[PATCH 00/13] remediation + OVAL updates for SSH section

Shawn Wells shawn.d.wells at gmail.com
Sat Sep 7 19:22:40 UTC 2013


-------------- next part --------------
>From 841ba81777fe7089a31e16ca07f249264648cced Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 7 Sep 2013 12:49:27 -0400
Subject: [PATCH 00/13] remediation + OVAL updates for SSH section

- Updated OVAL ID and filenames to match XCCDF
- Converted OVAL <ind:filename> to <ind:filepath> to consolidate LOC
- Added and tested remediation scripts for a few SSH checks

Shawn Wells (13):
  umask_for_daemons: filename -> filepath & updated signoff    
    [shawn at rhel6 checks]$ var_umask_for_daemons=027 ; export
    var_umask_for_daemons ; ./testcheck.py umask_for_daemons.xml    
    external_variable with id : var_umask_for_daemons     Evaluating
    with OVAL tempfile : /tmp/umask_for_daemons0Ed5hX.xml     Writing
    results to : /tmp/umask_for_daemons0Ed5hX.xml-results    
    Definition oval:scap-security-guide.testing:def:116: false    
    Evaluation done.     [shawn at rhel6 checks]$
    var_umask_for_daemons=022 ; export var_umask_for_daemons ;
    ./testcheck.py umask_for_daemons.xml     external_variable with id
    : var_umask_for_daemons     Evaluating with OVAL tempfile :
    /tmp/umask_for_daemonsCSwhJr.xml     Writing results to :
    /tmp/umask_for_daemonsCSwhJr.xml-results     Definition
    oval:scap-security-guide.testing:def:116: true     Evaluation done.
  Update to network_disable_zeroconf OVAL     - Updated OVAL name to
    match XCCDF name     - filename --> filepath in OVAL     - Added
    remediation
  sshd_use_approved_ciphers OVAL: filename -> filepath
  New remediation: sshd_use_approved_ciphers
  Updated sshd_disable_rhosts     - Renamed OVAL check to match XCCDF
    name     - filename -> filepath     - Added remediation
  OVAL + remediation for sshd_set_keepalive     - Updated OVAL names to
    match XCCDF     - filename --> filepath     - Added remediation
  OVAL + remediation for sshd_disable_root_login     - Updated OVAL
    file & id to match XCCDF     - filename --> filepath     - Added
    remediation
  OVAL + remediation: disable_host_auth     - Updated OVAL ID and
    filename to match XCCDF     - filename --> filepath     - Added
    remediation
  OVAL + remediation: sshd_do_not_permit_user_env     - Updated OVAL ID
    and filename to match XCCDF     - filename -> filepath OVAL     -
    Added remediation
  remediation + OVAL for sshd_set_idle_timeout     - Updated OVAL ID &
    filename to match XCCDF     - filename --> filepath OVAL     -
    Added remediation
  remediation + OVAL for sshd_disable_empty_passwords     - Updated
    OVAL naming to match XCCDF     - filename --> filepath     - Added
    remediation
  [bugfix] sshd_set_idle_timeout.xml --> sshd_set_idle_timeout.sh
    (remediation script)
  remediation + OVAL for sshd_enable_warning_banner     - Updated OVAL
    namings to match XCCDF     - filename --> filepath     - added
    remediation

