[PATCH 00/17] Updated NIST Mappings
Shawn Wells
shawn.d.wells at gmail.com
Tue Jan 1 17:04:36 UTC 2013
-------------- next part --------------
>From 8d7ae49d6632648f69199ffb0a79ef4824082046 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 1 Jan 2013 12:02:19 -0500
Subject: [PATCH 00/17] Updated NIST Mappings
Initial patchset to:
(1) Create a profile mapping against NIST Low-Low-Low (as defined by CNSS 1253)
(2) Updated several NIST mappings, getting specific to sub-components and control enhancements. Used formatting scheme from CNSS
Shawn Wells (17):
Removed AC-2 mapping from ldap_server_config_olcrootpw Setting a
root password does not correspond to AC-2. Removing mapping.
Mapped sshd_use_approved_ciphers to AC-3 AC-3 requires FIPS 140-2
certified ciphers
Mapped to correct rule (account_temp_expire_date) Former mapping
didn't exist, needed to be mapped to account_temp_expire_date
Mapped account_temp_expire_date and
account_disable_post_pw_expiration to AC-2(2) and AC-2(3)
Mapped account_temp_expire_date and
account_disable_post_pw_expiration to AC-2(2) and AC-2(3)
Mapped audit_sysadmin_actions to AC-2(7)(b) Req calls for
tracking/monitoring privileged role assignments, which is done
through sudoers
Removed "strict" from var_selinux_policy_name There is no strict
mode in RHEL6 -- only targeted or mls
Removed AC-3 mapping against various rules AC-3 states that DAC
and MAC systems must be enabled, and that FIPS used whenever
possible. It does *not* call out file permissions, network
firewalls, etc... those things are set later (e.g. CM-6, SC-*).
Removed AC-4 mappings Removed numberous AC-4 mappings. AC-4 calls
for the IS to *enforce* flow control (e.g. turn on iptables,
selinux) but does not give configuration guidance. This is
enabled in later controls.
Updated mappings for AC-6* Updated serveral mappings for AC-6. A
key distinction between AC-6 and CM-6/CM-7 is that AC-6 calls
for least privilege -- e.g. file permissions -- whereas the later
CM-* sections call out least functionality (e.g. only ssh can
listen on port 22).
Updated mappings for AC-7* Updated mappings to reflect
granularity of AC-7(a) vs AC-7(b)
Updated mappings of AC-8* Updated to reflect granularity of
AC-8(a-c)
Updated AC-11* mappings Reflect granularity of AC-11(a), (b), and
(1)
Initial profile for NIST low/low/low Initial profile for NIST
low/low/low Much work left to do!
Created auxiliary mappings file for NIST profiles
Added mappings against AC-17* Added serveral mappings against the
AC-17* requirements, broke them down into sup compartments
AC-17(1), AC-17(a), etc
Added mappings for AC-18*, disablement of wireless capabilities
Updated granularity of existing mappings
Finished mappings through AC-*
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
RHEL6/input/auxiliary/nist_support.xml | 42 ++
RHEL6/input/intro/intro.xml | 15 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 526 ++++++++++++++++++++
RHEL6/input/profiles/stig-rhel6-server.xml | 2 -
RHEL6/input/services/avahi.xml | 8 +-
RHEL6/input/services/base.xml | 39 +-
RHEL6/input/services/ldap.xml | 6 +-
RHEL6/input/services/mail.xml | 8 +-
RHEL6/input/services/obsolete.xml | 27 +-
RHEL6/input/services/ssh.xml | 6 +-
RHEL6/input/system/accounts/banners.xml | 6 +-
RHEL6/input/system/accounts/pam.xml | 6 +-
RHEL6/input/system/accounts/physical.xml | 18 +-
.../accounts/restrictions/account_expiration.xml | 5 +-
.../accounts/restrictions/password_expiration.xml | 6 +-
.../accounts/restrictions/password_storage.xml | 2 +-
.../system/accounts/restrictions/root_logins.xml | 8 +-
RHEL6/input/system/accounts/session.xml | 2 +-
RHEL6/input/system/auditing.xml | 68 ++--
RHEL6/input/system/logging.xml | 8 +-
RHEL6/input/system/network/iptables.xml | 18 +-
RHEL6/input/system/network/kernel.xml | 6 +-
RHEL6/input/system/network/ssl.xml | 8 +-
RHEL6/input/system/network/wireless.xml | 10 +-
RHEL6/input/system/permissions/execution.xml | 4 +-
RHEL6/input/system/permissions/files.xml | 46 +-
RHEL6/input/system/permissions/mounting.xml | 14 +-
RHEL6/input/system/permissions/partitions.xml | 9 +-
RHEL6/input/system/selinux.xml | 9 +-
RHEL6/input/system/software/integrity.xml | 2 +-
31 files changed, 747 insertions(+), 189 deletions(-)
create mode 100644 RHEL6/input/auxiliary/nist_support.xml
create mode 100644 RHEL6/input/profiles/nist-CL-IL-AL.xml
More information about the scap-security-guide
mailing list