[PATCH 4/5] added check text to services sections

Shawn Wells shawn at redhat.com
Mon Sep 24 14:58:09 UTC 2012


On 9/24/12 9:45 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/services/dhcp.xml  |  128 ++++++++++++++++++++++++++--------------
>   RHEL6/input/services/ftp.xml   |   11 +++-
>   RHEL6/input/services/http.xml  |   12 +++-
>   RHEL6/input/services/imap.xml  |    6 ++
>   RHEL6/input/services/nfs.xml   |    9 ++-
>   RHEL6/input/services/ntp.xml   |    1 +
>   RHEL6/input/services/snmp.xml  |   11 +++-
>   RHEL6/input/services/squid.xml |   11 +++-
>   8 files changed, 128 insertions(+), 61 deletions(-)
>
> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
> index 8417bb0..51dbba5 100644
> --- a/RHEL6/input/services/dhcp.xml
> +++ b/RHEL6/input/services/dhcp.xml
> @@ -39,6 +39,7 @@ and removed.
>   any system that does not need to act as a DHCP server.
>   <service-disable-macro service="dhcpd" />
>   </description>
> +<ocil><service-disable-check-macro service="dhcpd" /></ocil>
>   <rationale>
>   Unmanaged or unintentionally activate DHCP servers may provide faulty information
>   to clients, interfering with the operation of a legitimate site
> @@ -53,9 +54,9 @@ DHCP server if there is one.
>   <title>Uninstall DHCP Server Package</title>
>   <description>If the system does not need to act as a DHCP server,
>   the dhcp package can be uninstalled.
> -To do so, run the command:
> -<pre># yum erase dhcp</pre>
> +<package-remove-macro package="dhcp" />
>   </description>
> +<ocil><package-remove-check-macro package="dhcp" /></ocil>
>   <rationale>
>   Removing the DHCP server ensures that it cannot be easily or
>   accidentally reactivated and disrupt network operation.
> @@ -69,18 +70,34 @@ accidentally reactivated and disrupt network operation.
>   
>   <Group id="dhcp_server_configuration">
>   <title>Disable DHCP Server</title>
> -<description>If the system must act as a DHCP server, the configuration information it serves should be minimized. Also, support for other protocols and DNS-updating schemes should be explicitly disabled unless needed. The configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file begins with a number of global configuration options. The remainder of the file is divided into sections, one for each block of addresses offered by dhcpd, each of which contains configuration options specific to that address block.</description>
> +<description>If the system must act as a DHCP server, the configuration
> +information it serves should be minimized. Also, support for other protocols
> +and DNS-updating schemes should be explicitly disabled unless needed. The
> +configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file
> +begins with a number of global configuration options. The remainder of the file
> +is divided into sections, one for each block of addresses offered by dhcpd,
> +each of which contains configuration options specific to that address
> +block.</description>
>   
>   <Rule id="dhcp_server_disable_ddns">
>   <title>Do Not Use Dynamic DNS</title>
> -<description>To prevent the DHCP server from receiving DNS information from clients, edit <tt>/etc/dhcpd.conf</tt>, and add
> -or correct the following global option:
> -<pre>ddns-update-style none;</pre>
> +<description>To prevent the DHCP server from receiving DNS information from
> +clients, edit <tt>/etc/dhcpd.conf</tt>, and add or correct the following global
> +option: <pre>ddns-update-style none;</pre>
>   </description>
> -<rationale>The Dynamic DNS protocol is used to remotely update the data served by a DNS server. DHCP servers can use Dynamic DNS to publish information about their clients. This setup carries security risks, and its use is not recommended.
> -If Dynamic DNS must be used despite the risks it poses, it is critical that Dynamic DNS transactions be protected using TSIG or some other cryptographic authentication mechanism. See dhcpd.conf(5) for more information about protecting the DHCP server from passing along malicious DNS data from its clients.
