[PATCH 5/5] added check text to system section
Shawn Wells
shawn at redhat.com
Mon Sep 24 15:01:01 UTC 2012
On 9/24/12 9:45 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/accounts/physical.xml | 25 ++-
> .../accounts/restrictions/password_storage.xml | 40 +++--
> .../system/accounts/restrictions/root_logins.xml | 10 +-
> RHEL6/input/system/auditing.xml | 204 +++++++++++++++++---
> RHEL6/input/system/logging.xml | 13 +-
> RHEL6/input/system/network/ipsec.xml | 8 +-
> RHEL6/input/system/network/iptables.xml | 5 +
> RHEL6/input/system/network/ipv6.xml | 12 ++
> RHEL6/input/system/network/kernel.xml | 45 +++++
> RHEL6/input/system/network/uncommon.xml | 32 ++--
> RHEL6/input/system/network/wireless.xml | 4 +
> RHEL6/input/system/permissions/execution.xml | 6 +-
> RHEL6/input/system/permissions/files.xml | 145 ++++++++++-----
> RHEL6/input/system/selinux.xml | 45 ++---
> 14 files changed, 453 insertions(+), 141 deletions(-)
>
> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
> index 26b697c..568fc59 100644
> --- a/RHEL6/input/system/accounts/physical.xml
> +++ b/RHEL6/input/system/accounts/physical.xml
> @@ -29,8 +29,12 @@ If any correction is needed for the permissions on <tt>/etc/grub.conf</tt>, (whi
>
> <Rule id="user_owner_grub_conf">
> <title>Verify /boot/grub/grub.conf User Ownership</title>
> -<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to <tt>/boot/grub/grub.conf</tt> which
> -should be owned by the <tt>root</tt> user to prevent destruction or modification of the file.</description>
> +<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to
> +<tt>/boot/grub/grub.conf</tt> which should be owned by the <tt>root</tt> user
> +to prevent destruction or modification of the file.
> +<fileowner-desc-macro file="/boot/grub/grub.conf" owner="root"/>
> +</description>
> +<ocil><fileowner-check-macro file="/boot/grub/grub.conf" owner="root"/></ocil>
> <rationale>
> Only root should be able to modify important boot parameters.
> </rationale>
> @@ -41,8 +45,12 @@ Only root should be able to modify important boot parameters.
>
> <Rule id="group_owner_grub_conf">
> <title>Verify /boot/grub/grub.conf Group Ownership</title>
> -<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to <tt>/boot/grub/grub.conf</tt> which
> -should be group-owned by the <tt>root</tt> group to prevent destruction or modification of the file.</description>
> +<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to
> +<tt>/boot/grub/grub.conf</tt> which should be group-owned by the <tt>root</tt>
> +group to prevent destruction or modification of the file.
> +<filegroupowner-desc-macro file="/boot/grub/grub.conf" owner="root"/>
> +</description>
> +<ocil><filegroupowner-check-macro file="/boot/grub/grub.conf" owner="root"/></ocil>
> <rationale>
> The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this
> file should not have any access privileges anyway.
> @@ -55,10 +63,13 @@ file should not have any access privileges anyway.
> <Rule id="permissions_grub_conf">
> <title>Verify /boot/grub/grub.conf Permissions</title>
> <description>File permissions for <tt>/boot/grub/grub.conf</tt> should be set to 600, which
> -is the default.</description>
> +is the default.
> +<fileperms-desc-macro file="/boot/grub/grub.conf" owner="600"/>
> +</description>
> +<ocil><fileperms-check-macro file="/boot/grub/grub.conf" owner="-rw-------"/></ocil>
> <rationale>
> -This ensures that only the root user should be able to modify important boot parameters contained in
> -this file.
> +Proper permissions ensure that only the root user can modify important boot
> +parameters.
> </rationale>
> <ident cce="3923-0" />
> <oval id="file_permissions_grub_conf" />
> diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> index 29572f2..b030ad4 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> @@ -20,15 +20,16 @@ should allow administrators to avoid such misconfiguration.
> <title>Prevent Log In to Accounts With Empty Password</title>
> <description>If an account is configured for password authentication
> but does not have an assigned password, it may be possible to log
> -into the account without authentication. Ensuring that the <tt>nullok</tt>
> -option is <b>NOT</b> used in the <tt>/etc/pam.d/system-auth-ac</tt>
> -prevents logins with empty passwords.
> -<br /><br />
> -To verify manually, the following command can be used:
> -<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
> -If this produces any output, fix the problem by removing any instance
> -of <tt>nullok</tt> in <tt>/etc/pam.d/system-auth-ac</tt>.
> +into the account without authentication. Remove any instances of the <tt>nullok</tt>
> +option in <tt>/etc/pam.d/system-auth-ac</tt> to
> +prevent logins with empty passwords.
> </description>
> +<ocil>
> +To verify that null passwords cannot be used, run the following command:
> +<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
> +If this produces any output, it may be possible to log into accounts
> +with empty passwords.
> +</ocil>
> <rationale>
> If an account has an empty password, anybody may log in and
> run commands with the privileges of that account. Accounts with
> @@ -42,10 +43,19 @@ environments.
>
> <Rule id="no_hashes_outside_shadow">
> <title>Verify All Account Password Hashes are Shadowed</title>
> -<description>To ensure that no password hashes are stored in
> -<tt>/etc/passwd</tt>, the following command should have no output:
> -<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
> +<description>
> +If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
> +instead of an <tt>x</tt>), the cause of this misconfiguration should be
> +investigated. The account should have its password reset and the hash should be
> +properly stored, or the account should be deleted entirely.
> </description>
> +<ocil>
> +To check that no password hashes are stored in
> +<tt>/etc/passwd</tt>, run the following command:
> +<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
> +If it produces any output, then a password hash is
> +stored in <tt>/etc/passwd</tt>.
> +</ocil>
> <rationale>
> The hashes for all user account passwords should be stored in
> the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
> @@ -62,12 +72,14 @@ which is readable by all users.
> used to auto-login into FTP servers and reside in the user's home
> directory. These files may contain unencrypted passwords to
> remote FTP servers making them susceptible to access by unauthorized
> -users and should not be used.
> -<br /><br />
> +users and should not be used. Any <tt>.netrc</tt> files should be removed.
