[PATCH 1/2] more QA work

Shawn Wells shawn at redhat.com
Fri Oct 26 20:37:19 UTC 2012


On 10/26/12 12:53 PM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/services/obsolete.xml                  |   13 +++++++++++++
>   RHEL6/input/system/accounts/banners.xml            |    1 +
>   RHEL6/input/system/accounts/pam.xml                |    1 +
>   RHEL6/input/system/accounts/physical.xml           |    5 +++++
>   .../accounts/restrictions/password_expiration.xml  |    4 ++++
>   RHEL6/input/system/permissions/files.xml           |   13 +++++++++++++
>   6 files changed, 37 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
> index 4c8c7bf..3fe6bf6 100644
> --- a/RHEL6/input/services/obsolete.xml
> +++ b/RHEL6/input/services/obsolete.xml
> @@ -39,6 +39,7 @@ attacks against xinetd itself.
>   <ident cce="4252-3" />
>   <oval id="service_xinetd_disabled" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="uninstall_xinetd">
> @@ -54,6 +55,7 @@ xinetd service's accidental (or intentional) activation.
>   <ident cce="4164-0" />
>   <oval id="package_xinetd_removed" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   </Group>
> @@ -80,6 +82,7 @@ subject to man-in-the-middle attacks.
>   <ident cce="3390-2" />
>   <oval id="service_telnetd_disabled" />
>   <ref disa="1436,196,197" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="uninstall_telnet_server" severity="high">
> @@ -95,6 +98,7 @@ telnet service's accidental (or intentional) activation.
>   <ident cce="4330-7" />
>   <oval id="package_telnet-server_removed" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> @@ -121,6 +125,7 @@ activation.
>   <ident cce="4308-3" />
>   <oval id="package_rsh-server_removed" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="disable_rexec" severity="high">
> @@ -139,6 +144,7 @@ stolen by eavesdroppers on the network.
>   <ident cce="undefined" />
>   <oval id="service_rexec_disabled" />
>   <ref disa="1436"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="disable_rsh" severity="high">
> @@ -157,6 +163,7 @@ stolen by eavesdroppers on the network.
>   <ident cce="4141-8" />
>   <oval id="service_rsh_disabled" />
>   <ref disa="1436" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="disable_rlogin" severity="high">
> @@ -175,6 +182,7 @@ stolen by eavesdroppers on the network.
>   <ident cce="3537-8" />
>   <oval id="service_rlogin_disabled" />
>   <ref disa="1436" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="no_rsh_trust_files" severity="high">
> @@ -197,6 +205,7 @@ used in conjunction with the R-services, they can allow
>   unauthenticated access to a system.</rationale>
>   <ident cce="TODO" />
>   <oval id="no_rsh_trusted_host_files" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   </Group>
> @@ -222,6 +231,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
>   <ident cce="4348-9" />
>   <oval id="package_ypserv_removed" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="disable_ypbind" severity="medium">
> @@ -238,6 +248,7 @@ as a client in a NIS or NIS+ domain.
>   <ident cce="3705-1" />
>   <oval id="service_ypbind_disabled" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> @@ -265,6 +276,7 @@ as a tftp server, which does not provide encryption or authentication.
>   <ident cce="4273-9" />
>   <oval id="service_tftp_disabled" />
>   <ref disa="1436" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="uninstall_tftp-server" severity="medium">
> @@ -282,6 +294,7 @@ accidental (or intentional) activation of tftp services.
>   <ident cce="3916-4" />
>   <oval id="package_tftp-server_removed" />
>   <ref disa="305"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="tftpd_uses_secure_mode" severity="high">
> diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
> index eaef2ae..243ccf9 100644
> --- a/RHEL6/input/system/accounts/banners.xml
> +++ b/RHEL6/input/system/accounts/banners.xml
> @@ -80,6 +80,7 @@ reinforces policy awareness during the logon process.
>   <ident cce="4060-0" />
>   <oval id="banner_etc_issue" value="login_banner_text"/>
>   <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Group id="gui_login_banner">
> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
> index 3633b6f..ee8bb91 100644
> --- a/RHEL6/input/system/accounts/pam.xml
> +++ b/RHEL6/input/system/accounts/pam.xml
> @@ -487,6 +487,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
>   <!-- <ident cce="14063-2" /> -->
>   <!-- <oval id="accounts_password_hashing_algorithm" /> -->
>   <ref nist="IA-5" disa="803"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
> index 40ac529..db67bf0 100644
> --- a/RHEL6/input/system/accounts/physical.xml
> +++ b/RHEL6/input/system/accounts/physical.xml
> @@ -36,6 +36,7 @@ Only root should be able to modify important boot parameters.
>   <ident cce="4144-2" />
>   <oval id="file_user_owner_grub_conf" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="group_owner_grub_conf" severity="medium">
> @@ -53,6 +54,7 @@ file should not have any access privileges anyway.
>   <ident cce="4197-0" />
>   <oval id="file_group_owner_grub_conf" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="permissions_grub_conf" severity="medium">
