[PATCH 7/7] content editing for permissions section, fixups for title style * my voyage through the content revealed to me how much other content editing is still needed
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Sep 4 23:16:36 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/services/cron.xml | 2 +-
RHEL6/input/services/dhcp.xml | 6 +-
RHEL6/input/services/dns.xml | 14 ++-
RHEL6/input/services/imap.xml | 5 +-
RHEL6/input/services/ldap.xml | 6 +-
RHEL6/input/services/squid.xml | 4 +-
RHEL6/input/services/xorg.xml | 4 +-
RHEL6/input/system/accounts/session.xml | 2 +-
RHEL6/input/system/auditing.xml | 17 ++--
RHEL6/input/system/permissions/execution.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 103 ++++++++++++++-----------
RHEL6/input/system/permissions/mounting.xml | 2 +-
RHEL6/input/system/selinux.xml | 4 +-
RHEL6/input/system/software/updating.xml | 4 +-
14 files changed, 95 insertions(+), 80 deletions(-)
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index 8d9f9db..612d40e 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -111,7 +111,7 @@ access to these files should be disabled.</description>
<Rule id="disable_at">
-<title>Disable atd Service if Possible</title>
+<title>Disable atd Service</title>
<description>
<service-disable-macro service="at" />
</description>
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 779fc53..cc0631a 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -25,7 +25,7 @@ changes – and should therefore be used with caution.</description>
<Group id="disabling_dhcp_server">
-<title>Disable DHCP Server if Possible</title>
+<title>Disable DHCP Server</title>
<description>
The DHCP server <tt>dhcpd</tt> is not installed or activated by
default. If the software was installed and activated, but the
@@ -68,7 +68,7 @@ accidentally reactivated and disrupt network operation.
</Group> <!-- <Group id="disabling_dhcp_server"> -->
<Group id="dhcp_server_configuration">
-<title>Disable DHCP Server if Possible</title>
+<title>Disable DHCP Server</title>
<description>If the system must act as a DHCP server, the configuration information it serves should be minimized. Also, support for other protocols and DNS-updating schemes should be explicitly disabled unless needed. The configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file begins with a number of global configuration options. The remainder of the file is divided into sections, one for each block of addresses offered by dhcpd, each of which contains configuration options specific to that address block.</description>
<Rule id="dhcp_server_disable_ddns">
@@ -154,7 +154,7 @@ process.</description>
</Group> <!-- <Group id="dhcp_server_configuration"> -->
<Group id="disabling_dhcp_client">
-<title>Disable DHCP Client if Possible</title>
+<title>Disable DHCP Client</title>
<description>
DHCP is the default network configuration method provided by the system
installer, and common on many networks. Nevertheless, manual management
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index b572ccd..91d00ce 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -7,7 +7,7 @@ be disabled on any system
on which it is not needed.</description>
<Group id="disabling_dns_server">
-<title>Disable DNS Server if Possible</title>
+<title>Disable DNS Server</title>
<description>
DNS software should be disabled on any machine which does not
need to be a nameserver. Note that the BIND DNS server software is
@@ -49,12 +49,16 @@ removing it provides a safeguard against its activation.
<Group id="dns_server_isolation">
<title>Isolate DNS from Other Services</title>
-<description>This section discusses mechanisms for preventing the DNS server from interfering with other services. This is done both to protect the remainder of the network should a nameserver be compromised, and to make direct attacks on nameservers more difficult.</description>
+<description>This section discusses mechanisms for preventing the DNS server
+from interfering with other services. This is done both to protect the
+remainder of the network should a nameserver be compromised, and to make direct
+attacks on nameservers more difficult.</description>
<Rule id="dns_server_dedicated">
-<title>Run DNS Software on Dedicated Servers if Possible</title>
-<description>Since DNS is a high-risk service which must frequently be made available to the entire Internet, it is strongly
-recommended that no other services be offered by machines which act as organizational DNS servers.</description>
+<title>Run DNS Software on Dedicated Servers</title> <description>Since DNS is
+a high-risk service which must frequently be made available to the entire
+Internet, it is strongly recommended that no other services be offered by
+machines which act as organizational DNS servers.</description>
<!--<ident cce="4219-2" />-->
<!--<oval id="dns_server_dedicated" />-->
<!--<ref nist="CM-6, CM-7" />-->
diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
index 6ef53dc..c6a0326 100644
--- a/RHEL6/input/services/imap.xml
+++ b/RHEL6/input/services/imap.xml
@@ -6,7 +6,7 @@ contains more detailed information about Dovecot
configuration.</description>
<Group id="disabling_dovecot">
-<title>Disable Dovecot if Possible</title>
+<title>Disable Dovecot</title>
<description>If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.