> -</rationale>
> -<warning category="general">The ddns-update-style option controls only whether the DHCP server will attempt to act as a Dynamic DNS client. As long as the DNS server itself is correctly configured to reject DDNS attempts, an incorrect ddns-update-style setting on the client is harmless (but should be fixed as a best practice).</warning>
> +<rationale>The Dynamic DNS protocol is used to remotely update the data served
> +by a DNS server. DHCP servers can use Dynamic DNS to publish information about
> +their clients. This setup carries security risks, and its use is not
> +recommended.  If Dynamic DNS must be used despite the risks it poses, it is
> +critical that Dynamic DNS transactions be protected using TSIG or some other
> +cryptographic authentication mechanism. See dhcpd.conf(5) for more information
> +about protecting the DHCP server from passing along malicious DNS data from its
> +clients.  </rationale>
> +<warning category="general">The ddns-update-style option controls only whether
> +the DHCP server will attempt to act as a Dynamic DNS client. As long as the DNS
> +server itself is correctly configured to reject DDNS attempts, an incorrect
> +ddns-update-style setting on the client is harmless (but should be fixed as a
> +best practice).</warning>
>   <ident cce="4257-2" />
>   <!--<oval id="dhcp_server_disable_ddns" /> -->
>   <!--<ref nist="CM-6, CM-7" /> -->
> @@ -88,12 +105,14 @@ If Dynamic DNS must be used despite the risks it poses, it is critical that Dyna
>   
>   <Rule id="dhcp_server_deny_decline">
>   <title>Deny Decline Messages</title>
> -<description>Edit <tt>/etc/dhcpd.conf</tt> and add or correct the following global option to prevent the DHCP server from responding the DHCPDECLINE messages, if possible:
> -<pre>deny declines;</pre>
> -</description>
> -<rationale>The DHCPDECLINE message can be sent by a DHCP client to indicate that it does not consider the lease
> -offered by the server to be valid. By issuing many DHCPDECLINE messages, a malicious client can exhaust the
> -DHCP server’s pool of IP addresses, causing the DHCP server to forget old address allocations.</rationale>
> +<description>Edit <tt>/etc/dhcpd.conf</tt> and add or correct the following
> +global option to prevent the DHCP server from responding the DHCPDECLINE
> +messages, if possible: <pre>deny declines;</pre> </description>
> +<rationale>The DHCPDECLINE message can be sent by a DHCP client to indicate
> +that it does not consider the lease offered by the server to be valid. By
> +issuing many DHCPDECLINE messages, a malicious client can exhaust the DHCP
> +server’s pool of IP addresses, causing the DHCP server to forget old address
> +allocations.</rationale>
>   <ident cce="4403-2" />
>   <!--<oval id="dhcp_server_deny_decline" /> -->
>   <!--<ref nist="CM-6, CM-7" /> -->
> @@ -101,19 +120,24 @@ DHCP server’s pool of IP addresses, causing the DHCP server to forget old addr
>   
>   <Rule id="dhcp_server_deny_bootp">
>   <title>Deny BOOTP Queries</title>
> -<description>Unless your network needs to support older BOOTP clients, disable support for the bootp protocol by adding or correcting the global option:
> +<description>Unless your network needs to support older BOOTP clients, disable
> +support for the bootp protocol by adding or correcting the global option:
>   <pre>deny bootp;</pre>
>   </description>
> -<rationale>The bootp option tells dhcpd to respond to BOOTP queries. If support for this simpler protocol is not needed, it should be disabled to remove attack vectors against the DHCP server.
> +<rationale>The bootp option tells dhcpd to respond to BOOTP queries. If support
> +for this simpler protocol is not needed, it should be disabled to remove attack
> +vectors against the DHCP server.
>   </rationale>
>   <ident cce="4345-5" />
>   <!--<oval id="dhcp_server_deny_bootp" /> -->
>   <!--<ref nist="CM-6, CM-7" /> -->
>   </Rule>
>   
> -<Rule id="dhcp_server_minimize_served_info">
> +<Group id="dhcp_server_minimize_served_info">
>   <title>Minimize Served Information</title>
> -<description>Edit /etc/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is an operational need to provide this information via DHCP:
> +<description>Edit /etc/dhcpd.conf. Examine each address range section within
> +the file, and ensure that the following options are not defined unless there is
> +an operational need to provide this information via DHCP:
>   <pre>option domain-name
>   option domain-name-servers
>   option nis-domain
> @@ -122,30 +146,38 @@ option ntp-servers
>   option routers
>   option time-offset</pre>
>   </description>
> -<rationale>Because the configuration information provided by the DHCP server could be maliciously provided to clients by a rogue DHCP server, the amount of information provided via DHCP should be minimized. Remove these definitions from the DHCP server configuration to ensure that legitimate clients do not unnecessarily rely on DHCP for this information.
