[PATCH] New XCCDF Profile - Red Hat Certified Cloud Provider (rht-ccp)

Shawn Wells shawn at redhat.com
Fri Oct 11 19:54:22 UTC 2013


-------------- next part --------------
>From 363324350a1c4efe4dceefa3e309865fc54913b6 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 10 Oct 2013 08:11:24 -0400
Subject: [PATCH] New XCCDF Profile: Red Hat Certified Cloud Provider (rht-ccp)
 - Testing profile for Red Hat's CCP program (standards for Red Hat's certified cloud providers)

oscap xccdf eval generates no errors
---
 RHEL6/input/guide.xslt           |    1 +
 RHEL6/input/profiles/rht-ccp.xml |  137 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 138 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/profiles/rht-ccp.xml

diff --git a/RHEL6/input/guide.xslt b/RHEL6/input/guide.xslt
index 17e0f23..5c7d0f6 100644
--- a/RHEL6/input/guide.xslt
+++ b/RHEL6/input/guide.xslt
@@ -16,6 +16,7 @@
 		<!-- <xsl:apply-templates select="document('profiles/ftp.xml')" /> -->
 		<xsl:apply-templates select="document('profiles/stig-rhel6-server.xml')" />
 		<xsl:apply-templates select="document('profiles/usgcb-rhel6-server.xml')" />
+		<xsl:apply-templates select="document('profiles/rht-ccp.xml')" />
 