</description>
@@ -26,12 +26,11 @@ avenue of attack, and should be disabled if not needed.
</Rule>
<Rule id="uninstall_dovecot">
-<title>Uninstall dovecot RPM Package</title>
+<title>Uninstall dovecot Package</title>
<description>The <tt>dovecot</tt> package can be uninstalled
with the following command:
<pre># yum erase dovecot</pre>
</description>
-
<rationale>
If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation.
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 58e4553..6c2bebf 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -26,7 +26,7 @@ LDAP client, ensure that a working LDAP server is present on the
network.</warning>
<Rule id="ldap_client_start_tls">
-<title>LDAP Uses TLS For All Transactions</title>
+<title>Configure LDAP to Use TLS For All Transactions</title>
<description>Configure LDAP to enforce TLS use. First, edit the file
<tt>/etc/pam_ldap.conf</tt>, and add or correct the following lines:
<pre>ssl start_tls</pre>
@@ -41,7 +41,7 @@ than doing LDAP over SSL.</rationale>
</Rule>
<Rule id="ldap_client_tls_cacertpath">
-<title>LDAP Uses TLS For All Transactions</title>
+<title>Configure Certificate Directives for LDAP Use of TLS</title>
<description>Ensure a copy of the site's CA certificate has been placed in
the file <tt>/etc/pki/tls/CA/cacert.pem</tt>. Configure LDAP to enforce TLS
use and to trust certificates signed by the site's CA. First, edit the file
@@ -72,7 +72,7 @@ securing an OpenLDAP infrastructure nonetheless.
</description>
<Rule id="package_openldap-servers_removed">
-<title>Uninstall the OpenLDAP Server RPM</title>
+<title>Uninstall openldap-servers Package</title>
<description>The <tt>openldap-servers</tt> package should be removed if not in use.
Is this machine the OpenLDAP server? If not, remove the package:
<pre># yum erase openldap-servers</pre>
diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml
index 08d1fb8..4dbfa30 100644
--- a/RHEL6/input/services/squid.xml
+++ b/RHEL6/input/services/squid.xml
@@ -16,7 +16,7 @@ and removed.
</description>
<Rule id="disable_squid">
-<title>Disable Squid if Possible</title>
+<title>Disable Squid</title>
<description>
<service-disable-macro service="squid" />
</description>
@@ -29,7 +29,7 @@ of attack, and should be removed if not needed.
</Rule>
<Rule id="uninstall_squid">
-<title>Uninstall Squid if Possible</title>
+<title>Uninstall squid Package</title>
<description>The <tt>squid</tt> package can be uninstalled with the
following command:
<pre># yum erase squid</pre>
diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
index 04611f4..5b60568 100644
--- a/RHEL6/input/services/xorg.xml
+++ b/RHEL6/input/services/xorg.xml
@@ -4,7 +4,7 @@
system is called X.org.</description>
<Group id="disabling_xwindows">
-<title>Disable X Windows if Possible</title>
+<title>Disable X Windows</title>
<description>Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure that X is not set to start
automatically at boot and remove the X Windows software packages.
@@ -26,7 +26,7 @@ features a <tt>3</tt> as shown:
<Rule id="packagegroup_xwindows_remove">
-<title>Remove the X Windows Package Group if Possible</title>
+<title>Remove the X Windows Package Group</title>
<description>Removing all packages which constitute the X Window System
ensures that users or malicious software cannot start X.
