[PATCH 1/3] added proposed new "<ocil>" tags to contain manual check information. * these also use new macros for disabling services and checking partitioning
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu Sep 6 21:14:07 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/services/avahi.xml | 1 +
RHEL6/input/services/base.xml | 25 +++++++++++++++++++++++++
RHEL6/input/services/cron.xml | 2 ++
RHEL6/input/services/dns.xml | 1 +
RHEL6/input/services/http.xml | 1 +
RHEL6/input/services/obsolete.xml | 7 +++++++
RHEL6/input/services/printing.xml | 1 +
RHEL6/input/services/smb.xml | 1 +
8 files changed, 39 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
index fce0f4d..5e4d7d3 100644
--- a/RHEL6/input/services/avahi.xml
+++ b/RHEL6/input/services/avahi.xml
@@ -20,6 +20,7 @@ Disabling it can reduce the system’s vulnerability to such attacks.
<description>
<service-disable-macro service="avahi-daemon" />
</description>
+<ocil><service-disable-check-macro service="avahi-daemon" /></ocil>
<rationale>
Because the Avahi daemon service keeps an open network
port, it is subject to network attacks. Its functionality
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 037f7b7..eba13df 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -16,6 +16,7 @@ reports to files, or forward crash reports to a centralized issue tracking
system such as RHTSupport.
<service-disable-macro service="abrtd" />
</description>
+<ocil><service-disable-check-macro service="abrtd" /></ocil>
<rationale> Mishandling crash data could expose sensitive information about
vulnerablities in software executing on the local machine, as well as sensitive
information from within a process's address space or registers.</rationale>
@@ -32,6 +33,7 @@ dispatches ACPI events (such as power/reset button depressed) to userspace
programs.
<service-disable-macro service="acpid" />
</description>
+<ocil><service-disable-check-macro service="acpid" /></ocil>
<rationale>ACPI support is highly desirable for systems in some network roles,
such as laptops or desktops. For other systems, such as servers, it may permit
accidental or trivially achievable denial of service situations and disabling
@@ -51,6 +53,7 @@ recurring. The daemon <tt>atd</tt> keeps track of tasks scheduled via
<tt>at</tt> and <tt>batch</tt>, and executes them at the specified time.
<service-disable-macro service="atd" />
</description>
+<ocil><service-disable-check-macro service="atd" /></ocil>
<rationale>
The <tt>atd</tt> service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
@@ -71,6 +74,7 @@ combined with Red Hat's IPA (Identity Policy Audit) security information managem
solution to aid in the management of certificates.
<service-disable-macro service="certmonger" />
</description>
+<ocil><service-disable-check-macro service="certmonger" /></ocil>
<rationale>The services provided by certmonger may be essential for systems
fulfilling some roles a PKI infrastructure, but its functionality is not necesssary
for many other use cases.</rationale>
@@ -87,6 +91,7 @@ memory, network bandwidth, etc) among a defined group (or groups) of processes e
a system. The <tt>cgconfig</tt> daemon starts at boot and establishes the predefined control groups.
<service-disable-macro service="cgconfig" />
</description>
+<ocil><service-disable-check-macro service="cgconfig" /></ocil>
<rationale>Unless control groups are used to manage system resources, running the cgconfig
service is not necessary.
</rationale>
@@ -101,6 +106,7 @@ service is not necessary.
parameters set in the <tt>/etc/cgrules.conf</tt> configuration file.
<service-disable-macro service="cgred" />
</description>
+<ocil><service-disable-check-macro service="cgred" /></ocil>
<rationale>Unless control groups are used to manage system resources, running the cgred service
service is not necessary.
</rationale>
@@ -115,6 +121,7 @@ service is not necessary.
the current processing load thereby conserving power and reducing heat.
