[PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's rules to Fedora

Jan Lieskovsky jlieskov at redhat.com
Mon Oct 14 10:21:06 UTC 2013


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Monday, October 14, 2013 5:59:12 AM
> Subject: Re: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's	rules to Fedora
> 
> On 10/11/13 10:54 AM, Jan Lieskovsky wrote:
> 
> 
> 
> This proposal converts rules from RHEL6's 'Restrict Root Logins'
> section so they could be used on Fedora too. Depends on previous
> typo fix (caab207a8c8a587914d9a1b318d972bbd678896c).
> 
> Common Fedora rpm Makefile rules and Fedora SSG Makefile content
> rules have been tested and confirmed to work properly.
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> 0001-Fedora-Convert-RHEL6-Restrict-Root-Logins-section-s-.patch
> From 844d8b1e757942da57adedf8f6ad726a4771ae01 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Fri, 11 Oct 2013 16:44:31
> +0200
> Subject: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's
>  rules to Fedora
> 
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  .../input/checks/accounts_no_uid_except_zero.xml   |  23 +++
>  .../checks/no_shelllogin_for_systemaccounts.xml    |  22 ++
>  .../input/checks/restrict_serial_port_logins.xml   |  27 +++
>  .../checks/securetty_root_login_console_only.xml   |  26 +++
>  Fedora/input/guide.xml                             |   2 +-
>  Fedora/input/guide.xslt                            |   1 +
>  Fedora/input/profiles/common.xml                   |  35 +++-
>  .../system/accounts/restrictions/root_logins.xml   | 230
>  +++++++++++++++++++++
>  Fedora/scap-security-guide.spec                    |   5 +-
>  9 files changed, 359 insertions(+), 12 deletions(-)
>  create mode 100644 Fedora/input/checks/accounts_no_uid_except_zero.xml
>  create mode 100644 Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
>  create mode 100644 Fedora/input/checks/restrict_serial_port_logins.xml
>  create mode 100644 Fedora/input/checks/securetty_root_login_console_only.xml
>  create mode 100644 Fedora/input/system/accounts/restrictions/root_logins.xml
> 
> diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml
> b/Fedora/input/checks/accounts_no_uid_except_zero.xml
> new file mode 100644
> index 0000000..cc337f4
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_no_uid_except_zero.xml
> @@ -0,0 +1,23 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_no_uid_except_zero"
> version="1">
> +    <metadata>
> +      <title>UID 0 Belongs Only To Root</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>Only the root account should be assigned a user id of
> 0.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in
> /etc/passwd file" test_ref="test_accounts_no_uid_except_root" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist"
> comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file"
> id="test_accounts_no_uid_except_root" version="1">
> +    <ind:object object_ref="object_accounts_no_uid_except_root" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_accounts_no_uid_except_root"
> version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>passwd</ind:filename>
> +    <ind:pattern operation="pattern
> match">^(?!root:)[^:]*:[^:]:0</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
> b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
> new file mode 100644
> index 0000000..8f1b6f6
> --- /dev/null
> +++ b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml
> @@ -0,0 +1,22 @@
> +<def-group>
> +  <definition class="compliance" id="no_shelllogin_for_systemaccounts"
> version="1">
> +    <metadata>
> +      <title>System Accounts Do Not Run a Shell</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The root account is the only system account that should
> have a login shell.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="tests for the presence of login shells (not
> /sbin/nologin) for system accounts in /etc/passwd file"
> test_ref="test_no_shelllogin_for_systemaccounts" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist"
> comment="tests for the presence of login shells (not /sbin/nologin) for
> system accounts in /etc/passwd file"
> id="test_no_shelllogin_for_systemaccounts" version="1">
> +    <ind:object object_ref="object_no_shelllogin_for_systemaccounts" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_no_shelllogin_for_systemaccounts"
> version="1">
> +    <ind:filepath>/etc/passwd</ind:filepath>
> +    <ind:pattern operation="pattern
> match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/Fedora/input/checks/restrict_serial_port_logins.xml
> b/Fedora/input/checks/restrict_serial_port_logins.xml
> new file mode 100644
> index 0000000..a1f456e
> --- /dev/null
