Installing vlock ensures that a console locking capability is available
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index a464c4e..89643b7 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -116,6 +116,7 @@ and add or correct the following line, replacing <i>DAYS</i> appropriately:
 <pre>PASS_MIN_DAYS <i>DAYS</i></pre>
 A value of 1 day is considered for sufficient for many
 environments.
+The DoD requirement is 1. 
 </description>
 <ocil clause="it is not set to the required value">
 To check the minimum password age, run the command:
@@ -138,15 +139,15 @@ after satisfying the password reuse requirement.
 <description>To specify password maximum age for new accounts,
 edit the file <tt>/etc/login.defs</tt>
 and add or correct the following line, replacing <i>DAYS</i> appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i><!-- <sub idref="password_max_age_login_defs_value" /> --></pre>
+<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
 A value of 180 days is sufficient for many environments. 
 The DoD requirement is 60.
 </description>
 <ocil clause="it is not set to the required value">
 To check the maximum password age, run the command:
 <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-A value of 180 days is sufficient for many environments. 
 The DoD requirement is 60.
+A value of 180 days is sufficient for many environments. 
 </ocil>
 <rationale>
 Setting the password maximum age ensures that users are required to
@@ -165,16 +166,14 @@ location subject to physical compromise.</rationale>
 <description>To specify how many days prior to password
 expiration that a warning will be issued to users,
 edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line:
+ the following line, replacing <i>DAYS</i> appropriately:
 <pre>PASS_WARN_AGE <i>DAYS</i></pre>
-A value of 14 days is considered for appropriate for many
-environments.
+The DoD requirement is 7.
 <!-- <sub idref="password_warn_age_login_defs_value" /> -->
 </description>
 <ocil clause="it is not set to the required value">
 To check the password warning age, run the command:
 <pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
-A value of 7 days is sufficient for many environments. 
 The DoD requirement is 7.
 </ocil>
 <rationale>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 244bd4b..e234e7e 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -47,13 +47,11 @@ vc/3
 vc/4</pre>
 <!-- TODO: discussion/description of virtual consoles-->
 </description>
-<ocil clause="the user root hasn't been restricted from VCD's">To check for these entries from the command prompt, issue the
+<ocil clause="root login over virtual console devices is permitted">
+To check for virtual console entries which permit root login, run the
 following command:
 <pre># grep ^vc/[0-9] /etc/securetty</pre>
-If any values are returned, you need to remove them by manipulating the file.
-To remove any occurance of the virtual consoles in one command
-type the following:
-<pre># sed -i '/^vc/d' /etc/securetty</pre>
+If any output is returned, then root logins over virtual console devices is permitted.
 </ocil>
 <rationale>
 Preventing direct root login to virtual console devices
@@ -73,13 +71,11 @@ ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
 ttyS1</pre>
 <!-- TODO: discussion/description of serial port -->
 </description>
-<ocil clause="the user root hasn't been restricted from Serial Ports">To check for these entries from the command prompt,
-issue the following command:
+<ocil clause="root login over serial ports is permitted">
+To check for serial port entries which permit root login,
+run the following command:
 <pre># grep ^ttyS/[0-9] /etc/securetty</pre>
-If any values are returned, you need to remove them by manipulating
-the file. To remove any occurance of the virtual consoles in one
-command type the following:
-<pre># sed -i '/^ttyS/d' /etc/securetty</pre>
+If any output is returned, then root login over serial ports is permitted.
 </ocil>
 <rationale>
 Preventing direct root login to serial port interfaces
@@ -99,22 +95,21 @@ user of the system, and exist to perform some administrative
 function. Should an attacker be able to log into these accounts,
 he or she should not be granted access to a shell.
 <br /><br />
-Ensure that no shells are granted to system accounts.
-First, obtain a listing of all users,
-their UIDs, and their shells, by running:
+The login shell for each local account is stored in the last field of each line
+in <tt>/etc/passwd</tt>.  System accounts are those user accounts with a user ID less than
+500. The user ID is stored in the third field. 
+If any system account <i>SYSACCT</i> (other than root) has a login shell,
+disable it with the command:
+<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
+</description>
+<ocil clause="any system account (other than root) has a login shell">
+To obtain a listing of all users,
+their UIDs, and their shells, run the command:
 <pre>$ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd</pre>
 Identify the system accounts from this listing. These will
 primarily be the accounts with UID numbers less than 500, other
 than root.
