[PATCH] additional OCIL check text
Jeffrey Blank
blank at eclipse.ncsc.mil
Fri Sep 28 15:47:56 UTC 2012
Please push. Thanks!
On 09/27/2012 06:35 PM, David Smith wrote:
>
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/services/dhcp.xml | 10 ++++++++++
> RHEL6/input/services/nfs.xml | 12 ++----------
> RHEL6/input/services/smb.xml | 11 +++++++++++
> RHEL6/input/services/xorg.xml | 10 ++++++++++
> RHEL6/input/system/accounts/pam.xml | 8 +++++++-
> RHEL6/input/system/network/wireless.xml | 5 ++++-
> RHEL6/input/system/permissions/execution.xml | 6 ++++++
> RHEL6/input/system/permissions/mounting.xml | 3 +++
> RHEL6/input/system/software/integrity.xml | 5 +++++
> 9 files changed, 58 insertions(+), 12 deletions(-)
>
> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
> index 2c33e4f..a86271b 100644
> --- a/RHEL6/input/services/dhcp.xml
> +++ b/RHEL6/input/services/dhcp.xml
> @@ -212,6 +212,16 @@ GATEWAY=192.168.1.1</pre>
> </li>
> </ul>
> </description>
> +<ocil clause="it does not">
> +To verify that DHCP is not being used, examine the following file for each interface:
> +<pre># /etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></pre>
> +Look for the following:
> +<pre>BOOTPROTO=static</pre>
> +and the following, substituting the appropriate values based on your site's addressing scheme:
> +<pre>NETMASK=255.255.255.0
> +IPADDR=192.168.1.2
> +GATEWAY=192.168.1.1</pre>
> +</ocil>
> <rationale>
> DHCP relies on trusting the local network. If the local network is not trusted,
> then it should not be used. However, the automatic configuration provided by
> diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
> index e72bc71..bfde1a4 100644
> --- a/RHEL6/input/services/nfs.xml
> +++ b/RHEL6/input/services/nfs.xml
> @@ -226,16 +226,8 @@ If properly configured, the output should look like:
> <description>The rpcsvcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd service is the server-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled.
> <service-disable-macro service="rpcsvcgssd" />
> </description>
> -<ocil clause="it does not">
> -It is prudent to ensure the <tt>rpcsvcgssd</tt> service is disabled in system boot, as well as
> -not currently running. First, run the following to verify the service is stopped:
> -<pre>$ service rpcsvcgssd status</pre>
> -If the service is stopped or disabled, it will return the following:
> -<pre>rpc.svcgssd is stopped</pre>
> -To verify that the <tt>rpcsvcgssd</tt> service is disabled, run the following command:
> -<pre>$ chkconfig --list rpcsvcgssd</pre>
> -If properly configured, the output should look like:
> -<pre>rpcsvcgssd 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre>
> +<ocil>
> +<service-disable-check-macro service="rpcsvcgssd" />
> </ocil>
> <ident cce="4491-7" />
> <oval id="service_rpcsvcgssd_disabled" />
> diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
> index 1f1e05d..b46720a 100644
> --- a/RHEL6/input/services/smb.xml
> +++ b/RHEL6/input/services/smb.xml
> @@ -190,6 +190,12 @@ Requiring samba clients such as <tt>smbclient</tt> to use packet
> signing ensures that they can
> only communicate with servers that support packet signing.
> </description>
> +<ocil clause="it is not">
> +To verify that Samba clients running smbclient must use packet signing, run the following command:
> +<pre># grep signing /etc/samba/smb.conf</pre>
> +The output should show:
> +<pre>client signing = mandatory</pre>
> +</ocil>
> <rationale>
> Packet signing can prevent
> man-in-the-middle attacks which modify SMB packets in
> @@ -211,6 +217,11 @@ See the <tt>mount.cifs(8)</tt> man page for more information. A Samba
> client should only communicate with servers who can support SMB
> packet signing.
> </description>
> +<ocil clause="it does not">
> +To verify that Samba clients using mount.cifs must use packet signing, run the following command:
> +<pre># grep sec /etc/fstab</pre>
> +The output should show either <tt>krb5i</tt> or <tt>ntlmv2i</tt> in use.
> +</ocil>
> <rationale>
> Packet signing can prevent man-in-the-middle
> attacks which modify SMB packets in transit.
> diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
> index f55c2fc..3e5211f 100644
> --- a/RHEL6/input/services/xorg.xml
> +++ b/RHEL6/input/services/xorg.xml
> @@ -20,6 +20,12 @@ of the X server. To do so, ensure that the following line in <tt>/etc/inittab</t
> features a <tt>3</tt> as shown:
> <pre>id:3:initdefault:</pre>
> </description>
> +<ocil clause="it does not">
> +To verify that the default runlevel is 3, run the following command:
> +<pre># grep initdefault /etc/inittab</pre>
> +The output should show the following:
> +<pre>id:3:initdefault:</pre>
> +</ocil>
> <ident cce="4462-8" />
> <oval id="xwindows_runlevel_setting" />
> </Rule>
> @@ -32,6 +38,10 @@ ensures that users or malicious software cannot start X.
> To do so, run the following command:
> <pre># yum groupremove "X Window System"</pre>
> </description>
> +<ocil clause="there is output">
> +To ensure the X Windows package group is removed, run the following command:
> +<pre>$ rpm -qi xorg-x11-server-common</pre>
> +</ocil>
> <ident cce="4422-2" />
> <oval id="package_xorg-x11-server-common_removed" />
> </Rule>
> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
> index 59df7ed..162da7b 100644
> --- a/RHEL6/input/system/accounts/pam.xml
> +++ b/RHEL6/input/system/accounts/pam.xml
> @@ -332,7 +332,7 @@ These include
> By default, all individual programs' configuration files in <tt>/etc/pam.d</tt>
> include <tt>system-auth</tt> or <tt>password-auth</tt>.
> -->
> -<description>
> +<!-- <description>
> To configure
> the system to lock out accounts after a number of incorrect login
> attempts using
> @@ -355,7 +355,13 @@ auth sufficient pam_faillock.so authsucc audit deny=<sub idref="var_acco
> <ul><li>NOTE: The DoD requires accounts be locked out after 3 failed login attempts,
> accomplished by changing the value of the <tt>deny</tt> option to <i>3</i> in the example
> above.</li></ul>
> +</description> -->
> +<description>
> +This requires further investigation.
> </description>
> +<ocil>
> +This requires further investigation.
> +</ocil>
> <rationale>
> Locking out user accounts after a number of incorrect attempts
> prevents direct password guessing attacks.
> diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
> index 7686390..e76d569 100644
> --- a/RHEL6/input/system/network/wireless.xml
> +++ b/RHEL6/input/system/network/wireless.xml
> @@ -111,7 +111,10 @@ to prevent the loading of the Bluetooth module:
> <pre>install net-pf-31 /bin/true
> install bluetooth /bin/true</pre>
> </description>
> -
> +<ocil>
> +<module-disable-check-macro module="bluetooth" />
> +<module-disable-check-macro module="net-pf-31" />
> +</ocil>
> <rationale>If Bluetooth functionality must be disabled, preventing the kernel
> from loading the kernel module provides an additional safeguard against its
> activation.</rationale>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index 6d32805..0de5df5 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -73,6 +73,12 @@ value of 0 is recommended.</description>
> <tt>/etc/security/limits.conf</tt>:
> <pre>* hard core 0</pre>
> </description>
> +<ocil clause="it is not">
> +To verify that core dumps are disabled for all users, run the following command:
> +<pre>$ grep core /etc/security/limits.conf</pre>
> +The output should be:
> +<pre>* hard core 0</pre>
> +</ocil>
> <rationale>A core dump includes a memory image taken at the time the operating system
> terminates an application. The memory image could contain sensitive data and is generally useful
> only for developers trying to debug problems.</rationale>
> diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
> index a092bb8..a46f735 100644
> --- a/RHEL6/input/system/permissions/mounting.xml
> +++ b/RHEL6/input/system/permissions/mounting.xml
> @@ -52,6 +52,9 @@ kernel module:
> This will prevent the <tt>modprobe</tt> program from loading the <tt>usb-storage</tt>
> module, but will not prevent an administrator (or another program) from using the
> <tt>insmod</tt> program to load the module manually.</description>
> +<ocil>
> +<module-disable-check-macro module="usb-storage" />
> +</ocil>
> <rationale>USB storage devices such as thumb drives can be used to introduce unauthorized
> software and other vulnerabilities. Support for these devices should be disabled and
> the devices themselves should be tightly controlled.</rationale>
> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
> index 6c24ce9..96c2dc6 100644
> --- a/RHEL6/input/system/software/integrity.xml
> +++ b/RHEL6/input/system/software/integrity.xml
> @@ -144,6 +144,11 @@ files on the system have permissions that are different from what
> is expected by the RPM database:
> <pre># rpm -Va | grep '^.M'</pre>
> </description>
> +<ocil clause="there is output">
> +The following command will list which files on the system have permissions that are different from what
> +is expected by the RPM database:
> +<pre># rpm -Va | grep '^.M'</pre>
> +</ocil>
> <rationale>
> Permissions on system binaries and configuration files that are too generous
> could allow an unauthorized user to gain privileges that they should not have.
More information about the scap-security-guide
mailing list