<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Arial;color: #000000;font-size: 10pt;">I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have found some bugs/notes. Each of the following seems to be an issue with the OVAL content/test.<br>
<br>
<ul>
<li><b>Ensure All Files Are Owned by a User</b>
<ul>
<li>This reports PASS for me, but is a false positive. Running <font face="Courier New">
'find / -xdev -nouser -print'</font> reveals files that have a user owner that is not local to the system.</li></ul>
</li></ul>
<br>
<ul>
<li><b>Ensure All Files Are Owned by a Group</b>
<ul>
<li>This reports PASS for me, but is a false positive. Running <font face="Courier New">
'find / -xdev -nogroup -print'</font> reveals files that have a group that is not local to the system.</li></ul>
</li></ul>
<br>
<ul>
<li><b>Set Daemon Umask</b>
<ul>
<li>The test states it is looking for a umask of 022 or 027. In my /etc/init.d/functions, the umask is 022, but the test reports FAIL. This is a false positive.</li></ul>
</li></ul>
<br>
<ul>
<li><b>Set GNOME Login Inactivity Timeout</b></li><li><b>GNOME Desktop Screensaver Mandatory Use</b></li><li><b>Enable Screen Lock Activation After Idle Period</b></li><li><b>Implement Blank Screen Saver</b></li><li><b>Enable GUI Warning Banner Text<br>
</b>
<ul>
<li>Each of these tests assume that the execution is on an X system. My system does not have X installed or running, so the tests report FAIL. The test should first check if it is applicable to the test system and if not report NOT APPLICABLE or something
similar versus FAIL.</li></ul>
</li></ul>
<br>
<ul>
<li><b>Modify the System Login Banner</b>
<ul>
<li>This test appears to check for exactly the DoD banner text. Since the verbage states "a message compliant with the local site policy", suggest modifying the test to check for the presence of content in /etc/issue, but perhaps not an exact match, as not
all deployments may be DoD systems.</li></ul>
</li></ul>
<br>
<ul>
<li><b>Ensure Host Logs Sent to Remote Host</b>
<ul>
<li>For TCP, this checks for the following in the rsyslog file:<span style="font-size:10pt;" dir="ltr">
<pre style="text-indent:0;background-color:#CCCCCC;margin-top:14pt;margin-bottom:14pt;padding:0.2em;"><span style="background-color:#CCCCCC;font-weight:normal;font-variant:normal;text-transform:none;">*.* @@<i>loghost.example.com</i></span></pre>
</span></li><li><font face="Arial">Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in general they are? In my configuration, I have
<font face="Courier New">*.info</font> versus the <font face="Courier New">*.*</font> and the test reports FAIL. I would like to understand the intent on this one so I can comply.
<br>
</font></li><li><font face="Arial">Additionally, my filter portion excludes some logs marked via other ways (read in from files) with the string
<font face="Courier New">"*.info;local0.none @@dest-ip</font>" and I want to make sure that even if my string needs to be modified to
</font><font face="Arial"><font face="Courier New">"*.*;local0.none @@dest-ip</font>" to comply that the test will pass.</font><font face="Arial"> i.e. that the test is robust enough to understand the negation in the rsyslog configuration and report the
correct assessment value.</font></li></ul>
</li></ul>
<font face="Arial"><br>
</font>
<ul>
<li><b><font face="Arial">Configure auditd space_left Action on Low Disk Space</font></b></li><li><b><font face="Arial">Configure auditd admin_space_left Action on Low Disk Space</font></b>
<ul>
<li><font face="Arial">For both of these, the contents of /etc/audit/auditd.conf contain the correct key with a case-insensitive value (all caps value of one of the possible values) and the test reports FAIL. THis is a false negative. Suggest making the test
case-insensitive in the value match portion.</font></li></ul>
</li></ul>
<font face="Arial"><br>
</font>
<ul>
<li><b><font face="Arial">Disable Network Console (netconsole)</font></b></li><li><b><font face="Arial">Disable Network Router Discovery Daemon (rdisc)</font></b>
<ul>