<service-disable-macro service="cpuspeed" />
</description>
+<ocil><service-disable-check-macro service="cpuspeed" /></ocil>
<rationale>The <tt>cpuspeed</tt> service is only necessary if adjusting the CPU clock speed
provides benefit. Traditionally this has included laptops (to enhance battery life),
but may also apply to server or desktop environments where conserving power is
@@ -135,6 +142,7 @@ running a desktop environment, and may be necessary on any system which
deals with removable media or devices.
<service-disable-macro service="haldaemon" />
</description>
+<ocil><service-disable-check-macro service="haldaemon" /></ocil>
<rationale>The haldaemon provides essential functionality on systems
that use removable media or devices, but can be disabled for systems
that do not require these.
@@ -152,6 +160,7 @@ power savings and performance through distribution of hardware interrupts across
multiple processors.
<service-enable-macro service="irqbalance" />
</description>
+<ocil><service-disable-check-macro service="irqbalance" /></ocil>
<rationale>In an environment with multiple processors (now common), the irqbalance service
provides potential speedups for handling interrupt requests.</rationale>
<ident cce="4123-6" />
@@ -166,6 +175,7 @@ system call to boot a secondary kernel ("capture" kernel) following a system
crash, which can load information from the crashed kernel for analysis.
<service-disable-macro service="kdump" />
</description>
+<ocil><service-disable-check-macro service="kdump" /></ocil>
<rationale>Unless the system is used for kernel development or testing, there
is little need to run the kdump service.</rationale>
<ident cce="3425-6" />
@@ -199,6 +209,7 @@ mirrored or snapshot logical volumes then this service should be configured and
RAID setups do not use this service).
<service-disable-macro service="mdmonitor" />
</description>
+<ocil><service-disable-check-macro service="mdmonitor" /></ocil>
<rationale>If software RAID monitoring is not required (and it is uncommon),
there is no need to run the service.</rationale>
<ident cce="3854-7" />
@@ -215,6 +226,7 @@ Due to these dependencies, disabling D-Bus may not be practical for
many systems.
<service-disable-macro service="messagebus" />
</description>
+<ocil><service-disable-check-macro service="messagebus" /></ocil>
<rationale>If no services which require D-Bus are needed, then it
can be disabled. As a broker for IPC between processes of different privilege levels,
it could be a target for attack. However, disabling D-Bus is likely to be
@@ -234,6 +246,7 @@ syslog server. This allows debugging of problems where disk logging fails and
serial consoles are impractical.
<service-disable-macro service="netconsole" />
</description>
+<ocil><service-disable-check-macro service="netconsole" /></ocil>
<rationale>The <tt>netconsole</tt> service is not necessary unless there is a need to debug
kernel panics, which is not common.
</rationale>
@@ -252,6 +265,7 @@ and then sets the local hardware clock to the newly synchronized
system time.
<service-disable-macro service="ntpdate" />
</description>
+<ocil><service-disable-check-macro service="ntpdate" /></ocil>
<rationale>The <tt>ntpdate</tt> service may only be suitable for systems which
are rebooted frequently enough that clock drift does not cause problems between
reboots. In any event, the functionality of the ntpdate service is now
@@ -269,6 +283,7 @@ specified privileged tasks can run tasks for unprivileged client
applications. Communication with <tt>oddjobd</tt> through the system message bus.
<service-disable-macro service="oddjobd" />
</description>
+<ocil><service-disable-check-macro service="oddjobd" /></ocil>
<rationale>The <tt>oddjobd</tt> service may provide necessary functionality in
some environments but it can be disabled if it is not needed. Execution of
tasks by privileged programs, on behalf of unprivileged ones, has traditionally
@@ -286,6 +301,7 @@ be used to prevent portmap from binding to well known TCP ports that are
required for other services.
<service-disable-macro service="portreserve" />
</description>
+<ocil><service-disable-check-macro service="portreserve" /></ocil>
<rationale>The <tt>portreserve</tt> service provides helpful functionality by
preventing conflicting usage of ports in the reserved port range, but it can be
disabled if not needed.</rationale>
@@ -303,6 +319,7 @@ including <tt>acct</tt> and <tt>ac</tt> to allow system administrators to view
user activity, such as commands issued by users of the system.