> +</description>
> +<ocil>
> To check the system for the existence of any <tt>.netrc</tt> files,
> run the following command:
> <pre># find / -name .netrc</pre>
> -</description>
> +<!-- needs fixup to limit search to home dirs -->
> +</ocil>
> <rationale>
> Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
> files. DoD policy requires passwords be encrypted in storage and not used
> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> index 0ee4e8b..f08b702 100644
> --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
> +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> @@ -134,12 +134,16 @@ become inaccessible.
> <Rule id="no_uidzero_except_root">
> <title>Verify Only Root Has UID 0</title>
> <description>
> -This command will print all password file entries for
> +If any account other than root has a UID of 0,
> +this misconfiguration should be investigated and the
> +accounts other than root should be removed or have their UID changed.
> +</description>
> +<ocil>
> +To list all password file entries for
> accounts with UID 0:
> <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
> This should print only one line, for the user root.
> -<br /><br />
> -</description>
> +</ocil>
> <rationale>
> An account has root authority if it has a UID of 0. Multiple accounts
> with a UID of 0 afford more opportunity for potential intruders to
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index 1649cfc..5cdb2ff 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -87,6 +87,7 @@ the Linux Auditing System, as it is responsible for writing audit records to
> disk.
> <service-enable-macro service="auditd" />
> </description>
> +<ocil><service-enable-check-macro service="auditd" /></ocil>
> <rationale>Ensuring that the <tt>auditd</tt> service is active ensures that
> audit records generated by the kernel can be written to disk, or that appropriate
> actions will be taken if other obstacles exist.
> @@ -103,6 +104,10 @@ those which start prior to the audit daemon, add the argument
> <tt>audit=1</tt> to the kernel line in <tt>/etc/grub.conf</tt>, in the manner below:
> <pre>kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1</pre>
> </description>
> +<ocil>
> +Inspect the kernel boot arguments (which follow the word <tt>kernel</tt>) in
> +<tt>/etc/grub.conf</tt> to ensure that they include <tt>audit=1</tt>.
> +</ocil>
> <rationale>
> Each process on the system carries an "auditable" flag which
> indicates whether its activities can be audited. Although <tt>auditd</tt>
> @@ -226,10 +231,15 @@ normally.</i>
> <description>Determine how many log files
> <tt>auditd</tt> should retain when it rotates logs.
> Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following
> -line, substituting <i>NUMLOGS</i> with an appropriate value:
> +line, substituting <i>NUMLOGS</i> with the correct value:
> <pre>num_logs = <i>NUMLOGS</i></pre>
> -The default value of 5 is recommended for general-purpose systems. Note that
> -values less than 2 result in no log rotation.</description>
> +Set the value to 5 for general-purpose systems.
> +Note that values less than 2 result in no log rotation.</description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine how many logs the system is configured to retain after rotation:
> +<pre>num_logs = 5</pre>
> +</ocil>
> <rationale>The total storage for audit log files must be large enough to retain
> log information over the period required. This is a function of the maxium log
> file size and the number of logs retained.</rationale>
> @@ -242,11 +252,16 @@ file size and the number of logs retained.</rationale>
> <description>Determine the amount of audit data (in megabytes)
> which should be retained in each log file. Edit the file
> <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line, substituting
> -<i>STOREMB</i> with an appropriate value:
> +the correct value for <i>STOREMB</i>:
> <pre>max_log_file = <i>STOREMB</i></pre>
> -The default value of 6 (MB) or even higher is recommended for general-purpose systems.
> +Set the value to <tt>6</tt> (MB) or higher for general-purpose systems.
> Larger values, of course,
> support retention of even more audit data.</description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine how much data the system will retain in each audit log file:
> +<pre>max_log_file = 6</pre>
> +</ocil>
> <rationale>The total storage for audit log files must be large enough to retain
> log information over the period required. This is a function of the maxium
> log file size and the number of logs retained.</rationale>
> @@ -260,13 +275,23 @@ log file size and the number of logs retained.</rationale>
> is to rotate the log files, discarding the oldest one. To configure the action taken
> by <tt>auditd</tt>, add or correct the line:
> <pre>max_log_file_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>suspend</tt>, <tt>rotate</tt>,
> -and <tt>keep_logs</tt>.
> -<br/><br/>
> -The default (case-insensitive) setting,
> -<tt>rotate</tt>, is recommended for most environments.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man
> +page. These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>rotate</tt></li>
> +<li><tt>keep_logs</tt></li>
> +</ul>
> +Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation
> +occurs. This is the default. The setting is case-insensitive.
> </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to rotate logs when they reach their
> +maximum size: <pre>max_log_file_action <tt>rotate</tt></pre>
> +</ocil>
> <rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>)
> minimizes the chances of the system unexpectedly running out of disk space by
> being overwhelmed with log data. However, for systems that must never discard
> @@ -293,16 +318,29 @@ installation time. The partition should be larger than the maximum space which
> <title>Configure auditd space_left Action on Low Disk Space</title>
> <description>The <tt>auditd</tt> service can be configured to take an action
> when disk space <i>starts</i> to run low.
> -Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
> +Edit the file <tt>/etc/audit/auditd.conf</tt>. Modify the following line,
> substituting <i>ACTION</i> appropriately:
> <pre>space_left_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
> -<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>.
> -<br/><br/>
> -Setting this to <tt>email</tt> is recommended over the default
> -(<tt>suspend</tt>) as it may be more likely to get prompt attention.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
> +These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>email</tt></li>
> +<li><tt>exec</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>single</tt></li>
> +<li><tt>halt</tt></li>
> +</ul>
> +Set this to <tt>email</tt> (instead of the default,
> +which is <tt>suspend</tt>) as it is more likely to get prompt attention.
> </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to email the administrator when
> +disk space is starting to run low:
> +<pre>space_left_action email</pre>
> +</ocil>
> <rationale>Notifying administrators of an impending disk space problem may
> allow them to take corrective action prior to any disruption.</rationale>
> <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
> @@ -317,14 +355,28 @@ when disk space is running low but prior to running out of space completely.
> Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
> substituting <i>ACTION</i> appropriately:
> <pre>admin_space_left_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> include are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
> -<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>. The default setting is
> -<tt>suspend</tt>, which may not be noticed by some administrators.
