Some notes on current guide after review

Steve Grubb sgrubb at redhat.com
Fri Oct 19 16:52:32 UTC 2012


Hello,

I was looking over the guide and found some things that may need attention.

2.3.6 - selinux unconfined check should also look for processes with inetd_t 
label - excluding xinetd itself. Am inetd_t label also indicates a daemon that 
has no policy for it.

2.4 - should a check exist to make sure the stated home dir exists?

2.4.2 - also need to look in /etc/libuser.conf for crypt_style and set it to 
SHA512.

2.4.2.4.a - error, has pam_tally2 instead of pam_faillock.

2.4.4.2.a - vlock no longer meets common criteria requirements. It now 
requires automatic screen locking after a timeout and reauthentication to 
unlock. This was accomplished with the screen program and some code in various 
shell startups.

2.5.8.2 - should it say RSA 2048 or higher and SHA2 hash? By 2014 this is 
mandatory. Also, probably beyond scope, keys needed for FIPS compliance should 
only be generated when the system is in FIPS mode to ensure the RNG passes its 
periodic test during key generation.

2.6? - Do we care about setting kernel.dmesg_restrict = 1 in a sysctl?

3.4.3.k - the approved ciphers in FIPS mode are:  "aes128-ctr, aes192-ctr, 
aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc". A subset of these 
are listed and I don't know if there was a reason why all of them are not 
allowed.

3.4.3.l Would you want to add FIPS approved MACs? If so they are: "hmac-sha1" 
and/or “hmac-sha1-96”.  A SHA2 HMAC might be added in the future, but its 
undetermined yet.


I have not looked at the daemon setting in detail yet.

Thanks,
-Steve


More information about the scap-security-guide mailing list