Various False Positives?

Shawn Wells shawn at redhat.com
Sun Sep 1 14:08:59 UTC 2013


On 8/28/13 2:02 PM, leam hall wrote:
> Hey Maura!
>
> I'm using the openscap-utils rpm and the content from the Fedorahosted 
> zip file.
>
>
> On Wed, Aug 28, 2013 at 1:05 PM, Maura Dailey <maura at eclipse.ncsc.mil 
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
>     On 08/28/2013 12:04 PM, leam hall wrote:
>>     Hey all,
>>
>>     Just ran oscap with the xml files available on the website
>>     (Benchmark version 0.9). Here are the issues that seem to be
>>     false positives. Prefix everything with "RHEL-06-000". These are
>>     all marked as fail but the server meets the STIG.
>     Stupid question, but what are you running against exactly? The RPM
>     or the latest git checkout? I want to make sure that if I run
>     this, I'm seeing the same results, and I've made a lot of changes
>     to OVAL checks in the git repository in the past few weeks. I'm
>     going to run through your list, comparing it against the OVAL checks.
>
>>       9   rhnsd can be on if configured to Satellite server or similar
>     Fix text definitely implies this. It's not the only service that
>     implies it's allowed in certain environments, but then proceeds to
>     only accept a value of disabled.
>
>>      57   ucredit
>

STIG wants ucredit=-1, so to test:

[shawn at rhel6 checks]$ grep ucredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1


[shawn at rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export 
var_password_pam_cracklib_ucredit
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_ucredit.xml
external_variable with id : var_password_pam_cracklib_ucredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.

/Side note: stig-rhel6-server was inheriting 
var_password_pam_cracklib_ucredit=2 from common. Created patch to set 
var_password_pam_cracklib_ucredit=-1 for STIG requirements./

>>      58   ocredit
>

[shawn at rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 
ucredit=-1 *ocredit=5*
[shawn at rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export 
var_password_pam_cracklib_ocredit
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results
Definition oval:scap-security-guide.testing:def:117: false
Evaluation done.

[shawn at rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth
[shawn at rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 
ucredit=-1 *ocredit=-1*
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results
Definition oval:scap-security-guide.testing:def:117: true
Evaluation done.

/Side note: var_password_pam_cracklib_ocredit=2 inherited from common. 
Updated STIG profile for var_password_pam_cracklib_ocredit=-1/


>>      59   lcredit
>

[shawn at rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export 
var_password_pam_cracklib_lcredit
[shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 
ucredit=-1 ocredit=-1*lcredit=5*
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results
Definition oval:scap-security-guide.testing:def:122: false
Evaluation done.

[shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[sudo] password for shawn:
[shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 
ucredit=-1 ocredit=-1 *lcredit=-1*
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.

[shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 
ucredit=-1 ocredit=-1 *lcredit=-5*
[shawn at rhel6 checks]$ ./testcheck.py 
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : 
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml
Writing results to : 
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.


/Side note: var_password_pam_cracklib_lcredit=2 inherited from common. 
Updated STIG profile for var_password_pam_cracklib_lcredit=-1/

>     For the previous 3, I'd like to see the pam_cracklib.so line so I
>     can troubleshoot.
>

As Maura mentioned, can you send your /etc/pam.d/system-auth file? I had 
trouble reproducing your results.


>>      73   /etc/issue
>     Going back to my many many OVAL check updates, I'd like to see
>     your exact /etc/issue so I can debug what went wrong. If it's an
>     exact copy of the text from the STIG, I'll work off that.
>
Skipping since Maura has the regex foo for this :)


>>      98  No ipv6 installed
>     Do you mean it's disabled on your system, but the OVAL checks are
>     saying it isn't?
>
[shawn at rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat 
/etc/modprobe.d/disabled.conf ; \
 > ./testcheck.py kernel_module_ipv6_option_disabled.xml ; \
 > sudo vim /etc/modprobe.d/disabled.conf ; cat 
/etc/modprobe.d/disabled.conf ; \
 > ./testcheck.py kernel_module_ipv6_option_disabled.xml
options ipv6 disable=1
Evaluating with OVAL tempfile : 
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml
Writing results to : 
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results
Definition oval:scap-security-guide.testing:def:127: true
Evaluation done.
Evaluating with OVAL tempfile : 
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml
Writing results to : 
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results
Definition oval:scap-security-guide.testing:def:127: false
Evaluation done.

Appears working. Can you send where you disabled IPv6?


