[PATCH 00/22] OVAL testing, remediation, bugfixes
Shawn Wells
shawn.d.wells at gmail.com
Mon Sep 16 01:30:18 UTC 2013
-------------- next part --------------
>From bf44c490e81aba7221acb2804b715a61b067b3e8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 21:25:12 -0400
Subject: [PATCH 00/22] OVAL testing, remediation, bugfixes
- Updated OVAL/XCCDF namings. In the case of XCCDF variables, used var_$xccdfRuleName
- OVAL testings
- Remediations for tested OVAL
Shawn Wells (22):
XCCDF & OVAL signoff for file_ownership_library_dirs + remediation
- The XCCDF was not clear that users should scan the /lib/modules
directory, adjusted wording - XCCDF find command was wrong
(didn't check ownership of directories) - OVAL signoff -
Added remediation, based off Leam's work in Aqueduct
OVAL signoff + remediation: accounts_password_minlen_login_defs -
Old OVAL was checking system-auth, XCCDF calls /etc/login.defs
- OVAL signoff - Added remediation
Added Remediation for accounts_minimum_age_login_defs Based off
prior template
Added remediation: accounts_maximum_age_login_defs
[bugfix] Updated filepaths Just noticed these two were using
/etc/sshd... updated!
OVAL signoff + remediation: accounts_password_warn_age_login_defs
- OVAL signoff - Added remediation
Added Remediation: set_sysctl_fs_suid_dumpable Built from
template
Added remediation: set_sysctl_kernel_dmesg_restrict From template
OVAL signoff + remediation: disable_interactive_boot - Updated
OVAL namings to match XCCDF - OVAL signoff (the old regex was
broke) - Added remediation
OVAL signoff + remediation: require_singleuser_auth - Updated
OVAL to match XCCDF namings - Created remediation -
Resignoff on OVAL due to changes
accounts_* remediation update Needed to append filename after
echo statement
Updated sysctl templates - Old sysctl XCCDF names varied from
"set_sysctl," "disable_sysctl" to "sysctl_*", standardized on
"sysctl_*" - This change ensures that all XCCDF, OVAL, and bash
scripts are properly linked together
Updated kernel module naming schemes - Unified naming between
XCCDF and OVAL namings for kernel module checks
New remediation template: create_kernel_module_disabled Created
bash remediation template for kernel_module_disabled checks
OVAL signoff + remediation:
auditd_data_retention_admin_space_left_action - OVAL signoff
- Updated XCCDF/OVAL namings - Remediation script
[ticket 393] Updated securetty_root_login_console_only - Updated
XCCDF/OVAL namings - filename ->filepath - Added
remediation
[ticket 390] Updated ensure_redhat_gpgkey_installed - XCCDF/OVAL
naming matchings - OVAL signoff
Added remediation for umask_for_daemons - OVAL/XCCDF namings
- Added remediation script
Added remediation for disable_users_coredumps - OVAL/XCCDF naming
- Added remediation
OVAL signoff + remediation: no_empty_passwords - OVAL/XCCDF
namings - OVAL signoff - filename -> filepath -
Remediation
Updated accounts_password_minlen_login_defs - XCCDF/OVAL namings
Updated XCCDF/OVAL namings
RHEL6/input/auxiliary/stig_overlay.xml | 16 ++--
RHEL6/input/auxiliary/transition_notes.xml | 34 ++++----
.../checks/accounts_maximum_age_login_defs.xml | 8 +-
.../checks/accounts_minimum_age_login_defs.xml | 4 +-
RHEL6/input/checks/accounts_pam_no_nullok.xml | 23 ------
.../checks/accounts_password_minlen_login_defs.xml | 21 +----
.../accounts_password_warn_age_login_defs.xml | 5 +-
...ditd_data_retention_admin_space_left_action.xml | 1 +
RHEL6/input/checks/core_dumps_limitsconf.xml | 31 --------
RHEL6/input/checks/disable_interactive_boot.xml | 30 +++++++
RHEL6/input/checks/disable_users_coredumps.xml | 31 ++++++++
.../checks/ensure_redhat_gpgkey_installed.xml | 43 +++++++++++
RHEL6/input/checks/file_ownership_library_dirs.xml | 1 +
RHEL6/input/checks/file_permissions_unowned.xml | 38 ---------
RHEL6/input/checks/interactive_boot_disable.xml | 28 -------
RHEL6/input/checks/no_empty_passwords.xml | 22 ++++++
RHEL6/input/checks/no_files_unowned_by_user.xml | 38 +++++++++
.../checks/package_red_hat_gpgkeys_installed.xml | 42 ----------
RHEL6/input/checks/require_singleuser_auth.xml | 27 +++++++