To do so, run the following command:
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 66d9263..26e33b6 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -23,7 +23,7 @@ operator="equals" interactive="0">
</Value>
<Rule id="max_concurrent_login_sessions">
-<title>Set the number of concurrent login sessions allowed per user</title>
+<title>Limit the Number of Concurrent Login Sessions Allowed Per User</title>
<description>
Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 796464e..1649cfc 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -116,7 +116,7 @@ process during boot.
</Rule>
<Group id="configure_auditd_data_retention">
-<title> Configure <tt>auditd</tt> Data Retention</title>
+<title>Configure <tt>auditd</tt> Data Retention</title>
<description>
The audit system writes data to <tt>/var/log/audit/audit.log</tt>. By default,
<tt>auditd</tt> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
@@ -448,7 +448,7 @@ to the system time should be audited.</rationale>
</Rule>
<Rule id="audit_rules_time_stime">
-<title>Record attempts to alter time through stime</title>
+<title>Record Attempts to Alter Time Through stime</title>
<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
<pre># audit_time_rules
-a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
@@ -471,7 +471,7 @@ to the system time should be audited.</rationale>
</Rule>
<Rule id="audit_rules_time_clock_settime">
-<title>Record attempts to alter time through clock_settime</title>
+<title>Record Attempts to Alter Time Through clock_settime</title>
<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
<pre># audit_time_rules
-a always,exit -F arch=b32 -S clock_settime -k audit_time_rules</pre>
@@ -496,7 +496,7 @@ to the system time should be audited.</rationale>
</Rule>
<Rule id="audit_rules_time_watch_localtime">
-<title>Record attempts to alter the localtime file</title>
+<title>Record Attempts to Alter the localtime File</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>:
<pre>-w /etc/localtime -p wa -k audit_time_rules</pre>
The -k option allows for the specification of a key in string form that can
@@ -535,7 +535,7 @@ legitimacy.</rationale>
</Rule>
<Rule id="audit_network_modifications">
-<title>Record Events that Modify the System’s Network Environment</title>
+<title>Record Events that Modify the System's Network Environment</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
ARCH to either b32 or b64 as appropriate for your system:
<pre># audit_network_modifications
@@ -555,7 +555,7 @@ audited.</rationale>
<Rule id="audit_mac_changes">
-<title>Record Events that Modify the System’s Mandatory Access
+<title>Record Events that Modify the System's Mandatory Access
Controls</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>:
<pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
@@ -1014,8 +1014,7 @@ unusual activity.
</Rule>
<Rule id="audit_media_exports">
-<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media
-(successful)</title>
+<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)</title>
<description>At a minimum the audit system should collect media
exportation events for all users and root. Add the following to
<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
@@ -1032,7 +1031,7 @@ loss.</rationale>
</Rule>
<Rule id="audit_file_deletions">
-<title>Ensure <tt>auditd</tt> Collects Files Deletion Events by User</title>
+<title>Ensure <tt>auditd</tt> Collects File Deletion Events by User</title>
<description>At a minimum the audit system should collect file
deletion events for all users and root. Add the following to
<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index b6c40a0..c7e4034 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -68,7 +68,7 @@ the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</description>
<Rule id="disable_users_coredumps">
-<title>Disable Core Dumps for all users</title>
+<title>Disable Core Dumps for All Users</title>
<description>To disable core dumps for all users, add the following line to <tt>/etc/security/limits.conf</tt>:
<pre>* hard core 0</pre>
</description>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index b796200..b82c024 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -9,16 +9,16 @@ to ensure that no harmful discrepancies have
