Various False Positives?

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 3 02:45:55 UTC 2013


This is not quite a practical strategy for us.  We will recommend (and
even write some Rules for removal of) some software which presents an
attack surface such as network services, but scope explodes if we
seriously attempt to configure all potentially installed software.

On Wed, Aug 28, 2013 at 12:57 PM, Hopkins, Robert J CTR BXPP, BXPP
<robert.j.hopkins1.ctr at navy.mil> wrote:
> I'm not sure about the OSCAP results but if X is installed then you should secure it.  Someone could accidentally set run level 5 or just do a startx and fire it up means any vulnerabilities and/or weaknesses would then be exposed.  If X is not installed, you can probably mark it N/A.
>
> -Rob
>
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of leam hall
> Sent: Wednesday, August 28, 2013 12:04
> To: scap-security-guide at lists.fedorahosted.org
> Subject: Various False Positives?
>
> Hey all,
>
>
> Just ran oscap with the xml files available on the website (Benchmark version 0.9). Here are the issues that seem to be false positives. Prefix everything with "RHEL-06-000". These are all marked as fail but the server meets the STIG.
>
>
>   9   rhnsd can be on if configured to Satellite server or similar
>
>  57   ucredit
>
>  58   ocredit
>
>  59   lcredit
>
>  73   /etc/issue
>
>  98  No ipv6 installed
>  99  "
>
> 165  adjtimex
>
> 167  settimeofday
>
> 169  stime  // Also, the STIG is wrong. There is no x86_64 stime syscall
>
> 171  clock_settime
>
> 184-196, 200 chmod, chown, etc...
>
> 206-211  No telnet installed or turned on
>
> 240  /etc/ssh/sshd_config Banner
>
> 271  If there are no removable partitions this is not a finding.
>
> 278  If the file permissions are more restrictive then it is not a finding.
>
> 324  No X running
> 326   "
>
> 346  Finding reported on umask 022
>
> 348  No vsftp installed, thus no file.
>
> 506  "hushlogin"
>
> 507  PrintLastLog
>
>
>
> Am I confused in thinking a system in run level 3 should net need to worry about X/Gnome findings?
>
>
> Leam
>
>
> --
>
> Mind on a Mission <http://leamhall.blogspot.com/>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>


More information about the scap-security-guide mailing list