> +<rationale>Because the configuration information provided by the DHCP server
> +could be maliciously provided to clients by a rogue DHCP server, the amount of
> +information provided via DHCP should be minimized. Remove these definitions
> +from the DHCP server configuration to ensure that legitimate clients do not
> +unnecessarily rely on DHCP for this information.
>   </rationale>
> -<warning category="general">By default, the RHEL client installation uses DHCP to request much of the above information from
> -the DHCP server. In particular, domain-name, domain-name-servers, and routers are configured via DHCP.
> -These settings are typically necessary for proper network functionality, but are also usually static across machines
> -at a given site.</warning>
> -<ident cce="3724-2" />
> +<warning category="general">By default, the RHEL client installation uses DHCP
> +to request much of the above information from the DHCP server. In particular,
> +domain-name, domain-name-servers, and routers are configured via DHCP.  These
> +settings are typically necessary for proper network functionality, but are also
> +usually static across machines at a given site.</warning>
> +<!--<ident cce="3724-2" />
>   <ident cce="4243-2" />
>   <ident cce="4389-3" />
>   <ident cce="3913-1" />
>   <ident cce="4169-9" />
>   <ident cce="4318-2" />
> -<ident cce="4319-0" />
> +<ident cce="4319-0" />-->
>   <!--<oval id="dhcp_server_minimize_served_info" /> -->
>   <!--<ref nist="CM-6, CM-7" /> -->
> -</Rule>
> +</Group>
>   
>   <Rule id="dhcp_server_configure_logging">
>   <title>Configure Logging</title>
> -<description>Ensure that the following line exists in <tt>/etc/syslog.conf</tt>:
> +<description>Ensure that the following line exists in
> +<tt>/etc/syslog.conf</tt>:
>   <pre>daemon.*           /var/log/daemon.log</pre>
> -Configure logwatch or other log monitoring tools to summarize error conditions reported by the dhcpd
> -process.</description>
> -<rationale>By default, dhcpd logs notices to the daemon facility. Sending all daemon messages to a dedicated log file is part of the syslog configuration outlined in the Logging and Auditing section</rationale>
> +Configure logwatch or other log monitoring tools to summarize error conditions
> +reported by the dhcpd process.</description>
> +<rationale>By default, dhcpd logs notices to the daemon facility. Sending all
> +daemon messages to a dedicated log file is part of the syslog configuration
> +outlined in the Logging and Auditing section</rationale>
>   <ident cce="3733-3" />
>   <!--<oval id="dhcp_server_configure_logging" /> -->
>   <!--<ref nist="CM-6, CM-7" /> -->
> @@ -165,8 +197,9 @@ accountability for network activity.
>   <Rule id="disable_dhcp_client">
>   <title>Disable DHCP Client</title>
>   <description>
> -For each interface <i>IFACE</i> on the system (e.g. eth0),
> -edit <tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt> and make the following changes:
> +For each interface <i>IFACE</i> on the system (e.g. eth0), edit
> +<tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt> and make the
> +following changes:
>   <ul>
>   <li> Correct the BOOTPROTO line to read:
>   <pre>BOOTPROTO=static</pre>
> @@ -180,8 +213,10 @@ GATEWAY=192.168.1.1</pre>
>   </ul>
>   </description>
>   <rationale>
> -DHCP is inherently insecure and should not be used unless it presents an unacceptable burden to the organization.
