[PATCH] additional rationale entries and added check text for ftp logging

David Smith dsmith at eclipse.ncsc.mil
Wed Oct 24 12:31:51 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/ftp.xml             |   13 +++++++++++++
 RHEL6/input/services/ldap.xml            |    1 +
 RHEL6/input/services/nfs.xml             |    3 +++
 RHEL6/input/services/xorg.xml            |    2 ++
 RHEL6/input/system/permissions/files.xml |    8 ++++++++
 5 files changed, 27 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 4b80424..f15fa65 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -82,6 +82,19 @@ and for consistency with future Red Hat releases, the use of vsftpd is recommend
 xferlog_std_format=NO
 log_ftp_protocol=YES</pre>
 </description>
+<ocil clause="xferlog_enable is missing, or is not set to yes">
+Find if logging is applied to the ftp daemon.
+<br/><br/>
+Procedures:
+<br/><br/>
+If vsftpd is started by xinetd:
+<pre># grep vsftpd /etc/xinetd.d/*</pre>
+This will indicate the xinetd.d startup file.
+<pre># grep server_args <i>vsftpd xinetd.d startup file</i></pre>
+This will indicate the vsftpd config file used when starting through xinetd.
+If the line is missing, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
+<pre># grep xferlog_enable <i>vsftpd config file</i></pre>
+</ocil>
 <rationale>The modifications above ensure that all commands sent to the ftp server are logged using the verbose vsftpd log
 format. The default vsftpd log file is /var/log/vsftpd.log.</rationale>
 <warning category="general">If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log</warning>
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index bdb51fb..1ed2b6f 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -96,6 +96,7 @@ run the following command:
 The output should show:
 <pre>package openldap-servers is not installed</pre>
 </ocil>
+<rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale>
 <ident cce="3501-4" />
 <oval id="package_openldap-servers_removed" />
 <ref nist="CM-6, CM-7" disa="366"/>
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index 70e37e9..6e75440 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -299,6 +299,7 @@ To verify that the <tt>nfs</tt> service is disabled, run the following command:
 If properly configured, the output should look like:
 <pre>nfs            	0:off	1:off	2:off	3:off	4:off	5:off	6:off</pre>
 </ocil>
+<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
 <ident cce="4473-5" />
 <oval id="service_nfs_disabled" />
 </Rule>
@@ -314,6 +315,8 @@ RPC then this service should be disabled.
 <ocil>
 <service-disable-check-macro service="rpcsvcgssd" />
 </ocil>
+<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
+<ident cce="4473-5" />
 <ident cce="4491-7" />
 <oval id="service_rpcsvcgssd_disabled" />
 </Rule>
diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
index e8a2229..6f68b8c 100644
--- a/RHEL6/input/services/xorg.xml
+++ b/RHEL6/input/services/xorg.xml
@@ -26,6 +26,7 @@ To verify that the default runlevel is 3, run the following command:
 The output should show the following:
 <pre>id:3:initdefault:</pre>
 </ocil>
+<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
 <ident cce="4462-8" />
 <oval id="xwindows_runlevel_setting" />
 <ref disa="366" />
@@ -45,6 +46,7 @@ To ensure the X Windows package group is removed, run the following command:
 The output should be:
 <pre>package xorg-x11-server-common is not installed</pre>
 </ocil>
+<rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale>
 <ident cce="4422-2" />
 <oval id="package_xorg-x11-server-common_removed" />
 <ref disa="366" />
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 4e1c45c..484e14e 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -315,6 +315,14 @@ following command:
 To find world-writable directories that lack the sticky bit, run the following command:
 <pre># find / -type d -perm 002 ! -perm 1000</pre>
 </ocil>
+<rationale>
+Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.
+<br/><br/>
+The only authorized public directories are those temporary directories supplied with the system, 
+or those designed to be temporary file repositories.  The setting is normally reserved for directories 
+used by the system, and by users for temporary file storage - such as /tmp - 
+and for directories requiring global read/write access.
+</rationale>
 <ident cce="3399-3" />
 <oval id="dir_perms_world_writable_sticky_bits" />
 <ref nist="CM-6"/>
-- 
1.7.1



More information about the scap-security-guide mailing list