Kickstart with SSG/fixes and More

Shawn Wells shawn at redhat.com
Thu May 14 14:52:38 UTC 2015



On 5/14/15 10:29 AM, Greg Elin wrote:
> Ted,
>
> I was googling about and came across a 2013 email to SSG list 
> regarding kickstart with SSG fixes?
>
> Can we get you to share that again? Thanks!
>
> http://marc.info/?l=scap-security-guide&m=138031105712558&w=2
>

Originals attached.

Later versions of SSG now contain kickstart scripts. They'll eventually 
be included downstream (RHEL, derivatives):
https://github.com/OpenSCAP/scap-security-guide/tree/master/RHEL/6/kickstart/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150514/3a70d459/attachment-0003.html>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150514/3a70d459/attachment-0004.html>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150514/3a70d459/attachment-0005.html>
-------------- next part --------------
install
network --bootproto static --ip 192.168.122.90 --netmask 255.255.255.0 --gateway 192.168.122.1 --nameserver 192.168.122.1 --hostname=proxy.local
cdrom
repo --name="Red Hat Enterprise Linux"  --baseurl=file:/mnt/source --cost=100
lang en_US
keyboard us
zerombr
clearpart --all
bootloader --location mbr
timezone America/New_York
auth --enablemd5 --enableshadow
rootpw --iscrypted $1$Zw.0A4vy$6117sRxtKCmgvDdwec5QX1
selinux --enforcing
reboot
firewall --enabled
graphical
part /boot --fstype=ext3 --size=200 
part pv.01 --size=1000 --grow 
part swap --size=1536   --maxsize=2048
volgroup myvg pv.01 
logvol / --vgname=myvg --name=rootvol --size=1000 --grow
logvol /home --vgname=myvg --name=homevol --size=2048
logvol /tmp --vgname=myvg --name=tmpvol --size=1000
logvol /var --vgname=myvg --name=varvol --size=2048
logvol /var/log --vgname=myvg --name=varlogvol --size=2048
logvol /var/log/audit --vgname=myvg --name=varlogauditvol --size=1024

%packages  --nobase
@Core
yum
rhn-setup
openssh-server
openssh-clients
httpd
perl-Pod-Escapes
perl-libs
perl-version
perl-Module-Pluggable
perl-Pod-Simple
perl
perl-YAML-Syck
perl-Date-Manip
vlock
mailx
logwatch
screen
scrub
aide
ntp
libxslt
openscap
openscap-utils
system-config-firewall-tui
openswan
%end

%pre

%end

%post --nochroot

# SSG
cp /mnt/source/scap-security-guide-0.1-12.el6.noarch.rpm /mnt/sysimage/tmp

%post

/sbin/chkconfig httpd on
/sbin/chkconfig ntpd on

# SSG
yum localinstall -y /tmp/scap-security-guide-0.1-12.el6.noarch.rpm

# Scan using SSG
cd /root

oscap xccdf eval --profile stig-rhel6-server --results BeforeFix-ssg-results.xml --report BeforeFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

# Generate Fix
oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server BeforeFix-ssg-results.xml > /root/fix.sh

# Run Fix
chmod +x fix.sh
/bin/bash /root/fix.sh

#-------- Additional Fixes ------- #

# Set varialbles for future use
arch=`uname -p`
if [ $arch = x86_64 ]
then
  b="b64"
else
  b="b32"
fi

# kernel_module_usb-storage_disabled
cat << EOF > /etc/modprobe.d/usb-storage.conf
# disable usb-storage per security requirements
install usb-storage /bin/false
EOF

# disable_users_coredumps
sed -i "s/# End of file/*\t\thard\tcore\t\t0\n# End of file/g" /etc/security/limits.conf

# restrict_root_login_consoles
sed -i '/^vc*/d' /etc/securetty 

# no_empty_passwords
sed -i "s/nullok //g" /etc/pam.d/system-auth

# password_min_len
sed -i 's/\(^PASS_MIN_LEN\).*/\1\t14/g' /etc/login.defs

# password_min_days
sed -i 's/\(^PASS_MIN_DAYS\).*/\1\t1/g' /etc/login.defs

# password_max_age
sed -i 's/\(^PASS_MAX_DAYS\).*/\1\t60/g' /etc/login.defs

# account_disable_post_pw_expiration
sed -i 's/\(^INACTIVE=\).*/\135/g' /etc/default/useradd

# display_login_attempts
sed -i 's/pam_limits.so/pam_limits.so\nsession     required      pam_lastlog.so showfailed/g' /etc/pam.d/system-auth

# password_require_digits
sed -i 's/\(pam_cracklib.so \)/\1dcredit=-1 /' /etc/pam.d/system-auth

# password_require_uppercases
sed -i 's/\(pam_cracklib.so \)/\1ucredit=-1 /' /etc/pam.d/system-auth

# password_require_specials
sed -i 's/\(pam_cracklib.so \)/\1ocredit=-1 /' /etc/pam.d/system-auth

# password_require_lowercases
sed -i 's/\(pam_cracklib.so \)/\1lcredit=-1 /' /etc/pam.d/system-auth

# password_require_diffchars
sed -i 's/\(pam_cracklib.so \)/\1difok=4 /' /etc/pam.d/system-auth

# deny_password_attempts
sed -i 's/\(^auth.*pam_unix.so.*\)/\1\nauth        \[default=die\] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900\nauth        required      pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900/' /etc/pam.d/system-auth

