Various False Positives?

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 3 02:51:01 UTC 2013


Yes -- a few items seem to be surprise additions via FSO, but overall
the working experience has been a positive one and we look forward to
working together in the future per the Vendor STIG process.

We'll attempt to reach consensus on those items before long; we need
an itemized list of these for evaluation.

On Sun, Sep 1, 2013 at 10:08 AM, Shawn Wells <shawn at redhat.com> wrote:
> On 8/28/13 2:02 PM, leam hall wrote:
>
> Hey Maura!
>
> I'm using the openscap-utils rpm and the content from the Fedorahosted zip
> file.
>
>
> On Wed, Aug 28, 2013 at 1:05 PM, Maura Dailey <maura at eclipse.ncsc.mil>
> wrote:
>>
>> On 08/28/2013 12:04 PM, leam hall wrote:
>>
>> Hey all,
>>
>> Just ran oscap with the xml files available on the website (Benchmark
>> version 0.9). Here are the issues that seem to be false positives. Prefix
>> everything with "RHEL-06-000". These are all marked as fail but the server
>> meets the STIG.
>>
>> Stupid question, but what are you running against exactly? The RPM or the
>> latest git checkout? I want to make sure that if I run this, I'm seeing the
>> same results, and I've made a lot of changes to OVAL checks in the git
>> repository in the past few weeks. I'm going to run through your list,
>> comparing it against the OVAL checks.
>>
>>   9   rhnsd can be on if configured to Satellite server or similar
>>
>> Fix text definitely implies this. It's not the only service that implies
>> it's allowed in certain environments, but then proceeds to only accept a
>> value of disabled.
>>
>>  57   ucredit
>
>
> STIG wants ucredit=-1, so to test:
>
> [shawn at rhel6 checks]$ grep ucredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
>
>
> [shawn at rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export
> var_password_pam_cracklib_ucredit
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_ucredit.xml
> external_variable with id : var_password_pam_cracklib_ucredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results
> Definition oval:scap-security-guide.testing:def:112: true
> Evaluation done.
>
> Side note: stig-rhel6-server was inheriting
> var_password_pam_cracklib_ucredit=2 from common. Created patch to set
> var_password_pam_cracklib_ucredit=-1 for STIG requirements.
>
>>  58   ocredit
>
>
> [shawn at rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
> ocredit=5
> [shawn at rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export
> var_password_pam_cracklib_ocredit
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_ocredit.xml
> external_variable with id : var_password_pam_cracklib_ocredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results
> Definition oval:scap-security-guide.testing:def:117: false
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth
> [shawn at rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
> ocredit=-1
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_ocredit.xml
> external_variable with id : var_password_pam_cracklib_ocredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results
> Definition oval:scap-security-guide.testing:def:117: true
> Evaluation done.
>
> Side note: var_password_pam_cracklib_ocredit=2 inherited from common.
> Updated STIG profile for var_password_pam_cracklib_ocredit=-1
>
>
>>  59   lcredit
>
>
> [shawn at rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export
> var_password_pam_cracklib_lcredit
> [shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
> ocredit=-1 lcredit=5
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_lcredit.xml
> external_variable with id : var_password_pam_cracklib_lcredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results
> Definition oval:scap-security-guide.testing:def:122: false
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
> [sudo] password for shawn:
> [shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
> [shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
> ocredit=-1 lcredit=-1
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_lcredit.xml
> external_variable with id : var_password_pam_cracklib_lcredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results
> Definition oval:scap-security-guide.testing:def:122: true
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo vim /etc/pam.d/system-auth
> [shawn at rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
> password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1
> ocredit=-1 lcredit=-5
> [shawn at rhel6 checks]$ ./testcheck.py
> accounts_password_pam_cracklib_lcredit.xml
> external_variable with id : var_password_pam_cracklib_lcredit
> Evaluating with OVAL tempfile :
> /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml
> Writing results to :
> /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results
> Definition oval:scap-security-guide.testing:def:122: true
> Evaluation done.
>
>
> Side note: var_password_pam_cracklib_lcredit=2 inherited from common.
> Updated STIG profile for var_password_pam_cracklib_lcredit=-1
>
>
>> For the previous 3, I'd like to see the pam_cracklib.so line so I can
>> troubleshoot.
