[PATCH 16/22] [ticket 393] Updated securetty_root_login_console_only
Shawn Wells
shawn.d.wells at gmail.com
Mon Sep 16 01:33:25 UTC 2013
-------------- next part --------------
>From f886bdf2942ff7da5ca18ecff02e063e1337aafb Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 19:05:08 -0400
Subject: [PATCH 16/22] [ticket 393] Updated securetty_root_login_console_only
- Updated XCCDF/OVAL namings
- filename ->filepath
- Added remediation
TESTING:
[root at SSG-RHEL6 checks]# ./testcheck.py securetty_root_login_console_only.xml
Evaluating with OVAL tempfile : /tmp/securetty_root_login_console_onlyPRqW61.xml
Writing results to : /tmp/securetty_root_login_console_onlyPRqW61.xml-results
Definition oval:scap-security-guide.testing:def:202: false
Evaluation done.
[root at SSG-RHEL6 checks]# bash ../fixes/bash/securetty_root_login_console_only.sh
[root at SSG-RHEL6 checks]# ./testcheck.py securetty_root_login_console_only.xml
Evaluating with OVAL tempfile : /tmp/securetty_root_login_console_onlyCh84Vl.xml
Writing results to : /tmp/securetty_root_login_console_onlyCh84Vl.xml-results
Definition oval:scap-security-guide.testing:def:202: true
Evaluation done.
---
RHEL6/input/auxiliary/transition_notes.xml | 4 +-
RHEL6/input/checks/file_permissions_unowned.xml | 38 --------------------
RHEL6/input/checks/no_files_unowned_by_user.xml | 38 ++++++++++++++++++++
.../checks/securetty_root_login_console_only.xml | 3 +-
.../bash/securetty_root_login_console_only.sh | 1 +
RHEL6/input/profiles/CS2.xml | 4 +-
RHEL6/input/profiles/common.xml | 4 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 6 ++--
RHEL6/input/profiles/nist-CL-IL-AL.xml | 4 +-
RHEL6/input/profiles/stig-rhel6-server.xml | 2 +-
RHEL6/input/profiles/test.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 +-
.../system/accounts/restrictions/root_logins.xml | 2 +-
13 files changed, 56 insertions(+), 56 deletions(-)
delete mode 100644 RHEL6/input/checks/file_permissions_unowned.xml
create mode 100644 RHEL6/input/checks/no_files_unowned_by_user.xml
create mode 100644 RHEL6/input/fixes/bash/securetty_root_login_console_only.sh
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index d4d4cba..f2e18dd 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -5,7 +5,7 @@
<note ref="811" auth="GG" rule="service_auditd_enabled">This is covered in RHEL 6 content</note>
-<note ref="778" auth="GG" rule="restrict_root_console_logins">This is covered in RHEL 6 content</note>
+<note ref="778" auth="GG" rule="securetty_root_login_console_only">This is covered in RHEL 6 content</note>
<note ref="768" auth="GG" rule="">This is not covered in RHEL 6 content</note>
@@ -1560,7 +1560,7 @@ rule=no_hashes_outside_shadow manual=no
<note ref="22375" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it
does exist.
