<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 8/28/13 2:02 PM, leam hall wrote:<br>
    </div>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div dir="ltr">Hey Maura!<br>
        <br>
        I'm using the openscap-utils rpm and the content from the
        Fedorahosted zip file.<br>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Wed, Aug 28, 2013 at 1:05 PM, Maura
          Dailey <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <div>On 08/28/2013 12:04 PM, leam hall wrote:<br>
                </div>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>Hey all,<br>
                      <br>
                    </div>
                    <div>Just ran oscap with the xml files available on
                      the website (Benchmark version 0.9). Here are the
                      issues that seem to be false positives. Prefix
                      everything with "RHEL-06-000". These are all
                      marked as fail but the server meets the STIG.<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              Stupid question, but what are you running against exactly?
              The RPM or the latest git checkout? I want to make sure
              that if I run this, I'm seeing the same results, and I've
              made a lot of changes to OVAL checks in the git repository
              in the past few weeks. I'm going to run through your list,
              comparing it against the OVAL checks.
              <div class="im"><br>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>  9   rhnsd can be on if configured to
                      Satellite server or similar<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              Fix text definitely implies this. It's not the only
              service that implies it's allowed in certain environments,
              but then proceeds to only accept a value of disabled.
              <div class="im"><br>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> 57   ucredit <br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    STIG wants ucredit=-1, so to test:<br>
    <br>
    [shawn@rhel6 checks]$ grep ucredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1<br>
    <br>
    <br>
    [shawn@rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export
    var_password_pam_cracklib_ucredit<br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_ucredit.xml <br>
    external_variable with id : var_password_pam_cracklib_ucredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results<br>
    Definition oval:scap-security-guide.testing:def:112: true<br>
    Evaluation done.<br>
    <br>
    <i>Side note: stig-rhel6-server was inheriting
      var_password_pam_cracklib_ucredit=2 from common. Created patch to
      set var_password_pam_cracklib_ucredit=-1 for STIG requirements.</i><br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div> 58   ocredit<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    [shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1 <b>ocredit=5</b><br>
    [shawn@rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export
    var_password_pam_cracklib_ocredit<br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_ocredit.xml <br>
    external_variable with id : var_password_pam_cracklib_ocredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results<br>
    Definition oval:scap-security-guide.testing:def:117: false<br>
    Evaluation done.<br>
    <br>
    [shawn@rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth<br>
    [shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1 <b>ocredit=-1</b><br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_ocredit.xml <br>
    external_variable with id : var_password_pam_cracklib_ocredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results<br>
    Definition oval:scap-security-guide.testing:def:117: true<br>
    Evaluation done.<br>
    <br>
    <i>Side note: var_password_pam_cracklib_ocredit=2 inherited from
      common. Updated STIG profile for
      var_password_pam_cracklib_ocredit=-1</i><br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div> 59   lcredit<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    [shawn@rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export
    var_password_pam_cracklib_lcredit<br>
    [shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1 ocredit=-1<b> lcredit=5</b><br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_lcredit.xml <br>
    external_variable with id : var_password_pam_cracklib_lcredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results<br>
    Definition oval:scap-security-guide.testing:def:122: false<br>
    Evaluation done.<br>
    <br>
    [shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth<br>
    [sudo] password for shawn: <br>
    [shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth<br>
    [shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1 ocredit=-1 <b>lcredit=-1</b><br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_lcredit.xml <br>
    external_variable with id : var_password_pam_cracklib_lcredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results<br>
    Definition oval:scap-security-guide.testing:def:122: true<br>
    Evaluation done.<br>
    <br>
    [shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth<br>
    [shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth<br>
    password    requisite     pam_cracklib.so try_first_pass retry=3
    ucredit=-1 ocredit=-1 <b>lcredit=-5</b><br>
    [shawn@rhel6 checks]$ ./testcheck.py
    accounts_password_pam_cracklib_lcredit.xml <br>
    external_variable with id : var_password_pam_cracklib_lcredit<br>
    Evaluating with OVAL tempfile :
    /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml<br>
    Writing results to :
    /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results<br>
    Definition oval:scap-security-guide.testing:def:122: true<br>
    Evaluation done.<br>
    <br>
    <br>
    <i>Side note: var_password_pam_cracklib_lcredit=2 inherited from
      common. Updated STIG profile for var_password_pam_cracklib_lcredit=-1</i><br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                  </div>
                </blockquote>
              </div>
              For the previous 3, I'd like to see the pam_cracklib.so
              line so I can troubleshoot.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    As Maura mentioned, can you send your /etc/pam.d/system-auth file? I
    had trouble reproducing your results.<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div> 73   /etc/issue<br>
                  </div>
                </div>
              </blockquote>
              Going back to my many many OVAL check updates, I'd like to
              see your exact /etc/issue so I can debug what went wrong.