> -<br/><br/>
> -Setting this value to <tt>single</tt> will cause the system to switch to
> -single user mode for corrective action, and is recommended.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
> +These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>email</tt></li>
> +<li><tt>exec</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>single</tt></li>
> +<li><tt>halt</tt></li>
> +</ul>
> +Set this value to <tt>single</tt> to cause the system to switch to single user
> +mode for corrective action. For certain systems, the need for availability
> +outweighs the need to log all actions, and a different setting should be
> +determined.
> </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to switch to single user mode
> +when disk space has run low:
> +<pre>admin_space_left_action single</pre>
> +</ocil>
> <rationale>Administrators should be made aware of an inability to record
> audit records. If a separate partition or logical volume of adequate size
> is used, running low on space for audit records should never occur.
> @@ -342,6 +394,12 @@ in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
> via email for those situations:
> <pre>action_mail_acct = root</pre>
> </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to send email to an
> +account when it needs to notify an administrator:
> +<pre>action_mail_acct = root</pre>
> +</ocil>
> <rationale>Email sent to the root account is typically aliased to the
> administrators of the system, who can take appropriate action.</rationale>
> <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
> @@ -412,6 +470,9 @@ desired, but is not required. See an example of multiple combined syscalls:
> <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
> -k audit_time_rules</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>Arbitrary changes to the system time can be used to obfuscate
> nefarious activites in log files as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -437,6 +498,9 @@ desired, but is not required. See an example of multiple combined syscalls:
> <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
> -k audit_time_rules</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>Arbitrary changes to the system time can be used to obfuscate
> nefarious activites in log files as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -460,6 +524,9 @@ See an example of multiple combined syscalls:
> <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
> -k audit_time_rules</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>Arbitrary changes to the system time can be used to obfuscate
> nefarious activites in log files as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -485,6 +552,9 @@ desired, but is not required. See an example of multiple combined syscalls:
> <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
> -k audit_time_rules</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>Arbitrary changes to the system time can be used to obfuscate
> nefarious activites in log files as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -503,6 +573,13 @@ The -k option allows for the specification of a key in string form that can
> be used for better reporting capability through ausearch and aureport and
> should always be used.
> </description>
> +<ocil>
> +To determine if the system is configured to audit attempts to
> +alter time via the /etc/localtime file, run the following
> +command:
> +<pre># auditctl -l | grep "watch=/etc/localtime"</pre>
> +If the system is configured to audit this activity, it will return a line.
> +</ocil>
> <rationale>Arbitrary changes to the system time can be used to obfuscate
> nefarious activites in log files as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -525,9 +602,16 @@ to capture events that modify account changes:
> -w /etc/shadow -p wa -k audit_account_changes
> -w /etc/security/opasswd -p wa -k audit_account_changes</pre>
> </description>
> +<ocil>
> +To determine if the system is configured to audit account changes,
> +run the following command:
> +<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> +If the system is configured to watch for account changes, lines should be returned for
> +each file specified (and with <tt>perm=wa</tt> for each).
> +</ocil>
> <rationale>In addition to auditing new user and group accounts, these watches
> -will alert the system administrator(s) to any modifications. It is recommended
> -that any unexpected users, groups, or modifications be investigated for
> +will alert the system administrator(s) to any modifications. Any
> +unexpected users, groups, or modifications should be investigated for
> legitimacy.</rationale>
> <ident cce="14829-6" />
> <oval id="audit_rules_usergroup_modification" />
> @@ -545,6 +629,13 @@ ARCH to either b32 or b64 as appropriate for your system:
> -w /etc/hosts -p wa -k audit_network_modifications
> -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre>
> </description>
> +<ocil>
> +To determine if the system is configured to audit changes to its network configuration,
> +run the following command:
> +<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> +If the system is configured to watch for account changes, a line should be returned for
> +each file specified (and <tt>perm=wa</tt> should be indicated for each).
> +</ocil>
> <rationale>The network environment should not be modified by anything other
> than administrator action. Any change to network parameters should be
> audited.</rationale>
> @@ -560,7 +651,14 @@ Controls</title>
> <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
> <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
> </description>
> -<!-- TODO add info for selinux system calls which load new policy? -->
> +<ocil>
> +To determine if the system is configured to audit changes to its SELinux
> +configuration files, run the following command:
> +<pre># auditctl -l | grep "dir=selinux"</pre>
> +If the system is configured to watch for changes to its SELinux
> +configuration, a line should be returned (including
> +<tt>perm=wa</tt> indicating permissions that are watched).
> +</ocil>
> <rationale>The system's mandatory access policy (SELinux) should not be
> arbitrarily changed by anything other than administrator action. All changes to
> MAC policy should be audited.</rationale>
> @@ -618,6 +716,9 @@ If the system is 64 bit then also add the following:
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> unauthorized users.</rationale>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <warning category="general">Note that these rules can be configured in a
> number of ways while still acheiving the desired effect. Here the system calls
> have been placed independant of other system calls. Grouping these system
> @@ -640,6 +741,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -666,6 +770,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -692,6 +799,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmodat" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -718,6 +828,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchown" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -744,6 +857,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchownat" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -770,6 +886,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fremovexattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -796,6 +915,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fsetxattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -822,6 +944,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -848,6 +973,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="lremovexattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -874,6 +1002,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="lsetxattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -900,6 +1031,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="removexattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -926,6 +1060,9 @@ If the system is 64 bit then also add the following:
> <pre>-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 \
> -k perm_mod</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="setxattr" />
> +</ocil>
> <rationale>The changing of file permissions could indicate that a user is attempting to
> gain access to information that would otherwise be disallowed. Auditing DAC modifications
> can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -985,6 +1122,7 @@ appropriate for your system:
> -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
> -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access</pre>
> </description>
> +
> <rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
> these events could serve as evidence of potential system compromise.</rationale>
> <ident cce="14917-9" />
> @@ -1039,6 +1177,12 @@ appropriate for your system:
> <pre>-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
> -F auid>=500 -F auid!=4294967295 -k delete</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="unlink" />
> +<audit-syscall-check-macro syscall="unlinkat" />
> +<audit-syscall-check-macro syscall="rename" />
> +<audit-syscall-check-macro syscall="renameat" />
> +</ocil>
> <rationale>Auditing file deletions will create an audit trail for files that are removed
> from the system. The audit trail could aid in system troubleshooting as well as detecting
> malicious processes that attempt to delete log files to conceal their presence.</rationale>
> @@ -1071,6 +1215,10 @@ to capture kernel module loading and unloading events:
> -w /sbin/modprobe -p x -k modules
> -a always,exit -S init_module -S delete_module -k modules</pre>
> </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="init_module" />
> +<audit-syscall-check-macro syscall="delete_module" />
> +</ocil>
> <rationale>The addition/removal of kernel modules can be used to alter the behavior of
> the kernel and potentially introduce malicious code into kernel space. It is important
> to have an audit trail of modules that have been introduced into the kernel.</rationale>
> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
> index ea30340..d24b421 100644
> --- a/RHEL6/input/system/logging.xml
> +++ b/RHEL6/input/system/logging.xml
> @@ -20,12 +20,12 @@ monitor logs.</description>
> <Rule id="package_rsyslog_installed">
> <title>Ensure rsyslog is Installed</title>
> <description>
> -Rsyslog is installed by default. Ensure that it is installed
> -by running:
> -<pre>$ rpm -q rsyslog</pre>
> -If it is not installed, install it by running:
> -<pre># yum install rsyslog</pre>
> +Rsyslog is installed by default.
