[PATCH v2] [Fedora] Switch on OVAL variables evaluation in rules description {was: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules description}

Shawn Wells shawn at redhat.com
Tue Mar 25 03:49:05 UTC 2014


On 3/24/14, 10:07 AM, Jan Lieskovsky wrote:
> Thank you for the review, Shawn.
>
> ----- Original Message -----
>> >From: "Shawn Wells"<shawn at redhat.com>
>> >To:scap-security-guide at lists.fedorahosted.org
>> >Sent: Friday, March 21, 2014 11:45:23 PM
>> >Subject: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules	description
>> >
>> >On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
>> >
>> >
>> >
>> >Based on xccdf:sub elements thread:
>> >https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005104.html
>> >switch on OVAL variables evaluation for Fedora content in XCCDF rules
>> >description.
>> >
>> >Together with that change, indent content of <pre> elements with one heading
>> >tab character.
>> >
>> >Tested on Fedora (both make & make validate seems to be working properly).
>> >
>> >Please review.
>> >
>> >Thank you && Regards, Jan.
>> >--
>> >Jan iankko Lieskovsky / Red Hat Security Technologies Team
>> >
>> >When we originally started authoring content, some 2 years ago, the XCCDF
>> >variable inclusion was not working (hence the comments scattered around).
>> >Applied your patch locally - everything looks great! Note a few whitespace
>> >errors, however this could be how I downloaded:
>> >
>> >$ git apply /tmp/j1.patch
>> >/tmp/j1.patch:104: trailing whitespace.
>> ><tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt>
>> >warning: 1 line adds whitespace errors.
> You are truly right, there was one whitespace noise case (didn't actually
> try to apply the patch. Sorry for that -- second version shouldn't have it already).
>
>> >
>> >Unclear on the purpose of the tabs though. For example:
>> >
>> >
>> >
>> >-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
>> >-A value of 1 day is considered to be sufficient for many environments.
>> >+edit the file <tt>/etc/login.defs</tt>, locate the following line:
>> >+<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
>> >+and correct it to have the form of:
>> >+<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs"
>> >/></b></pre>
>> >+A value greater than 1 day is considered to be sufficient for many
>> >environments.
>> >
>> >In this case it gives the user the impression these values should be prefaced
>> >with a tab. While technically acceptable, in /etc/login.defs everything is
>> >defined starting as the first character. Is there a reason for the tab?
> The intention was to prefix the particular row in HTML form of the guide with
> a tab character to separate HTML text from command line syntax (IOW so the
> command-line input would be differentiated not just by <pre> element, but also
> intended from left by one tab).
>
> But agree with you this might bring more confusion than the desired effect actually
> (didn't look at this the way you did) thus removed the tabs from the attached second version.
>
> Please review [*].
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> [*] make / make validate & basic testing passed.

Ack.


>
>> >--
>> >Shawn Wells
>> >Director, Innovation Programsshawn at redhat.com  | 443.534.0130
>> >@shawndwells
>
> 0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch
>
>
>  From 2ec99f4a2840209f8a9ef834b6d67d7ccd142b07 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Mon, 24 Mar 2014 14:31:26 +0100
> Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
>   description
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   Fedora/input/services/ssh.xml                      |  8 +++--
>   .../accounts/restrictions/password_expiration.xml  | 42 ++++++++++++----------
>   2 files changed, 29 insertions(+), 21 deletions(-)
>
> diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
> index ce289b1..0489b4b 100644
> --- a/Fedora/input/services/ssh.xml
> +++ b/Fedora/input/services/ssh.xml
> @@ -64,11 +64,13 @@ misconfiguration elsewhere.
>   <description>SSH allows administrators to set an idle timeout interval.
>   After this interval has passed, the idle user will be automatically logged out.
>   <br /><br />
> -To set an idle timeout interval, edit the following line in
> -<tt>/etc/ssh/sshd_config</tt> as follows:
> +To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
> +locate the following line:
>   <pre>ClientAliveInterval <b>INTERVAL</b></pre>
> +and correct it to have the form of:
> +<pre>ClientAliveInterval <b><sub idref="sshd_idle_timeout_value" /></b></pre>
>   The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
> -minutes, set <b>interval</b> to 900.
> +minutes, set <b>INTERVAL</b> to 900.
>   <br /><br />
>   If a shorter timeout has already been set for the login shell, that value will
>   preempt any SSH setting made here. Keep in mind that some processes may stop
> diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> index fd4646e..91a2fef 100644
> --- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
> +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> @@ -77,10 +77,11 @@ age, and 7 day warning period with the following command:
>   <Rule id="accounts_password_minlen_login_defs" severity="medium">
>   <title>Password Minimum Length</title>
>   <description>To specify password length requirements for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the following
> -lines:
> -<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
> -<br/><br/>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>PASS_MIN_LEN <b>LENGTH</b></pre>
> +and correct it to have the form of:
> +<pre>PASS_MIN_LEN <b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
> +<br />
>   Nowadays recommended values, considered as secure by various organizations
>   focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
>   <tt>14 (DoD)</tt> characters for password length requirements.
> @@ -109,15 +110,17 @@ counterproductive behavior that may result.
>   <Rule id="accounts_minimum_age_login_defs" severity="medium">
>   <title>Password Minimum Age</title>
>   <description>To specify password minimum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item as appropriate:
> -<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>PASS_MIN_DAYS <b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>PASS_MIN_DAYS <b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
> +<br />
> +A value greater than 1 day is considered to be sufficient for many environments.
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the minimum password age, run the command:
>   <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +A value greater than 1 day is considered to be sufficient for many environments.
>   </ocil>
>   <rationale>
>   Setting the minimum password age protects against users cycling
> @@ -131,15 +134,17 @@ requirement.
>   <Rule id="accounts_maximum_age_login_defs" severity="medium">
>   <title>Password Maximum Age</title>
>   <description>To specify password maximum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item appropriately:
> -<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
> -A value of 180 days is sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>PASS_MAX_DAYS <b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>PASS_MAX_DAYS <b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
> +<br />
> +A value less than 180 days is sufficient for many environments.
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the maximum password age, run the command:
>   <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
> -A value of 180 days is sufficient for many environments.
> +A value less than 180 days is sufficient for many environments.
>   </ocil>
>   <rationale>
>   Setting the password maximum age ensures users are required to
> @@ -155,11 +160,12 @@ location subject to physical compromise.</rationale>
>   <title>Password Warning Age</title>
>   <description>To specify how many days prior to password
>   expiration that a warning will be issued to users,
> -edit the file <tt>/etc/login.defs</tt> and add or correct
> - the following line, replacing the <i>DAYS</i> item as appropriate:
> -<pre>PASS_WARN_AGE <i>DAYS</i></pre>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>PASS_WARN_AGE <b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
> +<br />
>   A value of 7 days would be nowadays considered to be a standard.
> -<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
>   </description>
>   <ocil clause="it is not set to the required value">
>   To check the password warning age, run the command:
> -- 1.8.3.1


-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140324/17be1e03/attachment-0001.html>


More information about the scap-security-guide mailing list