[PATCH] [Fedora] Switch on OVAL variables evaluation in rules description

Shawn Wells shawn at redhat.com
Fri Mar 21 22:45:23 UTC 2014


On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
> Based on xccdf:sub elements thread:
>    https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005104.html
>
> switch on OVAL variables evaluation for Fedora content in XCCDF rules description.
>
> Together with that change, indent content of <pre> elements with one heading tab character.
>
> Tested on Fedora (both make & make validate seems to be working properly).
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team

When we originally started authoring content, some 2 years ago, the 
XCCDF variable inclusion was not working (hence the comments scattered 
around). Applied your patch locally - everything looks great! Note a few 
whitespace errors, however this could be how I downloaded:

$ git apply /tmp/j1.patch
/tmp/j1.patch:104: trailing whitespace.
<tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt>
warning: 1 line adds whitespace errors.

Unclear on the purpose of the tabs though. For example:
> -<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
> +A value greater than 1 day is considered to be sufficient for many environments.

In this case it gives the user the impression these values should be 
prefaced with a tab. While technically acceptable, in /etc/login.defs 
everything is defined starting as the first character. Is there a reason 
for the tab?







>
> 0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch
>
>
>  From a05cfa4500f487466605b59053aa94d92a8ce866 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Fri, 21 Mar 2014 15:22:04 +0100
> Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
>   description
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   Fedora/input/services/ntp.xml                      |  2 +-
>   Fedora/input/services/ssh.xml                      | 26 +++++------
>   .../accounts/restrictions/password_expiration.xml  | 40 +++++++++--------
>   .../system/accounts/restrictions/root_logins.xml   | 22 +++++-----
>   Fedora/input/system/permissions/files.xml          | 50 +++++++++++-----------
>   Fedora/input/system/settings/disable_prelink.xml   |  4 +-
>   Fedora/input/system/software/updating.xml          |  4 +-
>   Fedora/transforms/shorthand2xccdf.xslt             |  4 +-
>   8 files changed, 76 insertions(+), 76 deletions(-)
>
> diff --git a/Fedora/input/services/ntp.xml b/Fedora/input/services/ntp.xml
> index 61fc8c8..5d48733 100644
> --- a/Fedora/input/services/ntp.xml
> +++ b/Fedora/input/services/ntp.xml
> @@ -51,7 +51,7 @@http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</rationale>
>   <description>To specify a remote NTP server for time synchronization, edit
>   the file <tt>/etc/ntp.conf</tt>. Add or correct the following lines,
>   substituting the IP or hostname of a remote NTP server for <em>ntpserver</em>:
> -<pre>server <i>ntpserver</i></pre>
> +<pre>	server <b>ntpserver</b></pre>
>   This instructs the NTP software to contact that remote server to obtain time
>   data.
>   </description>
> diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
> index ce289b1..7ca7173 100644
> --- a/Fedora/input/services/ssh.xml
> +++ b/Fedora/input/services/ssh.xml
> @@ -28,9 +28,9 @@ information.</description>
>   <Rule id="sshd_disable_root_login" severity="medium">
>   <title>SSH Root Login Disabled</title>
>   <description>The root user should never be allowed to login to a system
> -directly over a network. To disable root login via SSH, add or correct the
> -following line in <tt>/etc/ssh/sshd_config</tt>:
> -<pre>PermitRootLogin no</pre>
> +directly over a network. To disable root login via SSH, edit the
> +<tt>/etc/ssh/sshd_config</tt> file as follows:
> +<pre>	PermitRootLogin <b>no</b></pre>
>   </description>
>   <rationale>
>   Permitting direct root login reduces auditable information about who ran
> @@ -44,8 +44,8 @@ root's password.
>   <Rule id="sshd_disable_empty_passwords" severity="high">
>   <title>SSH Access via Empty Passwords Disabled</title>
>   <description>To explicitly disallow remote login from accounts with empty
> -passwords, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>:
> -<pre>PermitEmptyPasswords no</pre>
> +passwords, edit the <tt>/etc/ssh/sshd_config</tt> file as follows:
> +<pre>	PermitEmptyPasswords <b>no</b></pre>
>   Any accounts with empty passwords should be disabled immediately, and PAM
>   configuration should prevent users from being able to assign themselves empty
>   passwords.
> @@ -64,11 +64,13 @@ misconfiguration elsewhere.
>   <description>SSH allows administrators to set an idle timeout interval.
>   After this interval has passed, the idle user will be automatically logged out.
>   <br /><br />
> -To set an idle timeout interval, edit the following line in
> -<tt>/etc/ssh/sshd_config</tt> as follows:
