RHEL5 vs RHEL6 language on HBSS (UNCLASSIFIED)

Vincent Passaro vince.passaro at fotisnetworks.com
Tue Sep 24 19:59:35 UTC 2013


+1

Having both SELinux and HBSS installed will often bring a system to its knees, it would be ideal to only require one or the other.  

I ranVincent C. Passaro
CISSP, L|PT, E|CSA, C|EH, CEPT, CPT, LPIC-3, RHCSA, Novell CLA, MCP, Security+, A+
Fotis Networks LLC
Cell: 760-846-1812
Toll Free: 888.75.FOTIS
Fax: 617-454-1121
Vincent.Passaro at fotisnetworks.com
www.fotisnetworks.com

________________________________________
From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Beavers, Randall D. CTR (US) [randall.d.beavers.ctr at mail.mil]
Sent: Tuesday, September 24, 2013 12:56 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: RE: RHEL5 vs RHEL6 language on HBSS (UNCLASSIFIED)

Classification: UNCLASSIFIED
Caveats: NONE

I'm with Leam.  We use BOTH on our system, but not together.  HBSS and
SELinux doesn't play well together.

Additionally, the HIPS portion of HBSS only partially works with Linux.  We
had to implement IPTables to fix the firewall portion of HIPS.

v/r,


Randy Beavers, GSLC, CISSP
Information Assurance Engineer
Joint Battle Command-Platform
6000-C Technology Drive
Huntsville, AL 35805
256-842-5426 (work)
256-289-6054 (cell)
256-876-2576 (fax)
randall.d.beavers.ctr at mail.mil
randall.d.beavers.ctr at mail.smil.mil


-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org
[mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of
leam hall
Sent: Tuesday, September 24, 2013 2:43 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: RHEL5 vs RHEL6 language on HBSS

Since HBSS and SELinux don't play well together, I'm for reverting.

Leam



On Tue, Sep 24, 2013 at 3:21 PM, Shawn Wells <shawn at redhat.com> wrote:


        I received the following note from a colleague today, outlining the
wording changes between RHEL5 and RHEL6 regarding HBSS. I searched the
mailing archives, and can't figure out *why* the language was changed.

        - Anyone remember why?
        - Objections to reverting to the RHEL5 language?

        EMail:


                from the RHEL 6 STIG:

                ============================
                Group ID (Vulid): V-38667
                Group Title: SRG-OS-000196
                Rule ID: SV-50468r1_rule
                Severity: CAT II
                Rule Version (STIG-ID): RHEL-06-000285
                Rule Title: The system must have a host-based intrusion
detection tool installed.

                Vulnerability Discussion: Adding host-based intrusion
detection tools can provide the capability to automatically take actions in
response to malicious behavior, which can provide additional agility in
reacting to network threats. These tools also often include a reporting
capability to provide network awareness of system, which may not otherwise
exist in an organization's systems management regime.

                Check Content:
                Inspect the system to determine if intrusion detection
software has been installed. Verify the intrusion detection software is
active.
                If no host-based intrusion detection tools are installed,
this is a finding.

                Fix Text: The base Red Hat platform already includes a
sophisticated auditing system that can detect intruder activity, as well as
SELinux, which provides host-based intrusion prevention capabilities by
confining privileged programs and user sessions which may become
compromised.

                Install an additional intrusion detection tool to provide
complementary or duplicative monitoring, reporting, and reaction
capabilities to those of the base platform. For DoD systems, the McAfee
Host-based Security System is provided to fulfill this role.
                ========================


                to look more like this from the RHEL 5 STIG:

                =========================
                Group ID (Vulid): V-782
                Group Title: GEN006480
                Rule ID: SV-37746r2_rule
                Severity: CAT II
                Rule Version (STIG-ID): GEN006480
                Rule Title: The system must have a host-based intrusion
detection tool installed.

                Vulnerability Discussion: Without a host-based intrusion
detection tool, there is no system-level defense when an intruder gains
access to a system or network. Additionally, a host-based intrusion
detection tool can provide methods to immediately lock out detected
intrusion attempts.

                Responsibility: System Administrator
                IAControls: ECID-1

                Check Content:
                Ask the SA or IAO if a host-based intrusion detection
application is loaded on the system. The preferred intrusion detection
system is McAfee HBSS available through Cybercom. If another host-based
intrusion detection application, such as SELinux, is used on the system,
this is not a finding.
                =========================

                People are getting confused and SElinux and HBSS are getting
installed with SElinux being disabled to make things work.





        _______________________________________________
        scap-security-guide mailing list
        scap-security-guide at lists.fedorahosted.org
<mailto:scap-security-guide at lists.fedorahosted.org>
        https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>





--

Mind on a Mission <http://leamhall.blogspot.com/>

Classification: UNCLASSIFIED
Caveats: NONE


More information about the scap-security-guide mailing list