        <Value id="conditional_clause" type="string" operator="equals">
                  <title>A conditional clause for check statements.</title>
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
new file mode 100644
index 0000000..40d4a81
--- /dev/null
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -0,0 +1,137 @@
+<Profile id="rht-ccp" xmlns="http://checklists.nist.gov/xccdf/1.1">
+<title>Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)</title>
+<description>This is a *draft* SCAP profile for Red Hat Certified Cloud Providers</description>
+<!-- CONFIGURATION OPTIONS -->
+<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_policy_name" selector="targeted"/>
+<refine-value idref="file_owner_logfiles_value" selector="root"/>
+<refine-value idref="file_groupowner_logfiles_value" selector="root"/>
+<refine-value idref="sshd_idle_timeout_value" selector="5_minutes"/>
+<refine-value idref="var_password_min_len" selector="6"/>
+<refine-value idref="var_password_max_age" selector="90"/>
+<refine-value idref="var_password_min_age" selector="7"/>
+<refine-value idref="var_password_warn_age" selector="7"/>
+<refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
+<refine-value idref="var_password_pam_cracklib_minlen" selector="14"/>
+<refine-value idref="var_password_pam_cracklib_dcredit" selector="1"/>
+<refine-value idref="var_password_pam_cracklib_ucredit" selector="2"/>
+<refine-value idref="var_password_pam_cracklib_ocredit" selector="2"/>
+<refine-value idref="var_password_pam_cracklib_lcredit" selector="2"/>
+<refine-value idref="var_password_pam_cracklib_difok" selector="3"/>
+<refine-value idref="password_history_retain_number" selector="5"/>
+<refine-value idref="var_accounts_user_umask" selector="077"/>
+<refine-value idref="login_banner_text" selector="usgcb_default"/>
+
+<!-- FILESYSTEM CHECKS -->
+<select idref="partition_for_tmp" selected="true"/>
+<select idref="partition_for_var" selected="true"/>
+<select idref="partition_for_var_log" selected="true"/>
+<select idref="partition_for_var_log_audit" selected="true"/>
+
+<!-- SELINUX CHECKS -->
+<select idref="enable_selinux_bootloader" selected="true"/>
+<select idref="set_selinux_state" selected="true"/>
+<select idref="set_selinux_policy" selected="true"/>
+<select idref="selinux_all_devicefiles_labeled" selected="true"/>
+
+
+<!-- UPDATING CHECKS -->
+<select idref="ensure_redhat_gpgkey_installed" selected="true"/>
+<select idref="security_patches_up_to_date" selected="true"/>
+<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
+<select idref="ensure_gpgcheck_never_disabled" selected="true"/>
+
+
+<select idref="package_aide_installed" selected="true"/>
+
+<!-- ACCOUNT MANAGEMENT CHECKS -->
+<select idref="limiting_password_reuse" selected="true"/>
+<select idref="no_shelllogin_for_systemaccounts" selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_hashes_outside_shadow" selected="true"/>
+<select idref="no_uidzero_except_root" selected="true"/>
+<select idref="accounts_password_minlen_login_defs" selected="true"/>
+<select idref="accounts_minimum_age_login_defs" selected="true"/>
+<select idref="accounts_maximum_age_login_defs" selected="true"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true"/>
+<select idref="accounts_password_pam_cracklib_retry" selected="true"/>
+<select idref="password_require_digits" selected="true"/>
+<select idref="password_require_uppercases" selected="true"/>
+<select idref="password_require_specials" selected="true"/>
+<select idref="password_require_lowercases" selected="true"/>
+<select idref="password_require_diffchars" selected="true"/>
+<select idref="deny_password_attempts" selected="true"/>
+<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
+<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
+<select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
+<select idref="require_singleuser_auth" selected="true"/>
+
+<!-- FILE PERMISSION CHECKS -->
+<select idref="userowner_shadow_file" selected="true"/>
+<select idref="groupowner_shadow_file" selected="true"/>
+<select idref="perms_shadow_file" selected="true"/>
+<select idref="userowner_gshadow_file" selected="true"/>
+<select idref="groupowner_gshadow_file" selected="true"/>
+<select idref="perms_gshadow_file" selected="true"/>
+<select idref="userowner_passwd_file" selected="true"/>
+<select idref="groupowner_passwd_file" selected="true"/>
+<select idref="file_permissions_etc_passwd" selected="true"/>
+<select idref="userowner_group_file" selected="true"/>
+<select idref="groupowner_group_file" selected="true"/>
+<select idref="perms_group_file" selected="true"/>
+<select idref="file_permissions_library_dirs" selected="true"/>
+<select idref="file_ownership_library_dirs" selected="true"/>
+<select idref="file_permissions_binary_dirs" selected="true"/>
+<select idref="file_ownership_binary_dirs" selected="true"/>
+<select idref="audit_logs_permissions" selected="true"/>
+<select idref="user_owner_grub_conf" selected="true"/>
+<select idref="group_owner_grub_conf" selected="true"/>
+<select idref="permissions_grub_conf" selected="true"/>
+<select idref="bootloader_password" selected="true"/>
+
+<!-- KERNEL SETTINGS -->
+<select idref="enable_randomize_va_space" selected="true"/>
+<select idref="enable_execshield" selected="true"/>
+<select idref="kernel_module_ipv6_option_disabled" selected="true"/>
+<select idref="service_ip6tables_enabled" selected="true"/>
+<select idref="service_iptables_enabled" selected="true"/>
+<select idref="set_iptables_default_rule" selected="true"/>
+<select idref="kernel_module_dccp_disabled" selected="true"/>
+<select idref="kernel_module_sctp_disabled" selected="true"/>
+<select idref="kernel_module_rds_disabled" selected="true"/>
+<select idref="kernel_module_tipc_disabled" selected="true"/>
+
+<!-- ANTIQUATED SERVICES -->
+<select idref="disable_xinetd" selected="true"/>
+<select idref="uninstall_xinetd" selected="true"/>
+<select idref="uninstall_telnet_server" selected="true"/>
+<select idref="disable_telnet_service" selected="true"/>
+<select idref="uninstall_rsh-server" selected="true"/>
+<select idref="disable_rsh" selected="true"/>
+<select idref="disable_rexec" selected="true"/>
+<select idref="disable_rlogin" selected="true"/>
+<select idref="uninstall_ypserv" selected="true"/>
+<select idref="disable_ypbind" selected="true"/>
+<select idref="uninstall_tftp-server" selected="true"/>
+<select idref="disable_tftp" selected="true"/>
+<select idref="disable_avahi" selected="true"/>
+<select idref="service_abrtd_disabled" selected="true"/>
+<select idref="service_atd_disabled" selected="true"/>
+<select idref="service_autofs_disabled" selected="true"/>
+<select idref="service_ntpdate_disabled" selected="true"/>
+<select idref="service_oddjobd_disabled" selected="true"/>
+<select idref="service_qpidd_disabled" selected="true"/>
+<select idref="service_rdisc_disabled" selected="true"/>
+
+<!-- SSH / REMOTE ACCESS CHECKS -->
+<select idref="sshd_allow_only_protocol2" selected="true"/>
+<select idref="sshd_set_idle_timeout" selected="true"/>
+<select idref="sshd_set_keepalive" selected="true"/>
+<select idref="sshd_disable_rhosts" selected="true"/>
+<select idref="disable_host_auth" selected="true"/>
+<select idref="sshd_disable_root_login" selected="true"/>
+<select idref="sshd_disable_empty_passwords" selected="true"/>
+<select idref="sshd_enable_warning_banner" selected="true"/>
+<select idref="sshd_do_not_permit_user_env" selected="true"/>
+<select idref="sshd_use_approved_ciphers" selected="true"/>
+</Profile>
-- 
1.7.1



More information about the scap-security-guide mailing list