[PATCH 00/13] remediation + OVAL updates for SSH section
Shawn Wells
shawn.d.wells at gmail.com
Sat Sep 7 19:22:40 UTC 2013
-------------- next part --------------
>From 841ba81777fe7089a31e16ca07f249264648cced Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 7 Sep 2013 12:49:27 -0400
Subject: [PATCH 00/13] remediation + OVAL updates for SSH section
- Updated OVAL ID and filenames to match XCCDF
- Converted OVAL <ind:filename> to <ind:filepath> to consolidate LOC
- Added and tested remediation scripts for a few SSH checks
Shawn Wells (13):
umask_for_daemons: filename -> filepath & updated signoff
[shawn at rhel6 checks]$ var_umask_for_daemons=027 ; export
var_umask_for_daemons ; ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons Evaluating
with OVAL tempfile : /tmp/umask_for_daemons0Ed5hX.xml Writing
results to : /tmp/umask_for_daemons0Ed5hX.xml-results
Definition oval:scap-security-guide.testing:def:116: false
Evaluation done. [shawn at rhel6 checks]$
var_umask_for_daemons=022 ; export var_umask_for_daemons ;
./testcheck.py umask_for_daemons.xml external_variable with id
: var_umask_for_daemons Evaluating with OVAL tempfile :
/tmp/umask_for_daemonsCSwhJr.xml Writing results to :
/tmp/umask_for_daemonsCSwhJr.xml-results Definition
oval:scap-security-guide.testing:def:116: true Evaluation done.
Update to network_disable_zeroconf OVAL - Updated OVAL name to
match XCCDF name - filename --> filepath in OVAL - Added
remediation
sshd_use_approved_ciphers OVAL: filename -> filepath
New remediation: sshd_use_approved_ciphers
Updated sshd_disable_rhosts - Renamed OVAL check to match XCCDF
name - filename -> filepath - Added remediation
OVAL + remediation for sshd_set_keepalive - Updated OVAL names to
match XCCDF - filename --> filepath - Added remediation
OVAL + remediation for sshd_disable_root_login - Updated OVAL
file & id to match XCCDF - filename --> filepath - Added
remediation
OVAL + remediation: disable_host_auth - Updated OVAL ID and
filename to match XCCDF - filename --> filepath - Added
remediation
OVAL + remediation: sshd_do_not_permit_user_env - Updated OVAL ID
and filename to match XCCDF - filename -> filepath OVAL -
Added remediation
remediation + OVAL for sshd_set_idle_timeout - Updated OVAL ID &
filename to match XCCDF - filename --> filepath OVAL -
Added remediation
remediation + OVAL for sshd_disable_empty_passwords - Updated
OVAL naming to match XCCDF - filename --> filepath - Added
remediation
[bugfix] sshd_set_idle_timeout.xml --> sshd_set_idle_timeout.sh
(remediation script)
remediation + OVAL for sshd_enable_warning_banner - Updated OVAL
namings to match XCCDF - filename --> filepath - added
remediation
RHEL6/input/checks/disable_host_auth.xml | 29 +++++++++++++++
RHEL6/input/checks/network_disable_zeroconf.xml | 27 ++++++++++++++
RHEL6/input/checks/sshd_banner_set.xml | 31 ----------------
RHEL6/input/checks/sshd_clientalivecountmax.xml | 35 ------------------
.../input/checks/sshd_disable_empty_passwords.xml | 31 ++++++++++++++++
RHEL6/input/checks/sshd_disable_rhosts.xml | 31 ++++++++++++++++
RHEL6/input/checks/sshd_disable_root_login.xml | 30 +++++++++++++++
RHEL6/input/checks/sshd_do_not_permit_user_env.xml | 29 +++++++++++++++
RHEL6/input/checks/sshd_enable_warning_banner.xml | 30 +++++++++++++++
.../input/checks/sshd_hostbasedauthentication.xml | 30 ---------------
RHEL6/input/checks/sshd_idle_timeout.xml | 38 --------------------
RHEL6/input/checks/sshd_no_user_envset.xml | 30 ---------------
.../input/checks/sshd_permitemptypasswords_no.xml | 32 ----------------
RHEL6/input/checks/sshd_permitrootlogin_no.xml | 31 ----------------
RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 32 ----------------
RHEL6/input/checks/sshd_set_idle_timeout.xml | 37 +++++++++++++++++++
RHEL6/input/checks/sshd_set_keepalive.xml | 34 +++++++++++++++++
RHEL6/input/checks/sshd_use_approved_ciphers.xml | 3 +-
RHEL6/input/checks/sysconfig_nozeroconf_yes.xml | 28 --------------
RHEL6/input/checks/umask_for_daemons.xml | 3 +-
RHEL6/input/fixes/bash/disable_host_auth.sh | 5 +++
RHEL6/input/fixes/bash/network_disable_zeroconf.sh | 1 +
.../fixes/bash/sshd_disable_empty_passwords.sh | 5 +++
RHEL6/input/fixes/bash/sshd_disable_rhosts.sh | 5 +++
RHEL6/input/fixes/bash/sshd_disable_root_login.sh | 5 +++
.../fixes/bash/sshd_do_not_permit_user_env.sh | 5 +++
.../input/fixes/bash/sshd_enable_warning_banner.sh | 5 +++
RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh | 8 ++++
RHEL6/input/fixes/bash/sshd_set_keepalive.sh | 5 +++
.../input/fixes/bash/sshd_use_approved_ciphers.sh | 5 +++
RHEL6/input/services/ssh.xml | 16 ++++----
RHEL6/input/system/network/network.xml | 2 +-
32 files changed, 338 insertions(+), 300 deletions(-)
create mode 100644 RHEL6/input/checks/disable_host_auth.xml
create mode 100644 RHEL6/input/checks/network_disable_zeroconf.xml
delete mode 100644 RHEL6/input/checks/sshd_banner_set.xml
delete mode 100644 RHEL6/input/checks/sshd_clientalivecountmax.xml
create mode 100644 RHEL6/input/checks/sshd_disable_empty_passwords.xml
create mode 100644 RHEL6/input/checks/sshd_disable_rhosts.xml
create mode 100644 RHEL6/input/checks/sshd_disable_root_login.xml
create mode 100644 RHEL6/input/checks/sshd_do_not_permit_user_env.xml
create mode 100644 RHEL6/input/checks/sshd_enable_warning_banner.xml
delete mode 100644 RHEL6/input/checks/sshd_hostbasedauthentication.xml
delete mode 100644 RHEL6/input/checks/sshd_idle_timeout.xml
delete mode 100644 RHEL6/input/checks/sshd_no_user_envset.xml
delete mode 100644 RHEL6/input/checks/sshd_permitemptypasswords_no.xml
delete mode 100644 RHEL6/input/checks/sshd_permitrootlogin_no.xml
delete mode 100644 RHEL6/input/checks/sshd_rsh_emulation_disabled.xml
create mode 100644 RHEL6/input/checks/sshd_set_idle_timeout.xml
create mode 100644 RHEL6/input/checks/sshd_set_keepalive.xml
delete mode 100644 RHEL6/input/checks/sysconfig_nozeroconf_yes.xml
create mode 100644 RHEL6/input/fixes/bash/disable_host_auth.sh
create mode 100644 RHEL6/input/fixes/bash/network_disable_zeroconf.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_disable_root_login.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_set_keepalive.sh
create mode 100644 RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
More information about the scap-security-guide
mailing list