[PATCH] [Fedora] Introduce 'Accounts and Access Control Section'. Convert four RHEL-6 rules from its 'Verify Proper Storage' subsection to Fedora

Shawn Wells shawn at redhat.com
Thu Oct 10 20:44:04 UTC 2013


On 10/10/13 10:52 AM, Jan Lieskovsky wrote:
> This patch introduces new 'Accounts and Access Control' section
> for Fedora content. Also convert four existing RHEL-6 rules from
> 'Protect Accounts by Restricting Password-Based Login' and include
> them into Fedora.
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-Fedora-Introduce-Accounts-and-Access-Control-Section.patch
>
>
>  From d5049e0baca827e33de5dbd7da28cf037c2eed40 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Thu, 10 Oct 2013 16:40:14 +0200
> Subject: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'.
>   Convert four RHEL-6 rules from its 'Verify Proper Storage'
>   subsection to Fedora
>
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   .../checks/accounts_password_all_shadowed.xml      |  24 +++++
>   Fedora/input/checks/no_empty_passwords.xml         |  22 +++++
>   Fedora/input/checks/no_netrc_files.xml             |  22 +++++
>   Fedora/input/guide.xslt                            |  15 +++
>   Fedora/input/profiles/common.xml                   |   4 +
>   Fedora/input/system/accounts/accounts.xml          |  11 +++
>   .../accounts/restrictions/password_storage.xml     | 107 +++++++++++++++++++++
>   .../system/accounts/restrictions/restrictions.xml  |  13 +++
>   Fedora/scap-security-guide.spec                    |  11 ++-
>   9 files changed, 228 insertions(+), 1 deletion(-)
>   create mode 100644 Fedora/input/checks/accounts_password_all_shadowed.xml
>   create mode 100644 Fedora/input/checks/no_empty_passwords.xml
>   create mode 100644 Fedora/input/checks/no_netrc_files.xml
>   create mode 100644 Fedora/input/system/accounts/accounts.xml
>   create mode 100644 Fedora/input/system/accounts/restrictions/password_storage.xml
>   create mode 100644 Fedora/input/system/accounts/restrictions/restrictions.xml
>
> diff --git a/Fedora/input/checks/accounts_password_all_shadowed.xml b/Fedora/input/checks/accounts_password_all_shadowed.xml
> new file mode 100644
> index 0000000..42b7482
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_password_all_shadowed.xml
> @@ -0,0 +1,24 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_password_all_shadowed" version="1">
> +    <metadata>
> +      <title>All Password Hashes Shadowed</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>All password hashes should be shadowed.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="password hashes are shadowed" test_ref="test_accounts_password_all_shadowed" />
> +    </criteria>
> +  </definition>
> +  <unix:password_test check="all" comment="password hashes are shadowed" id="test_accounts_password_all_shadowed" version="1">
> +    <unix:object object_ref="object_accounts_password_all_shadowed" />
> +    <unix:state state_ref="state_accounts_password_all_shadowed" />
> +  </unix:password_test>
> +  <unix:password_object id="object_accounts_password_all_shadowed" version="1">
> +    <unix:username operation="pattern match">.*</unix:username>
> +  </unix:password_object>
> +  <unix:password_state id="state_accounts_password_all_shadowed" version="1">
> +    <unix:password>x</unix:password>
> +  </unix:password_state>
> +</def-group>
> diff --git a/Fedora/input/checks/no_empty_passwords.xml b/Fedora/input/checks/no_empty_passwords.xml
> new file mode 100644
> index 0000000..054d643
> --- /dev/null
> +++ b/Fedora/input/checks/no_empty_passwords.xml
> @@ -0,0 +1,22 @@
> +<def-group>
> +  <definition class="compliance" id="no_empty_passwords" version="1">
> +    <metadata>
> +      <title>No nullok Option in /etc/pam.d/system-auth</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="test_no_empty_passwords" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="test_no_empty_passwords" version="1">
> +    <ind:object object_ref="object_no_empty_passwords" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_no_empty_passwords" version="1">
> +    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
> +    <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/Fedora/input/checks/no_netrc_files.xml b/Fedora/input/checks/no_netrc_files.xml
> new file mode 100644
> index 0000000..740a98b
> --- /dev/null
> +++ b/Fedora/input/checks/no_netrc_files.xml
> @@ -0,0 +1,22 @@
> +<def-group>
> +  <definition class="compliance" id="no_netrc_files" version="1">
> +    <metadata>
> +      <title>Verify No netrc Files Exist</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion test_ref="test_no_netrc_files_home" negate="true" />
> +    </criteria>
> +  </definition>
> +  <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="test_no_netrc_files_home" version="1">
> +    <unix:object object_ref="object_no_netrc_files_home" />
