[PATCH] Log file Rule changes

David Smith dsmith at eclipse.ncsc.mil
Fri Feb 15 13:13:25 UTC 2013


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/alt-titles-stig.xml |    6 +++
 RHEL6/input/profiles/common.xml           |    8 ++--
 RHEL6/input/system/auditing.xml           |    4 +-
 RHEL6/input/system/logging.xml            |   62 +++++++++++++++-------------
 RHEL6/input/system/permissions/files.xml  |   22 ++++++++++
 5 files changed, 67 insertions(+), 35 deletions(-)

diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index 3b9724d..dec21ab 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -50,6 +50,12 @@ The system must have USB Mass Storage disabled unless needed.
 <title rule="service_autofs_disabled" shorttitle="Disable the Automounter">
 Automated file system mounting tools must not be enabled unless needed.
 </title>
+<title rule="log_files_location" shorttitle="Verify Location of Log Files">
+Log files must be located in /var/log.
+</title>
+<title rule="perms_log_files" shorttitle="Verify Permissions on Log Files">
+Log files must have mode 0600.
+</title>
 <title rule="userowner_shadow_file" shorttitle="Verify User Who Owns shadow File">
 The /etc/shadow file must be owned by root.
 </title>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index d80e69a..5be7ddf 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -24,6 +24,10 @@
 <select idref="no_hashes_outside_shadow" selected="true"/>
 <select idref="no_uidzero_except_root" selected="true"/>
 
+
+<select idref="log_files_location" selected="true"/>
+<select idref="perms_log_files" selected="true"/>
+
 <select idref="userowner_shadow_file" selected="true"/>
 <select idref="groupowner_shadow_file" selected="true"/>
 <select idref="perms_shadow_file" selected="true"/>
@@ -45,7 +49,6 @@
 <select idref="file_permissions_binary_dirs" selected="true"/>
 <select idref="file_ownership_binary_dirs" selected="true"/>
 
-<select idref="audit_logs_permissions" selected="true"/>
 
 <select idref="password_min_len" selected="true"/>
 <select idref="password_min_age" selected="true"/>
@@ -101,9 +104,6 @@
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="service_rsyslog_enabled" selected="true"/>
 
-<select idref="userowner_rsyslog_files" selected="true"/>
-<select idref="groupowner_rsyslog_files" selected="true"/>
-<select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
 <select idref="ensure_logrotate_activated" selected="true"/>
 <select idref="enable_auditd_service" selected="true"/>
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index b4e54b8..f8008b0 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -681,7 +681,7 @@ audited.</rationale>
 <ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
 </Rule>
 
-<Rule id="audit_logs_permissions">
+<!-- <Rule id="audit_logs_permissions">
 <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
 <description>
 Change the mode of the audit log files with the following command:
@@ -715,7 +715,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio
 <oval id="file_ownership_var_log_audit" />
 <ref nist="AC-6,AU-1(b),AU-9" disa="166" />
 <tested by="DS" on="20121024"/>
-</Rule> 
+</Rule> --> 
 
 <Rule id="audit_mac_changes">
 <title>Record Events that Modify the System's Mandatory Access Controls</title>
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index 9ff9334..ffa9cbb 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -115,7 +115,7 @@ will not create it and important log messages can be lost.
 <ref nist="" />
 </Rule>
 
-<Rule id="userowner_rsyslog_files" severity="medium">
+<!-- <Rule id="userowner_rsyslog_files" severity="medium">
 <title>Ensure Log Files Are Owned By Appropriate User</title>
 <description>The owner of all log files written by
 <tt>rsyslog</tt> should be root.
@@ -165,38 +165,28 @@ protected from unauthorized access.</rationale>
 <oval id="rsyslog_files_groupownership" />
 <ref nist="AC-6" disa="1314"/>
 <tested by="DS" on="20121024"/>
-</Rule>
-
+</Rule> -->
 