-</description>
-<!--For each identified system account SYSACCT, lock the account:
-<pre># usermod -L SYSACCT</pre>-->
-<ocil clause="any SYSACCTs have a login shell">If any account <i>SYSACCT</i> has a login shell,
-disable it with the command:
-<pre># usermod -s /sbin/nologin SYSACCT</pre>
-The RHEL6 default is <tt>/sbin/nologin</tt>, but any command which will
-exit with a failure status and disallow execution of any further
-commands, such as <tt>/bin/false</tt> or <tt>/dev/null</tt>, will work.</ocil>
+</ocil>
 <rationale>
 Ensuring shells are not given to system accounts upon login
 makes it more difficult for attackers to make use of
@@ -138,18 +133,17 @@ If any account other than root has a UID of 0,
 this misconfiguration should be investigated and the
 accounts other than root should be removed or have their UID changed.
 </description>
-<ocil clause="any other accounts, other than root have an ID of 0">
-To list all password file entries for
-accounts with UID 0:
+<ocil clause="any account other than root has a UID of 0">
+To list all password file entries for accounts with UID 0:
 <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
 This should print only one line, for the user root.
 </ocil>
 <rationale>
 An account has root authority if it has a UID of 0. Multiple accounts
 with a UID of 0 afford more opportunity for potential intruders to
-guess a password for a provilieged account. Proper configuration of
-sudo is recommended to afford multiple System Administrators
-access to the root account.
+guess a password for a privileged account. Proper configuration of
+sudo is recommended to afford multiple system administrators
+access to root privileges in an accountable manner.
 </rationale>
 <ident cce="4009-7" />
 <oval id="accounts_no_uid_except_zero" />
@@ -158,40 +152,3 @@ access to the root account.
 
 </Group>
 
-<!-- Commenting the wheel/su items, since there may be little value/benefit
-in dictating others' account privilege choices.
-
-<Group id="wheel_group">
-<title>The wheel group should exist</title>
-<description>
-<ol>
-<li>Ensure that the group <tt>wheel</tt> exists, and that the usernames of
-all administrators who should be allowed to execute commands as
-root are members of that group.
-<pre># grep ^wheel /etc/group</pre>
-</li>
-<li>Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the
-line:
-<pre>auth required pam_wheel.so use_uid</pre>
-</li>
-</ol>The <tt>su</tt> command allows a user to gain the privileges of another
-user by entering the password for that user's account. It is
-desirable to restrict the root user so that only known
-administrators are ever allowed to access the root account. This
-restricts password-guessing against the root account by
-unauthorized users or by accounts which have been compromised.
-<br /><br />
-By convention, the group <tt>wheel</tt> contains all users who are
-allowed to run privileged commands. The PAM module <tt>pam_wheel.so</tt> is
-used to restrict root access to this set of users.</description>
-
-<Rule id="limit_su_to_wheel">
-<title>Limit /bin/su Access To Wheel Group</title>
-<description>Command access to the root account should be
-restricted to the <tt>wheel</tt> group.</description>
-<ident cce="15047-4" />
-<oval id="accounts_su_wheel_only" />
-<ref nist="AC-3, CM-6" />
-</Rule>
-</Group>
--->
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 8adcc8c..d9f40de 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -372,7 +372,7 @@ mode for corrective action.  For certain systems, the need for availability
 outweighs the need to log all actions, and a different setting should be
 determined.
 </description>
-<ocil clause="the system isn't properly configured to swtich to single user
+<ocil clause="the system isn't configured to switch to single user
 mode for corrective action">
 Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
 determine if the system is configured to switch to single user mode
@@ -472,7 +472,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules</pre>
 </description>
-<ocil clause="the system hasn't been properly set up to audit time changes, rules, or usage flags">
+<ocil clause="the system isn't configured to audit time changes">
 <audit-syscall-check-macro syscall="adjtimex" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
@@ -500,7 +500,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules</pre>
 </description>
-<ocil clause="the system hasn't been properly set up to audit time changes, rules, or usage flags">
+<ocil clause="the system isn't configured to audit time changes">
 <audit-syscall-check-macro syscall="settimeofday" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
@@ -526,7 +526,7 @@ See an example of multiple combined syscalls:
 <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules</pre>
 </description>
-<ocil clause="the system hasn't been properly set up to audit time changes, rules, or usage flags">
+<ocil clause="the system isn't configured to audit time changes">
 <audit-syscall-check-macro syscall="stime" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
@@ -554,7 +554,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules</pre>
 </description>
-<ocil clause="the system hasn't been properly set up to audit time changes, rules, or usage flags">
+<ocil clause="the system isn't configured to audit time changes">
 <audit-syscall-check-macro syscall="clock_settime" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
@@ -575,7 +575,7 @@ The -k option allows for the specification of a key in string form that can
 be used for better reporting capability through ausearch and aureport and
 should always be used.