> -<pre>ClientAliveInterval <b>INTERVAL</b></pre>
> +To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
> +locate the following line:
> +<pre>	ClientAliveInterval	<b>INTERVAL</b></pre>
> +and correct it to have the form of:
> +<pre>	ClientAliveInterval	<b><sub idref="sshd_idle_timeout_value" /></b></pre>
>   The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
> -minutes, set <b>interval</b> to 900.
> +minutes, set <b>INTERVAL</b> to 900.
>   <br /><br />
>   If a shorter timeout has already been set for the login shell, that value will
>   preempt any SSH setting made here. Keep in mind that some processes may stop
> @@ -85,9 +87,9 @@ one system leading trivially to compromises on another.
>   <Rule id="sshd_set_keepalive">
>   <title>SSH Client Alive Count Used</title>
>   <description>To ensure the SSH idle timeout occurs precisely when the
> -<tt>ClientAliveCountMax</tt> is set, edit <tt>/etc/ssh/sshd_config</tt> as
> -follows:
> -<pre>ClientAliveCountMax 0</pre>
> +<tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt>
> +file as follows:
> +<pre>	ClientAliveCountMax <b>0</b></pre>
>   </description>
>   <rationale>
>   This ensures a user login will be terminated as soon as the
> diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> index fd4646e..055c408 100644
> --- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
> +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> @@ -25,7 +25,7 @@ users 7 days of warnings at login time that their passwords are about to expire.
>   For example, for each existing human user <i>USER</i>, expiration parameters
>   could be adjusted to a 180 day maximum password age, 7 day minimum password
>   age, and 7 day warning period with the following command:
> -<pre># chage -M 180 -m 7 -W 7 USER</pre>
> +<pre>	# chage -M 180 -m 7 -W 7 USER</pre>
>   </description>
>   
>   <Value id="var_accounts_password_minlen_login_defs" type="number" >
> @@ -77,10 +77,10 @@ age, and 7 day warning period with the following command:
>   <Rule id="accounts_password_minlen_login_defs" severity="medium">
>   <title>Password Minimum Length</title>
>   <description>To specify password length requirements for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the following
> -lines:
> -<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
> -<br/><br/>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_MIN_LEN	<b>LENGTH</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_MIN_LEN	<b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
>   Nowadays recommended values, considered as secure by various organizations
>   focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
>   <tt>14 (DoD)</tt> characters for password length requirements.
> @@ -109,15 +109,16 @@ counterproductive behavior that may result.
>   <Rule id="accounts_minimum_age_login_defs" severity="medium">
>   <title>Password Minimum Age</title>
>   <description>To specify password minimum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item as appropriate:
> -<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
> +A value greater than 1 day is considered to be sufficient for many environments.
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the minimum password age, run the command:
>   <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +A value greater than 1 day is considered to be sufficient for many environments.
>   </ocil>
>   <rationale>
>   Setting the minimum password age protects against users cycling
> @@ -131,15 +132,16 @@ requirement.
>   <Rule id="accounts_maximum_age_login_defs" severity="medium">
>   <title>Password Maximum Age</title>
>   <description>To specify password maximum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item appropriately:
> -<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
> -A value of 180 days is sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_MAX_DAYS	<b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_MAX_DAYS	<b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
> +A value less than 180 days is sufficient for many environments.
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the maximum password age, run the command:
>   <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
> -A value of 180 days is sufficient for many environments.
> +A value less than 180 days is sufficient for many environments.
>   </ocil>
>   <rationale>
>   Setting the password maximum age ensures users are required to
> @@ -155,11 +157,11 @@ location subject to physical compromise.</rationale>
>   <title>Password Warning Age</title>
>   <description>To specify how many days prior to password
>   expiration that a warning will be issued to users,
> -edit the file <tt>/etc/login.defs</tt> and add or correct
> - the following line, replacing the <i>DAYS</i> item as appropriate:
> -<pre>PASS_WARN_AGE <i>DAYS</i></pre>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_WARN_AGE	<b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_WARN_AGE	<b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