> @@ -69,6 +71,7 @@ parameters.
>   <ident cce="3923-0" />
>   <oval id="file_permissions_grub_conf" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="bootloader_password" severity="medium">
> @@ -98,6 +101,7 @@ and whether to enter single-user mode.
>   <ident cce="3818-2" />
>   <oval id="bootloader_password" />
>   <ref nist="CM-7, IA-5, AC-3" disa="213" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   </Group>
> @@ -376,6 +380,7 @@ for users who may need to suspend console logins.
>   <ident cce="3910-7" />
>   <oval id="package_vlock_installed" />
>   <ref nist="CM-6, CM-7" disa="58" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> index 5f01b5c..8a6f17e 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> @@ -104,6 +104,7 @@ behavior that may result.
>   <ident cce="4154-1" />
>   <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
>   <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   
> @@ -130,6 +131,7 @@ after satisfying the password reuse requirement.
>   <ident cce="4180-6" />
>   <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
>   <ref nist="CM-6, IA-5" disa="198"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   
> @@ -157,6 +159,7 @@ location subject to physical compromise.</rationale>
>   <ident cce="4092-3" />
>   <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
>   <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   
> @@ -182,6 +185,7 @@ make the change at a practical time.
>   <ident cce="4097-2" />
>   <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
>   <ref nist="CM-6, CM-7, IA-5, AC-3" />
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
> index 216999c..4b6c040 100644
> --- a/RHEL6/input/system/permissions/files.xml
> +++ b/RHEL6/input/system/permissions/files.xml
> @@ -29,6 +29,7 @@ which could weaken the system security posture.</rationale>
>   <ident cce="3918-0" />
>   <oval id="file_owner_etc_shadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="groupowner_shadow_file" severity="medium">
> @@ -40,6 +41,7 @@ critical for system security.</rationale>
>   <ident cce="3988-3" />
>   <oval id="file_groupowner_etc_shadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="perms_shadow_file" severity="medium">
> @@ -54,6 +56,7 @@ which could weaken the system security posture.</rationale>
>   <ident cce="4130-1" />
>   <oval id="file_permissions_etc_shadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="userowner_group_file" severity="medium">
> @@ -65,6 +68,7 @@ on the system. Protection of this file is important for system security.</ration
>   <ident cce="3276-3" />
>   <oval id="file_owner_etc_group" />
>   <ref nist="AC-3, CM-6"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="groupowner_group_file" severity="medium">
> @@ -76,6 +80,7 @@ on the system. Protection of this file is important for system security.</ration
>   <ident cce="3883-6" />
>   <oval id="file_groupowner_etc_group" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="perms_group_file" severity="medium">
> @@ -87,6 +92,7 @@ on the system. Protection of this file is important for system security.</ration
>   <ident cce="3967-7" />
>   <oval id="file_permissions_etc_group" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="userowner_gshadow_file" severity="medium">
> @@ -98,6 +104,7 @@ is critical for system security.</rationale>
>   <ident cce="4210-1" />
>   <oval id="file_owner_etc_gshadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="groupowner_gshadow_file" severity="medium">
> @@ -109,6 +116,7 @@ is critical for system security.</rationale>
>   <ident cce="4064-2" />
>   <oval id="file_groupowner_etc_gshadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="perms_gshadow_file" severity="medium">
> @@ -120,6 +128,7 @@ is critical for system security.</rationale>
>   <ident cce="3932-1" />
>   <oval id="file_permissions_etc_gshadow" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="userowner_passwd_file" severity="medium">
> @@ -131,6 +140,7 @@ the system. Protection of this file is critical for system security.</rationale>
>   <ident cce="3958-6" />
>   <oval id="file_owner_etc_passwd" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="groupowner_passwd_file" severity="medium">
> @@ -142,6 +152,7 @@ the system. Protection of this file is critical for system security.</rationale>
>   <ident cce="3495-9" />
>   <oval id="file_groupowner_etc_passwd" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="file_permissions_etc_passwd" severity="medium">
> @@ -155,6 +166,7 @@ is critical for system security.</rationale>
>   <ident cce="3566-7" />
>   <oval id="file_permissions_etc_passwd" />
>   <ref nist="AC-3, CM-6" disa="225"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   </Group>
>   
> @@ -200,6 +212,7 @@ space of processes (including privileged ones) or of the kernel itself at
>   runtime. Restrictive permissions are necessary to protect the integrity of the system.
>   </rationale>
>   <ref disa="1499"/>
> +<tested by="DS" on="20121026"/>
>   </Rule>
>   
>   <Rule id="file_ownership_library_dirs" severity="medium">


Pushed


More information about the scap-security-guide mailing list