[PATCH 00/22] OVAL testing, remediation, bugfixes

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:30:18 UTC 2013


-------------- next part --------------
>From bf44c490e81aba7221acb2804b715a61b067b3e8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 21:25:12 -0400
Subject: [PATCH 00/22] OVAL testing, remediation, bugfixes

- Updated OVAL/XCCDF namings. In the case of XCCDF variables, used var_$xccdfRuleName
- OVAL testings
- Remediations for tested OVAL



Shawn Wells (22):
  XCCDF & OVAL signoff for file_ownership_library_dirs + remediation   
     - The XCCDF was not clear that users should scan the /lib/modules
    directory, adjusted wording     - XCCDF find command was wrong
    (didn't check ownership of directories)     - OVAL signoff     -
    Added remediation, based off Leam's work in Aqueduct
  OVAL signoff + remediation: accounts_password_minlen_login_defs     -
    Old OVAL was checking system-auth, XCCDF calls /etc/login.defs    
    - OVAL signoff     - Added remediation
  Added Remediation for accounts_minimum_age_login_defs     Based off
    prior template
  Added remediation: accounts_maximum_age_login_defs
  [bugfix] Updated filepaths     Just noticed these two were using
    /etc/sshd... updated!
  OVAL signoff + remediation: accounts_password_warn_age_login_defs    
    - OVAL signoff     - Added remediation
  Added Remediation: set_sysctl_fs_suid_dumpable     Built from
    template
  Added remediation: set_sysctl_kernel_dmesg_restrict     From template
  OVAL signoff + remediation: disable_interactive_boot     - Updated
    OVAL namings to match XCCDF     - OVAL signoff (the old regex was
    broke)     - Added remediation
  OVAL signoff + remediation: require_singleuser_auth     - Updated
    OVAL to match XCCDF namings     - Created remediation     -
    Resignoff on OVAL due to changes
  accounts_* remediation update     Needed to append filename after
    echo statement
  Updated sysctl templates     - Old sysctl XCCDF names varied from
    "set_sysctl," "disable_sysctl" to "sysctl_*", standardized on
    "sysctl_*"     - This change ensures that all XCCDF, OVAL, and bash
    scripts are properly linked together
  Updated kernel module naming schemes     - Unified naming between
    XCCDF and OVAL namings for kernel module checks
  New remediation template: create_kernel_module_disabled     Created
    bash remediation template for kernel_module_disabled checks
  OVAL signoff + remediation:
    auditd_data_retention_admin_space_left_action     - OVAL signoff   
     - Updated XCCDF/OVAL namings     - Remediation script
  [ticket 393] Updated securetty_root_login_console_only     - Updated
    XCCDF/OVAL namings     - filename ->filepath     - Added
    remediation
  [ticket 390] Updated ensure_redhat_gpgkey_installed     - XCCDF/OVAL
    naming matchings     - OVAL signoff
  Added remediation for umask_for_daemons     - OVAL/XCCDF namings    
    - Added remediation script
  Added remediation for disable_users_coredumps     - OVAL/XCCDF naming
        - Added remediation
  OVAL signoff + remediation: no_empty_passwords     - OVAL/XCCDF
    namings     - OVAL signoff     - filename -> filepath     -
    Remediation
  Updated accounts_password_minlen_login_defs     - XCCDF/OVAL namings
  Updated XCCDF/OVAL namings