>   A value of 7 days would be nowadays considered to be a standard.
> -<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the password warning age, run the command:
> diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml b/Fedora/input/system/accounts/restrictions/root_logins.xml
> index c04dc22..b299d54 100644
> --- a/Fedora/input/system/accounts/restrictions/root_logins.xml
> +++ b/Fedora/input/system/accounts/restrictions/root_logins.xml
> @@ -37,9 +37,7 @@ only allows the root user to login at the console physically attached to the
>   machine. To prevent root from logging in, remove the contents of this file.
>   To prevent direct root logins, remove the contents of this file by typing the
>   following command:
> -<pre>
> -echo > /etc/securetty
> -</pre>
> +<pre>	echo > /etc/securetty</pre>
>   </description>
>   <ocil clause="the /etc/securetty file is not empty">
>   To ensure root may not directly login to the system over physical consoles,
> @@ -61,10 +59,10 @@ by security standards.
>   <description>
>   To restrict root logins through the (deprecated) virtual console devices,
>   ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> -<pre>vc/1
> -vc/2
> -vc/3
> -vc/4</pre>
> +<pre>	vc/1
> +	vc/2
> +	vc/3
> +	vc/4</pre>
>   </description>
>   <ocil clause="root login over virtual console devices is permitted">
>   To check for virtual console entries which permit root login, run the
> @@ -85,8 +83,8 @@ using the root account.
>   <title>Serial Port Root Logins Restricted</title>
>   <description>To restrict root logins on serial ports,
>   ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> -<pre>ttyS0
> -ttyS1</pre>
> +<pre>	ttyS0
> +	ttyS1</pre>
>   <!-- TODO: discussion/description of serial port -->
>   </description>
>   <ocil clause="root login over serial ports is permitted">
> @@ -134,7 +132,7 @@ in <tt>/etc/passwd</tt>. System accounts are those user accounts with a user ID
>   500. The user ID is stored in the third field.
>   If any system account <i>SYSACCT</i> (other than root) has a login shell,
>   disable it with the command:
> -<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
> +<pre>	# usermod -s /sbin/nologin <i>SYSACCT</i></pre>
>   </description>
>   <ocil clause="any system account (other than root) has a login shell">
>   To obtain a listing of all users,
> @@ -185,8 +183,8 @@ access to root privileges in an accountable manner.
>   <title>Root Path Is Vendor Default</title>
>   <description>
>   Assuming root shell is bash, edit the following files:
> -<pre>~/.profile</pre>
> -<pre>~/.bashrc</pre>
> +<pre>	~/.profile</pre>
> +<pre>	~/.bashrc</pre>
>   Change any <tt>PATH</tt> variables to the vendor default for root and remove any
>   empty <tt>PATH</tt> entries or references to relative paths.
>   </description>
> diff --git a/Fedora/input/system/permissions/files.xml b/Fedora/input/system/permissions/files.xml
> index b365f1c..dba01f4 100644
> --- a/Fedora/input/system/permissions/files.xml
> +++ b/Fedora/input/system/permissions/files.xml
> @@ -12,17 +12,16 @@ correctly and restrictively.
>   <description>System-wide shared library files, which are linked to executables
>   during process load time or run time, are stored in the following directories
>   by default:
> -<pre>/lib
> -/lib64
> -/usr/lib
> -/usr/lib64
> -</pre>
> +<pre>	/lib
> +	/lib64
> +	/usr/lib
> +	/usr/lib64</pre>
>   Kernel modules, which can be added to the kernel during runtime, are stored in
>   <tt>/lib/modules</tt>. All files in these directories should not be
>   group-writable or world-writable. If any file in these directories is found to
>   be group-writable or world-writable, correct its permission with the following
>   command:
> -<pre># chmod go-w <i>FILE</i></pre>
> +<pre>	# chmod go-w <i>FILE</i></pre>
>   </description>
>   <rationale>Files from shared library directories are loaded into the address
>   space of processes (including privileged ones) or of the kernel itself at
> @@ -38,17 +37,16 @@ system.
>   <description>System-wide shared library files, which are linked to executables
>   during process load time or run time, are stored in the following directories
>   by default:
> -<pre>/lib
> -/lib64
> -/usr/lib
> -/usr/lib64
> -</pre>
> +<pre>	/lib
> +	/lib64
> +	/usr/lib
> +	/usr/lib64</pre>
>   Kernel modules, which can be added to the kernel during runtime, are also
>   stored in <tt>/lib/modules</tt>. All files in these directories should be owned
>   by the <tt>root</tt> user. If the directory, or any file in these directories,
>   is found to be owned by a user other than root correct its ownership with the
>   following command:
> -<pre># chown root <i>FILE</i></pre>
> +<pre>	# chown root <i>FILE</i></pre>
>   </description>
>   <rationale>Files from shared library directories are loaded into the address