<li><font face="Arial">For both of these, the service is not active/installed, but the test reports FAIL. This is a false negative.</font></li></ul>
</li></ul>
<font face="Arial"><br>
</font>
<ul>
<li><b><font face="Arial">Disable SSH Support for .rhosts Files</font></b></li><li><b><font face="Arial">Disable Host-Based Authentication</font></b></li><li><b><font face="Arial">Disable SSH Root Login</font></b>
<ul>
<li><font face="Arial">For all of these, the required value is present in its entirety, but is preceeded by the comment character, making it inactive. The test reports PASS, which is a false positive.</font></li><li><font face="Arial">Additionally, for the SSH Root Login test, the commented value is incorrect and the test reports PASS.</font></li></ul>
</li></ul>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>In addition to these bugs, I found that the following items did not have any check content ref specified in the XCCDF, thus reported NOTCHECKED. I realize some of the check cannot be performed automatically, but each of these can be, but is not.<br>
</p>
<ul>
<li><b>Disable Ctrl-Alt-Del Reboot Activation</b></li><li><b>Install the screen Package</b></li><li><b>Set GUI Warning Banner Text</b></li><li><b>Set Default IPTables Policy for Forwarded Packets</b></li><li><b>Disable ntpdate Service (ntpdate)</b></li><li><b>Ensure Insecure File Locking is Not Allowed</b></li><li><b>Verify No netrc Files Exist</b></li><li><b>Ensure All Accounts on the System Have Unique Names</b></li><li><b>Set Password to Maximum of Three Consecutive Repeating Characters</b></li><li><b>Set Password Hashing Algorithm in /etc/pam.d/system-auth</b></li><li><b>Set Password Hashing Algorithm in /etc/login.defs</b></li><li><b>Set Password Hashing Algorithm in /etc/libuser.conf</b></li></ul>
<b></b><br>
<b></b>
<ul>
<li><b>Verify that Shared Library Files Have Restrictive Permissions</b></li><li><b>Verify that Shared Library Files Have Root Ownership</b></li><li><b>Verify that System Executables Have Restrictive Permissions</b></li><li><b>Verify that System Executables Have Root Ownership</b></li><li><b>Ensure No World-Writable Files Exist</b><br>
<ul>
<li>Each of the 5 above can be tested using one of:
<ul>
<li><font face="Courier New">`find $dir -xdev -perm /o=w ! \( -type d -perm /o=t \) ! -type l -print`</font></li><li><font face="Courier New">`find $dir -xdev ! -user root ! -type d ! -type l -print`</font></li></ul>
</li></ul>
</li></ul>
<b></b>
<ul>
<li><b>Limit the Number of Concurrent Login Sessions Allowed Per User</b>
<ul>
<li>For this one, perhaps check that the key is present, as the value is up to the system owner.</li></ul>
</li></ul>
<b></b>
<ul>
<li><b>Uninstall Sendmail Package</b>
<ul>
<li>Additionally, suggest naming this "Ensure sendmail not installed" or something of that flavor more indicative of what the test is checking for, versus an action.<br>
</li></ul>
</li></ul>
<b></b>
<ul>
<li><b>Enable Logging of All FTP Transactions</b></li><li><b>Create Warning Banners for All FTP Users</b></li><li><b>Configure SNMP Service to Use Only SNMPv3 or Newer</b></li><li><b>Ensure Default Password Is Not Used</b>
<ul>
<li>For the previous 4, the test must first check applicability (much like the GNOME tests), as my system does not have/support FTP or SNMP and should not have FAIL reported.</li></ul>
</li></ul>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>And the last item--each of the following reports UNKNOWN as the <font face="Courier New">
check-content-ref</font> element in the XCCDF references a non-existent id in the OVAL.</p>
<ul>
<li><b>Ensure Log Files Are Owned By Appropriate Group</b></li><li><b>Ensure System Log Files Have Correct Permissions</b></li><li><b>Ensure Logrotate Runs Periodically</b><br>
</li></ul>
<div><br>
<br>
<br>
<div style="font-family:Tahoma; font-size:13px"><font style="font-family:Arial" size="1"><font size="2"><span style="font-weight:bold"><br>
--Logan Rodrian</span></font></font><font size="1"><span style="font-family:Arial; color:rgb(128,128,128)"></span><br>
</font></div>
</div>
</div>
</body>
</html>