>
>
> As Maura mentioned, can you send your /etc/pam.d/system-auth file? I had
> trouble reproducing your results.
>
>
>
>>  73   /etc/issue
>>
>> Going back to my many many OVAL check updates, I'd like to see your exact
>> /etc/issue so I can debug what went wrong. If it's an exact copy of the text
>> from the STIG, I'll work off that.
>
> Skipping since Maura has the regex foo for this :)
>
>
>
>>  98  No ipv6 installed
>>
>> Do you mean it's disabled on your system, but the OVAL checks are saying
>> it isn't?
>
> [shawn at rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat
> /etc/modprobe.d/disabled.conf ; \
>> ./testcheck.py kernel_module_ipv6_option_disabled.xml ; \
>> sudo vim /etc/modprobe.d/disabled.conf ; cat /etc/modprobe.d/disabled.conf
>> ; \
>> ./testcheck.py kernel_module_ipv6_option_disabled.xml
> options ipv6 disable=1
> Evaluating with OVAL tempfile :
> /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml
> Writing results to :
> /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results
> Definition oval:scap-security-guide.testing:def:127: true
> Evaluation done.
> Evaluating with OVAL tempfile :
> /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml
> Writing results to :
> /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results
> Definition oval:scap-security-guide.testing:def:127: false
> Evaluation done.
>
> Appears working. Can you send where you disabled IPv6?
>
>
>>  99  "
>>
>> ?
>
> RHEL-06-000099: The system must ignore ICMPv6 redirects by default.
> aka sysctl_net_ipv6_conf_default_accept_redirects.xml
>
> [root at rhel6 checks]# sysctl -q -n -w
> net.ipv6.conf.default.accept_redirects=0
> [root at rhel6 checks]# ./testcheck.py
> sysctl_net_ipv6_conf_default_accept_redirects.xml
> Evaluating with OVAL tempfile :
> /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml
> Writing results to :
> /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results
> Definition oval:scap-security-guide.testing:def:130: true
> Evaluation done.
> [root at rhel6 checks]# sysctl -q -n -w
> net.ipv6.conf.default.accept_redirects=1
> [root at rhel6 checks]# ./testcheck.py
> sysctl_net_ipv6_conf_default_accept_redirects.xml
> Evaluating with OVAL tempfile :
> /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml
> Writing results to :
> /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results
> Definition oval:scap-security-guide.testing:def:130: false
> Evaluation done.
>
> Can you send us the output of:
> `grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and
> `sysctl -a | grep net.ipv6.conf.default.accept_redirects`
>
>> 165  adjtimex
>
> [root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k
> audit_time_rules" >> /etc/audit/audit.rules
> [root at rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml
> Evaluating with OVAL tempfile : /tmp/audit_rules_time_adjtimexQoelxQ.xml
> Writing results to : /tmp/audit_rules_time_adjtimexQoelxQ.xml-results
> Definition oval:scap-security-guide.testing:def:137: true
> Definition oval:scap-security-guide.testing:def:135: false
> Definition oval:scap-security-guide.testing:def:134: true
> Evaluation done.
>
> Since these operate on OR's, the false is checking for 32bit auditing rules.
> Ultimately, this results in a pass.
>
> Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?
>
>
>
>> 167  settimeofday
>
> [root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S settimeofday -k
> audit_time_rules" >> /etc/audit/audit.rules
> [root at rhel6 checks]# ./testcheck.py audit_rules_time_settimeofday.xml
> Evaluating with OVAL tempfile : /tmp/audit_rules_time_settimeofday9TYIqD.xml
> Writing results to : /tmp/audit_rules_time_settimeofday9TYIqD.xml-results
> Definition oval:scap-security-guide.testing:def:147: true
> Definition oval:scap-security-guide.testing:def:137: true
> Definition oval:scap-security-guide.testing:def:135: false
> Evaluation done.
> (passes)
>
>
> Can you send the output of 'grep settimeofday /etc/audit/audit.rules' ?
>
>
>
>
>> 169  stime  // Also, the STIG is wrong. There is no x86_64 stime syscall
>>
>> The STIG actually says that stime is not necessary, which is kind of a
>> strange wording, but the suggested line in the fix text prose is correct, at
>> least. So far as OVAL checks go, I haven't gotten to testing audit checks
>> yet. Maybe this is broken. I'll check it out once I've deciphered the OVAL
>> check.