-rule=configure_auditd_space_left_action manual=no
+rule=auditd_data_retention_space_left_action manual=no
</note>
<note ref="22376,22377" auth="KS">
diff --git a/RHEL6/input/checks/file_permissions_unowned.xml b/RHEL6/input/checks/file_permissions_unowned.xml
deleted file mode 100644
index 5fc8afc..0000000
--- a/RHEL6/input/checks/file_permissions_unowned.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="file_permissions_unowned" version="1">
- <metadata>
- <title>Find files unowned by a user</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>All files should be owned by a
- user</description>
- </metadata>
- <criteria>
- <criterion comment="Check all files and make sure they are owned by a user"
- negate="true"
- test_ref="test_20050" />
- </criteria>
- </definition>
- <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
- check="all" comment="files with no user owner"
- id="test_20050" version="1">
- <notes>
- <note>This will enumerate all files on local
- partitions</note>
- </notes>
- <unix:object object_ref="obj_20022" />
- <unix:state state_ref="state_20050" />
- </unix:file_test>
- <unix:file_state comment="Executables with suid set"
- id="state_20050" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="all local files"
- id="obj_20022" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" />
- <unix:path>/</unix:path>
- <unix:filename operation="pattern match">.*</unix:filename>
- </unix:file_object>
-</def-group>
diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml b/RHEL6/input/checks/no_files_unowned_by_user.xml
new file mode 100644
index 0000000..5fc8afc
--- /dev/null
+++ b/RHEL6/input/checks/no_files_unowned_by_user.xml
@@ -0,0 +1,38 @@
+<def-group>
+ <definition class="compliance"
+ id="file_permissions_unowned" version="1">
+ <metadata>
+ <title>Find files unowned by a user</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>All files should be owned by a
+ user</description>
+ </metadata>
+ <criteria>
+ <criterion comment="Check all files and make sure they are owned by a user"
+ negate="true"
+ test_ref="test_20050" />
+ </criteria>
+ </definition>
+ <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
+ check="all" comment="files with no user owner"
+ id="test_20050" version="1">
+ <notes>
+ <note>This will enumerate all files on local
+ partitions</note>
+ </notes>
+ <unix:object object_ref="obj_20022" />
+ <unix:state state_ref="state_20050" />
+ </unix:file_test>
+ <unix:file_state comment="Executables with suid set"
+ id="state_20050" version="1">
+ <unix:user_id datatype="int">0</unix:user_id>
+ </unix:file_state>
+ <unix:file_object comment="all local files"
+ id="obj_20022" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" />
+ <unix:path>/</unix:path>
+ <unix:filename operation="pattern match">.*</unix:filename>
+ </unix:file_object>
+</def-group>
diff --git a/RHEL6/input/checks/securetty_root_login_console_only.xml b/RHEL6/input/checks/securetty_root_login_console_only.xml
index 7a686ec..5b0e378 100644
--- a/RHEL6/input/checks/securetty_root_login_console_only.xml
+++ b/RHEL6/input/checks/securetty_root_login_console_only.xml
@@ -20,8 +20,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="object_virtual_consoles_etc_securetty" version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>securetty</ind:filename>
+ <ind:filepath>/etc/securetty</ind:filepath>
<ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
diff --git a/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh b/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh
new file mode 100644
index 0000000..2d1dd44
--- /dev/null
+++ b/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh
@@ -0,0 +1 @@
+sed -i '/^vc\//d' /etc/securetty
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 84329b4..57651e7 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -145,7 +145,7 @@
<select idref="audit_media_exports" selected="true"/>
<select idref="audit_file_deletions" selected="true"/>
-<select idref="restrict_root_console_logins" selected="true" />
+<select idref="securetty_root_login_console_only" selected="true" />
<select idref="no_direct_root_logins" selected="true" />
<select idref="userowner_shadow_file" selected="true"/>
@@ -174,7 +174,7 @@
<select idref="service_restorecond_enabled" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
-<select idref="selinux_unlabeled_device_files" selected="true"/>
+<select idref="selinux_all_devicefiles_labeled" selected="true"/>
<select idref="set_selinux_state" selected="true"/>
<select idref="set_selinux_policy" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index dc6cd10..6c6aa07 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -16,8 +16,8 @@
<select idref="no_rsh_trust_files" selected="true"/>
<select idref="set_selinux_state" selected="true"/>
<select idref="set_selinux_policy" selected="true"/>
-<select idref="selinux_unlabeled_device_files" selected="true"/>
-<select idref="restrict_root_console_logins" selected="true"/>
+<select idref="selinux_all_devicefiles_labeled" selected="true"/>
+<select idref="securetty_root_login_console_only" selected="true"/>
<select idref="restrict_serial_port_logins" selected="true"/>
<select idref="no_shelllogin_for_systemaccounts" selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index d50a06d..afe5f47 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -61,7 +61,7 @@
