Current scan issues
Shawn Wells
shawn at redhat.com
Sat May 24 00:49:57 UTC 2014
I believe most of these have been fixed. A few comments in-line:
On 5/19/14, 3:37 PM, Andrew Gilmore wrote:
> Periodically, I do a git merge with upstream and test the result
> against my system. Most of the time, things get better, but
> occasionally, something breaks. Here's my list of broken stuff:
>
> Rule world_writeable_files:
> Now scans /proc and shows thousands of files from /proc/#/attr/<file>
> with permissions 777.
>
> Rule package_openswan_installed: Yum tells me that I have libreswan
> installed, which obsoletes openswan. Is downgrading to openswan really
> required, and why?
The obsoletion is odd. All I could find on the matter:
https://bugzilla.redhat.com/show_bug.cgi?id=1049517
Openswan was put through FIPS 140-2 on RHEL6. FISMA, FedRAMP, STIG, and
most other baselines call out the need to use FIPS 140-2 crypto, but as
others have pointed out, DAAs often give waivers. Openswan FIPS cert is
online at:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2012.htm#1859
> Rule world_writable_files_system_ownership:
> Now finding /tmp/.X11-unix and /tmp/.ICE-unix where it did not before.
> What's the right way to address this? Why are these 777 anyway?
I've no idea on this one =/
> Rule accounts_max_concurrent_login_sessions:
> Broken regular expressions, I may get to a patch for this one,
> something like (if I can ever figure out gmail's formatting!)
>
> diff --git
> a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
> b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
> index b08faa5..b0f0920 100644
> --- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
> +++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
> @@ -21,7 +21,7 @@
> <ind:textfilecontent54_object
> id="object_etc_security_limits_conf_maxlogins" version="1">
> <ind:filepath>/etc/security/limits.conf</ind:filepath>
> - <ind:pattern operation="pattern
> match">^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
> + <ind:pattern operation="pattern
> match">^[\s]*\*[\s]+hard|-[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140523/4a45235e/attachment.html>
More information about the scap-security-guide
mailing list