 RHEL6/input/auxiliary/stig_overlay.xml             |   16 ++--
 RHEL6/input/auxiliary/transition_notes.xml         |   34 ++++----
 .../checks/accounts_maximum_age_login_defs.xml     |    8 +-
 .../checks/accounts_minimum_age_login_defs.xml     |    4 +-
 RHEL6/input/checks/accounts_pam_no_nullok.xml      |   23 ------
 .../checks/accounts_password_minlen_login_defs.xml |   21 +----
 .../accounts_password_warn_age_login_defs.xml      |    5 +-
 ...ditd_data_retention_admin_space_left_action.xml |    1 +
 RHEL6/input/checks/core_dumps_limitsconf.xml       |   31 --------
 RHEL6/input/checks/disable_interactive_boot.xml    |   30 +++++++
 RHEL6/input/checks/disable_users_coredumps.xml     |   31 ++++++++
 .../checks/ensure_redhat_gpgkey_installed.xml      |   43 +++++++++++
 RHEL6/input/checks/file_ownership_library_dirs.xml |    1 +
 RHEL6/input/checks/file_permissions_unowned.xml    |   38 ---------
 RHEL6/input/checks/interactive_boot_disable.xml    |   28 -------
 RHEL6/input/checks/no_empty_passwords.xml          |   22 ++++++
 RHEL6/input/checks/no_files_unowned_by_user.xml    |   38 +++++++++
 .../checks/package_red_hat_gpgkeys_installed.xml   |   42 ----------
 RHEL6/input/checks/require_singleuser_auth.xml     |   27 +++++++
 .../checks/securetty_root_login_console_only.xml   |    3 +-
 RHEL6/input/checks/singleuser_password.xml         |   28 -------
 .../fixes/bash/accounts_maximum_age_login_defs.sh  |    8 ++
 .../fixes/bash/accounts_minimum_age_login_defs.sh  |    8 ++
 .../bash/accounts_password_minlen_login_defs.sh    |    8 ++
 .../bash/accounts_password_warn_age_login_defs.sh  |    8 ++
 ...uditd_data_retention_admin_space_left_action.sh |    8 ++
 RHEL6/input/fixes/bash/disable_interactive_boot.sh |    5 +
 RHEL6/input/fixes/bash/disable_users_coredumps.sh  |    1 +
 .../fixes/bash/file_ownership_library_dirs.sh      |    7 ++
 .../fixes/bash/kernel_module_cramfs_disabled.sh    |    1 +
 .../fixes/bash/kernel_module_dccp_disabled.sh      |    1 +
 .../fixes/bash/kernel_module_freevxfs_disabled.sh  |    1 +
 .../input/fixes/bash/kernel_module_hfs_disabled.sh |    1 +
 .../fixes/bash/kernel_module_hfsplus_disabled.sh   |    1 +
 .../fixes/bash/kernel_module_jffs2_disabled.sh     |    1 +
 .../input/fixes/bash/kernel_module_rds_disabled.sh |    1 +
 .../fixes/bash/kernel_module_sctp_disabled.sh      |    1 +
 .../fixes/bash/kernel_module_squashfs_disabled.sh  |    1 +
 .../fixes/bash/kernel_module_tipc_disabled.sh      |    1 +
 .../input/fixes/bash/kernel_module_udf_disabled.sh |    1 +
 .../bash/kernel_module_usb-storage_disabled.sh     |    1 +
 RHEL6/input/fixes/bash/no_empty_passwords.sh       |    1 +
 .../fixes/bash/password_require_minimum_class.sh   |    6 ++
 .../fixes/bash/password_require_minimun_class.sh   |    6 --
 RHEL6/input/fixes/bash/require_singleuser_auth.sh  |    5 +
 .../bash/securetty_root_login_console_only.sh      |    1 +
 .../fixes/bash/set_sysctl_kernel_exec_shield.sh    |   16 ----
 .../bash/set_sysctl_kernel_randomize_va_space.sh   |   16 ----
 ...et_sysctl_net_ipv4_conf_all_accept_redirects.sh |   16 ----
 ...sysctl_net_ipv4_conf_all_accept_source_route.sh |   16 ----
 .../set_sysctl_net_ipv4_conf_all_log_martians.sh   |   16 ----
 .../bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh |   16 ----
 ...et_sysctl_net_ipv4_conf_all_secure_redirects.sh |   16 ----
 .../set_sysctl_net_ipv4_conf_all_send_redirects.sh |   16 ----
 ...ysctl_net_ipv4_conf_default_accept_redirects.sh |   16 ----
 ...tl_net_ipv4_conf_default_accept_source_route.sh |   16 ----
 .../set_sysctl_net_ipv4_conf_default_rp_filter.sh  |   16 ----
 ...ysctl_net_ipv4_conf_default_secure_redirects.sh |   16 ----
 ..._sysctl_net_ipv4_conf_default_send_redirects.sh |   16 ----
 ..._sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh |   16 ----
 ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh |   16 ----
 .../fixes/bash/set_sysctl_net_ipv4_ip_forward.sh   |   16 ----
 .../bash/set_sysctl_net_ipv4_tcp_syncookies.sh     |   16 ----
 .../set_sysctl_net_ipv6_conf_default_accept_ra.sh  |   16 ----
 ...ysctl_net_ipv6_conf_default_accept_redirects.sh |   16 ----
 RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh  |   16 ++++
 .../fixes/bash/sysctl_kernel_dmesg_restrict.sh     |   16 ++++
 .../input/fixes/bash/sysctl_kernel_exec_shield.sh  |   16 ++++
 .../fixes/bash/sysctl_kernel_randomize_va_space.sh |   16 ++++
 .../sysctl_net_ipv4_conf_all_accept_redirects.sh   |   16 ++++
 ...sysctl_net_ipv4_conf_all_accept_source_route.sh |   16 ++++
 .../bash/sysctl_net_ipv4_conf_all_log_martians.sh  |   16 ++++
 .../bash/sysctl_net_ipv4_conf_all_rp_filter.sh     |   16 ++++
 .../sysctl_net_ipv4_conf_all_secure_redirects.sh   |   16 ++++
 .../sysctl_net_ipv4_conf_all_send_redirects.sh     |   16 ++++
 ...ysctl_net_ipv4_conf_default_accept_redirects.sh |   16 ++++
 ...tl_net_ipv4_conf_default_accept_source_route.sh |   16 ++++
 .../bash/sysctl_net_ipv4_conf_default_rp_filter.sh |   16 ++++
 ...ysctl_net_ipv4_conf_default_secure_redirects.sh |   16 ++++