<select idref="no_files_unowned_by_group" selected="true" />
<select idref="world_writable_files_system_ownership" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
-<select idref="selinux_unlabeled_device_files" selected="true" />
+<select idref="selinux_all_devicefiles_labeled" selected="true" />
<select idref="userowner_rsyslog_files" selected="true" />
<select idref="groupowner_rsyslog_files" selected="true" />
<select idref="audit_logs_permissions" selected="true" />
@@ -71,7 +71,7 @@
<select idref="rpm_verify_permissions" selected="true" />
<!-- AC-6(2) -->
-<select idref="restrict_root_console_logins" selected="true" />
+<select idref="securetty_root_login_console_only" selected="true" />
<select idref="restrict_serial_port_logins" selected="true" />
<!-- AC-7(a)
@@ -193,7 +193,7 @@
<select idref="configure_auditd_num_logs" selected="true" />
<select idref="configure_auditd_max_log_file" selected="true" />
<select idref="configure_auditd_max_log_file_action" selected="true" />
-<select idref="configure_auditd_space_left_action" selected="true" />
+<select idref="auditd_data_retention_space_left_action" selected="true" />
<refine-value idref="var_auditd_admin_space_left_action" selector="halt" />
<select idref="auditd_data_retention_admin_space_left_action" selected="true" />
<select idref="configure_auditd_action_mail_acct" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index a85fc15..28e65dc 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -161,7 +161,7 @@ assurance."</description>
<select idref="groupowner_rsyslog_files" selected="true" \>
<!-- AC-6(2) -->
-<select idref="restrict_root_console_logins" selected="true" \>
+<select idref="securetty_root_login_console_only" selected="true" \>
<select idref="restrict_serial_port_logins" selected="true" \>
<select idref="sshd_disable_root_login" selected="true" \>
@@ -267,7 +267,7 @@ assurance."</description>
<select idref="configure_auditd_num_logs" selected="true" \>
<select idref="configure_auditd_max_log_file" selected="true" \>
<select idref="configure_auditd_max_log_file_action" selected="true" \>
-<select idref="configure_auditd_space_left_action" selected="true" \>
+<select idref="auditd_data_retention_space_left_action" selected="true" \>
<select idref="auditd_data_retention_admin_space_left_action" selected="true" \>
<select idref="configure_auditd_action_mail_acct" selected="true" \>
<select idref="configure_auditd_audispd" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 2058cdf..2e95ec9 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -36,7 +36,7 @@
<select idref="aide_periodic_cron_checking" selected="true"/>
<select idref="disable_users_coredumps" selected="true"/>
<select idref="no_insecure_locks_exports" selected="true" />
-<select idref="configure_auditd_space_left_action" selected="true" />
+<select idref="auditd_data_retention_space_left_action" selected="true" />
<select idref="configure_auditd_action_mail_acct" selected="true" />
<select idref="kernel_module_bluetooth_disabled" selected="true"/>
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index e980e04..a729046 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -32,7 +32,7 @@
<select idref="configure_auditd_num_logs" selected="true"/>
<select idref="configure_auditd_max_log_file" selected="true"/>
<select idref="configure_auditd_action_mail_acct" selected="true"/>
-<select idref="configure_auditd_space_left_action" selected="true"/>
+<select idref="auditd_data_retention_space_left_action" selected="true"/>
<select idref="auditd_data_retention_admin_space_left_action" selected="true"/>
<select idref="configure_auditd_max_log_file_action" selected="true"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index fd2c857..246931c 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -61,7 +61,7 @@
<select idref="enable_randomize_va_space" selected="true" />
<select idref="enable_execshield" selected="true" />
<select idref="install_PAE_kernel_on_x86" selected="true" />
-<select idref="restrict_root_console_logins" selected="true" /> <!-- slightly different language than rhel5 -->
+<select idref="securetty_root_login_console_only" selected="true" /> <!-- slightly different language than rhel5 -->
<select idref="restrict_serial_port_logins" selected="true" />
<select idref="no_empty_passwords" selected="true" />
<select idref="no_hashes_outside_shadow" selected="true" />
@@ -116,7 +116,7 @@
<select idref="set_selinux_policy" selected="true" />
<select idref="enable_selinux_bootloader" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
-<select idref="selinux_unlabeled_device_files" selected="true" />
+<select idref="selinux_all_devicefiles_labeled" selected="true" />
<select idref="sysctl_ipv4_ip_forward" selected="true" />
<select idref="sysctl_ipv4_all_send_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" />
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 1f2a840..0701ddb 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -54,7 +54,7 @@ and FISMA Moderate systems.
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="restrict_root_console_logins" severity="medium">
+<Rule id="securetty_root_login_console_only" severity="medium">
<title>Restrict Virtual Console Root Logins</title>
<description>
To restrict root logins through the (deprecated) virtual console devices,
--
1.7.1
More information about the scap-security-guide
mailing list