> +<package-install-macro service="rsyslog" />
> </description>
> +<ocil>
> +<package-check-macro package="rsyslog" />
> +</ocil>
> <rationale>
> The rsyslog package provides the rsyslog daemon, which provides
> system logging services.
> @@ -41,6 +41,9 @@ system logging services.
> <description>The <tt>rsyslog</tt> service provides syslog-style logging by default on RHEL 6.
> <service-enable-macro service="rsyslog" />
> </description>
> +<ocil>
> +<service-enable-check-macro service="rsyslog" />
> +</ocil>
> <rationale>The <tt>rsyslog</tt> service must be running in order to provide
> logging services, which are essential to system administration.
> </rationale>
> diff --git a/RHEL6/input/system/network/ipsec.xml b/RHEL6/input/system/network/ipsec.xml
> index a9bc1a7..a738354 100644
> --- a/RHEL6/input/system/network/ipsec.xml
> +++ b/RHEL6/input/system/network/ipsec.xml
> @@ -8,10 +8,12 @@ is provided in RHEL 6 with Openswan.
> <title>Install openswan Package</title>
> <description>The Openswan package provides an implementation of IPsec
> and IKE, which permits the creation of secure tunnels over
> -untrusted networks. The <tt>openswan</tt> package can be installed
> -with the following command:
> -<pre># yum install openswan</pre>
> +untrusted networks.
> +<package-install-macro package="openswan" />
> </description>
> +<ocil>
> +<package-check-macro package="openswan" />
> +</ocil>
> <rationale>Providing the ability for remote users or systems
> to initiate a secure VPN connection protects information when it is
> transmitted over a wide area network.
> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
> index 31237b7..9aae35d 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -71,6 +71,7 @@ IPv6 lacks reliable connection-tracking functionality.</description>
> <description>
> <service-enable-macro service="ip6tables" />
> </description>
> +<ocil><service-enable-check-macro service="ip6tables" /></ocil>
> <rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
> capability for IPv6 and ICMPv6.
> </rationale>
> @@ -84,6 +85,7 @@ capability for IPv6 and ICMPv6.
> <description>
> <service-enable-macro service="iptables" />
> </description>
> +<ocil><service-enable-check-macro service="iptables" /></ocil>
> <rationale>
> The <tt>iptables</tt> service provides the system's host-based firewalling
> capability for IPv4 and ICMP.
> @@ -133,6 +135,9 @@ add or correct the following line in
> <tt>/etc/sysconfig/iptables</tt>:
> <pre>:INPUT DROP [0:0]</pre>
> </description>
> +<ocil>Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine
> +the default policy for the INPUT chain. It should be set to DROP.
> +</ocil>
> <rationale>In <tt>iptables</tt> the default policy is applied only after all
> the applicable rules in the table are examined for a match. Setting the
> default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
> diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
> index 7b43edd..b703e1d 100644
> --- a/RHEL6/input/system/network/ipv6.xml
> +++ b/RHEL6/input/system/network/ipv6.xml
> @@ -22,6 +22,18 @@ instruct the IPv6 kernel module not to load it.</description>
> This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it),
> while disabling support for the IPv6 protocol.
> </description>
> +<ocil>
> +If the system is configured to prevent the loading of the
> +<tt>ipv6</tt> kernel module, it will contain a line
> +of the form
> +<pre>options ipv6 disable=1</pre>
> +inside any file in <tt>/etc/modprobe.d</tt> or the deprecated<tt>/etc/modprobe.conf</tt>.
> +This permits insertion of the IPv6 kernel module (which other parts of the system
> +expect to be present), but otherwise keeps it inactive.
> +Run the following command to search for such lines in all files in <tt>/etc/modprobe.d</tt>
> +and the deprecated <tt>/etc/modprobe.conf</tt>:
> +<pre xml:space="preserve">$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d</pre>
> +</ocil>
> <rationale>
> Any networking stack, including IPv6, that does not need to be active should be
> disabled in order to reduce the system's vulnerability
> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
> index 63bb1f5..5485fcd 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -16,6 +16,9 @@ of network traffic.</description>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
> +</ocil>
> <rationale>Sending ICMP redirects permits the system to instruct other systems
> to update their routing information. The ability to send ICMP redirects is
> only appropriate for routers.</rationale>
> @@ -29,6 +32,9 @@ only appropriate for routers.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
> +</ocil>
> <rationale>Sending ICMP redirects permits the system to instruct other systems
> to update their routing information. The ability to send ICMP redirects is
> only appropriate for routers.</rationale>
> @@ -42,6 +48,9 @@ only appropriate for routers.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
> +</ocil>
> <rationale>IP forwarding permits the kernel to forward packets from one network
> interface to another. The ability to forward packets between two networks is
> only appropriate for routers.</rationale>
> @@ -190,6 +199,9 @@ operator="equals" interactive="0">
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
> +</ocil>
> <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> <ident cce="4236-6" />
> @@ -202,6 +214,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
> +</ocil>
> <rationale>Accepting ICMP redirects has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> <ident cce="4217-6" />
> @@ -215,6 +230,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
> +</ocil>
> <rationale>Accepting "secure" ICMP redirects (from those gateways listed as
> default gateways) has few legitimate uses. It should be disabled unless it is
> absolutely required.</rationale>
> @@ -228,6 +246,9 @@ absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
> +</ocil>
> <rationale>The presence of "martian" packets (which have impossible addresses)
> as well as spoofed packets, source-routed packets, and redirects could be a
> sign of nefarious network activity. Logging these packets enables this activity
> @@ -243,6 +264,9 @@ to be detected.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
> +</ocil>
> <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> <ident cce="4091-5" />
> @@ -256,6 +280,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
> +</ocil>
> <rationale>This feature of the IPv4 protocol has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> <ident cce="4186-3" />
> @@ -269,6 +296,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
> +</ocil>
> <rationale>Accepting "secure" ICMP redirects (from those gateways listed as
> default gateways) has few legitimate uses. It should be disabled unless it is
> absolutely required.</rationale>
> @@ -283,6 +313,9 @@ absolutely required.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
> +</ocil>
> <rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
> addresses makes the system slightly more difficult to enumerate on the network.
