[PATCH 3/5] editing on prose text for software integrity/updating

Shawn Wells shawn at redhat.com
Thu Oct 10 03:20:14 UTC 2013


On 10/9/13 10:58 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/software/integrity.xml |  103 ++++++++++-------------------
>   RHEL6/input/system/software/updating.xml  |   31 ++++-----
>   2 files changed, 50 insertions(+), 84 deletions(-)
>
> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
> index 6d91bfb..b706f90 100644
> --- a/RHEL6/input/system/software/integrity.xml
> +++ b/RHEL6/input/system/software/integrity.xml
> @@ -10,8 +10,8 @@ The RPM package management system can conduct integrity
>   checks by comparing information in its metadata database with
>   files installed on the system.
>   <br /><br />
> -Integrity checking cannot <i>prevent</i> intrusions into your
> -system, but can detect that they have occurred. Requirements
> +Integrity checking cannot <i>prevent</i> intrusions,
> +but can detect that they have occurred. Requirements
>   for software integrity checking may be highly dependent on
>   the environment in which the system will be used. Snapshot-based
>   approaches such as AIDE may induce considerable overhead
> @@ -21,8 +21,8 @@ in the presence of frequent software updates.
>   <Group id="aide">
>   <title>Verify Integrity with AIDE</title>
>   <description>AIDE conducts integrity checks by comparing information about
> -files with previously-gathered information. Ideally, the AIDE database should
> -be created immediately after your system is built, and then again after any
> +files with previously-gathered information. Ideally, the AIDE database is
> +created immediately after initial system configuration, and then again after any
>   software update.  AIDE is highly configurable, with further configuration
>   information located in <tt>/usr/share/doc/aide-<i>VERSION</i></tt>.
>   </description>
> @@ -86,7 +86,6 @@ must be captured and it should be able to be verified against the installed file
>   <Rule id="aide_periodic_cron_checking" severity="medium">
>   <title>Configure Periodic Execution of AIDE</title>
>   <description>
> -AIDE should be executed on a periodic basis to check for changes.
>   To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
>   <pre>05 4 * * * root /usr/sbin/aide --check</pre>
>   AIDE can be executed periodically through other means; this is merely one example.
> @@ -97,38 +96,11 @@ To determine that periodic AIDE execution has been scheduled, run the following
>   </ocil>
>   <rationale>
>   By default, AIDE does not install itself for periodic execution. Periodically
> -running AIDE may reveal unexpected changes in installed files.
> +running AIDE is necessary to reveal unexpected changes in installed files.
>   </rationale>
>   <ident cce="27222-9" />
>   <ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/>
>   </Rule>
> -<!--
> -<Group id="aide_verify_integrity_manually">
> -<title>Manually Verify Integrity of AIDE</title>
> -<description>
> -Manually verify the integrity of the AIDE binaries, configuration file, and database. Possibilities for doing
> -so include:
> -<br /><br />
> -1. Use sha1sum or md5sum to generate checksums on the files and then visually compare them to those
> -generated from the safely stored versions. This does not, of course, preclude the possibility that such
> -output could also be faked.
> -<br /><br />
> -2. Mount the stored versions on read-only media and run <tt>/bin/diff</tt> to verify that there are no differences
> -between the files.
> -<br /><br />
> -3. Copying the files to another system and performing the hash or file comparisons there may impart
> -additional confidence that the manual verification process is not being interfered with.
> -</description>
> -<rationale>
> -Because integrity checking is a means of intrusion detection and not intrusion prevention, it cannot be guaranteed
> -that the AIDE binaries, configuration files, or database have not been tampered with. An attacker could disable
> -or alter these files after a successful intrusion. Because of this, manual and frequent checks on these files is
> -recommended. The safely stored copies (or hashes) of the database, binary, and configuration file were created
> -earlier for this purpose.
> -</rationale>
> -<ref nist="SC-28, SI-7" />
> -</Group>
> --->
>   </Group>
>   
>   <Group id="rpm_verification">
> @@ -145,12 +117,16 @@ See the man page for <tt>rpm</tt> to see a complete explanation of each column.