<service-enable-macro service="psacct" />
</description>
+<ocil><service-disable-check-macro service="psacct" /></ocil>
<rationale>The <tt>psacct</tt> service can provide administrators a convenient
view into some user activities. However, it should be noted that the auditing
system and its audit records provide more authoritative and comprehensive
@@ -320,6 +337,7 @@ Queuing Protocol. By default the qpidd service will bind to port 5672 and
listen for connection attempts.
<service-disable-macro service="qpidd" />
</description>
+<ocil><service-disable-check-macro service="qpidd" /></ocil>
<rationale>The qpidd service is automatically installed when the "base"
package selection is selected during installation. The qpidd service listens
for network connections which increases the attack surface of the system. If
@@ -339,6 +357,7 @@ violation using D-Bus or by sending a message to the terminal that the user has
last accessed.
<service-disable-macro service="quota_nld" />
</description>
+<ocil><service-disable-check-macro service="quota_nld" /></ocil>
<rationale>If disk quotas are enforced on the local system, then the
<tt>quota_nld</tt> service likely provides useful functionality and should
remain enabled. However, if disk quotas are not used or user notification of
@@ -358,6 +377,7 @@ the local subnet. If a router is discovered then the local routing table is
updated with a corresponding default route. By default this daemon is disabled.
<service-disable-macro service="rdisc" />
</description>
+<ocil><service-disable-check-macro service="rdisc" /></ocil>
<rationale>General-purpose systems typically have their network and routing
information configured statically by a system administrator. Workstations or
some special-purpose systems often use DHCP (instead of IRDP) to retrieve
@@ -376,6 +396,7 @@ such as package updates. This only occurs if the system was registered to an
RHN server or satellite and managed as such.
<service-disable-macro service="rhnsd" />
</description>
+<ocil><service-disable-check-macro service="rhnsd" /></ocil>
<rationale>Although systems management and patching is extremely important to
system security, management by a system outside the enterprise enclave is not
desirable for some environments.</rationale>
@@ -392,6 +413,7 @@ changes in the entitlement certificates for a registered system and updates it
accordingly.
<service-disable-macro service="rhsmcertd" />
</description>
+<ocil><service-disable-check-macro service="rhsmcertd" /></ocil>
<rationale>The <tt>rhsmcertd</tt> service can provide administrators with some
additional control over which of their systems are entitled to particular
subscriptions. However, for systems that are managed locally or which are not
@@ -412,6 +434,7 @@ to provide proxy authentication services to clients that do not understand SASL
based authentication.
<service-disable-macro service="saslauthd" />
</description>
+<ocil><service-disable-check-macro service="saslauthd" /></ocil>
<rationale>The <tt>saslauthd</tt> service provides essential functionality for
performing authentication in some directory environments, such as those which
use Kerberos and LDAP. For others, however, in which only local files may be
@@ -429,6 +452,7 @@ feature of hard drives that allows them to detect symptoms of disk failure and
relay an appropriate warning.
<service-disable-macro service="smartd" />
</description>
+<ocil><service-disable-check-macro service="smartd" /></ocil>
<rationale>SMART can help protect against denial of
service due to failing hardware. Nevertheless, if it is not needed or the
system's drives are not SMART-capable (such as solid state drives), it can be
@@ -466,6 +490,7 @@ performance statistics to zero in order to begin counting from a fresh state
at boot time.
<service-disable-macro service="sysstat" />
</description>
+<ocil><service-disable-check-macro service="sysstat" /></ocil>
<rationale>By default the <tt>sysstat</tt> service merely runs a program at
boot to reset the statistics, which can be retrieved using programs such as
<tt>sar</tt> and <tt>sadc</tt>. These may provide useful insight into system
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index 612d40e..da724e6 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -13,6 +13,7 @@ preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
<service-enable-macro service="crond" />
</description>
+<ocil><service-enable-check-macro service="crond" /></ocil>
<rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.