> +++ b/Fedora/input/checks/restrict_serial_port_logins.xml
> @@ -0,0 +1,27 @@
> +<def-group>
> +  <definition class="compliance" id="restrict_serial_port_logins"
> version="1">
> +    <metadata>
> +      <title>Restrict Serial Port Root Logins</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>Preventing direct root login to serial port interfaces
> helps
> +      ensure accountability for actions taken on the system using the root
> +      account.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="serial ports /etc/securetty"
> test_ref="test_serial_ports_etc_securetty" negate="true" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> comment="serial ports /etc/securetty" id="test_serial_ports_etc_securetty"
> version="1">
> +    <ind:object object_ref="object_serial_ports_etc_securetty" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object comment="serial ports /etc/securetty"
> id="object_serial_ports_etc_securetty" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>securetty</ind:filename>
> +    <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/Fedora/input/checks/securetty_root_login_console_only.xml
> b/Fedora/input/checks/securetty_root_login_console_only.xml
> new file mode 100644
> index 0000000..51a33de
> --- /dev/null
> +++ b/Fedora/input/checks/securetty_root_login_console_only.xml
> @@ -0,0 +1,26 @@
> +<def-group>
> +  <definition class="compliance" id="securetty_root_login_console_only"
> version="1">
> +    <metadata>
> +      <title>Restrict Virtual Console Root Logins</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>Preventing direct root login to virtual console devices
> +      helps ensure accountability for actions taken on the system using the
> +      root account.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="virtual consoles /etc/securetty"
> test_ref="test_virtual_consoles_etc_securetty" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist"
> comment="virtual consoles /etc/securetty"
> id="test_virtual_consoles_etc_securetty" version="1">
> +    <ind:object object_ref="object_virtual_consoles_etc_securetty" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object comment="virtual consoles /etc/securetty"
> id="object_virtual_consoles_etc_securetty" version="1">
> +    <ind:filepath>/etc/securetty</ind:filepath>
> +    <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
> index 6e276b1..8d21fe8 100644
> --- a/Fedora/input/guide.xml
> +++ b/Fedora/input/guide.xml
> @@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United
> States and other
>  countries. All other names are registered trademarks or trademarks of their
>  respective companies.</rear-matter>
>  <platform idref="cpe:/o:fedoraproject:fedora:19" />
> -<version>0.0.2</version>
> +<version>0.0.3</version>
>  </Benchmark>
> diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
> index 559042e..d99da5a 100644
> --- a/Fedora/input/guide.xslt
> +++ b/Fedora/input/guide.xslt
> @@ -45,6 +45,7 @@
>    <xsl:template match="Group[@id='accounts-restrictions']">
>      <xsl:copy>
>        <xsl:copy-of select="@*|node()" />
> +      <xsl:apply-templates
> select="document('system/accounts/restrictions/root_logins.xml')" />
>        <xsl:apply-templates
>        select="document('system/accounts/restrictions/password_storage.xml')"
>        />
>        <xsl:apply-templates
>        select="document('system/accounts/restrictions/password_expiration.xml')"
>        />
>      </xsl:copy>
> diff --git a/Fedora/input/profiles/common.xml
> b/Fedora/input/profiles/common.xml
> index 83e3478..8997e79 100644
> --- a/Fedora/input/profiles/common.xml
> +++ b/Fedora/input/profiles/common.xml
> @@ -2,15 +2,30 @@
>  <title>Common Profile for General-Purpose Fedora Systems</title>
>  <description>This profile contains items common to general-purpose Fedora
>  installations.</description>
>  
> -<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
> -<select idref="ensure_gpgcheck_never_disabled" selected="true"/>
> -<select idref="no_empty_passwords" selected="true"/>
> -<select idref="no_hashes_outside_shadow" selected="true"/>
> -<select idref="gid_passwd_group_same" selected="true"/>
> -<select idref="no_netrc_files" selected="true"/>
> -<select idref="accounts_password_minlen_login_defs" selected="true"/>
> -<select idref="accounts_minimum_age_login_defs" selected="true"/>
> -<select idref="accounts_maximum_age_login_defs" selected="true"/>
> -<select idref="accounts_password_warn_age_login_defs" selected="true"/>
> +<!-- Installing and Maintaining Software section rules -->
> +  <!-- Updating Software section rules -->
> +  <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
> +  <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