>
>
> [root at rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k
> audit_time_rules" >> /etc/audit/audit.rules
> [root at rhel6 RHEL6]# cd input/checks/
> [root at rhel6 checks]# ./testcheck.py audit_rules_time_s
> audit_rules_time_settimeofday.xml  audit_rules_time_stime.xml
> [root at rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml
> Evaluating with OVAL tempfile : /tmp/audit_rules_time_stime4hUFRb.xml
> Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results
> Definition oval:scap-security-guide.testing:def:152: true
> Definition oval:scap-security-guide.testing:def:137: true
> Definition oval:scap-security-guide.testing:def:135: false
> Evaluation done.
>
>
> Can you send the output of 'grep stime /etc/audit/audit.rules' ?
>
>
>>
>> 171  clock_settime
>
> [root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S clock_settime -k
> audit_time_rules" >> /etc/audit/audit.rules
> [root at rhel6 checks]# ./testcheck.py audit_rules_time_clock_settime.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_time_clock_settime2SUHvv.xml
> Writing results to : /tmp/audit_rules_time_clock_settime2SUHvv.xml-results
> Definition oval:scap-security-guide.testing:def:155: true
> Definition oval:scap-security-guide.testing:def:137: true
> Definition oval:scap-security-guide.testing:def:135: false
> Evaluation done.
>
>
> Can you send the output of 'grep clock_settime /etc/audit/audit.rules' ?
>
>
>
>> 184-196, 200 chmod, chown, etc...
>>
>> Haven't tested audit checks yet...
>
> [root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S fchmod -S
> fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod" >>
> /etc/audit/audit.rules
> [root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_chmod.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_chmodA0U8eF.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results
> Definition oval:scap-security-guide.testing:def:160: true
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
> [root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchmod.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results
> Definition oval:scap-security-guide.testing:def:180: false
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
> [root at rhel6 checks]# ./testcheck.py
> audit_rules_dac_modification_fchmodat.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results
> Definition oval:scap-security-guide.testing:def:185: false
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
>
>
>
> [root at rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S fchown -S
> fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod" >>
> /etc/audit/audit.rules
> [root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchown.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_fchownR4dTLm.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results
> Definition oval:scap-security-guide.testing:def:165: false
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
> [root at rhel6 checks]# ./testcheck.py
> audit_rules_dac_modification_fchownat.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_fchownata3WKRL.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results
> Definition oval:scap-security-guide.testing:def:170: false
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
> [root at rhel6 checks]# ./testcheck.py audit_rules_dac_modification_lchown.xml
> Evaluating with OVAL tempfile :
> /tmp/audit_rules_dac_modification_lchownmX0BTK.xml
> Writing results to :
> /tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results
> Definition oval:scap-security-guide.testing:def:175: false
> Definition oval:scap-security-guide.testing:def:137: true
> Evaluation done.
>
>
> Please send relevant lines from audit.rules
>
>
>
>>
>> 206-211  No telnet installed or turned on
>>
>> These are both automated checks. Unless the package name is wrong, I don't
>> know why they'd give false positives.
>
> This is broke. I forgot who originally reported, but we still need to update
> the telnet checks to use the xinet templates.
>
>
>
>> 240  /etc/ssh/sshd_config Banner
>>
>> The OVAL check was definitely working on my system when I last tested it.
>
> I'm able to reproduce...
>
> [root at rhel6 checks]# cat /etc/issue
> You are accessing a U.S. Government (USG) Information System (IS) that is
> provided for USG-authorized use only. By using this IS (which includes any
> device attached to this IS), you consent to the following conditions:
> -The USG routinely intercepts and monitors communications on this IS for
> purposes including, but not limited to, penetration testing, COMSEC
> monitoring, network operations and defense, personnel misconduct (PM), law
> enforcement (LE), and counterintelligence (CI) investigations.
> -At any time, the USG may inspect and seize data stored on this IS.
> -Communications using, or data stored on, this IS are not private, are
> subject to routine monitoring, interception, and search, and may be
> disclosed or used for any USG-authorized purpose.
> -This IS includes security measures (e.g., authentication and access
> controls) to protect USG interests -- not for your personal benefit or
> privacy.