 </description>
-<ocil clause="the system hasn't been properly set up to audit time rules logging">
+<ocil clause="the system isn't configured to audit time changes">
 To determine if the system is configured to audit attempts to
 alter time via the /etc/localtime file, run the following
 command:
@@ -604,7 +604,7 @@ to capture events that modify account changes:
 -w /etc/shadow -p wa -k audit_account_changes
 -w /etc/security/opasswd -p wa -k audit_account_changes</pre>
 </description>
-<ocil clause="the system hasn't been properly set up to audit (and log) account changes">
+<ocil clause="the system isn't configured to audit account changes">
 To determine if the system is configured to audit account changes,
 run the following command:
 <pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
@@ -631,7 +631,7 @@ ARCH to either b32 or b64 as appropriate for your system:
 -w /etc/hosts -p wa -k audit_network_modifications
 -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre>
 </description>
-<ocil clause="the system isn't congfigured to audit changes of the network configuration">
+<ocil clause="the system isn't configured to audit changes of the network configuration">
 To determine if the system is configured to audit changes to its network configuration,
 run the following command:
 <pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
@@ -652,7 +652,7 @@ audited.</rationale>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
 </description>
-<ocil clause="the system isn't properly set up to notify an admin when attemps to change the MAC tables occur">
+<ocil clause="the system isn't configured to audit attempts to change the MAC policy">
 To determine if the system is configured to audit changes to its SELinux
 configuration files, run the following command:
 <pre># auditctl -l | grep "dir=selinux"</pre>
@@ -716,7 +716,7 @@ If the system is 64 bit then also add the following:
 gain access to information that would otherwise be disallowed. Auditing DAC modifications
 can facilitate the identification of patterns of abuse amoung both authorized and
 unauthorized users.</rationale>
-<ocil clause="the system hasn't been properly set up to audit permission changes">
+<ocil clause="the system isn't configured to audit permission changes">
 <audit-syscall-check-macro syscall="fchmod" />
 </ocil>
 <warning category="general">Note that these rules can be configured in a 
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index ee509ad..cc9737e 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -182,7 +182,11 @@ by default:
 </pre>
 Kernel modules, which can be added to the kernel during runtime, are
 stored in <tt>/lib/modules</tt>. All files in these directories should not be
-group-writable or world-writable.
+group-writable or world-writable. 
+If any file <i>FILE</i> in these directories is found
+to be group-writable or world-writeable, correct its permission with the
+following command:
+<pre># chmod go-w <i>FILE</i></pre>
 </description>
 <ocil clause="any of the modules are group-writable">
 To find shared libraries that are group-writable or world-writable,
@@ -209,6 +213,10 @@ by default:
 Kernel modules, which can be added to the kernel during runtime, are also
 stored in <tt>/lib/modules</tt>.  All files in these directories should be
 owned by the <tt>root</tt> user.
+If any file <i>FILE</i> in these directories is found
+to be owned by a user other than root, correct its ownership with the
+following command:
+<pre># chown root <i>FILE</i></pre>
 </description>
 <ocil clause="any of the shared modules aren't owned by root">
 To find shared libraries that are not owned by <tt>root</tt>,
@@ -234,6 +242,10 @@ System executables are stored in the following directories by default:
 /usr/sbin
 /usr/local/sbin</pre>
 All files in these directories should not be group-writable or world-writable.
+If any file <i>FILE</i> in these directories is found
+to be group-writable or world-writeable, correct its permission with the
+following command:
+<pre># chmod go-w <i>FILE</i></pre>
 </description>
 <ocil clause="any system executables are found to be group, or world writable">
 To find system executables that are group-writable or world-writable,
@@ -258,6 +270,10 @@ System executables are stored in the following directories by default:
 /usr/sbin
 /usr/local/sbin</pre>
 All files in these directories should be owned by the <tt>root</tt> user.
+If any file <i>FILE</i> in these directories is found
+to be owned by a user other than root, correct its ownership with the
+following command:
+<pre># chown root <i>FILE</i></pre>
 </description>
 <ocil clause="any system executables are found to not be owned by root">
 To find system executables that are not owned by <tt>root</tt>,
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index b677ff6..4f899ed 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -89,9 +89,9 @@ and to protect the boot process.
 Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
 file to prevent SELinux from being being disabled at boot.
 </description>
-<ocil clause="SELinux is Disabled at boot time">
+<ocil clause="SELinux is disabled at boot time">
 Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
-in the kernel boot arguments.  Presences of <tt>selinux=0</tt> indicates
+in the kernel boot arguments.  Presence of <tt>selinux=0</tt> indicates
 that SELinux is disabled at boot time.
 </ocil>
 <rationale>
@@ -108,10 +108,10 @@ the chances that it will remain off during system operation.
 <title>Ensure SELinux State is Enforcing</title>
 <description>The SELinux state should be set to <tt>enforcing</tt> at
 system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
-line <tt>SELINUX=enforcing</tt> to configure the system to boot into enforcing
-mode.
+following line to configure the system to boot into enforcing mode:
+<pre>SELINUX=enforcing</pre>
 </description>
-<ocil clause="SELINUX=enforcing is not set properly">
+<ocil clause="SELINUX is not set to enforcing">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
 <pre>SELINUX=enforcing</pre>
 </ocil>
@@ -137,7 +137,7 @@ Other policies, such as <tt>mls</tt>, provide additional security labeling
 and greater confinement but are not compatible with many general-purpose
 use cases.
 </description>
-<ocil clause="SELINUX=targeted is not set properly">
+<ocil clause="it does not">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
 <pre>SELINUXTYPE=targeted</pre>
 </ocil>
@@ -232,9 +232,9 @@ or allow privileges that the daemon does not require.
 <description>Device files are used for communication with important system resources.
 SELinux contexts should exist for these.  By checking for <tt>unlabeled_t</tt> file
 contexts, we can determine if the system is optimally configured.</description>
-<ocil clause="unlabeled_t file contexts exist">To check for unlabeled device files, run the following command in
+<ocil clause="there is output">To check for unlabeled device files, run the following command in
 the directory that you want to check the SELinux contexts:
-<pre># ls -Z | grep unlabeled_t</pre>
+<pre># ls -Z /dev | grep unlabeled_t</pre>
 It should produce no output in a well-configured system.</ocil>
 <rationale>
 If a device file is not labeled, then misconfiguration is likely.
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 3a2e4cf..28781e2 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -31,7 +31,9 @@ configurable, with further configuration information located in
 Install the AIDE package with the command:
 <pre># yum install aide</pre>
 </description>
-<ocil><package-check-macro package="aide"/></ocil>
+<ocil clause="the package is not installed">
+<package-check-macro package="aide"/>
+</ocil>
 <rationale>
 The AIDE package must be installed if it is to be available for integrity checking.
 </rationale>
@@ -174,7 +176,7 @@ A "c" in the second column indicates that a file is a configuration file,
 which may appropriately be expected to change.
 </description>
 <rationale>
-The MD5 hash on important files like system executables should match the information given
+The hash on important files like system executables should match the information given
 by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity
 on the system.</rationale>
 <ident cce="TODO" />
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index a89cab4..8d732ef 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -101,17 +101,23 @@ protects against malicious tampering.
 
 <Rule id="security_patches_up_to_date">
 <title>Ensure Software Patches Installed</title>
-<description>The following command prints a list of packages that
-need to be updated:
-<pre># yum check-update</pre>
-To actually install these updates, run:
+<description>If the system is joined to the Red Hat Network, a Red Hat Satellite Server,
+or a yum server, run the following command to install updates:
 <pre># yum update</pre>
+If the system is not configured to use one of these sources, updates (in the form of RPM packages)
+can be manually downloaded from the Red Hat Network and installed using <tt>rpm</tt>.
 </description>
-<ocil clause="Updates are not installed">
-After running the update command, invoking the update command again can be used
-to determine success of the updates. If nothing is returned, the update was
-successful.
-<pre># yum update</pre>
+<ocil clause="updates are not installed">
+If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or
+a yum server which provides updates, invoking the following command will
+indicate if updates are available:
+<pre># yum check-update</pre>
+If the system is not configured to update from one of these sources,
+run the following command to list when each package was last updated:
+<pre>$ rpm -qa -last</pre>
+Compare this to Red Hat Security Advisories (RHSA) listed at 
+https://access.redhat.com/security/updates/active/
+to determine if the system is missing applicable updates.
 </ocil>
 <rationale>
 Installing software updates is a fundamental mitigation against
-- 
1.7.1



More information about the scap-security-guide mailing list