>   </description>
>   
>   <Rule id="rpm_verify_permissions">
> -<title>Verify File Permissions with RPM</title>
> -<description>The RPM package management system can check file access
> +<title>Verify and Correct File Permissions with RPM</title>
> +<description>
> +The RPM package management system can check file access
>   permissions of installed software packages, including many that are
> -important to system security. The following command will reset permissions to
> -their expected values:
> -<pre># rpm --setperms <i>package</i></pre>
> +important to system security.
> +After locating a file with incorrect permissions, run the following command to determine which package owns it:
> +<pre># rpm -qf <i>FILENAME</i></pre>
> +Next, run the following command to reset its permissions to
> +the correct values:
> +<pre># rpm --setperms <i>PACKAGENAME</i></pre>
>   </description>
>   <ocil clause="there is output">
>   The following command will list which files on the system have permissions different from what
> @@ -174,21 +150,25 @@ installed software packages, including many that are important to system
>   security. Run the following command to list which files on the system
>   have hashes that differ from what is expected by the RPM database:
>   <pre># rpm -Va | grep '^..5'</pre>
> -A "c" in the second column indicates that a file is a configuration file,
> -which may appropriately be expected to change.
> -If the file that has changed was not expected to then refresh from distribution media or online repositories.
> -<pre>rpm -Uvh <i>affected_package</i></pre>
> -OR
> -<pre>yum reinstall <i>affected_package</i></pre>
> +A "c" in the second column indicates that a file is a configuration file, which
> +may appropriately be expected to change.  If the file was not expected to
> +change, investigate the cause of the change using audit logs or other means.
> +The package can then be reinstalled to restore the file.
> +Run the following command to determine which package owns the file:
> +<pre># rpm -qf <i>FILENAME</i></pre>
> +The package can be reinstalled from a yum repository using the command:
> +<pre>yum reinstall <i>PACKAGENAME</i></pre>
> +Alternatively, the package can be reinstalled from trusted media using the command:
> +<pre>rpm -Uvh <i>PACKAGENAME</i></pre>
>   </description>
>   <ocil clause="there is output"> The following command will list which files on the system
>   have file hashes different from what is expected by the RPM database.
>   <pre># rpm -Va | grep '$1 ~ /..5/ &amp;&amp; $2 != "c"'</pre>
>   </ocil>
>   <rationale>
> -The hash on important files like system executables should match the information given
> -by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity
> -on the system.</rationale>
> +The hashes of important files like system executables should match the
> +information given by the RPM database. Executables with erroneous hashes could
> +be a sign of nefarious activity on the system.</rationale>
>   <ident cce="27223-7" />
>   <oval id="rpm_verify_hashes" />
>   <ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" />
> @@ -208,30 +188,17 @@ software may not be appropriate for some specialized systems.
>   <Rule id="install_hids" severity="high">
>   <title>Install Intrusion Detection Software</title>
>   <description>
> -The base Red Hat platform already includes a sophisticated auditing system that
> -can detect intruder activity, as well as SELinux, which provides host-based
> -intrusion prevention capabilities by confining privileged programs and user
> -sessions which may become compromised.
> -<br/>
> -<br/>
> -Install an additional intrusion detection tool to provide complementary or
> -duplicative monitoring, reporting, and reaction capabilities to those of the base
> -platform.  For DoD systems, the McAfee Host Based Security System is provided
> -to fulfill this role.
> -<!-- provide link to cybercom site? -->
> -<!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux -->
> +The Red Hat platform includes a sophisticated auditing system
> +and SELinux, which provide host-based intrusion detection capabilities.
>   </description>
> -<ocil clause="no host-based intrusion detection tools are installed">
> -Inspect the system to determine if intrusion detection software has been installed.
> -Verify the intrusion detection software is active.
> -<!-- add instructions for HBSS?  the text in the RHEL 5 STIG is wrong as usual -->
> +<ocil clause="SELinux is installed, this is not a finding.  However, if neither SELinux nor HBSS is used on the system">
> +Inspect the system to determine if intrusion detection software has been installed.
> +SELinux is the intrusion detection system included with RHEL. Another one is
> +McAfee HBSS, which is available through Cybercom.
>   </ocil>
>   <rationale>
> -Adding host-based intrusion detection tools can provide the capability to
> -automatically take actions in response to malicious behavior, which can provide
> -additional agility in reacting to network threats. These tools also often
> -include a reporting capability to provide network awareness of system, which
> -may not otherwise exist in an organization's systems management regime.