-<Rule id="rsyslog_file_permissions" severity="medium">
-<title>Ensure System Log Files Have Correct Permissions</title>
-<description>The file permissions for all log files written by
-rsyslog should be set to 600, or more restrictive.
-These log files are determined by the second part of each Rule line in
-<tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>. 
-For each log file <i>LOGFILE</i> referenced in <tt>/etc/rsyslog.conf</tt>,
-run the following command to inspect the file's permissions:
-<pre>$ ls -l <i>LOGFILE</i></pre>
-If the permissions are not 600 or more restrictive,
-run the following command to correct this:
-<pre># chmod 0600 <i>LOGFILE</i></pre>
+<Rule id="log_files_location">
+<title>Verify Location of Log Files</title>
+<description>
+To configure the storage location of log files, add or correct the storage location 
+for each log type listed in the second column under <tt>RULES</tt> in <tt>/etc/rsyslog.conf</tt>.
 </description>
-<ocil clause="the permissions are not correct">
-To see the permissions of a given log file, run the following command:
-<pre>$ ls -l <i>LOGFILE</i></pre>
-The permissions should be 600, or more restrictive.
+<ocil clause="all logs are not stored in /var/log/">
+To ensure all system log files are stored in /var/log/, examine the rules in the file
+<tt>/etc/rsyslog.conf</tt>.  All log locations are listed in the second column, under the 
+<tt>RULES</tt> section, and should begin with <tt>/var/log/</tt>.
 </ocil>
-<rationale>Log files can contain valuable information regarding system
-configuration. If the system log files are not protected unauthorized
-users could change the logged data, eliminating their forensic value.
+<rationale>The log files generated by rsyslog contain valuable information regarding system
+configuration, user authentication, and other such information. Log files should be
+protected from unauthorized access.
 </rationale>
-<ident cce="27190-8" />
-<oval id="rsyslog_files_permissions" />
-<ref nist="" disa="1314"/>
-<tested by="DS" on="20121024"/>
+<ident cce="26821-9" />
+<ref nist="AU-9" disa="1314"/>
 </Rule>
-</Group>
 
+</Group>
 <Group id="rsyslog_sending_messages">
 <title>Rsyslog Logs Sent To Remote Host</title>
 <description>
@@ -231,8 +221,8 @@ Along with these other directives, the system can be configured
 to forward its logs to a particular log server by
 adding or correcting one of the following lines,
 substituting <tt><i>loghost.example.com</i></tt> appropriately.
-The choice of protocol depends on the environment of the system; 
-although TCP and RELP provide more reliable message delivery, 
+The choice of protocol depends on the environment of the system;
+although TCP and RELP provide more reliable message delivery,
 they may not be supported in all environments.
 <br/>
 To use UDP for log message delivery:
@@ -264,6 +254,7 @@ place to view the status of multiple hosts within the enterprise.
 <oval id="rsyslog_remote_loghost" />
 <ref nist="AU-3(2),AU-9" disa="1348, 136" />
 </Rule>
+
 </Group>
 
 <Group id="rsyslog_accepting_remote_messages">
@@ -431,6 +422,19 @@ the logserver.</description> -->
 
 </Group> <!-- <Group id="configure_logwatch_on_logserver"> -->
 
+
+
+<!-- Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): 
+<pre># cd /etc/cron.daily 
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch 
+</pre>
+free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be 
+that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note 
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, 
+such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to 
+the logserver.</description> -->
+
+
 <Rule id="disable_logwatch_for_logserver">
 <title> Disable Logwatch on Clients if a Logserver Exists</title>
 <description> 
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index e1db8c6..84b20d1 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -17,6 +17,28 @@ need read access to the <tt>passwd</tt> file in order to function properly, but
 read access to the <tt>shadow</tt> file allows malicious attacks against system
 passwords, and should never be enabled.</description>
 
+<Rule id="perms_log_files" severity="medium">
+<title>Verify Permissions on Log Files</title>
+<description>The file permissions for all log files written by
+rsyslog and auditd should be set to 0600.
+For any log files with permissions other than 0600, run the following command:
+<pre># chmod 0600 <i>LOGFILE</i></pre>
+</description>
+<ocil clause="there are any files listed in the output">
+To ensure there are no log files with incorrect permissions in /var/log/,
+run the following command:
+<pre># find /var/log/ ! -perm 0600 -type f</pre>
+</ocil>
+<rationale>Log files can contain valuable information regarding system
+configuration. If the system log files are not protected unauthorized
+users could change the logged data, eliminating their forensic value.
+</rationale>
+<ident cce="27190-8" />
+<oval id="rsyslog_files_permissions" />
+<ref nist="" disa="1314"/>
+<tested by="DS" on="20121024"/>
+</Rule>
+
 <Rule id="userowner_shadow_file" severity="medium">
 <title>Verify User Who Owns <tt>shadow</tt> File</title>
 <description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>
-- 
1.7.1



More information about the scap-security-guide mailing list