> </rationale>
> @@ -297,6 +330,9 @@ addresses makes the system slightly more difficult to enumerate on the network.
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
> +</ocil>
> <rationale>Ignoring bogus ICMP error responses reduces
> log size, although some activity would not be logged.</rationale>
> <ident cce="4133-5" />
> @@ -309,6 +345,9 @@ log size, although some activity would not be logged.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
> +</ocil>
> <rationale> A TCP SYN flood attack can cause a denial of service by filling a
> system's TCP connection table with connections in the SYN_RCVD state.
> Syncookies can be used to track a connection when a subsequent ACK is received,
> @@ -326,6 +365,9 @@ enables the system to continue servicing valid connection requests.
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
> +</ocil>
> <rationale>Enabling reverse path filtering drops packets with source addresses
> that should not have been able to be received on the interface they were
> received on. It should not be used on systems which are routers for
> @@ -341,6 +383,9 @@ networks.</rationale>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
> </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
> +</ocil>
> <rationale>Enabling reverse path filtering drops packets with source addresses
> that should not have been able to be received on the interface they were
> received on. It should not be used on systems which are routers for
> diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
> index 75e35d7..84697d5 100644
> --- a/RHEL6/input/system/network/uncommon.xml
> +++ b/RHEL6/input/system/network/uncommon.xml
> @@ -14,13 +14,15 @@ prior to disabling them.
>
> <Rule id="disable_protocol_dccp" severity="medium">
> <title>Disable DCCP Support</title>
> -<description>To prevent the DCCP kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install dccp /bin/true</pre>
> +<description>
> The Datagram Congestion Control Protocol (DCCP) is a
> relatively new transport layer protocol, designed to support
> streaming media and telephony.
> +<module-disable-macro module="dccp" />
> </description>
> +<ocil>
> +<module-disable-check-macro module="dccp" />
> +</ocil>
> <rationale>
> Disabling DCCP protects
> the system against exploitation of any flaws in its implementation.
> @@ -33,14 +35,16 @@ the system against exploitation of any flaws in its implementation.
>
> <Rule id="disable_protocol_sctp" severity="medium">
> <title>Disable SCTP Support</title>
> -<description>To prevent the SCTP kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install sctp /bin/true</pre>
> +<description>
> The Stream Control Transmission Protocol (SCTP) is a
> transport layer protocol, designed to support the idea of
> message-oriented communication, with several streams of messages
> within one connection.
> +<module-disable-macro module="sctp" />
> </description>
> +<ocil>
> +<module-disable-check-macro module="sctp" />
> +</ocil>
> <rationale>
> Disabling SCTP protects
> the system against exploitation of any flaws in its implementation.
> @@ -53,13 +57,15 @@ the system against exploitation of any flaws in its implementation.
>
> <Rule id="disable_protocol_rds">
> <title>Disable RDS Support</title>
> -<description>To prevent the RDS kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install rds /bin/true</pre>
> +<description>
> The Reliable Datagram Sockets (RDS) protocol is a transport
> layer protocol designed to provide reliable high- bandwidth,
> low-latency communications between nodes in a cluster.
> +<module-disable-macro module="rds" />
> </description>
> +<ocil>
> +<module-disable-check-macro module="rds" />
> +</ocil>
> <rationale>
> Disabling RDS protects
> the system against exploitation of any flaws in its implementation.
> @@ -72,13 +78,15 @@ the system against exploitation of any flaws in its implementation.
>
> <Rule id="disable_protocol_tipc" severity="medium">
> <title>Disable TIPC Support</title>
> -<description>To prevent the TIPC kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install tipc /bin/true</pre>
> +<description>
> The Transparent Inter-Process Communication (TIPC) protocol
> is designed to provide communications between nodes in a
> cluster.
> +<module-disable-macro module="tipc" />
> </description>
> +<ocil>
> +<module-disable-check-macro module="tipc" />
> +</ocil>
> <rationale>
> Disabling TIPC protects
> the system against exploitation of any flaws in its implementation.
> diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
> index 689fe69..7686390 100644
> --- a/RHEL6/input/system/network/wireless.xml
> +++ b/RHEL6/input/system/network/wireless.xml
> @@ -90,6 +90,9 @@ the need to install such a driver first.
> <description>
> <service-disable-macro service="bluetooth" />
> </description>
> +<ocil>
> +<service-disable-check-macro service="bluetooth" />
> +</ocil>
> <rationale>Disabling the <tt>bluetooth</tt> service prevents the system from attempting
> connections to to Bluetooth devices, which entails some security risk.