> -</rationale>
> +DHCP relies on trusting the local network. If the local network is not trusted,
> +then it should not be used.  However, the automatic configuration provided by
> +DHCP is commonly used and the alternative, manual configuration, presents an
> +unacceptable burden in many circumstances.</rationale>
>   <ident cce="4191-3" />
>   <oval id="sysconfig_networking_bootproto_ifcfg" />
>   <ref nist="CM-6, CM-7" />
> @@ -198,14 +233,18 @@ dhclient(8) and dhclient.conf(5) man pages.  </description>
>   
>   <Group id="dhcp_client_restrict_options">
>   <title>Minimize the DHCP-Configured Options</title>
> -<description>Create the file <tt>/etc/dhclient.conf</tt>, and add an appropriate setting for each of the ten configuration settings which can be obtained via DHCP. For each setting, setting , do one of the following:
> -If the setting should not be configured remotely by the DHCP server, select an appropriate static value, and add the line:
> -supersede <tt>setting value</tt>;
> +<description>Create the file <tt>/etc/dhclient.conf</tt>, and add an
> +appropriate setting for each of the ten configuration settings which can be
> +obtained via DHCP. For each setting, do one of the following:
> +<br/>
> +If the setting should <i>not</i> be configured remotely by the DHCP server,
> +select an appropriate static value, and add the line:
> +<pre>supersede <tt>setting value</tt>;</pre>
>   If the setting should be configured remotely by the DHCP server, add the lines:
> -request <tt>setting</tt>;
> -require <tt>setting</tt>;
> -For example, suppose the DHCP server should provide only the IP address itself and the subnet mask. Then
> -the entire file should look like:
> +<pre>request <tt>setting</tt>;
> +require <tt>setting</tt>;</pre>
> +For example, suppose the DHCP server should provide only the IP address itself
> +and the subnet mask. Then the entire file should look like:
>   <pre>supersede domain-name "example.com";
>   supersede domain-name-servers 192.168.1.2;
>   supersede nis-domain "";
> @@ -214,7 +253,8 @@ supersede ntp-servers "ntp.example.com ";
>   supersede routers 192.168.1.1;
>   supersede time-offset -18000;
>   request subnet-mask;
> -require subnet-mask;</pre></description>
> +require subnet-mask;</pre>
> +</description>
>   <rationale>By default, the DHCP client program, dhclient, requests and applies
>   ten configuration options (in addition to the IP address) from the DHCP server:
>   subnet-mask, broadcast-address, time-offset, routers, domain-name,
> diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
> index da0a476..7741fc9 100644
> --- a/RHEL6/input/services/ftp.xml
> +++ b/RHEL6/input/services/ftp.xml
> @@ -19,6 +19,9 @@ data available to the public.</description>
>   <description>
>   <service-disable-macro service="vsftpd" />
>   </description>
> +<ocil>
> +<service-disable-macro service="vsftpd" />
> +</ocil>
>   <rationale>
>   Running FTP server software provides a network-based avenue
>   of attack, and should be disabled if not needed.
> @@ -32,10 +35,12 @@ a risk of compromising sensitive information.
>   
>   <Rule id="uninstall_vsftpd">
>   <title>Uninstall vsftpd Package</title>
> -<description>The <tt>vsftpd</tt> package can be
> -uninstalled with the following command:
> -<pre># yum erase vsftpd</pre>
> +<description>
> +<package-remove-macro service="vsftpd" />
>   </description>
> +<ocil>
> +<package-check-macro service="vsftpd" />
> +</ocil>
>   <rationale>
>   Removing the vsftpd package decreases the risk of its
>   accidental activation.
> diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
> index 7cd3782..679d32a 100644
> --- a/RHEL6/input/services/http.xml
> +++ b/RHEL6/input/services/http.xml
> @@ -27,7 +27,9 @@ and removed from the system.
>   <description>
>   <service-disable-macro service="httpd" />
>   </description>
> -<ocil><service-disable-macro service="httpd" /></ocil>
> +<ocil>
> +<service-disable-macro service="httpd" />
> +</ocil>
>   <rationale>
>   Running web server software provides a network-based avenue
>   of attack, and should be disabled if not needed.
> @@ -39,10 +41,12 @@ of attack, and should be disabled if not needed.
>   
>   <Rule id="uninstall_httpd">
>   <title>Uninstall httpd Package</title>
> -<description>The <tt>httpd</tt> package can be uninstalled with
> -the following command:
> -<pre># yum erase httpd</pre>
> +<description>
> +<package-remove-macro service="httpd" />
>   </description>
> +<ocil>
> +<package-check-macro service="httpd" />
> +</ocil>
>   <rationale>
>   If there is no need to make the web server software available,
>   removing it provides a safeguard against its activation.
> diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
> index c6a0326..a173122 100644
> --- a/RHEL6/input/services/imap.xml
> +++ b/RHEL6/input/services/imap.xml
> @@ -17,6 +17,9 @@ POP3 server, the dovecot software should be disabled and removed.
>   <description>
>   <service-disable-macro service="dovecot" />
>   </description>
> +<ocil>
> +<service-disable-check-macro service="dovecot" />
> +</ocil>
>   <rationale>
>   Running an IMAP or POP3 server provides a network-based
>   avenue of attack, and should be disabled if not needed.