>   space of processes (including privileged ones) or of the kernel itself at
> @@ -62,16 +60,16 @@ runtime. Proper ownership is necessary to protect the integrity of the system.
>   <title>System Executables Have Restrictive Permissions</title>
>   <description>
>   System executables are stored in the following directories by default:
> -<pre>/bin
> -/usr/bin
> -/usr/local/bin
> -/sbin
> -/usr/sbin
> -/usr/local/sbin</pre>
> +<pre>	/bin
> +	/usr/bin
> +	/usr/local/bin
> +	/sbin
> +	/usr/sbin
> +	/usr/local/sbin</pre>
>   All files in these directories should not be group-writable or world-writable.
>   If any file <i>FILE</i> in these directories is found to be group-writable or
>   world-writable, correct its permission with the following command:
> -<pre># chmod go-w <i>FILE</i></pre>
> +<pre>	# chmod go-w <i>FILE</i></pre>
>   </description>
>   <rationale>System binaries are executed by privileged users, as well as system
>   services, and restrictive permissions are necessary to ensure execution of
> @@ -85,16 +83,16 @@ these programs cannot be co-opted.
>   <title>System Executables Have Root Ownership</title>
>   <description>
>   System executables are stored in the following directories by default:
> -<pre>/bin
> -/usr/bin
> -/usr/local/bin
> -/sbin
> -/usr/sbin
> -/usr/local/sbin</pre>
> +<pre>	/bin
> +	/usr/bin
> +	/usr/local/bin
> +	/sbin
> +	/usr/sbin
> +	/usr/local/sbin</pre>
>   All files in these directories should be owned by the <tt>root</tt> user. If
>   any file <i>FILE</i> in these directories is found to be owned by a user other
>   than root, correct its ownership with the following command:
> -<pre># chown root <i>FILE</i></pre>
> +<pre>	# chown root <i>FILE</i></pre>
>   </description>
>   <rationale>System binaries are executed by privileged users as well as system
>   services, and restrictive permissions are necessary to ensure that their
> diff --git a/Fedora/input/system/settings/disable_prelink.xml b/Fedora/input/system/settings/disable_prelink.xml
> index a5871a6..079e68c 100644
> --- a/Fedora/input/system/settings/disable_prelink.xml
> +++ b/Fedora/input/system/settings/disable_prelink.xml
> @@ -4,10 +4,10 @@
>   The prelinking feature changes binaries in an attempt to decrease their startup
>   time. In order to disable it, change or add the following line inside the file
>   <tt>/etc/sysconfig/prelink</tt>:
> -<pre>PRELINKING=no</pre>
> +<pre>	PRELINKING=no</pre>
>   Next, run the following command to return binaries to a normal, non-prelinked
>   state:
> -<pre># /sbin/prelink -ua</pre>
> +<pre>	# /sbin/prelink -ua</pre>
>   </description>
>   <rationale>
>   The prelinking feature can interfere with the operation of checksum integrity
> diff --git a/Fedora/input/system/software/updating.xml b/Fedora/input/system/software/updating.xml
> index 84de806..3b9f6a3 100644
> --- a/Fedora/input/system/software/updating.xml
> +++ b/Fedora/input/system/software/updating.xml
> @@ -22,7 +22,7 @@ checking of an RPM package's signature always occurs prior to its
>   installation. To configure yum to check package signatures before installing
>   them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
>   the <tt>[main]</tt> section:
> -<pre>gpgcheck=1</pre>
> +<pre>	gpgcheck=1</pre>
>   </description>
>   <ocil clause="GPG checking is not enabled">
>   To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
> @@ -46,7 +46,7 @@ protects against malicious tampering.
>   <title>gpgcheck Enabled For All Yum Package Repositories</title>
>   <description>To ensure signature checking is not disabled for
>   any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
> -<pre>gpgcheck=0</pre>
> +<pre>	gpgcheck=0</pre>
>   </description>
>   <ocil clause="GPG checking is disabled">
>   To determine whether <tt>yum</tt> has been configured to disable
> diff --git a/Fedora/transforms/shorthand2xccdf.xslt b/Fedora/transforms/shorthand2xccdf.xslt
> index c0f4546..a0da413 100644
> --- a/Fedora/transforms/shorthand2xccdf.xslt
> +++ b/Fedora/transforms/shorthand2xccdf.xslt
> @@ -383,12 +383,12 @@
>   
>     <xsl:template match="service-disable-macro">
>       The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command:
> -    <xhtml:pre># systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre>
> +    <xhtml:pre>	# systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre>
>     </xsl:template>
>   
>     <xsl:template match="service-enable-macro">
>       The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command:
> -    <xhtml:pre># systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre>
> +    <xhtml:pre>	# systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre>
>     </xsl:template>
>   
>     <xsl:template match="service-disable-check-macro">
> -- 1.8.3.1


-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140321/aa0209b8/attachment-0001.html>


More information about the scap-security-guide mailing list