arisen.</description>
<Group id="permissions_important_account_files">
-<title>Verify Permissions on <tt>passwd</tt>, <tt>shadow</tt>,
-<tt>group</tt> and <tt>gshadow</tt> Files</title>
-<description>Default permissions for the <tt>passwd</tt>, <tt>shadow</tt>,
-<tt>group</tt>, and <tt>gshadow</tt> files should be maintained. Many
-utilities need read access to the <tt>passwd</tt> file in order to function
-properly, but read access to the <tt>shadow</tt> file allows malicious attacks
-against system passwords, and should never be enabled.</description>
+<title>Verify Permissions on Files with Local Account Information and Credentials</title>
+<description>The default restritctive permissions for files which act as
+important security databases such as <tt>passwd</tt>, <tt>shadow</tt>,
+<tt>group</tt>, and <tt>gshadow</tt> files must be maintained. Many utilities
+need read access to the <tt>passwd</tt> file in order to function properly, but
+read access to the <tt>shadow</tt> file allows malicious attacks against system
+passwords, and should never be enabled.</description>
<Rule id="userowner_shadow_file">
-<title>Verify user who owns <tt>shadow</tt> file</title>
+<title>Verify User Who Owns <tt>shadow</tt> File</title>
<description>The <tt>/etc/shadow</tt> file should be owned by
root.</description>
<rationale>The <tt>/etc/shadow</tt> file contains the list of local
@@ -32,10 +32,10 @@ which could weaken the system security posture.</rationale>
</Rule>
<Rule id="groupowner_shadow_file">
-<title>Verify group who owns <tt>shadow</tt> file</title>
+<title>Verify Group Who Owns <tt>shadow</tt> File</title>
<description>The <tt>/etc/shadow</tt> file should be group-owned by
root.</description>
-<rationale>The /etc/shadow file stores password hashes. Protection of this file is
+<rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
critical for system security.</rationale>
<ident cce="3988-3" />
<oval id="file_groupowner_etc_shadow" />
@@ -43,9 +43,9 @@ critical for system security.</rationale>
</Rule>
<Rule id="perms_shadow_file">
-<title>Verify permissions on <tt>shadow</tt> file</title>
+<title>Verify Permissions on <tt>shadow</tt> File</title>
<description>File permissions for <tt>/etc/shadow</tt> should be set
-to 0400 or more restrictive.</description>
+to 0000.</description>
<rationale>The <tt>/etc/shadow</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
@@ -57,10 +57,10 @@ which could weaken the system security posture.</rationale>
</Rule>
<Rule id="userowner_group_file">
-<title>Verify user who owns <tt>group</tt> file</title>
+<title>Verify User Who Owns <tt>group</tt> File</title>
<description>The <tt>/etc/group</tt> file should be owned by
root.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident cce="3276-3" />
<oval id="file_owner_etc_group" />
@@ -68,10 +68,10 @@ on the system. Protection of this file is important for system security.</ration
</Rule>
<Rule id="groupowner_group_file">
-<title>Verify group who owns <tt>group</tt> file</title>
+<title>Verify Group Who Owns <tt>group</tt> File</title>
<description>The <tt>/etc/group</tt> file should be group-owned by
root.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident cce="3883-6" />
<oval id="file_groupowner_etc_group" />
@@ -79,10 +79,10 @@ on the system. Protection of this file is important for system security.</ration
</Rule>
<Rule id="perms_group_file">
-<title>Verify permissions on <tt>group</tt> file</title>
+<title>Verify Permissions on <tt>group</tt> File</title>
<description>File permissions for <tt>/etc/group</tt> should be set
correctly.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident cce="3967-7" />
<oval id="file_permissions_etc_group" />
@@ -90,10 +90,10 @@ on the system. Protection of this file is important for system security.</ration
</Rule>
<Rule id="userowner_gshadow_file">
-<title>Verify user who owns <tt>gshadow</tt> file</title>
+<title>Verify User Who Owns <tt>gshadow</tt> File</title>
<description>The <tt>/etc/gshadow</tt> file should be group-owned by
root.</description>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident cce="4210-1" />
<oval id="file_owner_etc_gshadow" />