 RHEL6/input/checks/disable_host_auth.xml           |   29 +++++++++++++++
 RHEL6/input/checks/network_disable_zeroconf.xml    |   27 ++++++++++++++
 RHEL6/input/checks/sshd_banner_set.xml             |   31 ----------------
 RHEL6/input/checks/sshd_clientalivecountmax.xml    |   35 ------------------
 .../input/checks/sshd_disable_empty_passwords.xml  |   31 ++++++++++++++++
 RHEL6/input/checks/sshd_disable_rhosts.xml         |   31 ++++++++++++++++
 RHEL6/input/checks/sshd_disable_root_login.xml     |   30 +++++++++++++++
 RHEL6/input/checks/sshd_do_not_permit_user_env.xml |   29 +++++++++++++++
 RHEL6/input/checks/sshd_enable_warning_banner.xml  |   30 +++++++++++++++
 .../input/checks/sshd_hostbasedauthentication.xml  |   30 ---------------
 RHEL6/input/checks/sshd_idle_timeout.xml           |   38 --------------------
 RHEL6/input/checks/sshd_no_user_envset.xml         |   30 ---------------
 .../input/checks/sshd_permitemptypasswords_no.xml  |   32 ----------------
 RHEL6/input/checks/sshd_permitrootlogin_no.xml     |   31 ----------------
 RHEL6/input/checks/sshd_rsh_emulation_disabled.xml |   32 ----------------
 RHEL6/input/checks/sshd_set_idle_timeout.xml       |   37 +++++++++++++++++++
 RHEL6/input/checks/sshd_set_keepalive.xml          |   34 +++++++++++++++++
 RHEL6/input/checks/sshd_use_approved_ciphers.xml   |    3 +-
 RHEL6/input/checks/sysconfig_nozeroconf_yes.xml    |   28 --------------
 RHEL6/input/checks/umask_for_daemons.xml           |    3 +-
 RHEL6/input/fixes/bash/disable_host_auth.sh        |    5 +++
 RHEL6/input/fixes/bash/network_disable_zeroconf.sh |    1 +
 .../fixes/bash/sshd_disable_empty_passwords.sh     |    5 +++
 RHEL6/input/fixes/bash/sshd_disable_rhosts.sh      |    5 +++
 RHEL6/input/fixes/bash/sshd_disable_root_login.sh  |    5 +++
 .../fixes/bash/sshd_do_not_permit_user_env.sh      |    5 +++
 .../input/fixes/bash/sshd_enable_warning_banner.sh |    5 +++
 RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh    |    8 ++++
 RHEL6/input/fixes/bash/sshd_set_keepalive.sh       |    5 +++
 .../input/fixes/bash/sshd_use_approved_ciphers.sh  |    5 +++
 RHEL6/input/services/ssh.xml                       |   16 ++++----
 RHEL6/input/system/network/network.xml             |    2 +-
 32 files changed, 338 insertions(+), 300 deletions(-)
 create mode 100644 RHEL6/input/checks/disable_host_auth.xml
 create mode 100644 RHEL6/input/checks/network_disable_zeroconf.xml
 delete mode 100644 RHEL6/input/checks/sshd_banner_set.xml
 delete mode 100644 RHEL6/input/checks/sshd_clientalivecountmax.xml
 create mode 100644 RHEL6/input/checks/sshd_disable_empty_passwords.xml
 create mode 100644 RHEL6/input/checks/sshd_disable_rhosts.xml
 create mode 100644 RHEL6/input/checks/sshd_disable_root_login.xml
 create mode 100644 RHEL6/input/checks/sshd_do_not_permit_user_env.xml
 create mode 100644 RHEL6/input/checks/sshd_enable_warning_banner.xml
 delete mode 100644 RHEL6/input/checks/sshd_hostbasedauthentication.xml
 delete mode 100644 RHEL6/input/checks/sshd_idle_timeout.xml
 delete mode 100644 RHEL6/input/checks/sshd_no_user_envset.xml
 delete mode 100644 RHEL6/input/checks/sshd_permitemptypasswords_no.xml
 delete mode 100644 RHEL6/input/checks/sshd_permitrootlogin_no.xml
 delete mode 100644 RHEL6/input/checks/sshd_rsh_emulation_disabled.xml
 create mode 100644 RHEL6/input/checks/sshd_set_idle_timeout.xml
 create mode 100644 RHEL6/input/checks/sshd_set_keepalive.xml
 delete mode 100644 RHEL6/input/checks/sysconfig_nozeroconf_yes.xml
 create mode 100644 RHEL6/input/fixes/bash/disable_host_auth.sh
 create mode 100644 RHEL6/input/fixes/bash/network_disable_zeroconf.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_disable_root_login.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_set_keepalive.sh
 create mode 100644 RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh



More information about the scap-security-guide mailing list