> @@ -31,6 +34,9 @@ avenue of attack, and should be disabled if not needed.
>   with the following command:
>   <pre># yum erase dovecot</pre>
>   </description>
> +<ocil>
> +<package-check-macro package="dovecot" />
> +</ocil>
>   <rationale>
>   If there is no need to make the Dovecot software available,
>   removing it provides a safeguard against its activation.
> diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
> index abbb12d..31e17c3 100644
> --- a/RHEL6/input/services/nfs.xml
> +++ b/RHEL6/input/services/nfs.xml
> @@ -345,11 +345,12 @@ however, there are a few clients that do not send credentials when requesting a
>   the client to only be able to lock world-readable files. To get around this, the <tt>insecure_locks</tt>
>   option can be used so these clients can access the desired export. This poses a security risk by
>   potentially allowing the client access to data for which it does not have authorization.
> -<br /><br />
> -This configuration is not recommended and strongly discouraged.
> -<br /><br />
> -Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure_locks</tt>.
> +Remove any instances of the
> +<tt>insecure_locks</tt> option from the file <tt>/etc/exports</tt>.
>   </description>
> +<ocil>
> +Check the file <tt>/etc/exports</tt> for any instances of the <tt>insecure_locks</tt>.
> +</ocil>
>   <rationale>Allowing insecure file locking could allow for sensitive data to be viewed or edited by
>   an unauthorized user.
>   </rationale>
> diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
> index c87fedf..b3991ba 100644
> --- a/RHEL6/input/services/ntp.xml
> +++ b/RHEL6/input/services/ntp.xml
> @@ -37,6 +37,7 @@ time data, is available at http://www.ntp.org.
>   <description>
>   <service-enable-macro service="ntpd" />
>   </description>
> +<ocil><service-enable-check-macro service="ntpd" /></ocil>
>   <rationale>Enabling the <tt>ntpd</tt> service ensures that the <tt>ntpd</tt>
>   service will be running and that the system will synchronize its time to
>   any servers specified. This is important whether the system is configured to be
> diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml
> index 927119b..e224054 100644
> --- a/RHEL6/input/services/snmp.xml
> +++ b/RHEL6/input/services/snmp.xml
> @@ -19,6 +19,9 @@ installed and activated, the software should be disabled and removed.
>   <description>
>   <service-disable-macro service="snmpd" />
>   </description>
> +<ocil>
> +<service-disable-check-macro service="snmpd" />
> +</ocil>
>   <rationale>
>   Running SNMP software provides a network-based avenue of attack, and
>   should be disabled if not needed.
> @@ -29,10 +32,12 @@ should be disabled if not needed.
>   
>   <Rule id="uninstall_net-snmp">
>   <title>Uninstall <tt>net-snmp</tt> Package</title>
> -<description>The <tt>net-snmp</tt> package, which provides the snmpd service,
> -can be uninstalled with the following command:
> -<pre># yum erase net-snmpd</pre>
> +<description>The <tt>net-snmp</tt> package provides the snmpd service.
> +<package-remove-macro package="net-snmpd" />
>   </description>
> +<ocil>
> +<package-check-macro package="net-snmpd" />
> +</ocil>
>   <rationale>
>   If there is no need to run SNMP server software,
>   removing the package provides a safeguard against its
> diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml
> index 4dbfa30..7aa01cb 100644
> --- a/RHEL6/input/services/squid.xml
> +++ b/RHEL6/input/services/squid.xml
> @@ -20,6 +20,9 @@ and removed.
>   <description>
>   <service-disable-macro service="squid" />
>   </description>
> +<ocil>
> +<service-disable-check-macro service="squid" />
> +</ocil>
>   <rationale>
>   Running proxy server software provides a network-based avenue
>   of attack, and should be removed if not needed.
> @@ -30,10 +33,12 @@ of attack, and should be removed if not needed.
>   
>   <Rule id="uninstall_squid">
>   <title>Uninstall squid Package</title>
> -<description>The <tt>squid</tt> package can be uninstalled with the
> -following command:
> -<pre># yum erase squid</pre>
> +<description>
> +<package-remove-macro package="squid" />
>   </description>
> +<ocil>
> +<package-check-macro package="squid" />
> +</ocil>
>   <rationale>
>   If there is no need to make the proxy server software available,
>   removing it provides a safeguard against its activation.

Ack


More information about the scap-security-guide mailing list