@@ -101,10 +101,10 @@ is critical for system security.</rationale>
</Rule>
<Rule id="groupowner_gshadow_file">
-<title>Verify group who owns <tt>gshadow</tt> file</title>
+<title>Verify Group Who Owns <tt>gshadow</tt> File</title>
<description>The <tt>/etc/gshadow</tt> file should be group-owned by
root.</description>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident cce="4064-2" />
<oval id="file_groupowner_etc_gshadow" />
@@ -112,7 +112,7 @@ is critical for system security.</rationale>
</Rule>
<Rule id="perms_gshadow_file">
-<title>Verify permissions on <tt>gshadow</tt> file</title>
+<title>Verify Permissions on <tt>gshadow</tt> File</title>
<description>File permissions for <tt>/etc/gshadow</tt> should be set
correctly.</description>
<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
@@ -123,10 +123,10 @@ is critical for system security.</rationale>
</Rule>
<Rule id="userowner_passwd_file">
-<title>Verify user who owns <tt>passwd</tt> file</title>
+<title>Verify User Who Owns <tt>passwd</tt> File</title>
<description>The <tt>/etc/passwd</tt> file should be owned by
root.</description>
-<rationale>The /etc/passwd contains information about the users that are configured on
+<rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
<ident cce="3958-6" />
<oval id="file_owner_etc_passwd" />
@@ -134,10 +134,10 @@ the system. Protection of this file is critical for system security.</rationale>
</Rule>
<Rule id="groupowner_passwd_file">
-<title>Verify group who owns <tt>passwd</tt> file</title>
+<title>Verify Group Who Owns <tt>passwd</tt> File</title>
<description>The <tt>/etc/passwd</tt> file should be group-owned by
root.</description>
-<rationale>The /etc/passwd contains information about the users that are configured on
+<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
<ident cce="3495-9" />
<oval id="file_groupowner_etc_passwd" />
@@ -145,12 +145,13 @@ the system. Protection of this file is critical for system security.</rationale>
</Rule>
<Rule id="file_permissions_etc_passwd">
-<title>Verify permissions on <tt>passwd</tt> file</title>
+<title>Verify Permissions on <tt>passwd</tt> File</title>
<description>File permissions for <tt>/etc/passwd</tt> should be set
to 0644 or less permissive.</description>
-<rationale>If the passwd file is writable by a group-owner or the world the
-risk of passwd file compromise is increased. The passwd file contains the
-list of acounts on the system and associated information.</rationale>
+<rationale>If the <tt>/etc/passwd</tt> file is writable by a group-owner or the
+world the risk of its compromise is increased. The file contains the list of
+acounts on the system and associated information, and protection of this file
+is critical for system security.</rationale>
<ident cce="3566-7" />
<oval id="file_permissions_etc_passwd" />
<ref nist="AC-3, CM-6" disa="225"/>
@@ -267,7 +268,7 @@ changing modes.</description>
</Rule>
<Rule id="world_writeable_files">
-<title>Find Unauthorized World-Writable Files</title>
+<title>Ensure No World-Writable Files Exist</title>
<description>Data in world-writable files can be modified by any
user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
@@ -281,25 +282,38 @@ Also, monitor for recurring world-writable files, as these may be
symptoms of a misconfigured application or user
account.</description>
<ident cce="3795-2" />
-<oval id="dir_perms_world_writable_system_owned" />
<ref nist="CM-6"/>
</Rule>
<Rule id="no_unpackaged_sgid_files">
-<title>Find Unauthorized SGID System Executables</title>
-<description>The sgid bit should not be set for all files.</description>
-<rationale>Executable files with the SGID permission allow users to gain permissions commensurate with the
-group owner of the file. The presence of these files should be strictly controlled on the system.</rationale>
+<title>Ensure All Setgid Executables Are Authorized</title>
+<description>The SGID (set group id) bit should be set only on files that were
+installed via authorized means. A straightforward means of identifying
+unauthorized SGID files is determine if any were not installed as part of an
+RPM package, which is cryptographically verified. Investigate the origin
+of any unpackaged SGID files.