>>      99  "
>     ?
>
RHEL-06-000099: The system must ignore ICMPv6 redirects by default.
aka sysctl_net_ipv6_conf_default_accept_redirects.xml

[root at rhel6 checks]# sysctl -q -n -w 
net.ipv6.conf.default.accept_redirects=0
[root at rhel6 checks]# ./testcheck.py 
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile : 
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml
Writing results to : 
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results
Definition oval:scap-security-guide.testing:def:130: true
Evaluation done.
[root at rhel6 checks]# sysctl -q -n -w 
net.ipv6.conf.default.accept_redirects=1
[root at rhel6 checks]# ./testcheck.py 
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile : 
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml
Writing results to : 
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results
Definition oval:scap-security-guide.testing:def:130: false
Evaluation done.

Can you send us the output of:
`grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and
`sysctl -a | grep net.ipv6.conf.default.accept_redirects`

>>     165  adjtimex
>
[root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k 
audit_time_rules" >> /etc/audit/audit.rules
[root at rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_adjtimexQoelxQ.xml
Writing results to : /tmp/audit_rules_time_adjtimexQoelxQ.xml-results
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Definition oval:scap-security-guide.testing:def:134: true
Evaluation done.

Since these operate on OR's, the false is checking for 32bit auditing 
rules. Ultimately, this results in a pass.

Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?



>>     167  settimeofday
>
[root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S settimeofday -k 
audit_time_rules" >> /etc/audit/audit.rules
[root at rhel6 checks]# ./testcheck.py audit_rules_time_settimeofday.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_settimeofday9TYIqD.xml
Writing results to : /tmp/audit_rules_time_settimeofday9TYIqD.xml-results
Definition oval:scap-security-guide.testing:def:147: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
(passes)


Can you send the output of 'grep settimeofday /etc/audit/audit.rules' ?



>>     169  stime  // Also, the STIG is wrong. There is no x86_64 stime
>>     syscall
>     The STIG actually says that stime is not necessary, which is kind
>     of a strange wording, but the suggested line in the fix text prose
>     is correct, at least. So far as OVAL checks go, I haven't gotten
>     to testing audit checks yet. Maybe this is broken. I'll check it
>     out once I've deciphered the OVAL check.
>

[root at rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k 
audit_time_rules" >> /etc/audit/audit.rules
[root at rhel6 RHEL6]# cd input/checks/
[root at rhel6 checks]# ./testcheck.py audit_rules_time_s
audit_rules_time_settimeofday.xml audit_rules_time_stime.xml
[root at rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_stime4hUFRb.xml
Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results
Definition oval:scap-security-guide.testing:def:152: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.


Can you send the output of 'grep stime /etc/audit/audit.rules' ?


>
>>     171  clock_settime
>
[root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S clock_settime 
-k audit_time_rules" >> /etc/audit/audit.rules
[root at rhel6 checks]# ./testcheck.py audit_rules_time_clock_settime.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_time_clock_settime2SUHvv.xml
Writing results to : /tmp/audit_rules_time_clock_settime2SUHvv.xml-results
Definition oval:scap-security-guide.testing:def:155: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.


Can you send the output of 'grep clock_settime /etc/audit/audit.rules' ?


>>     184-196, 200 chmod, chown, etc...
>     Haven't tested audit checks yet...
>
[root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S fchmod 
-S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod" >> 
/etc/audit/audit.rules
[root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_chmod.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml
Writing results to : 
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results
Definition oval:scap-security-guide.testing:def:160: true
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchmod.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml
Writing results to : 
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results
Definition oval:scap-security-guide.testing:def:180: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root at rhel6 checks]# ./testcheck.py 
audit_rules_dac_modification_fchmodat.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml
Writing results to : 
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results
Definition oval:scap-security-guide.testing:def:185: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.



[root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S fchown 
-S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod" >> 
/etc/audit/audit.rules
[root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchown.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml
Writing results to : 
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results
Definition oval:scap-security-guide.testing:def:165: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root at rhel6 checks]# ./testcheck.py 
audit_rules_dac_modification_fchownat.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml
Writing results to : 
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_lchown.xml
Evaluating with OVAL tempfile : 
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml
Writing results to : 
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results
Definition oval:scap-security-guide.testing:def:175: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.


Please send relevant lines from audit.rules


>
>>     206-211  No telnet installed or turned on
>     These are both automated checks. Unless the package name is wrong,
>     I don't know why they'd give false positives.
>
This is broke. I forgot who originally reported, but we still need to 
update the telnet checks to use the xinet templates.