.../checks/securetty_root_login_console_only.xml | 3 +-
RHEL6/input/checks/singleuser_password.xml | 28 -------
.../fixes/bash/accounts_maximum_age_login_defs.sh | 8 ++
.../fixes/bash/accounts_minimum_age_login_defs.sh | 8 ++
.../bash/accounts_password_minlen_login_defs.sh | 8 ++
.../bash/accounts_password_warn_age_login_defs.sh | 8 ++
...uditd_data_retention_admin_space_left_action.sh | 8 ++
RHEL6/input/fixes/bash/disable_interactive_boot.sh | 5 +
RHEL6/input/fixes/bash/disable_users_coredumps.sh | 1 +
.../fixes/bash/file_ownership_library_dirs.sh | 7 ++
.../fixes/bash/kernel_module_cramfs_disabled.sh | 1 +
.../fixes/bash/kernel_module_dccp_disabled.sh | 1 +
.../fixes/bash/kernel_module_freevxfs_disabled.sh | 1 +
.../input/fixes/bash/kernel_module_hfs_disabled.sh | 1 +
.../fixes/bash/kernel_module_hfsplus_disabled.sh | 1 +
.../fixes/bash/kernel_module_jffs2_disabled.sh | 1 +
.../input/fixes/bash/kernel_module_rds_disabled.sh | 1 +
.../fixes/bash/kernel_module_sctp_disabled.sh | 1 +
.../fixes/bash/kernel_module_squashfs_disabled.sh | 1 +
.../fixes/bash/kernel_module_tipc_disabled.sh | 1 +
.../input/fixes/bash/kernel_module_udf_disabled.sh | 1 +
.../bash/kernel_module_usb-storage_disabled.sh | 1 +
RHEL6/input/fixes/bash/no_empty_passwords.sh | 1 +
.../fixes/bash/password_require_minimum_class.sh | 6 ++
.../fixes/bash/password_require_minimun_class.sh | 6 --
RHEL6/input/fixes/bash/require_singleuser_auth.sh | 5 +
.../bash/securetty_root_login_console_only.sh | 1 +
.../fixes/bash/set_sysctl_kernel_exec_shield.sh | 16 ----
.../bash/set_sysctl_kernel_randomize_va_space.sh | 16 ----
...et_sysctl_net_ipv4_conf_all_accept_redirects.sh | 16 ----
...sysctl_net_ipv4_conf_all_accept_source_route.sh | 16 ----
.../set_sysctl_net_ipv4_conf_all_log_martians.sh | 16 ----
.../bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh | 16 ----
...et_sysctl_net_ipv4_conf_all_secure_redirects.sh | 16 ----
.../set_sysctl_net_ipv4_conf_all_send_redirects.sh | 16 ----
...ysctl_net_ipv4_conf_default_accept_redirects.sh | 16 ----
...tl_net_ipv4_conf_default_accept_source_route.sh | 16 ----
.../set_sysctl_net_ipv4_conf_default_rp_filter.sh | 16 ----
...ysctl_net_ipv4_conf_default_secure_redirects.sh | 16 ----
..._sysctl_net_ipv4_conf_default_send_redirects.sh | 16 ----
..._sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh | 16 ----
...l_net_ipv4_icmp_ignore_bogus_error_responses.sh | 16 ----
.../fixes/bash/set_sysctl_net_ipv4_ip_forward.sh | 16 ----
.../bash/set_sysctl_net_ipv4_tcp_syncookies.sh | 16 ----
.../set_sysctl_net_ipv6_conf_default_accept_ra.sh | 16 ----
...ysctl_net_ipv6_conf_default_accept_redirects.sh | 16 ----
RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh | 16 ++++
.../fixes/bash/sysctl_kernel_dmesg_restrict.sh | 16 ++++
.../input/fixes/bash/sysctl_kernel_exec_shield.sh | 16 ++++
.../fixes/bash/sysctl_kernel_randomize_va_space.sh | 16 ++++
.../sysctl_net_ipv4_conf_all_accept_redirects.sh | 16 ++++
...sysctl_net_ipv4_conf_all_accept_source_route.sh | 16 ++++
.../bash/sysctl_net_ipv4_conf_all_log_martians.sh | 16 ++++
.../bash/sysctl_net_ipv4_conf_all_rp_filter.sh | 16 ++++
.../sysctl_net_ipv4_conf_all_secure_redirects.sh | 16 ++++
.../sysctl_net_ipv4_conf_all_send_redirects.sh | 16 ++++
...ysctl_net_ipv4_conf_default_accept_redirects.sh | 16 ++++
...tl_net_ipv4_conf_default_accept_source_route.sh | 16 ++++
.../bash/sysctl_net_ipv4_conf_default_rp_filter.sh | 16 ++++
...ysctl_net_ipv4_conf_default_secure_redirects.sh | 16 ++++
.../sysctl_net_ipv4_conf_default_send_redirects.sh | 16 ++++
.../sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh | 16 ++++
...l_net_ipv4_icmp_ignore_bogus_error_responses.sh | 16 ++++
.../input/fixes/bash/sysctl_net_ipv4_ip_forward.sh | 16 ++++
.../fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh | 16 ++++
.../bash/sysctl_net_ipv6_conf_default_accept_ra.sh | 16 ++++
...ysctl_net_ipv6_conf_default_accept_redirects.sh | 16 ++++
RHEL6/input/fixes/bash/templates/Makefile | 5 +-
.../templates/create_kernel_module_disabled.py | 40 ++++++++++