> +  </unix:file_test>
> +  <unix:file_object comment="look for .netrc in /home" id="object_no_netrc_files_home" version="1">
> +    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
> +    <unix:path operation="equals">/home</unix:path>
> +    <unix:filename operation="pattern match">^\.netrc$</unix:filename>
> +  </unix:file_object>
> +</def-group>
> diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
> index a24bdd9..8bdf86e 100644
> --- a/Fedora/input/guide.xslt
> +++ b/Fedora/input/guide.xslt
> @@ -24,6 +24,7 @@
>       <xsl:copy>
>         <xsl:copy-of select="@*|node()" />
>         <xsl:apply-templates select="document('system/software/software.xml')" />
> +      <xsl:apply-templates select="document('system/accounts/accounts.xml')" />
>       </xsl:copy>
>     </xsl:template>
>   
> @@ -34,6 +35,20 @@
>       </xsl:copy>
>     </xsl:template>
>   
> +  <xsl:template match="Group[@id='accounts']">
> +    <xsl:copy>
> +      <xsl:copy-of select="@*|node()" />
> +      <xsl:apply-templates select="document('system/accounts/restrictions/restrictions.xml')" />
> +    </xsl:copy>
> +  </xsl:template>
> +
> +  <xsl:template match="Group[@id='accounts-restrictions']">
> +    <xsl:copy>
> +      <xsl:copy-of select="@*|node()" />
> +      <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
> +    </xsl:copy>
> +  </xsl:template>
> +
>     <!-- copy everything else through to final output -->
>     <xsl:template match="@*|node()">
>       <xsl:copy>
> diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
> index 18c8f3e..2739a33 100644
> --- a/Fedora/input/profiles/common.xml
> +++ b/Fedora/input/profiles/common.xml
> @@ -4,5 +4,9 @@
>   
>   <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
>   <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
> +<select idref="no_empty_passwords" selected="true"/>
> +<select idref="no_hashes_outside_shadow" selected="true"/>
> +<select idref="gid_passwd_group_same" selected="true"/>
> +<select idref="no_netrc_files" selected="true"/>
>   
>   </Profile>
> diff --git a/Fedora/input/system/accounts/accounts.xml b/Fedora/input/system/accounts/accounts.xml
> new file mode 100644
> index 0000000..044d85d
> --- /dev/null
> +++ b/Fedora/input/system/accounts/accounts.xml
> @@ -0,0 +1,11 @@
> +<Group id="accounts">
> +<title>Account and Access Control</title>
> +<description>In traditional Unix security, if an attacker gains
> +shell access to a certain login account, they can perform any action
> +or access any file to which that account has access. Therefore,
> +making it more difficult for unauthorized people to gain shell
> +access to accounts, particularly to privileged accounts, is a
> +necessary part of securing a system. This section introduces
> +mechanisms for restricting access to accounts under Fedora.
> +</description>
> +</Group>
> diff --git a/Fedora/input/system/accounts/restrictions/password_storage.xml b/Fedora/input/system/accounts/restrictions/password_storage.xml
> new file mode 100644
> index 0000000..d1bbcd3
> --- /dev/null
> +++ b/Fedora/input/system/accounts/restrictions/password_storage.xml
> @@ -0,0 +1,107 @@
> +<Group id="password_storage">
> +<title>Verify Proper Storage and Existence of Password
> +Hashes</title>
> +<description>
> +By default, password hashes for local accounts are stored
> +in the second field (colon-separated) in
> +<tt>/etc/shadow</tt>. This file should be readable only by
> +processes running with root credentials, preventing users from
> +casually accessing others' password hashes and attempting
> +to crack them.
> +However, it remains possible to misconfigure the system
> +and store password hashes
> +in world-readable files such as <tt>/etc/passwd</tt>, or
> +to even store passwords themselves in plaintext on the system.
> +Using system-provided tools for password change/creation
> +should allow administrators to avoid such misconfiguration.
> +</description>
> +
> +<Rule id="no_empty_passwords" severity="high">
> +<title>Prevent Log In to Accounts With Empty Password</title>
> +<description>If an account is configured for password authentication
> +but does not have an assigned password, it may be possible to log
> +into the account without authentication. Remove any instances of the <tt>nullok</tt>
> +option in <tt>/etc/pam.d/system-auth</tt> to
> +prevent logins with empty passwords.
> +</description>
> +<ocil clause="NULL passwords can be used">
> +To verify that null passwords cannot be used, run the following command:
> +<pre># grep nullok /etc/pam.d/system-auth</pre>
> +If this produces any output, it may be possible to log into accounts
> +with empty passwords.
> +</ocil>
> +<rationale>
> +If an account has an empty password, anyone could log in and
> +run commands with the privileges of that account. Accounts with
> +empty passwords should never be used in operational
> +environments.