</rationale>
@@ -115,6 +116,7 @@ access to these files should be disabled.</description>
<description>
<service-disable-macro service="at" />
</description>
+<ocil><service-disable-check-macro service="at" /></ocil>
<rationale>
Many of the periodic or delayed execution features of the at
daemon can be provided through the cron daemon instead.
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 91d00ce..717c3b7 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -21,6 +21,7 @@ nameservers.
<description>
<service-disable-macro service="named" />
</description>
+<ocil><service-disable-macro service="named" /></ocil>
<rationale>
All network services involve some risk of compromise due to
implementation flaws and should be disabled if possible.
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
index 2c9ee58..7cd3782 100644
--- a/RHEL6/input/services/http.xml
+++ b/RHEL6/input/services/http.xml
@@ -27,6 +27,7 @@ and removed from the system.
<description>
<service-disable-macro service="httpd" />
</description>
+<ocil><service-disable-macro service="httpd" /></ocil>
<rationale>
Running web server software provides a network-based avenue
of attack, and should be disabled if not needed.
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 53836b0..91d7884 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -29,6 +29,7 @@ is not even available as part of RHEL 6.</description>
<description>
<service-disable-macro service="xinetd" />
</description>
+<ocil><service-disable-check-macro service="xinetd" /></ocil>
<rationale>
The xinetd service provides a dedicated listener service for some programs,
which is no longer necessary for commonly-used network services. Disabling
@@ -65,6 +66,7 @@ actively working to migrate to a more secure protocol.</description>
<description>
<service-disable-macro service="telnet" />
</description>
+<ocil><service-disable-check-macro service="telnet" /></ocil>
<rationale>
The telnet protocol uses unencrypted network communication, which
means that data from the login session, including passwords and
@@ -121,6 +123,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rexec" />
</description>
+<ocil><service-disable-check-macro service="rexec" /></ocil>
<rationale>The rexec service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
@@ -137,6 +140,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rsh" />
</description>
+<ocil><service-disable-check-macro service="rsh" /></ocil>
<rationale>The rsh service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
@@ -154,6 +158,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rlogin" />
</description>
+<ocil><service-disable-check-macro service="rlogin" /></ocil>
<rationale>The rlogin service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
@@ -205,6 +210,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
a NIS or NIS+ domain, should be disabled.
<service-disable-macro service="ypbind" />
</description>
+<ocil><service-disable-check-macro service="ypbind" /></ocil>
<rationale>
Disabling the <tt>ypbind</tt> service ensures the system is not acting
as a client in a NIS or NIS+ domain.
@@ -230,6 +236,7 @@ found.</description>
<description>The <tt>tftp</tt> service should be disabled.
<service-disable-macro service="tftp" />
</description>
+<ocil><service-disable-check-macro service="tftp" /></ocil>
<rationale>
Disabling the <tt>tftp</tt> service ensures the system is not acting
as a tftp server, which does not provide encryption or authentication.
diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml
index f252508..0daae0f 100644
--- a/RHEL6/input/services/printing.xml
+++ b/RHEL6/input/services/printing.xml
@@ -19,6 +19,7 @@ and more detailed documentation are available at http://www.cups.org.
<description>Do you need the ability to print from this machine or to allow others to print to it? If not, disable it.
<service-disable-macro service="cups" />
</description>
+<ocil><service-disable-check-macro service="cups" /></ocil>
<rationale>Turn off unneeded services to reduce attack surface.
</rationale>
<ident cce="CCE-4112-9" />
diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
index 7428247..80481b5 100644
--- a/RHEL6/input/services/smb.xml
+++ b/RHEL6/input/services/smb.xml
@@ -25,6 +25,7 @@ sharing functionality.
<description>
<service-disable-macro service="smb" />
</description>
+<ocil><service-disable-macro service="smb" /></ocil>
<rationale>
Running a Samba server provides a network-based avenue of attack, and
should be disabled if not needed.
--
1.7.1
More information about the scap-security-guide
mailing list