> Nevertheless, variation in this risk decision may be expected due to the
> @@ -108,6 +111,7 @@ to prevent the loading of the Bluetooth module:
> <pre>install net-pf-31 /bin/true
> install bluetooth /bin/true</pre>
> </description>
> +
> <rationale>If Bluetooth functionality must be disabled, preventing the kernel
> from loading the kernel module provides an additional safeguard against its
> activation.</rationale>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index c7e4034..6d32805 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -69,7 +69,8 @@ value of 0 is recommended.</description>
>
> <Rule id="disable_users_coredumps">
> <title>Disable Core Dumps for All Users</title>
> -<description>To disable core dumps for all users, add the following line to <tt>/etc/security/limits.conf</tt>:
> +<description>To disable core dumps for all users, add the following line to
> +<tt>/etc/security/limits.conf</tt>:
> <pre>* hard core 0</pre>
> </description>
> <rationale>A core dump includes a memory image taken at the time the operating system
> @@ -84,6 +85,7 @@ only for developers trying to debug problems.</rationale>
> <Rule id="disable_setuid_coredumps">
> <title>Disable Core Dumps for SUID programs</title>
> <description><sysctl-desc-macro sysctl="fs.suid_dumpable" value="0" /></description>
> +<ocil><sysctl-check-macro sysctl="fs.suid_dumpable" value="0" /></ocil>
> <rationale>The core dump of a setuid program is more likely to contain
> sensitive data, as the program itself runs with greater privileges than the
> user who initiated execution of the program. Disabling the ability for any
> @@ -109,6 +111,7 @@ controlled through <tt>sysctl</tt> variables <tt>kernel.exec-shield</tt> and
> <Rule id="enable_execshield">
> <title>Enable ExecShield</title>
> <description><sysctl-desc-macro sysctl="kernel.exec-shield" value="1" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.exec-shield" value="1" /></ocil>
> <rationale>ExecShield uses the segmentation feature on all x86 systems
> to prevent execution in memory higher than a certain address. It
> writes an address as a limit in the code segment descriptor, to
> @@ -124,6 +127,7 @@ address range.</rationale>
> <Rule id="enable_randomize_va_space">
> <title>Enable Randomized Layout of Virtual Address Space</title>
> <description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="1" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="1" /></ocil>
> <rationale> Address space layout randomization (ASLR) makes it more difficult
> for an attacker to predict the location of attack code he or she has introduced
> into a process's address space during an attempt at exploitation. ASLR also
> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
> index b82c024..59f0a3a 100644
> --- a/RHEL6/input/system/permissions/files.xml
> +++ b/RHEL6/input/system/permissions/files.xml
> @@ -19,8 +19,8 @@ passwords, and should never be enabled.</description>
>
> <Rule id="userowner_shadow_file">
> <title>Verify User Who Owns <tt>shadow</tt> File</title>
> -<description>The <tt>/etc/shadow</tt> file should be owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/shadow" owner="root"/></ocil>
> <rationale>The <tt>/etc/shadow</tt> file contains the list of local
> system accounts and stores password hashes. Protection of this file is
> critical for system security. Failure to give ownership of this file
> @@ -33,8 +33,8 @@ which could weaken the system security posture.</rationale>
>
> <Rule id="groupowner_shadow_file">
> <title>Verify Group Who Owns <tt>shadow</tt> File</title>
> -<description>The <tt>/etc/shadow</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/shadow" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/shadow" group="root"/></ocil>
> <rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
> critical for system security.</rationale>
> <ident cce="3988-3" />
> @@ -44,8 +44,8 @@ critical for system security.</rationale>
>
> <Rule id="perms_shadow_file">
> <title>Verify Permissions on <tt>shadow</tt> File</title>
> -<description>File permissions for <tt>/etc/shadow</tt> should be set
> -to 0000.</description>
> +<description><fileperms-desc-macro file="/etc/shadow" perms="0000"/></description>
> +<ocil><fileperms-check-macro file="/etc/shadow" perms="----------"/></ocil>
> <rationale>The <tt>/etc/shadow</tt> file contains the list of local
> system accounts and stores password hashes. Protection of this file is
> critical for system security. Failure to give ownership of this file
> @@ -58,8 +58,8 @@ which could weaken the system security posture.</rationale>
>
> <Rule id="userowner_group_file">
> <title>Verify User Who Owns <tt>group</tt> File</title>
> -<description>The <tt>/etc/group</tt> file should be owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/group" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/group" owner="root"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
> on the system. Protection of this file is important for system security.</rationale>
> <ident cce="3276-3" />
> @@ -69,8 +69,8 @@ on the system. Protection of this file is important for system security.</ration
>
> <Rule id="groupowner_group_file">
> <title>Verify Group Who Owns <tt>group</tt> File</title>
> -<description>The <tt>/etc/group</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/group" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/group" group="root"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
> on the system. Protection of this file is important for system security.</rationale>
> <ident cce="3883-6" />
> @@ -80,8 +80,8 @@ on the system. Protection of this file is important for system security.</ration
>
> <Rule id="perms_group_file">
> <title>Verify Permissions on <tt>group</tt> File</title>
> -<description>File permissions for <tt>/etc/group</tt> should be set
> -correctly.</description>
> +<description><fileperms-desc-macro file="/etc/group" perms="644"/></description>
> +<ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
> on the system. Protection of this file is important for system security.</rationale>
> <ident cce="3967-7" />
> @@ -91,8 +91,8 @@ on the system. Protection of this file is important for system security.</ration
>
> <Rule id="userowner_gshadow_file">
> <title>Verify User Who Owns <tt>gshadow</tt> File</title>
> -<description>The <tt>/etc/gshadow</tt> file should be group-owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/gshadow" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/gshadow" owner="root"/></ocil>
> <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
> is critical for system security.</rationale>
> <ident cce="4210-1" />
> @@ -102,8 +102,8 @@ is critical for system security.</rationale>
>
> <Rule id="groupowner_gshadow_file">
> <title>Verify Group Who Owns <tt>gshadow</tt> File</title>
> -<description>The <tt>/etc/gshadow</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/gshadow" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/gshadow" group="root"/></ocil>
> <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
> is critical for system security.</rationale>
> <ident cce="4064-2" />
> @@ -113,8 +113,8 @@ is critical for system security.</rationale>
>
> <Rule id="perms_gshadow_file">
> <title>Verify Permissions on <tt>gshadow</tt> File</title>
> -<description>File permissions for <tt>/etc/gshadow</tt> should be set
> -correctly.</description>
> +<description><fileperms-desc-macro file="/etc/gshadow" perms="0000"/></description>
> +<ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
> <rationale>The /etc/gshadow file contains group password hashes. Protection of this file
> is critical for system security.</rationale>
> <ident cce="3932-1" />
> @@ -124,6 +124,8 @@ is critical for system security.</rationale>
>
> <Rule id="userowner_passwd_file">
> <title>Verify User Who Owns <tt>passwd</tt> File</title>
> +<description><fileowner-desc-macro file="/etc/passwd" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil>
> <description>The <tt>/etc/passwd</tt> file should be owned by
> root.</description>
> <rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on
> @@ -135,8 +137,8 @@ the system. Protection of this file is critical for system security.</rationale>
>
> <Rule id="groupowner_passwd_file">
> <title>Verify Group Who Owns <tt>passwd</tt> File</title>
> -<description>The <tt>/etc/passwd</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/passwd" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/passwd" group="root"/></ocil>
> <rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
> the system. Protection of this file is critical for system security.</rationale>
> <ident cce="3495-9" />
> @@ -146,8 +148,8 @@ the system. Protection of this file is critical for system security.</rationale>
>
> <Rule id="file_permissions_etc_passwd">
> <title>Verify Permissions on <tt>passwd</tt> File</title>
> -<description>File permissions for <tt>/etc/passwd</tt> should be set
> -to 0644 or less permissive.</description>
> +<description><fileperms-desc-macro file="/etc/passwd" perms="0644"/></description>
> +<ocil><fileperms-check-macro file="/etc/passwd" perms="-rw-r--r--"/></ocil>
> <rationale>If the <tt>/etc/passwd</tt> file is writable by a group-owner or the
> world the risk of its compromise is increased. The file contains the list of
> acounts on the system and associated information, and protection of this file
> @@ -184,6 +186,11 @@ Kernel modules, which can be added to the kernel during runtime, are
> stored in <tt>/lib/modules</tt>. All files in these directories should not be
> group-writable or world-writable.