.../fixes/bash/templates/create_sysctl_bash.py | 2 +-
.../bash/templates/template_kernel_module_disabled | 1 +
RHEL6/input/fixes/bash/umask_for_daemons.sh | 8 ++
RHEL6/input/profiles/CS2.xml | 80 ++++++++++----------
RHEL6/input/profiles/common.xml | 64 ++++++++--------
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 76 +++++++++---------
RHEL6/input/profiles/nist-CL-IL-AL.xml | 64 ++++++++--------
RHEL6/input/profiles/stig-rhel6-server.xml | 8 +-
RHEL6/input/profiles/test.xml | 24 +++---
RHEL6/input/profiles/usgcb-rhel6-server.xml | 76 +++++++++---------
RHEL6/input/system/accounts/physical.xml | 4 +-
.../accounts/restrictions/password_expiration.xml | 28 ++++----
.../accounts/restrictions/password_storage.xml | 2 +-
.../system/accounts/restrictions/root_logins.xml | 2 +-
RHEL6/input/system/auditing.xml | 17 +----
RHEL6/input/system/network/ipv6.xml | 6 +-
RHEL6/input/system/network/kernel.xml | 30 ++++----
RHEL6/input/system/network/uncommon.xml | 8 +-
RHEL6/input/system/permissions/execution.xml | 4 +-
RHEL6/input/system/permissions/files.xml | 10 ++-
RHEL6/input/system/permissions/mounting.xml | 14 ++--
RHEL6/input/system/software/updating.xml | 2 +-
110 files changed, 956 insertions(+), 817 deletions(-)
delete mode 100644 RHEL6/input/checks/accounts_pam_no_nullok.xml
delete mode 100644 RHEL6/input/checks/core_dumps_limitsconf.xml
create mode 100644 RHEL6/input/checks/disable_interactive_boot.xml
create mode 100644 RHEL6/input/checks/disable_users_coredumps.xml
create mode 100644 RHEL6/input/checks/ensure_redhat_gpgkey_installed.xml
delete mode 100644 RHEL6/input/checks/file_permissions_unowned.xml
delete mode 100644 RHEL6/input/checks/interactive_boot_disable.xml
create mode 100644 RHEL6/input/checks/no_empty_passwords.xml
create mode 100644 RHEL6/input/checks/no_files_unowned_by_user.xml
delete mode 100644 RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
create mode 100644 RHEL6/input/checks/require_singleuser_auth.xml
delete mode 100644 RHEL6/input/checks/singleuser_password.xml
create mode 100644 RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh
create mode 100644 RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh
create mode 100644 RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
create mode 100644 RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
create mode 100644 RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh
create mode 100644 RHEL6/input/fixes/bash/disable_interactive_boot.sh
create mode 100644 RHEL6/input/fixes/bash/disable_users_coredumps.sh
create mode 100644 RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_cramfs_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_dccp_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_freevxfs_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_hfs_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_hfsplus_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_jffs2_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_rds_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_sctp_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_squashfs_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_tipc_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_udf_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/kernel_module_usb-storage_disabled.sh
create mode 100644 RHEL6/input/fixes/bash/no_empty_passwords.sh
create mode 100644 RHEL6/input/fixes/bash/password_require_minimum_class.sh
delete mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh
create mode 100644 RHEL6/input/fixes/bash/require_singleuser_auth.sh
create mode 100644 RHEL6/input/fixes/bash/securetty_root_login_console_only.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh
create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh
create mode 100755 RHEL6/input/fixes/bash/templates/create_kernel_module_disabled.py
create mode 100644 RHEL6/input/fixes/bash/templates/template_kernel_module_disabled
create mode 100644 RHEL6/input/fixes/bash/umask_for_daemons.sh
More information about the scap-security-guide
mailing list