> +Host-based intrusion detection tools provide a system-level defense when an
> +intruder gains access to a system or network.
>   </rationale>
>   <ref nist="SC-7" disa="1263"/>
>   </Rule>
> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
> index c441322..cccf5c2 100644
> --- a/RHEL6/input/system/software/updating.xml
> +++ b/RHEL6/input/system/software/updating.xml
> @@ -6,10 +6,9 @@ software update tool in the <b>System</b> menu, in the <b>Administration</b> sub
>   called <b>Software Update</b>.
>   <br /><br />
>   Red Hat Enterprise Linux systems contain an installed software catalog called
> -the RPM database, which records metadata of installed packages.  Tools such as
> -<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM
> -packages for software installation.  This allows for insight into the current
> -inventory of installed software on the system, and is highly recommended.
> +the RPM database, which records metadata of installed packages. Consistently using
> +<tt>yum</tt> or the graphical <b>Software Update</b> for all software installation
> +allows for insight into the current inventory of installed software on the system.
>   </description>
>   
>   <Rule id="ensure_redhat_gpgkey_installed" severity="high">
> @@ -17,15 +16,15 @@ inventory of installed software on the system, and is highly recommended.
>   <description>
>   To ensure the system can cryptographically verify base software
>   packages come from Red Hat (and to connect to the Red Hat Network to
> -receive them if desired), the Red Hat GPG key must properly be installed.
> -To ensure the GPG key is installed, run:
> +receive them), the Red Hat GPG key must properly be installed.
> +To install the Red Hat GPG key, run:
>   <pre># rhn_register</pre>
> -If the system is not connected to the internet, or a local RHN Satellite,
> -then install the Red Hat GPG key from a secure, static location, such as
> +If the system is not connected to the Internet or an RHN Satellite,
> +then install the Red Hat GPG key from trusted media such as
>   the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted
> -in /mnt/cdrom, use the following command as the root user to import
> +in <tt>/media/cdrom</tt>, use the following command as the root user to import
>   it into the keyring:
> -<pre># rpm --import /mnt/cdrom/RPM-GPG-KEY</pre>
> +<pre># rpm --import /media/cdrom/RPM-GPG-KEY</pre>
>   </description>
>   <ocil clause="the Red Hat GPG Key is not installed">
>   To ensure that the GPG key is installed, run:
> @@ -34,7 +33,7 @@ The command should return the string below:
>   <pre>gpg(Red Hat, Inc. (release key 2)  &lt;security at redhat.com&gt;</pre>
>   </ocil>
>   <rationale>
> -This key is necessary to cryptographically verify packages
> +The Red Hat GPG key is necessary to cryptographically verify packages
>   are from Red Hat.
>   </rationale>
>   <ident cce="26506-6"/>
> @@ -48,9 +47,9 @@ are from Red Hat.
>        ensure they have configured an update source! -->
>   <Rule id="ensure_gpgcheck_globally_activated" severity="high">
>   <title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
> -<description>The <tt>gpgcheck</tt> option should be used to ensure
> -checking of an RPM package's signature always occurs prior to its
> -installation. To configure yum to check package signatures before installing
> +<description>The <tt>gpgcheck</tt> option controls whether
> +RPM packages' signatures are always checked prior to installation.
> +To configure yum to check package signatures before installing
>   them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
>   the <tt>[main]</tt> section:
>   <pre>gpgcheck=1</pre>
> @@ -66,7 +65,7 @@ disabled.
>   </ocil>
>   <rationale>
>   Ensuring the validity of packages' cryptographic signatures prior to
> -installation ensures the provenance of the software and
> +installation ensures the authenticity of the software and
>   protects against malicious tampering.
>   </rationale>
>   <ident cce="26709-6" />
> @@ -91,7 +90,7 @@ A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for tha
>   </ocil>
>   <rationale>
>   Ensuring all packages' cryptographic signatures are valid prior to
> -installation ensures the provenance of the software and
> +installation ensures the authenticity of the software and
>   protects against malicious tampering.
>   </rationale>
>   <ident cce="26647-8" />

ack


More information about the scap-security-guide mailing list