> </description>
> +<ocil>
> +To find shared libraries that are group-writable or world-writable,
> +run the following command for each directory <i>DIR</i> which contains shared libraries:
> +<pre>$ find <i>DIR</i> -perm /022</pre>
> +</ocil>
> <rationale>Files from shared library directories are loaded into the address
> space of processes (including privileged ones) or of the kernel itself at
> runtime. Restrictive permissions are necessary to protect the integrity of the system.
> @@ -204,6 +211,11 @@ Kernel modules, which can be added to the kernel during runtime, are also
> stored in <tt>/lib/modules</tt>. All files in these directories should be
> owned by the <tt>root</tt> user.
> </description>
> +<ocil>
> +To find shared libraries that are not owned by <tt>root</tt>,
> +run the following command for each directory <i>DIR</i> which contains shared libraries:
> +<pre>$ find <i>DIR</i> \! -user root</pre>
> +</ocil>
> <rationale>Files from shared library directories are loaded into the address
> space of processes (including privileged ones) or of the kernel itself at
> runtime. Proper ownership is necessary to protect the integrity of the system.
> @@ -223,6 +235,11 @@ System executables are stored in the following directories by default:
> /usr/local/sbin</pre>
> All files in these directories should not be group-writable or world-writable.
> </description>
> +<ocil>
> +To find system executables that are group-writable or world-writable,
> +run the following command for each directory <i>DIR</i> which contains system executables:
> +<pre>$ find <i>DIR</i> -perm /022</pre>
> +</ocil>
> <rationale>System binaries are executed by privileged users as well as system services,
> and restrictive permissions are necessary to ensure that their
> execution of these programs cannot be co-opted.
> @@ -241,6 +258,11 @@ System executables are stored in the following directories by default:
> /usr/local/sbin</pre>
> All files in these directories should be owned by the <tt>root</tt> user.
> </description>
> +<ocil>
> +To find system executables that are not owned by <tt>root</tt>,
> +run the following command for each directory <i>DIR</i> which contains system executables:
> +<pre>$ find <i>DIR</i> \! -user root</pre>
> +</ocil>
> <rationale>System binaries are executed by privileged users as well as system services,
> and restrictive permissions are necessary to ensure that their
> execution of these programs cannot be co-opted.
> @@ -261,7 +283,16 @@ there is no reason for a directory to be world-writable, a better
> solution is to remove that permission rather than to set the sticky
> bit. However, if a directory is used by a particular application,
> consult that application's documentation instead of blindly
> -changing modes.</description>
> +changing modes.
> +<br/>
> +To set the sticky bit on a world-writable directory <i>DIR</i>, run the
> +following command:
> +<pre># chmod +t <i>DIR</i></pre>
> +</description>
> +<ocil>
> +To find world-writable directories that lack the sticky bit, run the following command:
> +<pre># find / -type d -perm -002 ! -perm -1000</pre>
> +</ocil>
> <ident cce="3399-3" />
> <oval id="dir_perms_world_writable_sticky_bits" />
> <ref nist="CM-6"/>
> @@ -281,6 +312,10 @@ documentation for specific applications before making changes.
> Also, monitor for recurring world-writable files, as these may be
> symptoms of a misconfigured application or user
> account.</description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
> <ident cce="3795-2" />
> <ref nist="CM-6"/>
> </Rule>
> @@ -293,6 +328,10 @@ unauthorized SGID files is determine if any were not installed as part of an
> RPM package, which is cryptographically verified. Investigate the origin
> of any unpackaged SGID files.
> </description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
> <rationale>Executable files with the SGID permission run with the privileges of
> the owner of the file. SGID files of uncertain provenance could allow for
> unprivileged users to elevate privileges. The presence of these files should be
> @@ -310,6 +349,10 @@ unauthorized SGID files is determine if any were not installed as part of an
> RPM package, which is cryptographically verified. Investigate the origin
> of any unpackaged SUID files.
> </description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
> <rationale>Executable files with the SUID permission run with the privileges of
> the owner of the file. SUID files of uncertain provenance could allow for
> unprivileged users to elevate privileges. The presence of these files should be
> @@ -322,16 +365,20 @@ strictly controlled on the system.</rationale>
>
> <Rule id="no_files_unowned_by_user">
> <title>Ensure All Files Are Owned by a User</title>
> -<description>The following command will discover and print any
> -files on local partitions which do not belong to a valid user and a
> -valid group. Run it once for each local partition PART:
> -<pre># find PART -xdev \( -nouser -o -nogroup \) -print</pre>
> -If this command prints any results, investigate each reported file and
> -either assign it to an appropriate user and group or remove it.
