[PATCH 1/2] added OCIL checks

David Smith dsmith at eclipse.ncsc.mil
Tue Sep 25 20:00:53 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/ftp.xml  |    6 ++++--
 RHEL6/input/services/ldap.xml |    4 ++++
 RHEL6/input/services/mail.xml |    5 +++++
 RHEL6/input/services/ssh.xml  |   23 +++++++++++++++++++++++
 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 7d62c2c..b6a8f65 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -99,12 +99,14 @@ by default. Add or correct the following configuration options:
 <ref disa="48" />
 <!--<oval id="ftp_present_banner" />-->
 <!--<ref nist="CM-6, CM-7" /> -->
-<ocil>To verify this configuration, run the following command:
+<ocil clause="it does not">
+To verify this configuration, run the following command:
 <pre>grep "banner_file" /etc/vsftpd/vsftpd.conf</pre>
 
 The output should show the value of <tt>banner_file</tt> is set to <tt>/etc/issue</tt>, an example of which is shown below:
 <pre># grep "banner_file" /etc/issue
-banner_file=/etc/issue"</pre></ocil>
+banner_file=/etc/issue"</pre>
+</ocil>
 </Rule>
 
 <Group id="ftp_restrict_users">
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 3ee8b64..de3a552 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -32,6 +32,10 @@ network.</warning>
 <pre>ssl start_tls</pre>
 Then review the LDAP server and ensure TLS has been configured.
 </description>
+<ocil clause="no lines are returned">
+To ensure LDAP is configured to use TLS for all transactions, run the following command:
+<pre>$ grep start_tls /etc/pam_ldap.conf</pre>
+</ocil>
 <rationale>The ssl directive specifies whether to use ssl or not. If
 not specified it will default to no. It should be set to start_tls rather
 than doing LDAP over SSL.</rationale>
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index d0016bc..e30d011 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -69,6 +69,11 @@ Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
 <tt>inet_interfaces</tt> line appears:
 <pre>inet_interfaces = localhost</pre>
 </description>
+<ocil clause="it does not">
+Run the following command to ensure postfix accepts mail messages from only the local system:
+<pre>$ grep inet_interfaces /etc/postfix/main.cf</pre>
+If properly configured, the output should show only <tt>localhost</tt>.
+</ocil>
 <rationale>
 This ensures that <tt>postfix</tt> accepts mail messages
 (such as cron job reports) from the local system only,
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 19c17f0..d60e499 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -69,6 +69,11 @@ verified by ensuring that the following
 line appears:
 <pre>Protocol 2</pre>
 </description>
+<ocil clause="it is not">
+To check which SSH protocol version is allowed, run the following command:
+<pre># grep Protocol /etc/ssh/sshd_config</pre>
+If configured properly, output should be <pre>Protocol 2</pre>
+</ocil>
 <rationale>
 SSH protocol version 1 suffers from design flaws that
 result in security vulnerabilities and
@@ -151,6 +156,12 @@ shell, that value will preempt any SSH
 setting made here. Keep in mind that some processes may stop SSH
 from correctly detecting that the user is idle.
 </description>
+<ocil clause="it is not">
+Run the following command to see what the timeout interval is:
+<pre># grep ClientAliveInterval /etc/ssh/sshd_config</pre>
+If properly configured, the output should be:
+<pre>ClientAliveInterval 900</pre>
+</ocil>
 <rationale>
 Causing idle users to be automatically logged out
 guards against compromises one system leading trivially
@@ -169,6 +180,12 @@ edit <tt>/etc/ssh/sshd_config</tt> as
 follows:
 <pre>ClientAliveCountMax 0</pre>
 </description>
+<ocil clause="it is not">
+To ensure the SSH idle timeout will occur when the <tt>ClientAliveInterval</tt> is set, run the following command:
+<pre># grep ClientAliveCountMax /etc/ssh/sshd_config</pre>
+If properly configured, output should be:
+<pre>ClientAliveCountMax 0</pre>
+</ocil>
 <rationale>
 This ensures that a user login will be terminated as soon as the <tt>ClientAliveInternal</tt>
 is reached.
@@ -281,6 +298,12 @@ environment options to the SSH daemon, add or correct the following line
 in <tt>/etc/ssh/sshd_config</tt>:
 <pre>PermitUserEnvironment no</pre>
 </description>
+<ocil clause="it is not">
+To ensure users are not able to present environment daemons, run the following command:
+<pre># grep PermitUserEnvironment /etc/ssh/sshd_config</pre>
+If properly configured, output should be:
+<pre>PermitUserEnvironment no</pre>
+</ocil>
 <rationale>
 SSH environment options potentially allow users to bypass
 access restriction in some configurations.
-- 
1.7.1



More information about the scap-security-guide mailing list