> +
> +<!-- Account and Access Control section rules -->
> +  <!-- Protect Accounts by Restricting Password-Based Login section rules
> -->
> +    <!-- Restrict Root Logins section rules -->
> +    <select idref="no_direct_root_logins" selected="true"/>
> +    <select idref="securetty_root_login_console_only" selected="true"/>
> +    <select idref="restrict_serial_port_logins" selected="true"/>
> +    <select idref="no_root_webbrowsing" selected="true"/>
> +    <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
> +    <select idref="no_uidzero_except_root" selected="true"/>
> +    <select idref="root_path_default" selected="true"/>
> +    <!-- Verify Proper Storage and Existence of Password Hashes section
> rules -->
> +    <select idref="no_empty_passwords" selected="true"/>
> +    <select idref="no_hashes_outside_shadow" selected="true"/>
> +    <select idref="gid_passwd_group_same" selected="true"/>
> +    <select idref="no_netrc_files" selected="true"/>
> +    <!-- Set Password Expiration Parameters section rules -->
> +    <select idref="accounts_password_minlen_login_defs" selected="true"/>
> +    <select idref="accounts_minimum_age_login_defs" selected="true"/>
> +    <select idref="accounts_maximum_age_login_defs" selected="true"/>
> +    <select idref="accounts_password_warn_age_login_defs" selected="true"/>
>  
>  </Profile>
> diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml
> b/Fedora/input/system/accounts/restrictions/root_logins.xml
> new file mode 100644
> index 0000000..48b222b
> --- /dev/null
> +++ b/Fedora/input/system/accounts/restrictions/root_logins.xml
> @@ -0,0 +1,230 @@
> +<Group id="root_logins">
> +<title>Restrict Root Logins</title>
> +<description>
> +Direct root logins should be allowed only for emergency use.
> +In normal situations, the administrator should access the system
> +via a unique unprivileged account, and then use <tt>su</tt> or <tt>sudo</tt>
> to execute
> +privileged commands. Discouraging administrators from accessing the
> +root account directly ensures an audit trail in organizations with
> +multiple administrators. Locking down the channels through which
> +root can connect directly also reduces opportunities for
> +password-guessing against the root account. The <tt>login</tt> program
> +uses the file <tt>/etc/securetty</tt> to determine which interfaces
> +should allow root logins.
> +
> +The virtual devices <tt>/dev/console</tt>
> +and <tt>/dev/tty*</tt> represent the system consoles (accessible via
> +the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
> +installation). The default securetty file also contains <tt> / dev/vc /
> *</tt>.
> +These are likely to be deprecated in most environments, but may be retained
> +for compatibility. Furthermore, <tt>/dev/hvc*</tt> represent virtio-serial
> +consoles, <tt>/dev/hvsi*</tt> IBM pSeries serial consoles, and finally
> +<tt>/dev/xvc0</tt> Xen virtual console. Root should also be prohibited
> +from connecting via network protocols. Other sections of this document
> +include guidance describing how to prevent root from logging in via SSH.
> +</description>
> +
> +<Rule id="no_direct_root_logins" severity="medium">
> +<title>Direct root Logins Not Allowed</title>
> +<description>To further limit access to the <tt>root</tt> account,
> administrators
> +can disable root logins at the console by editing the
> <tt>/etc/securetty</tt> file.
> +This file lists all devices the root user is allowed to login to. If the
> file does
> +not exist at all, the root user can login through any communication device
> on the
> +system, whether via the console or via a raw network interface. This is
> dangerous
> +as user can login to his machine as root via Telnet, which sends the
> password in
> +plain text over the network. By default, Fedora's <tt>/etc/securetty</tt>
> file
> +only allows the root user to login at the console physically attached to the
> +machine. To prevent root from logging in, remove the contents of this file.
> +To prevent direct root logins, remove the contents of this file by typing
> the
> +following command:
> +<pre>
> +echo > /etc/securetty
> +</pre>
> +</description>
> +<ocil clause="the /etc/securetty file is not empty">
> +To ensure root may not directly login to the system over physical consoles,
> +run the following command:
> +<pre>cat /etc/securetty</pre>
> +If any output is returned, this is a finding.
> +</ocil>
> +<rationale>
> +Disabling direct root logins ensures proper accountability and multifactor
> +authentication to privileged accounts. Users will first login, then escalate
> +to privileged (root) access via su / sudo. This scenario is nowadays
> required
> +by security standards.