+</description>
+<rationale>Executable files with the SGID permission run with the privileges of
+the owner of the file. SGID files of uncertain provenance could allow for
+unprivileged users to elevate privileges. The presence of these files should be
+strictly controlled on the system.</rationale>
<ident cce="14970-8" />
<oval id="file_permissions_unauthorized_sgid" />
<ref nist="CM-6"/>
</Rule>
<Rule id="no_unpackaged_suid_files">
-<title>Find Unauthorized SUID System Executables</title>
-<description>The suid bit should not be set for all files.</description>
-<rationale>Executable files with the SUID permission allow users to gain permissions commensurate with the
-owner of the file. The presence of these files should be strictly controlled on the system.</rationale>
+<title>Ensure All SUID Executables Are Authorized</title>
+<description>The SUID (set user id) bit should be set only on files that were
+installed via authorized means. A straightforward means of identifying
+unauthorized SGID files is determine if any were not installed as part of an
+RPM package, which is cryptographically verified. Investigate the origin
+of any unpackaged SUID files.
+</description>
+<rationale>Executable files with the SUID permission run with the privileges of
+the owner of the file. SUID files of uncertain provenance could allow for
+unprivileged users to elevate privileges. The presence of these files should be
+strictly controlled on the system.</rationale>
<ident cce="14340-4" />
<oval id="file_permissions_unauthorized_suid" />
<ref nist="AC-3, CM-6"/>
@@ -307,7 +321,7 @@ owner of the file. The presence of these files should be strictly controlled on
<Rule id="no_files_unowned_by_user">
-<title>Find files unowned by a user</title>
+<title>Ensure All Files Are Owned by a User</title>
<description>The following command will discover and print any
files on local partitions which do not belong to a valid user and a
valid group. Run it once for each local partition PART:
@@ -330,7 +344,7 @@ and the cause should be discovered and addressed.
</Rule>
<Rule id="no_files_unowned_by_group">
-<title>Find files unowned by a group</title>
+<title>Ensure All Files Are Owned by a Group</title>
<description>The following command will discover and print any
files on local partitions which do not belong to a valid user and a
valid group. Run it once for each local partition PART:
@@ -353,8 +367,7 @@ and the cause should be discovered and addressed.
</Rule>
<Rule id="world_writable_files_system_ownership">
-<title>Find world writable directories not owned by a
-system account</title>
+<title>Ensure All World-Writable Directories Are Owned by a System Account</title>
<description>Locate any directories in local partitions which are
world-writable and ensure that they are owned by root or another
system account. The following command will discover and print these
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 6dc1fbc..c52707a 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -117,7 +117,7 @@ configuration of the native OS. The BIOS should be configured to disallow bootin
</Rule>
<Rule id="service_autofs_disabled">
-<title>Disable the Automounter if Possible</title>
+<title>Disable the Automounter</title>
<description>The <tt>autofs</tt> daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>.
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 9fcbae5..7893c27 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -100,7 +100,7 @@ the chances that it remain off during system operation.
</Rule>
<Rule id="set_selinux_state">
-<title>Check SELinux State</title>
+<title>Ensure SELinux State is Enforcing</title>
<description>The SELinux state should be set to <tt>enforcing</tt> during
normal system operation. To ensure the system is configured to
boot into enforcing mode, add or correct the following line in
@@ -119,7 +119,7 @@ privileges.
</Rule>
<Rule id="set_selinux_policy">
-<title>Check SELinux Policy</title>
+<title>Configure SELinux Policy</title>
<description>The SELinux <tt>targeted</tt> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy,
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 8cd6727..2670147 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -60,7 +60,7 @@ the exploitation of publicly-known vulnerabilities.
<ref nist="SI-2" disa="1232"/>
</Rule>
<Rule id="ensure_gpgcheck_globally_activated">
-<title>Ensure "gpgcheck" Enabled In Yum Configuration</title>
+<title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
<description>The <tt>gpgcheck</tt> option should be used to ensure that
checking of an RPM package’s signature always occurs prior to its
installation. To force yum to check package signatures before installing
@@ -79,7 +79,7 @@ protects against malicious tampering.
</Rule>
<Rule id="ensure_gpgcheck_never_disabled">
-<title>Ensure "gpgcheck" Enabled For All Yum Package Repositories</title>
+<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
<description>To ensure that signature checking is not disabled for
any repos, ensure that the following line DOES NOT appear in any
repo configuration files in <tt>/etc/yum.repos.d</tt> or elsewhere:
--
1.7.1
More information about the scap-security-guide
mailing list