> +</rationale>
> +<oval id="no_empty_passwords" />
> +<ref nist="IA-5(b),IA-5(c),IA-5(1)(a)" />
> +</Rule>
> +
> +<Rule id="no_hashes_outside_shadow" severity="medium">
> +<title>Verify All Account Password Hashes are Shadowed</title>
> +<description>
> +If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
> +instead of an <tt>x</tt>), the cause of this misconfiguration should be
> +investigated.  The account should have its password reset and the hash should be
> +properly stored, or the account should be deleted entirely.
> +</description>
> +<ocil clause="any stored hashes are found in /etc/passwd">
> +To check that no password hashes are stored in
> +<tt>/etc/passwd</tt>, run the following command:
> +<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
> +If it produces any output, then a password hash is
> +stored in <tt>/etc/passwd</tt>.
> +</ocil>
> +<rationale>
> +The hashes for all user account passwords should be stored in
> +the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
> +which is readable by all users.
> +</rationale>
> +<oval id="accounts_password_all_shadowed" />
> +<ref nist="IA-5(h)" disa="201" />
> +</Rule>
> +
> +<Rule id="gid_passwd_group_same">
> +<title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
> +<description>
> +Add a group to the system for each GID referenced without a corresponding group.
> +</description>
> +<ocil clause="there is output">
> +To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>,
> +run the following command:
> +<pre># pwck -qr</pre>
> +There should be no output.
> +</ocil>
> +<rationale>
> +Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
> +</rationale>
> +<ref disa="366" />
> +</Rule>
> +
> +<Rule id="no_netrc_files" severity="medium">
> +<title>Verify No netrc Files Exist</title>
> +<description>The <tt>.netrc</tt> files contain login information
> +used to auto-login into FTP servers and reside in the user's home
> +directory. These files may contain unencrypted passwords to
> +remote FTP servers making them susceptible to access by unauthorized
> +users and should not be used.  Any <tt>.netrc</tt> files should be removed.
> +</description>
> +<ocil clause="any .netrc files exist">
> +To check the system for the existence of any <tt>.netrc</tt> files,
> +run the following command:
> +<pre># find /home -xdev -name .netrc</pre>
> +<!-- needs fixup to limit search to home dirs -->
> +</ocil>
> +<rationale>
> +Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
> +files. DoD policy requires passwords be encrypted in storage and not used
> +in access scripts.
> +</rationale>
> +<oval id="no_netrc_files" />
> +<ref nist="IA-5(h)" disa="196" />
> +</Rule>
> +
> +</Group>
> diff --git a/Fedora/input/system/accounts/restrictions/restrictions.xml b/Fedora/input/system/accounts/restrictions/restrictions.xml
> new file mode 100644
> index 0000000..febead6
> --- /dev/null
> +++ b/Fedora/input/system/accounts/restrictions/restrictions.xml
> @@ -0,0 +1,13 @@
> +<Group id="accounts-restrictions">
> +<title>Protect Accounts by Restricting Password-Based Login</title>
> +<description>Conventionally, Unix shell accounts are accessed by
> +providing a username and password to a login program, which tests
> +these values for correctness using the <tt>/etc/passwd</tt> and
> +<tt>/etc/shadow</tt> files. Password-based login is vulnerable to
> +guessing of weak passwords, and to sniffing and man-in-the-middle
> +attacks against passwords entered over a network or at an insecure
> +console. Therefore, mechanisms for accessing accounts by entering
> +usernames and passwords should be restricted to those which are
> +operationally necessary.</description>
> +
> +</Group>
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
> index 4ef3713..73eab57 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>   # file one level up - in the main scap-security-guide directory (instead of
>   # this one).
>   
> -%global	fedorassgrelease	2.rc1
> +%global	fedorassgrelease	2.rc2
>   
>   Name:		scap-security-guide
>   Version:	0.1
> @@ -50,6 +50,15 @@ rm -rf $RPM_BUILD_ROOT
>   %{_datadir}/xml/scap/ssg/fedora/19/*
>   
>   %changelog
> +* Thu Oct 10 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1-2.rc2
> +- Introduce 'Account and Access Control' section
> +- Convert following "Verify Proper Storage and Existence of Password Hashes" section
> +  rules to Fedora:
> +  * Prevent Log In to Accounts With Empty Password
> +  * Verify All Account Password Hashes are Shadowed
> +  * All GIDs referenced in /etc/passwd must be defined in /etc/group
> +  * Verify No netrc Files Exist
> +
>   * Wed Oct 02 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1-2.rc1
>   - Set proper name of the build directory in the spec's %setup macro.
>   - Replace hard-wired paths with macros. Preserve attributes when copying files.
> -- 1.7.11.7

ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131010/0656743a/attachment-0001.html>


More information about the scap-security-guide mailing list