> +<description>If any files are not owned by a user, then the
> +cause of their lack of ownership should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate user.
> </description>
> +<ocil>
> +The following command will discover and print any
> +files on local partitions which do not belong to a valid user.
> +Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -nouser -print</pre>
> +</ocil>
> <rationale>
> Unowned files do not directly imply a security problem, but they are generally
> -a sign that something is wrong with some system process. They may
> +a sign that something is amiss. They may
> be caused by an intruder, by incorrect software installation or
> draft software removal, or by failure to remove all files belonging
> to a deleted account. The files should be repaired so that they
> @@ -345,16 +392,20 @@ and the cause should be discovered and addressed.
>
> <Rule id="no_files_unowned_by_group">
> <title>Ensure All Files Are Owned by a Group</title>
> -<description>The following command will discover and print any
> -files on local partitions which do not belong to a valid user and a
> -valid group. Run it once for each local partition PART:
> -<pre># find PART -xdev \( -nouser -o -nogroup \) -print</pre>
> -If this command prints any results, investigate each reported file and
> -either assign it to an appropriate user and group or remove it.
> +<description>If any files are not owned by a group, then the
> +cause of their lack of group-ownership should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate group.
> </description>
> +<ocil>
> +The following command will discover and print any
> +files on local partitions which do not belong to a valid group.
> +Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -nogroup -print</pre>
> +</ocil>
> <rationale>
> Unowned files do not directly imply a security problem, but they are generally
> -a sign that something is wrong with some system process. They may
> +a sign that something is amiss. They may
> be caused by an intruder, by incorrect software installation or
> draft software removal, or by failure to remove all files belonging
> to a deleted account. The files should be repaired so that they
> @@ -368,15 +419,19 @@ and the cause should be discovered and addressed.
>
> <Rule id="world_writable_files_system_ownership">
> <title>Ensure All World-Writable Directories Are Owned by a System Account</title>
> -<description>Locate any directories in local partitions which are
> -world-writable and ensure that they are owned by root or another
> -system account. The following command will discover and print these
> -(assuming only system accounts have a uid lower than 500). Run it
> -once for each local partition PART:
> -<pre># find PART -xdev -type d -perm -0002 -uid +500 -print</pre>
> -If this command produces any output, investigate why the
> -current owner is not root or another system account.
> +<description>All directories in local partitions which are
> +world-writable should be owned by root or another
> +system account. If any world-writable directories are not
> +owned by a system account, this should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate group.
> </description>
> +<ocil>
> +The following command will discover and print world-writable directories that
> +are not owned by a system account, given the assumption that only system
> +accounts have a uid lower than 500. Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -type d -perm -0002 -uid +500 -print</pre>
> +</ocil>
> <rationale>
> Allowing a user account to own a world-writeable directory is
> undesirable because it allows the owner of that directory to remove
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 1565d5f..3d68315 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -84,18 +84,15 @@ and to protect the boot process.
>
> <Rule id="enable_selinux_bootloader">
> <title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
> -<description>SELinux can be disabled at boot time by an argument
> -in <tt>/etc/grub.conf</tt>.
> -To ensure that SELinux is not disabled at boot time, ensure that <tt>selinux=0</tt> is not
> -found in the kernel arguments in that file.
> +<description>SELinux can be disabled at boot time by an argument in
> +<tt>/etc/grub.conf</tt>.
> +Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
> +file to prevent SELinux from being being disabled at boot.
> </description>
> <ocil>
> -Run the following command to determine if SELinux has been
> -disabled at boot time:
> -<pre># grep selinux=0 /etc/grub.conf</pre>
> -If it doesn't reurn a value, then it hasn't been disabled. ex:
> -<pre># grep selinux=0 /etc/grub.conf</pre>
> -<pre># <---Flashing cursor</pre>
> +Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
> +in the kernel boot arguments. Presences of <tt>selinux=0</tt> indicates
> +that SELinux is disabled at boot time.
> </ocil>
> <rationale>
> Disabling a major host protection feature such as SELinux at boot time prevents
> @@ -109,13 +106,15 @@ the chances that it remain off during system operation.
>
> <Rule id="set_selinux_state">
> <title>Ensure SELinux State is Enforcing</title>
> -<description>The SELinux state should be set to <tt>enforcing</tt> during
> -normal system operation.</description>
> -<ocil>To ensure the system is configured to boot into enforcing mode, add
> -or correct the following line in: <tt>/etc/selinux/config</tt> by ensuring the
> -following text is present: <tt>SELINUX=enforcing</tt>
> -<pre># grep "SELINUX=enforcing" /etc/selinux/config</pre>
> -If needed add the text to the file, and save it.</ocil>
> +<description>The SELinux state should be set to <tt>enforcing</tt> at
> +system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
> +line <tt>SELINUX=enforcing</tt> to configure the system to boot into enforcing
> +mode.
> +</description>
> +<ocil>
> +Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
> +<pre>SELINUX=enforcing</pre>
> +</ocil>
> <rationale>
> Setting the SELinux state to enforcing ensures that SELinux is able to confine
> potentially compromised processes to the security policy, which is designed to
> @@ -135,13 +134,13 @@ To configure the system to use this policy, add or correct the following line
> in <tt>/etc/selinux/config</tt>:
> <pre>SELINUXTYPE=targeted</pre>
> Other policies, such as <tt>mls</tt>, provide additional security labeling
> -and greater confinement.
> +and greater confinement but are not compatible with many general-purpose
> +use cases.
> </description>
> -<ocil>To ensure the system is configured to boot into targeted mode, add
> -or correct the following line in: <tt>/etc/selinux/config</tt> by ensuring the
> -following text is present: <tt>SELINUX=targeted</tt>
> -<pre># grep "SELINUX=targeted" /etc/selinux/config</pre>
> -If needed add the text to the file, and save it.</ocil>
> +<ocil>
> +Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
> +<pre>SELINUXTYPE=targeted</pre>
> +</ocil>
> <rationale>
> Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
> ensures that the system will confine processes that are likely to be
I didn't know you'd be working on any of this, so this will conflict
with my patches & content, but ack since you pushed your patches out first.
Likely need to have a status call on content on who is working on what.
It's clear we both spent several hours working on the same content,
which was a gross duplication of effort.
More information about the scap-security-guide
mailing list