 .../sysctl_net_ipv4_conf_default_send_redirects.sh |   16 ++++
 .../sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh |   16 ++++
 ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh |   16 ++++
 .../input/fixes/bash/sysctl_net_ipv4_ip_forward.sh |   16 ++++
 .../fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh   |   16 ++++
 .../bash/sysctl_net_ipv6_conf_default_accept_ra.sh |   16 ++++
 ...ysctl_net_ipv6_conf_default_accept_redirects.sh |   16 ++++
 RHEL6/input/fixes/bash/templates/Makefile          |    5 +-
 .../templates/create_kernel_module_disabled.py     |   40 ++++++++++
 .../fixes/bash/templates/create_sysctl_bash.py     |    2 +-
 .../bash/templates/template_kernel_module_disabled |    1 +
 RHEL6/input/fixes/bash/umask_for_daemons.sh        |    8 ++
 RHEL6/input/profiles/CS2.xml                       |   80 ++++++++++----------
 RHEL6/input/profiles/common.xml                    |   64 ++++++++--------
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |   76 +++++++++---------
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |   64 ++++++++--------
 RHEL6/input/profiles/stig-rhel6-server.xml         |    8 +-
 RHEL6/input/profiles/test.xml                      |   24 +++---
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |   76 +++++++++---------
 RHEL6/input/system/accounts/physical.xml           |    4 +-
 .../accounts/restrictions/password_expiration.xml  |   28 ++++----
 .../accounts/restrictions/password_storage.xml     |    2 +-
 .../system/accounts/restrictions/root_logins.xml   |    2 +-
 RHEL6/input/system/auditing.xml                    |   17 +----
 RHEL6/input/system/network/ipv6.xml                |    6 +-
 RHEL6/input/system/network/kernel.xml              |   30 ++++----
 RHEL6/input/system/network/uncommon.xml            |    8 +-
 RHEL6/input/system/permissions/execution.xml       |    4 +-
 RHEL6/input/system/permissions/files.xml           |   10 ++-
 RHEL6/input/system/permissions/mounting.xml        |   14 ++--
 RHEL6/input/system/software/updating.xml           |    2 +-
 110 files changed, 956 insertions(+), 817 deletions(-)
 delete mode 100644 RHEL6/input/checks/accounts_pam_no_nullok.xml
 delete mode 100644 RHEL6/input/checks/core_dumps_limitsconf.xml
 create mode 100644 RHEL6/input/checks/disable_interactive_boot.xml
 create mode 100644 RHEL6/input/checks/disable_users_coredumps.xml
 create mode 100644 RHEL6/input/checks/ensure_redhat_gpgkey_installed.xml
 delete mode 100644 RHEL6/input/checks/file_permissions_unowned.xml
 delete mode 100644 RHEL6/input/checks/interactive_boot_disable.xml
 create mode 100644 RHEL6/input/checks/no_empty_passwords.xml
 create mode 100644 RHEL6/input/checks/no_files_unowned_by_user.xml
 delete mode 100644 RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
 create mode 100644 RHEL6/input/checks/require_singleuser_auth.xml
 delete mode 100644 RHEL6/input/checks/singleuser_password.xml
 create mode 100644 RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh
 create mode 100644 RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh
 create mode 100644 RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
 create mode 100644 RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
 create mode 100644 RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh
 create mode 100644 RHEL6/input/fixes/bash/disable_interactive_boot.sh
 create mode 100644 RHEL6/input/fixes/bash/disable_users_coredumps.sh
 create mode 100644 RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_cramfs_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_dccp_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_freevxfs_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_hfs_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_hfsplus_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_jffs2_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_rds_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_sctp_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_squashfs_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_tipc_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_udf_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/kernel_module_usb-storage_disabled.sh
 create mode 100644 RHEL6/input/fixes/bash/no_empty_passwords.sh
 create mode 100644 RHEL6/input/fixes/bash/password_require_minimum_class.sh
 delete mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh
 create mode 100644 RHEL6/input/fixes/bash/require_singleuser_auth.sh
 create mode 100644 RHEL6/input/fixes/bash/securetty_root_login_console_only.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
 delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh
 create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh
 create mode 100755 RHEL6/input/fixes/bash/templates/create_kernel_module_disabled.py
 create mode 100644 RHEL6/input/fixes/bash/templates/template_kernel_module_disabled
 create mode 100644 RHEL6/input/fixes/bash/umask_for_daemons.sh



More information about the scap-security-guide mailing list