mappings to DISA STIG identifiers

Shawn Wells shawn at redhat.com
Mon Sep 9 15:18:11 UTC 2013


On 9/5/13 12:09 PM, Burns, Robert K (US SSA) wrote:
> A couple of corrections, version 1.1.
>
> Regards,
>
> Robert K. Burns
> Navy Validator
> Robert.burns at baesystems.com
>
> Rule_Ver,SCAP_ID
> RHEL-06-000526,service_autofs_disabled
> RHEL-06-000525,enable_auditd_bootloader
> RHEL-06-000524,
> RHEL-06-000036,userowner_gshadow_file
> RHEL-06-000523,
> RHEL-06-000522,
> RHEL-06-000521,
> RHEL-06-000519,rpm_verify_hashes
> RHEL-06-000037,groupowner_gshadow_file
> RHEL-06-000038,perms_gshadow_file
> RHEL-06-000039,userowner_passwd_file
> RHEL-06-000040,groupowner_passwd_file
> RHEL-06-000518,rpm_verify_permissions
> RHEL-06-000517,
> RHEL-06-000516,
> RHEL-06-000001,partition_for_tmp
> RHEL-06-000002,partition_for_var
> RHEL-06-000041,file_permissions_etc_passwd
> RHEL-06-000042,userowner_group_file
> RHEL-06-000043,groupowner_group_file
> RHEL-06-000515,
> RHEL-06-000044,perms_group_file
> RHEL-06-000514,
> RHEL-06-000003,partition_for_var_log
> RHEL-06-000511,
> RHEL-06-000045,file_permissions_library_dirs
> RHEL-06-000046,file_ownership_library_dirs
> RHEL-06-000004,partition_for_var_log_audit
> RHEL-06-000510,configure_auditd_space_left_action
> RHEL-06-000047,file_permissions_binary_dirs
> RHEL-06-000005,configure_auditd_space_left_action
> RHEL-06-000509,
> RHEL-06-000048,file_ownership_binary_dirs
> RHEL-06-000007,partition_for_home
> RHEL-06-000508,
> RHEL-06-000050,password_min_len
> RHEL-06-000008,ensure_redhat_gpgkey_installed
> RHEL-06-000051,password_min_age
> RHEL-06-000009,service_rhnsd_disabled
> RHEL-06-000053,password_max_age
> RHEL-06-000054,password_warn_age
> RHEL-06-000011,security_patches_up_to_date
> RHEL-06-000056,password_require_digits
> RHEL-06-000013,ensure_gpgcheck_globally_activated
> RHEL-06-000507,
> RHEL-06-000506,
> RHEL-06-000505,
> RHEL-06-000015,ensure_gpgcheck_never_disabled
> RHEL-06-000504,
> RHEL-06-000016,package_aide_installed
> RHEL-06-000503,kernel_module_usb-storage_disabled
> RHEL-06-000019,no_rsh_trust_files
> RHEL-06-000027,restrict_root_console_logins
> RHEL-06-000385,
> RHEL-06-000028,restrict_serial_port_logins
> RHEL-06-000384,
> RHEL-06-000029,
> RHEL-06-000030,no_empty_passwords
> RHEL-06-000383,audit_logs_permissions
> RHEL-06-000031,no_hashes_outside_shadow
> RHEL-06-000032,no_uidzero_except_root
> RHEL-06-000357,deny_password_attempts_fail_interval
> RHEL-06-000033,userowner_shadow_file
> RHEL-06-000034,groupowner_shadow_file
> RHEL-06-000035,perms_shadow_file
> RHEL-06-000082,disable_sysctl_ipv4_ip_forward
> RHEL-06-000117,enable_ip6tables
> RHEL-06-000120,set_iptables_default_rule
> RHEL-06-000124,disable_protocol_dccp
> RHEL-06-000125,disable_protocol_sctp
> RHEL-06-000126,disable_protocol_rds
> RHEL-06-000127,disable_protocol_tipc
> RHEL-06-000133,userowner_rsyslog_files
> RHEL-06-000134,groupowner_rsyslog_files
> RHEL-06-000136,rsyslog_send_messages_to_logserver
> RHEL-06-000137,rsyslog_send_messages_to_logserver
> RHEL-06-000167,audit_rules_time_settimeofday
> RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route
> RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects
> RHEL-06-000169,audit_rules_time_stime
> RHEL-06-000086,set_sysctl_net_ipv4_conf_all_secure_redirects
> RHEL-06-000171,audit_rules_time_clock_settime
> RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians
> RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route
> RHEL-06-000173,audit_rules_time_watch_localtime
> RHEL-06-000174,audit_account_changes
> RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects
> RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects
> RHEL-06-000175,audit_account_changes
> RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
> RHEL-06-000176,audit_account_changes
> RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
> RHEL-06-000177,audit_account_changes
> RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies
> RHEL-06-000182,audit_network_modifications
> RHEL-06-000183,audit_mac_changes
> RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter
> RHEL-06-000184,audit_rules_dac_modification_chmod
> RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter
> RHEL-06-000185,audit_rules_dac_modification_chown
> RHEL-06-000098,disable_ipv6_module_loading
> RHEL-06-000186,audit_rules_dac_modification_fchmod
> RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects
> RHEL-06-000103,enable_ip6tables
> RHEL-06-000187,audit_rules_dac_modification_fchmodat
> RHEL-06-000106,enable_ip6tables
> RHEL-06-000188,audit_rules_dac_modification_fchown
> RHEL-06-000107,enable_ip6tables
> RHEL-06-000189,audit_rules_dac_modification_fchownat
> RHEL-06-000113,enable_iptables
> RHEL-06-000190,audit_rules_dac_modification_fremovexattr
> RHEL-06-000191,audit_rules_dac_modification_fsetxattr
> RHEL-06-000192,audit_rules_dac_modification_lchown
> RHEL-06-000193,audit_rules_dac_modification_lremovexattr
> RHEL-06-000116,enable_ip6tables
> RHEL-06-000194,audit_rules_dac_modification_lsetxattr
> RHEL-06-000195,audit_rules_dac_modification_removexattr
> RHEL-06-000196,audit_rules_dac_modification_setxattr
> RHEL-06-000197,audit_file_access
> RHEL-06-000198,audit_privileged_commands
> RHEL-06-000199,audit_media_exports
> RHEL-06-000057,password_require_uppercases
> RHEL-06-000058,password_require_specials
> RHEL-06-000059,password_require_lowercases
> RHEL-06-000060,password_require_diffchars
> RHEL-06-000061,deny_password_attempts
> RHEL-06-000062,pass set_password_hashing_algorithm_systemauth
> RHEL-06-000200,audit_file_deletions
> RHEL-06-000063,set_password_hashing_algorithm_logindefs
> RHEL-06-000064,set_password_hashing_algorithm_libuserconf
> RHEL-06-000201,audit_sysadmin_actions
> RHEL-06-000065,user_owner_grub_conf
> RHEL-06-000202,audit_kernel_module_loading
> RHEL-06-000066,group_owner_grub_conf
> RHEL-06-000203,disable_xinetd
> RHEL-06-000067,permissions_grub_conf
> RHEL-06-000204,uninstall_xinetd
> RHEL-06-000068,bootloader_password
> RHEL-06-000069,require_singleuser_auth
> RHEL-06-000206,uninstall_telnet_server
> RHEL-06-000070,disable_interactive_boot
> RHEL-06-000211,disable_telnet_service
> RHEL-06-000071,package_screen_installed
> RHEL-06-000213,uninstall_rsh-server
> RHEL-06-000356,deny_password_attempts
> RHEL-06-000073,set_system_login_banner
> RHEL-06-000214,disable_rsh
> RHEL-06-000349,smartcard_auth
> RHEL-06-000078,enable_randomize_va_space
> RHEL-06-000079,enable_execshield
> RHEL-06-000216,disable_rexec
> RHEL-06-000348,ftp_present_banner
> RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects
> RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects
> RHEL-06-000218,disable_rlogin
> RHEL-06-000220,uninstall_ypserv
> RHEL-06-000221,disable_ypbind
> RHEL-06-000224,enable_cron
> RHEL-06-000222,uninstall_tftp-server
> RHEL-06-000227,sshd_allow_only_protocol2
> RHEL-06-000230,sshd_set_idle_timeout
> RHEL-06-000223,disable_tftp
> RHEL-06-000231,sshd_set_keepalive
> RHEL-06-000234,sshd_disable_rhosts
> RHEL-06-000236,disable_host_auth
> RHEL-06-000237,sshd_disable_root_login
> RHEL-06-000239,sshd_disable_empty_passwords
> RHEL-06-000240,sshd_enable_warning_banner
> RHEL-06-000241,sshd_do_not_permit_user_env
> RHEL-06-000243,sshd_use_approved_ciphers
> RHEL-06-000246,disable_avahi
> RHEL-06-000347,no_netrc_files
> RHEL-06-000247,enable_ntpd
> RHEL-06-000248,ntpd_specify_remote_server
> RHEL-06-000249,postfix_network_listening
> RHEL-06-000135,rsyslog_file_permissions
> RHEL-06-000138,ensure_logrotate_activated
> RHEL-06-000252,ldap_client_start_tls