> +</rationale>
> +<ref nist="IA-2(1)" />
> +</Rule>
> +
> +<Rule id="securetty_root_login_console_only" severity="medium">
> +<title>Restrict Virtual Console Root Logins</title>
> +<description>
> +To restrict root logins through the (deprecated) virtual console devices,
> +ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> +<pre>vc/1
> +vc/2
> +vc/3
> +vc/4</pre>
> +</description>
> +<ocil clause="root login over virtual console devices is permitted">
> +To check for virtual console entries which permit root login, run the
> +following command:
> +<pre># grep ^vc/[0-9] /etc/securetty</pre>
> +If any output is returned, then root logins over virtual console devices is
> permitted.
> +</ocil>
> +<rationale>
> +Preventing direct root login to virtual console devices
> +helps ensure accountability for actions taken on the system
> +using the root account.
> +</rationale>
> +<oval id="securetty_root_login_console_only" />
> +<ref nist="AC-6(2)" disa="770" />
> +</Rule>
> +
> +<Rule id="restrict_serial_port_logins">
> +<title>Restrict Serial Port Root Logins</title>
> +<description>To restrict root logins on serial ports,
> +ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> +<pre>ttyS0
> +ttyS1</pre>
> +<!-- TODO: discussion/description of serial port -->
> +</description>
> +<ocil clause="root login over serial ports is permitted">
> +To check for serial port entries which permit root login,
> +run the following command:
> +<pre># grep ^ttyS/[0-9] /etc/securetty</pre>
> +If any output is returned, then root login over serial ports is permitted.
> +</ocil>
> +<rationale>
> +Preventing direct root login to serial port interfaces
> +helps ensure accountability for actions taken on the systems
> +using the root account.
> +</rationale>
> +<oval id="restrict_serial_port_logins" />
> +<ref nist="AC-6(2)" disa="770" />
> +</Rule>
> +
> +<Rule id="no_root_webbrowsing">
> +<title>Restrict Web Browser Use for Administrative Accounts</title>
> +<description>
> +Enforce policy requiring administrative accounts use web browsers only for
> +local service administration.
> +</description>
> +<ocil clause="this is not the case">
> +Check the <tt>root</tt> home directory for a <tt>.mozilla</tt> directory. If
> +one exists, ensure browsing is limited to local service administration.
> +</ocil>
> +<rationale>
> +If a browser vulnerability is exploited while running with administrative
> privileges,
> +the entire system could be compromised. Specific exceptions for local
> service
> +administration should be documented in site-defined policy.
> +</rationale>
> +</Rule>
> +
> +<Rule id="no_shelllogin_for_systemaccounts" severity="medium">
> +<title>Ensure that System Accounts Do Not Run a Shell Upon Login</title>
> +<description>
> +Some accounts are not associated with a human
> +user of the system, and exist to perform some administrative
> +function. Should an attacker be able to log into these accounts,
> +they should not be granted access to a shell.
> +<br /><br />
> +The login shell for each local account is stored in the last field of each
> line
> +in <tt>/etc/passwd</tt>. System accounts are those user accounts with a user
> ID less than
> +500. The user ID is stored in the third field.
> +If any system account <i>SYSACCT</i> (other than root) has a login shell,
> +disable it with the command:
> +<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
> +</description>
> +<ocil clause="any system account (other than root) has a login shell">
> +To obtain a listing of all users,
> +their UIDs, and their shells, run the command:
> +<pre>$ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd</pre>
> +Identify the system accounts from this listing. These will
> +primarily be the accounts with UID numbers less than 500, other
> +than root.
> +</ocil>
> +<rationale>
> +Ensuring shells are not given to system accounts upon login
> +makes it more difficult for attackers to make use of
> +system accounts.
> +</rationale>
> +<warning category="functionality">
> +Do not perform the steps in this
> +section on the root account. Doing so might cause the system to
> +become inaccessible.
> +</warning>
> +<oval id="no_shelllogin_for_systemaccounts" />
> +<ref nist="" disa="178" />
> +</Rule>
> +
> +<Rule id="no_uidzero_except_root" severity="medium">
> +<title>Verify Only Root Has UID 0</title>
> +<description>
> +If any account other than root has a UID of 0,
> +this misconfiguration should be investigated and the
> +accounts other than root should be removed or have their UID changed.
