telnet section

Andrew Gilmore agilmore2 at gmail.com
Wed Jul 31 20:39:13 UTC 2013


Right, I recently pushed a fix for this bug, it just hasn't made the
current build yet. Good catch though, false positives stink.

Andrew


On Wed, Jul 31, 2013 at 9:15 AM, Stuart Green
<stuart.green at doccentrics.com>wrote:

> Greetings All,
>
> New to this list!
>
> I think I might have found an issue with the  SSG policy content.
>
> Summary:  If you do not have telnet installed on the system it causes Rule
> ID: disable_telnet_service to fail.
>
>
>
> In no place in this rule does it consider that telnet might not be
> installed at all, so it fails (rather than errors, or even better does a
> check as a precursor to see if its installed at all and if not passes!)
>
>
> grep 'id="oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml
>       <ind-def:textfilecontent54_**test id="oval:ssg:tst:231" version="1"
> check_existence="all_exist" check="all" comment="Disable Telnet Service">
>         <test test_id="oval:ssg:tst:231" version="1"
> check_existence="all_exist" check="all" result="false"/>
>
>
>         <Rule id="disable_telnet_service" selected="false" severity="high">
>           <title xml:lang="en-US">Disable telnet Service</title>
>           <description xmlns:xhtml="http://www.w3.**org/1999/xhtml<http://www.w3.org/1999/xhtml>"
> xml:lang="en-US">
>
>     The <xhtml:code>telnet</xhtml:**code> service can be disabled with
> the following command:
>
>     <xhtml:pre># chkconfig telnet off</xhtml:pre>
>           </description>
>           <reference href="http://csrc.nist.gov/**
> publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf<http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf>
> ">**AC-17(8)</reference>
>           <reference href="http://csrc.nist.gov/**
> publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf<http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf>
> ">**CM-7</reference>
>           <reference href="http://csrc.nist.gov/**
> publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf<http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf>
> ">**IA-5(1)(c)</reference>
>           <reference href="http://iase.disa.mil/**cci/index.html<http://iase.disa.mil/cci/index.html>
> ">68</reference>
>           <reference href="http://iase.disa.mil/**cci/index.html<http://iase.disa.mil/cci/index.html>
> ">1436</**reference>
>           <reference href="http://iase.disa.mil/**cci/index.html<http://iase.disa.mil/cci/index.html>
> ">197</**reference>
>           <reference href="http://iase.disa.mil/**cci/index.html<http://iase.disa.mil/cci/index.html>
> ">877</**reference>
>           <reference href="http://iase.disa.mil/**cci/index.html<http://iase.disa.mil/cci/index.html>
> ">888</**reference>
>           <reference xmlns:dc="http://purl.org/dc/**elements/1.1/<http://purl.org/dc/elements/1.1/>"
> href="test_attestation">
>             <dc:contributor>DS</dc:**contributor>
>             <dc:date>20121026</dc:date>
>           </reference>
>
>           <rationale xmlns:xhtml="http://www.w3.**org/1999/xhtml<http://www.w3.org/1999/xhtml>"
> xml:lang="en-US">
>
> The telnet protocol uses unencrypted network communication, which
> means that data from the login session, including passwords and
> all other information transmitted during the session, can be
> stolen by eavesdroppers on the network. The telnet protocol is also
> subject to man-in-the-middle attacks.
>
> </rationale>
>
>           <ident system="http://cce.mitre.org">**CCE-26836-7</ident>
>           <check system="http://oval.mitre.org/**
> XMLSchema/oval-definitions-5<http://oval.mitre.org/XMLSchema/oval-definitions-5>
> ">
>             <check-content-ref name="oval:ssg:def:230"
> href="ssg-rhel6-oval.xml"/>
>           </check>
>
>           <check system="ocil-transitional">
>             <check-export export-name="the service is running"
> value-id="conditional_clause"/**>
>             <check-content xmlns:xhtml="http://www.w3.**org/1999/xhtml<http://www.w3.org/1999/xhtml>
> ">
>
>     To check that the <xhtml:code>telnet</xhtml:**code> service is
> disabled in system boot configuration, run the following command:
>     <xhtml:pre># chkconfig <xhtml:code>telnet</xhtml:**code>
> --list</xhtml:pre>
>     Output should indicate the <xhtml:code>telnet</xhtml:**code> service
> has either not been installed,
>     or has been disabled at all runlevels, as shown in the example below:
>     <xhtml:pre># chkconfig <xhtml:code>telnet</xhtml:**code> --list
> <xhtml:code>telnet</xhtml:**code>       0:off   1:off 2:off   3:off
> 4:off   5:off   6:off</xhtml:pre>
>
>
>     Run the following command to verify <xhtml:code>telnet</xhtml:**code>
> is disabled through current runtime configuration:
>
>     <xhtml:pre># service telnet status</xhtml:pre>
>
>     If the service is disabled the command will return the following
> output:
>
>     <xhtml:pre>telnet is stopped</xhtml:pre>
>           </check-content>
>           </check>
>         </Rule>
>
>
>
> Cheers,
> Stu
>
> ______________________________**_________________
> scap-security-guide mailing list
> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130731/443e5f6a/attachment-0001.html>


More information about the scap-security-guide mailing list