>>     240  /etc/ssh/sshd_config Banner
>     The OVAL check was definitely working on my system when I last
>     tested it.
>
I'm able to reproduce...

[root at rhel6 checks]# cat /etc/issue
You are accessing a U.S. Government (USG) Information System (IS) that 
is provided for USG-authorized use only. By using this IS (which 
includes any device attached to this IS), you consent to the following 
conditions:
-The USG routinely intercepts and monitors communications on this IS for 
purposes including, but not limited to, penetration testing, COMSEC 
monitoring, network operations and defense, personnel misconduct (PM), 
law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are 
subject to routine monitoring, interception, and search, and may be 
disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access 
controls) to protect USG interests -- not for your personal benefit or 
privacy.
-Notwithstanding the above, using this IS does not constitute consent to 
PM, LE or CI investigative searching or monitoring of the content of 
privileged communications, or work product, related to personal 
representation or services by attorneys, psychotherapists, or clergy, 
and their assistants. Such communications and work product are private 
and confidential. See User Agreement for details.

[root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
Definition oval:scap-security-guide.testing:def:193: false
Definition oval:scap-security-guide.testing:def:191: false
Definition oval:scap-security-guide.testing:def:190: false
Evaluation done.

Maura, do you want to take a stab at this (noticed your signoff on the 
OVAL)?

FWIW, if I used the USGCB banner everything worked OK.


>>     271  If there are no removable partitions this is not a finding.
>     Working on testing this one now...
>
Skipping in my testing then

>
>>     278  If the file permissions are more restrictive then it is not
>>     a finding.
>
This pairs with rpm_verify_permissions, which has the following 
criterion checks:
>     <criteria operator="AND">
>       <criterion test_ref="test_verify_all_rpms_user_ownership" 
> comment="user ownership of all files matches local rpm database" />
>       <criterion test_ref="test_verify_all_rpms_group_ownership" 
> comment="group ownership of all files matches local rpm database" />
>       <criterion test_ref="test_verify_all_rpms_mode" comment="mode of 
> all files matches local rpm database" />
>     </criteria>

Can you send what files are being reported? It should only hit on 
ownership mismatches.


>>     324  No X running
>     Agreed, the GNOME checks need to be rewritten to have extended
>     definitions to exclude machines that don't have X installed.
>
Which package(s) should we check for? xorg-x11-server-Xorg? gnome-desktop?



>>     326   "
>     ?
>

Same thing as 324



>>     346  Finding reported on umask 022
>     This is DEFINITELY a bug. The check section is actually pointing
>     to a different check. The actual check for this rule was never
>     written.
>
The XCCDF (set_daemon_umask) points to:

<oval id="umask_for_daemons" value="var_umask_for_daemons"/>

so, to test:
[shawn at rhel6 checks]$ grep umask /etc/init.d/functions
# Make sure umask is sane
umask 022
[shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export 
var_umask_for_daemons
[shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
Definition oval:scap-security-guide.testing:def:212: false
Evaluation done.


but then in the OVAL code, it's looking at the wrong place:
<ind:textfilecontent54_object id="object_umask_for_daemons" version="1">
     <ind:path>/etc/sysconfig</ind:path>
     <ind:filename>init</ind:filename>
     <ind:pattern operation="pattern match">umask[\s]+(.*)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>

verified no other XCCDF rule was using this OVAL:
[shawn at rhel6 input]$ grep -rin umask_for_daemons system/*
system/permissions/execution.xml:18:<Value id="var_umask_for_daemons" 
type="string" operator="equals" interactive="0">
system/permissions/execution.xml:47:<oval id="umask_for_daemons" 
value="var_umask_for_daemons"/>

.... wrote a patch to fix the pattern match expression, and file path 
things seem OK now:
[shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export 
var_umask_for_daemons
[shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
Writing results to : /tmp/umask_for_daemons394CCR.xml-results
Definition oval:scap-security-guide.testing:def:212: true
Evaluation done.


>>     348  No vsftp installed, thus no file.
>     No OVAL check exists in SSG.
>

Created https://fedorahosted.org/scap-security-guide/ticket/411 to track


>>     506  "hushlogin"
>     This one isn't in the SSG at all.
>>     507  PrintLastLog
>     This one isn't in the SSG at all.
>
Not sure how/why DISA FSO slid these in. Leland?

-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130901/40bdd537/attachment-0001.html>


More information about the scap-security-guide mailing list