> +</description>
> +<ocil clause="any account other than root has a UID of 0">
> +To list all password file entries for accounts with UID 0, run the following
> command:
> +<pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
> +This should print only one line, for the user root.
> +</ocil>
> +<rationale>
> +An account has root authority if it has a UID of 0. Multiple accounts
> +with a UID of 0 afford more opportunity for potential intruders to
> +guess a password for a privileged account. Proper configuration of
> +sudo is recommended to afford multiple system administrators
> +access to root privileges in an accountable manner.
> +</rationale>
> +<oval id="accounts_no_uid_except_zero" />
> +<ref nist="AC-6,IA-2(1)" disa="366" />
> +</Rule>
> +
> +<Rule id="root_path_default">
> +<title>Root Path Must Be Vendor Default</title>
> +<description>
> +Assuming root shell is bash, edit the following files:
> +<pre>~/.profile</pre>
> +<pre>~/.bashrc</pre>
> +Change any <tt>PATH</tt> variables to the vendor default for root and remove
> any
> +empty <tt>PATH</tt> entries or references to relative paths.
> +</description>
> +<ocil clause="any of these conditions are not met">
> +To view the root user's <tt>PATH</tt>, run the following command:
> +<pre># env | grep PATH</pre>
> +If correctly configured, the <tt>PATH</tt> must: use vendor default
> settings,
> +have no empty entries, and have no entries beginning with a character
> +other than a slash (/).
> +</ocil>
> +<rationale>
> +The root account's executable search path must be the vendor default, and
> must
> +contain only absolute paths.
> +</rationale>
> +</Rule>
> +
> +<!--
> +     This is redundant to the previous rule, which insists that the
> +     root path is the vendor default.
> +
> +<Rule id="root_path_no_wwdir">
> +<title>Root Path Must Not Contain World-Writable Directories</title>
> +<description>
> +If a world-writable directory is found in the <tt>PATH</tt>, remove the
> +world-writable permission for that directory with the following command:
> +<pre># chmod o-w <i>/dir</i></pre>
> +Alternately, remove the world-writable directory from the <tt>PATH</tt>.
> +</description>
> +<ocil clause="any world-writable directories are found">
> +World-writable permissions on directories in root's path can be checked
> +with the following command:
> +<pre># ls -ld 'echo $PATH | sed "s/:/ /g"'</pre>
> +</ocil>
> +<rationale>
> +If the root search path contains a world-writable directory, malicious
> software
> +could be placed in the path.
> +</rationale>
> +<ref disa="366" />
> +</Rule> -->
> +
> +</Group>
> diff --git a/Fedora/scap-security-guide.spec
> b/Fedora/scap-security-guide.spec
> index 1abe666..a2db950 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>  # file one level up - in the main scap-security-guide directory (instead of
>  # this one).
>  
> -%global	fedorassgrelease	2.rc3
> +%global	fedorassgrelease	2.rc4
>  
>  Name:		scap-security-guide
>  Version:	0.1
> @@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT
>  %{_datadir}/xml/scap/ssg/fedora/19/*
>  
>  %changelog
> +* Fri Oct 11 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1-2.rc4
> +- Convert RHEL6 'Restrict Root Logins' section's rules to Fedora
> +
>  * Thu Oct 10 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1-2.rc3
>  - Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
> --
> 1.7.11.7
> 
> Consider updating the <ind:path> and <ind:filename> elements to use
> <ind:filepath>, .e.g:
> 
> old:
> 
> 
> 
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>securetty</ind:filename>
> 
> new:
> 
> 
> 
> +    <ind:filepath>/etc/securetty</ind:filepath>
> 
> Functionally the same thing. Many of the legacy OVAL checks that were
> inherited in RHEL6 use <filename>, we're slowly going through and updating
> to <filepath>. Not important enough to warrant a nack as these tags will be
> updated in the future (though some TBD process), but something to consider
> doing now.
> 
> Ack otherwise!

Thanks, Shawn. path+filename replaced with filepath, re-tested and pushed.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: Assuming the very same should be done for RHEL6 content (at minimal
      change the path+filename in those two RHEL6's checks, possibly grep
      whole RHEL6 for occurrence of path+filename combination and replace
      globally with filepath, right?)

> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list