> -Notwithstanding the above, using this IS does not constitute consent to PM,
> LE or CI investigative searching or monitoring of the content of privileged
> communications, or work product, related to personal representation or
> services by attorneys, psychotherapists, or clergy, and their assistants.
> Such communications and work product are private and confidential. See User
> Agreement for details.
>
> [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
> Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
> Definition oval:scap-security-guide.testing:def:193: false
> Definition oval:scap-security-guide.testing:def:191: false
> Definition oval:scap-security-guide.testing:def:190: false
> Evaluation done.
>
> Maura, do you want to take a stab at this (noticed your signoff on the
> OVAL)?
>
> FWIW, if I used the USGCB banner everything worked OK.
>
>
>
>> 271  If there are no removable partitions this is not a finding.
>>
>> Working on testing this one now...
>
> Skipping in my testing then
>
>
>>
>> 278  If the file permissions are more restrictive then it is not a
>> finding.
>
> This pairs with rpm_verify_permissions, which has the following criterion
> checks:
>
>     <criteria operator="AND">
>       <criterion test_ref="test_verify_all_rpms_user_ownership"
> comment="user ownership of all files matches local rpm database" />
>       <criterion test_ref="test_verify_all_rpms_group_ownership"
> comment="group ownership of all files matches local rpm database" />
>       <criterion test_ref="test_verify_all_rpms_mode" comment="mode of all
> files matches local rpm database" />
>     </criteria>
>
>
> Can you send what files are being reported? It should only hit on ownership
> mismatches.
>
>
>
>> 324  No X running
>>
>> Agreed, the GNOME checks need to be rewritten to have extended definitions
>> to exclude machines that don't have X installed.
>
> Which package(s) should we check for? xorg-x11-server-Xorg? gnome-desktop?
>
>
>
>> 326   "
>>
>> ?
>
>
> Same thing as 324
>
>
>
>
>> 346  Finding reported on umask 022
>>
>> This is DEFINITELY a bug. The check section is actually pointing to a
>> different check. The actual check for this rule was never written.
>
> The XCCDF (set_daemon_umask) points to:
>
> <oval id="umask_for_daemons" value="var_umask_for_daemons"/>
>
> so, to test:
> [shawn at rhel6 checks]$ grep umask /etc/init.d/functions
> # Make sure umask is sane
> umask 022
> [shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export
> var_umask_for_daemons
> [shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
> external_variable with id : var_umask_for_daemons
> Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
> Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
> Definition oval:scap-security-guide.testing:def:212: false
> Evaluation done.
>
>
> but then in the OVAL code, it's looking at the wrong place:
> <ind:textfilecontent54_object id="object_umask_for_daemons" version="1">
>     <ind:path>/etc/sysconfig</ind:path>
>     <ind:filename>init</ind:filename>
>     <ind:pattern operation="pattern match">umask[\s]+(.*)</ind:pattern>
>     <ind:instance datatype="int">1</ind:instance>
>   </ind:textfilecontent54_object>
>
> verified no other XCCDF rule was using this OVAL:
> [shawn at rhel6 input]$ grep -rin umask_for_daemons system/*
> system/permissions/execution.xml:18:<Value id="var_umask_for_daemons"
> type="string" operator="equals" interactive="0">
> system/permissions/execution.xml:47:<oval id="umask_for_daemons"
> value="var_umask_for_daemons"/>
>
> .... wrote a patch to fix the pattern match expression, and file path things
> seem OK now:
> [shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export
> var_umask_for_daemons
> [shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
> external_variable with id : var_umask_for_daemons
> Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
> Writing results to : /tmp/umask_for_daemons394CCR.xml-results
> Definition oval:scap-security-guide.testing:def:212: true
> Evaluation done.
>
>
>
>> 348  No vsftp installed, thus no file.
>>
>> No OVAL check exists in SSG.
>
>
> Created https://fedorahosted.org/scap-security-guide/ticket/411 to track
>
>
>
>> 506  "hushlogin"
>>
>> This one isn't in the SSG at all.
>>
>> 507  PrintLastLog
>>
>> This one isn't in the SSG at all.
>
> Not sure how/why DISA FSO slid these in. Leland?
>
> --
> Shawn Wells
> Director, Innovation Programs
> shawn at redhat.com | 443.534.0130
> @shawndwells
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>


More information about the scap-security-guide mailing list