[PATCH 00/17] Updated NIST Mappings

Shawn Wells shawn.d.wells at gmail.com
Tue Jan 1 17:04:36 UTC 2013


-------------- next part --------------
>From 8d7ae49d6632648f69199ffb0a79ef4824082046 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 1 Jan 2013 12:02:19 -0500
Subject: [PATCH 00/17] Updated NIST Mappings

Initial patchset to:

(1) Create a profile mapping against NIST Low-Low-Low (as defined by CNSS 1253)

(2) Updated several NIST mappings, getting specific to sub-components and control enhancements. Used formatting scheme from CNSS


Shawn Wells (17):
  Removed AC-2 mapping from ldap_server_config_olcrootpw     Setting a
    root password does not correspond to AC-2. Removing mapping.
  Mapped sshd_use_approved_ciphers to AC-3     AC-3 requires FIPS 140-2
    certified ciphers
  Mapped to correct rule (account_temp_expire_date)     Former mapping
    didn't exist, needed to be mapped to account_temp_expire_date
  Mapped account_temp_expire_date and
    account_disable_post_pw_expiration to AC-2(2) and AC-2(3)    
    Mapped account_temp_expire_date and
    account_disable_post_pw_expiration to AC-2(2) and AC-2(3)
  Mapped audit_sysadmin_actions to AC-2(7)(b)     Req calls for
    tracking/monitoring privileged role assignments,     which is done
    through sudoers
  Removed "strict" from var_selinux_policy_name     There is no strict
    mode in RHEL6 -- only targeted or mls
  Removed AC-3 mapping against various rules     AC-3 states that DAC
    and MAC systems must be enabled, and that FIPS used whenever    
    possible. It does *not* call out file permissions, network
    firewalls, etc...     those things are set later (e.g. CM-6, SC-*).
  Removed AC-4 mappings     Removed numberous AC-4 mappings. AC-4 calls
    for the IS to *enforce*     flow control (e.g. turn on iptables,
    selinux) but does not     give configuration guidance. This is
    enabled in later controls.
  Updated mappings for AC-6*     Updated serveral mappings for AC-6. A
    key distinction between AC-6 and CM-6/CM-7 is that     AC-6 calls
    for least privilege -- e.g. file permissions -- whereas the later
    CM-* sections     call out least functionality (e.g. only ssh can
    listen on port 22).
  Updated mappings for AC-7*     Updated mappings to reflect
    granularity of AC-7(a) vs AC-7(b)
  Updated mappings of AC-8*     Updated to reflect granularity of
    AC-8(a-c)
  Updated AC-11* mappings     Reflect granularity of AC-11(a), (b), and
    (1)
  Initial profile for NIST low/low/low     Initial profile for NIST
    low/low/low     Much work left to do!
  Created auxiliary mappings file for NIST profiles
  Added mappings against AC-17*     Added serveral mappings against the
    AC-17* requirements,     broke them down into sup compartments
    AC-17(1), AC-17(a), etc
  Added mappings for AC-18*, disablement of wireless capabilities    
    Updated granularity of existing mappings
  Finished mappings through AC-*

 RHEL6/input/auxiliary/alt-titles-stig.xml          |    2 +-
 RHEL6/input/auxiliary/nist_support.xml             |   42 ++
 RHEL6/input/intro/intro.xml                        |   15 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |  526 ++++++++++++++++++++
 RHEL6/input/profiles/stig-rhel6-server.xml         |    2 -
 RHEL6/input/services/avahi.xml                     |    8 +-
 RHEL6/input/services/base.xml                      |   39 +-
 RHEL6/input/services/ldap.xml                      |    6 +-
 RHEL6/input/services/mail.xml                      |    8 +-
 RHEL6/input/services/obsolete.xml                  |   27 +-
 RHEL6/input/services/ssh.xml                       |    6 +-
 RHEL6/input/system/accounts/banners.xml            |    6 +-
 RHEL6/input/system/accounts/pam.xml                |    6 +-
 RHEL6/input/system/accounts/physical.xml           |   18 +-
 .../accounts/restrictions/account_expiration.xml   |    5 +-
 .../accounts/restrictions/password_expiration.xml  |    6 +-
 .../accounts/restrictions/password_storage.xml     |    2 +-
 .../system/accounts/restrictions/root_logins.xml   |    8 +-
 RHEL6/input/system/accounts/session.xml            |    2 +-
 RHEL6/input/system/auditing.xml                    |   68 ++--
 RHEL6/input/system/logging.xml                     |    8 +-
 RHEL6/input/system/network/iptables.xml            |   18 +-
 RHEL6/input/system/network/kernel.xml              |    6 +-
 RHEL6/input/system/network/ssl.xml                 |    8 +-
 RHEL6/input/system/network/wireless.xml            |   10 +-
 RHEL6/input/system/permissions/execution.xml       |    4 +-
 RHEL6/input/system/permissions/files.xml           |   46 +-
 RHEL6/input/system/permissions/mounting.xml        |   14 +-
 RHEL6/input/system/permissions/partitions.xml      |    9 +-
 RHEL6/input/system/selinux.xml                     |    9 +-
 RHEL6/input/system/software/integrity.xml          |    2 +-
 31 files changed, 747 insertions(+), 189 deletions(-)
 create mode 100644 RHEL6/input/auxiliary/nist_support.xml
 create mode 100644 RHEL6/input/profiles/nist-CL-IL-AL.xml



More information about the scap-security-guide mailing list