# limiting_password_reuse
sed -i 's/\(^password.*sufficient.*pam_unix.so.*\)/\1 remember=24/' /etc/pam.d/system-auth

# set_password_hashing_algorithm_systemauth
sed -i 's/\(^password.*sufficient.*pam_unix.so\)/\1 sha512/' /etc/pam.d/system-auth

# set_pasword_hashing_algorithm_logindefs
sed -i 's/^\(ENCRYPT_METHOD \).*/\1SHA512/' /etc/login.defs

# set_password_hashing_algorithm_libuserconf
sed -i 's/^\(crypt_style = \).*/\1sha512/' /etc/libuser.conf

# nax_concurrent_login_sessions
sed -i "s/# End of file/*\t\thard\tmaxlogins\t10\n# End of file/g" /etc/security/limits.conf

# user_umask_bashrc
sed -i 's/umask 002/umask 077/g' /etc/bashrc

# user_umask_cshrc
sed -i 's/umask 002/umask 077/g' /etc/csh.cshrc

# user_umask_profile
sed -i 's/umask 002/umask 077/g' /etc/profile

# require_singleuser_auth
sed -i 's/^\(SINGLE=\).*/\1\/sbin\/sulogin/' /etc/sysconfig/init

# disable_ctrlaltdel_reboot
sed -i 's/^exec.*/exec \/usr\/bin\/logger -p security.info "Control-Alt-Delete pressed"/' /etc/init/control-alt-delete.conf

# disable_interactive_boot
sed -i 's/^\(PROMPT=\).*/\1no/' /etc/sysconfig/init

# set_system_login_banner
# Note: the banner is set already as part of the oscap fix.sh script
# - we just need to remove extra characters.
sed -i 's/\[[^]]*\]/ /g' /etc/issue; sed -i 's/+//g' /etc/issue; sed -i 's/\\//g' /etc/issue; sed -i 's/\*//g' /etc/issue; sed -i 's/ - /\n-/g' /etc/issue

# disable_sysctl_ipv4_default_send_redirects
# Set run-time
sysctl -w net.ipv4.conf.default.send_redirects=0
cat << EOF >> /etc/sysctl.conf

# Set net.ipv4.conf.default.send_redirects to 0 per security requirements
net.ipv4.conf.default.send_redirects = 0
EOF

# disable_sysctl_ipv4_all_send_redirects
# Set run-time
sysctl -w net.ipv4.conf.all.send_redirects=0
cat << EOF >> /etc/sysctl.conf

# Set net.ipv4.conf.all.send_redirects to 0 per security requirements
net.ipv4.conf.all.send_redirects = 0
EOF

# kernel_module_bluetooth_disabled
cat << EOF > /etc/modprobe.d/bluetooth.conf
# disable bluetooth per security requirements
install net-pf-31 /bin/false
install bluetooth /bin/false
EOF

# disable_ipv6_module_loading
cat << EOF > /etc/modprobe.d/disabled.conf
# disable ipv6 module per security requirements
options ipv6 disable=1
EOF

# set_sysctl_ipv6_default_accept_redirects
# Set run-time
sysctl -w et.ipv6.conf.default.accept_redirects=0
cat << EOF >> /etc/sysctl.conf

# Set net.ipv6.conf.default.accept_redirects to 0 per security requirements
net.ipv6.conf.default.accept_redirects = 0
EOF

# set_iptables_default_rule
sed -i 's/\(^:INPUT \).*/\1DROP \[0:0\]/' /etc/sysconfig/iptables

# set_iptables_default_rule_forward
sed -i 's/\(^:FORWARD \).*/\1DROP \[0:0\]/' /etc/sysconfig/iptables

# disable_protocol_dccp
cat << EOF > /etc/modprobe.d/dccp.conf
# disable dccp protocol per security requirements
install dccp /bin/false
EOF

# disable_protocol_sctp
cat << EOF > /etc/modprobe.d/sctp.conf
# disable sctp protocol per security requirements
install sctp /bin/false
EOF

# disable_protocol_rds
cat << EOF > /etc/modprobe.d/rds.conf
# disable rds protocol per security requirements
install rds /bin/false
EOF

# disable_protocol_tipc
cat << EOF > /etc/modprobe.d/tipc.conf
# disable tipc protocol per security requirements
install tipc /bin/false
EOF