> RHEL-06-000253,ldap_client_tls_cacertpath
> RHEL-06-000256,package_openldap-servers_removed
> RHEL-06-000145,enable_auditd_service
> RHEL-06-000257,set_screensaver_inactivity_timeout
> RHEL-06-000258,enable_screensaver_after_idle
> RHEL-06-000148,enable_auditd_service
> RHEL-06-000154,enable_auditd_service
> RHEL-06-000160,configure_auditd_max_log_file
> RHEL-06-000161,configure_auditd_max_log_file_action
> RHEL-06-000165,audit_rules_time_adjtimex
> RHEL-06-000159,configure_auditd_num_logs
> RHEL-06-000281,rpm_verify_hashes
> RHEL-06-000259,enable_screensaver_password_lock
> RHEL-06-000260,set_blank_screensaver
> RHEL-06-000261,service_abrtd_disabled
> RHEL-06-000262,
> RHEL-06-000346,set_daemon_umask
> RHEL-06-000282,world_writeable_files
> RHEL-06-000265,service_ntpdate_disabled
> RHEL-06-000345,user_umask_logindefs
> RHEL-06-000266,service_oddjobd_disabled
> RHEL-06-000344,user_umask_profile
> RHEL-06-000267,service_qpidd_disabled
> RHEL-06-000343,user_umask_cshrc
> RHEL-06-000268,service_rdisc_disabled
> RHEL-06-000342,user_umask_bashrc
> RHEL-06-000269,use_nodev_option_on_nfs_mounts
> RHEL-06-000341,snmpd_not_default_password
> RHEL-06-000270,use_nosuid_option_on_nfs_mounts
> RHEL-06-000271,mountopt_noexec_on_removable_partitions
> RHEL-06-000272,require_smb_client_signing
> RHEL-06-000273,require_smb_client_signing_mount.cifs
> RHEL-06-000274,limiting_password_reuse
> RHEL-06-000275,encrypt_partitions
> RHEL-06-000340,snmpd_use_newer_protocol
> RHEL-06-000276,encrypt_partitions
> RHEL-06-000277,encrypt_partitions
> RHEL-06-000278,rpm_verify_permissions
> RHEL-06-000279,
> RHEL-06-000280,
> RHEL-06-000284,install_antivirus
> RHEL-06-000285,install_hids
> RHEL-06-000286,disable_ctrlaltdel_reboot
> RHEL-06-000287,service_postfix_enable
> RHEL-06-000306,aide_periodic_cron_checking
> RHEL-06-000288,package_sendmail_removed
> RHEL-06-000289,service_netconsole_disabled
> RHEL-06-000307,aide_periodic_cron_checking
> RHEL-06-000290,disable_xwindows_with_runlevel
> RHEL-06-000308,disable_users_coredumps
> RHEL-06-000291,packagegroup_xwindows_remove
> RHEL-06-000309,no_insecure_locks_exports
> RHEL-06-000311,configure_auditd_space_left_action
> RHEL-06-000292,disable_dhcp_client
> RHEL-06-000313,configure_auditd_action_mail_acct
> RHEL-06-000294,gid_passwd_group_same
> RHEL-06-000315,kernel_module_bluetooth_disabled
> RHEL-06-000296,account_unique_name
> RHEL-06-000319,max_concurrent_login_sessions
> RHEL-06-000297,account_temp_expire_date
> RHEL-06-000320,set_iptables_default_rule_forward
> RHEL-06-000321,install_openswan
> RHEL-06-000324,enable_gdm_login_banner
> RHEL-06-000326,
> RHEL-06-000298,account_temp_expire_date
> RHEL-06-000331,service_bluetooth_disabled
> RHEL-06-000334,account_disable_post_pw_expiration
> RHEL-06-000299,password_require_consecrepeat
> RHEL-06-000335,account_disable_post_pw_expiration
> RHEL-06-000302,aide_periodic_cron_checking
> RHEL-06-000303,aide_periodic_cron_checking
> RHEL-06-000336,sticky_world_writable_dirs
> RHEL-06-000304,aide_periodic_cron_checking
> RHEL-06-000337,world_writable_files_system_ownership
> RHEL-06-000305,aide_periodic_cron_checking
> RHEL-06-000338,tftpd_uses_secure_mode
> RHEL-06-000339,ftp_log_transactions

Well, dang. Hell of a way to make me recant the "nobody has found the 
mappings meaningful enough to do" statement! :)

Existing mappings are identified within <refs> tags:
> |<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32"/>|

Before extending XCCDF rules to include something akin to a <ref 
stig="338,339">, can FSO (Leland? Ricki?) chime in on how static these 
identifiers will be? Or, even better, could we generate them directly 
from SSG?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130909/80e7d389/attachment.html>


More information about the scap-security-guide mailing list