# enable_auditd_bootloader
sed -i '/^\tkernel/ s/$/ audit=1/g' /boot/grub/grub.conf

# configure_auditd_space_left_action
sed -i 's/\(^space_left_action =\).*/\1 EMAIL/' /etc/audit/auditd.conf

# configure_auditd_admin_space_left_action
sed -i 's/\(^admin_space_left_action =\).*/\1 SINGLE/' /etc/audit/auditd.conf

# audit_rules_time_adjtimex
cat << EOF >> /etc/audit/audit.rules

# audit_time_rules
-a always,exit -F arch=$b -S adjtimex -k audit_time_rules
EOF

# audit_rules_time_settimeofday
cat << EOF >> /etc/audit/audit.rules

# audit_settimeofday_rules
-a always,exit -F arch=$b -S settimeofday -k audit_time_rules
EOF

# audit_rules_time_clock_settime
cat << EOF >> /etc/audit/audit.rules

# audit_clock_settime_rules
-a always,exit -F arch=$b -S clock_settime -k audit_time_rules
EOF

# audit_rules_time_watch_localtime
cat << EOF >> /etc/audit/audit.rules

# watch localtime
-w /etc/localtime -p wa -k audit_time_rules
EOF

# audit_account_changes
cat << EOF >> /etc/audit/audit.rules

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes
EOF

# audit_network_modifications
cat << EOF >> /etc/audit/audit.rules

# audit_network_modifications
-a exit,always -F arch=$b -S sethostname -S setdomainname -k audit_network_modifications
-w /etc/issue -p wa -k audit_network_modifications
-w /etc/issue.net -p wa -k audit_network_modifications
-w /etc/hosts -p wa -k audit_network_modifications
-w /etc/sysconfig/network -p wa -k audit_network_modifications
EOF

# audit_mac_changes
cat << EOF >> /etc/audit/audit.rules

# watch MAC Changes
-w /etc/selinux -p wa -k MAC-policy
EOF

# audit_rules_dac_modification_chmod
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (chmod) for all users and root
-a always,exit -F arch=$b -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_chown
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (chown) for all users and root
-a always,exit -F arch=$b -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fchmod
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fchmod) for all users and root
-a always,exit -F arch=$b -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fchmodat
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fchmodat) for all users and root
-a always,exit -F arch=$b -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fchown
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fchown) for all users and root
-a always,exit -F arch=$b -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fchownat
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fchownat) for all users and root
-a always,exit -F arch=$b -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fremovexattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fremovexattr) for all users and root
-a always,exit -F arch=$b -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_fsetxattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (fsetxattr) for all users and root
-a always,exit -F arch=$b -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_lchown
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (lchown) for all users and root
-a always,exit -F arch=$b -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_lremovexattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (lremovexattr) for all users and root
-a always,exit -F arch=$b -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_lsetxattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (lsetxattr) for all users and root
-a always,exit -F arch=$b -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_removexattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (removexattr) for all users and root
-a always,exit -F arch=$b -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_rules_dac_modification_setxattr
cat << EOF >> /etc/audit/audit.rules

# Collect file permissions changes (setxattr) for all users and root
-a always,exit -F arch=$b -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
EOF

# audit_file_access
cat << EOF >> /etc/audit/audit.rules

# Collect unauthorized file access for all users and root
-a always,exit -F arch=$b -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=$b -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
EOF

# audit_privileged_commands
cat << EOF >> /etc/audit/audit.rules

# Collect execution of privileged commands for all users and root
EOF
for i in `find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null`; do echo "-a always,exit -F path=$i -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged">> /etc/audit/audit.rules; done;

# audit_media_exports
cat << EOF >> /etc/audit/audit.rules

# Collect media exportation events for all users and root
-a always,exit -F arch=$b -S mount -F auid>=500 -F auid!=4294967295 -k export
EOF

# audit_file_deletions
cat << EOF >> /etc/audit/audit.rules

# Collect media file deletion events for all users and root
-a always,exit -F arch=$b -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete
EOF

# audit_sysadmin_actions
cat << EOF >> /etc/audit/audit.rules

# Collect administrator actions for all users and root
-w /etc/sudoers -p wa -k actions
EOF

# audit_kernel_module_loading
cat << EOF >> /etc/audit/audit.rules

# Capture kernel module loading and unloading events
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=$b -S init_module -S delete_module -k modules
EOF

# service_rhnsd_disabled
chkconfig rhnsd off

# sshd_set_idle_timeout
sed -i 's/^#\(ClientAliveInterval \).*/\1900/' /etc/ssh/sshd_config

# sshd_set_keepalive
sed -i 's/^#\(ClientAliveCountMax \).*/\10/' /etc/ssh/sshd_config

# sshd_disable_empty_passwords
sed -i 's/^#\(PermitEmptyPasswords \).*/\1no/' /etc/ssh/sshd_config

# sshd_enable_warning_banner
sed -i 's/# no default banner path/# banner path/' sshd_config
sed -i 's/^#\(Banner \).*/\1\/etc\/issue/' /etc/ssh/sshd_config

# sshd_do_not_permit_user_env
sed -i 's/^#\(PermitUserEnvironment \).*/\1no/' /etc/ssh/sshd_config

# sshd_use_approved_ciphers
cat << EOF >> /etc/ssh/sshd_config

# Approved Ciphers
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
EOF

#-------- Re-Scan Server ------- #
# After completing the reconfiguration of the server, 
# we want to Re-scan the server and save another report 
# after the reconfiguration.
oscap xccdf eval --profile stig-rhel6-server --results AfterFix-ssg-results.xml --report AfterFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

%end


More information about the scap-security-guide mailing list