              If it's an exact copy of the text from the STIG, I'll work
              off that.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    Skipping since Maura has the regex foo for this :)<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div> 98  No ipv6 installed<br>
                  </div>
                </div>
              </blockquote>
              Do you mean it's disabled on your system, but the OVAL
              checks are saying it isn't?<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    [shawn@rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat
    /etc/modprobe.d/disabled.conf ; \<br>
    &gt; ./testcheck.py kernel_module_ipv6_option_disabled.xml ; \<br>
    &gt; sudo vim /etc/modprobe.d/disabled.conf ; cat
    /etc/modprobe.d/disabled.conf ; \<br>
    &gt; ./testcheck.py kernel_module_ipv6_option_disabled.xml <br>
    options ipv6 disable=1<br>
    Evaluating with OVAL tempfile :
    /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml<br>
    Writing results to :
    /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results<br>
    Definition oval:scap-security-guide.testing:def:127: true<br>
    Evaluation done.<br>
    Evaluating with OVAL tempfile :
    /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml<br>
    Writing results to :
    /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results<br>
    Definition oval:scap-security-guide.testing:def:127: false<br>
    Evaluation done.<br>
    <br>
    Appears working. Can you send where you disabled IPv6?<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div>  99  "<br>
                  </div>
                </div>
              </blockquote>
              ?</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    RHEL-06-000099: The system must ignore ICMPv6 redirects by default.<br>
    aka sysctl_net_ipv6_conf_default_accept_redirects.xml<br>
    <br>
    [root@rhel6 checks]# sysctl -q -n -w
    net.ipv6.conf.default.accept_redirects=0<br>
    [root@rhel6 checks]# ./testcheck.py
    sysctl_net_ipv6_conf_default_accept_redirects.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml<br>
    Writing results to :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results<br>
    Definition oval:scap-security-guide.testing:def:130: true<br>
    Evaluation done.<br>
    [root@rhel6 checks]# sysctl -q -n -w
    net.ipv6.conf.default.accept_redirects=1<br>
    [root@rhel6 checks]# ./testcheck.py
    sysctl_net_ipv6_conf_default_accept_redirects.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml<br>
    Writing results to :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results<br>
    Definition oval:scap-security-guide.testing:def:130: false<br>
    Evaluation done.<br>
    <br>
    Can you send us the output of:<br>
    `grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and<br>
    `sysctl -a | grep net.ipv6.conf.default.accept_redirects`<br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>165  adjtimex<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    [root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k
    audit_time_rules" &gt;&gt; /etc/audit/audit.rules <br>
    [root@rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_time_adjtimexQoelxQ.xml<br>
    Writing results to :
    /tmp/audit_rules_time_adjtimexQoelxQ.xml-results<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Definition oval:scap-security-guide.testing:def:135: false<br>
    Definition oval:scap-security-guide.testing:def:134: true<br>
    Evaluation done.<br>
    <br>
    Since these operate on OR's, the false is checking for 32bit
    auditing rules. Ultimately, this results in a pass.<br>
    <br>
    Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?<br>
    <meta charset="utf-8">
    <br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div>167  settimeofday<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    [root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S
    settimeofday -k audit_time_rules" &gt;&gt; /etc/audit/audit.rules<br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_time_settimeofday.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_time_settimeofday9TYIqD.xml<br>
    Writing results to :
    /tmp/audit_rules_time_settimeofday9TYIqD.xml-results<br>
    Definition oval:scap-security-guide.testing:def:147: true<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Definition oval:scap-security-guide.testing:def:135: false<br>
    Evaluation done.<br>
    (passes)<br>
    <br>
    <br>
    Can you send the output of 'grep settimeofday
    /etc/audit/audit.rules' ?<br>
    <br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div>169  stime  // Also, the STIG is wrong. There
                      is no x86_64 stime syscall<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              The STIG actually says that stime is not necessary, which
              is kind of a strange wording, but the suggested line in
              the fix text prose is correct, at least. So far as OVAL
              checks go, I haven't gotten to testing audit checks yet.
              Maybe this is broken. I'll check it out once I've
              deciphered the OVAL check.</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    [root@rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k
    audit_time_rules" &gt;&gt; /etc/audit/audit.rules <br>
    [root@rhel6 RHEL6]# cd input/checks/<br>
    [root@rhel6 checks]# ./testcheck.py audit_rules_time_s<br>
    audit_rules_time_settimeofday.xml 
    audit_rules_time_stime.xml         <br>
    [root@rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_time_stime4hUFRb.xml<br>
    Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results<br>
    Definition oval:scap-security-guide.testing:def:152: true<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Definition oval:scap-security-guide.testing:def:135: false<br>
    Evaluation done.<br>
    <br>
    <br>
    Can you send the output of 'grep stime /etc/audit/audit.rules' ?<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im"><br>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>171  clock_settime<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    [root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S
    clock_settime -k audit_time_rules" &gt;&gt; /etc/audit/audit.rules <br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_time_clock_settime.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_time_clock_settime2SUHvv.xml<br>
    Writing results to :
    /tmp/audit_rules_time_clock_settime2SUHvv.xml-results<br>
    Definition oval:scap-security-guide.testing:def:155: true<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Definition oval:scap-security-guide.testing:def:135: false<br>
    Evaluation done.<br>
    <br>
    <br>
    Can you send the output of 'grep clock_settime
    /etc/audit/audit.rules' ?<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div>184-196, 200 chmod, chown, etc...<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              Haven't tested audit checks yet...</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    [root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S
    fchmod -S fchmodat -F auid&gt;=500 -F auid!=4294967295 -k perm_mod"
    &gt;&gt; /etc/audit/audit.rules <br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_chmod.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_chmodA0U8eF.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results<br>
    Definition oval:scap-security-guide.testing:def:160: true<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_fchmod.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results<br>
    Definition oval:scap-security-guide.testing:def:180: false<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_fchmodat.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results<br>
    Definition oval:scap-security-guide.testing:def:185: false<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
    [root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S
    fchown -S fchownat -S lchown -F auid&gt;=500 -F auid!=4294967295 -k
    perm_mod" &gt;&gt; /etc/audit/audit.rules <br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_fchown.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_fchownR4dTLm.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results<br>
    Definition oval:scap-security-guide.testing:def:165: false<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_fchownat.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_fchownata3WKRL.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results<br>
    Definition oval:scap-security-guide.testing:def:170: false<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    [root@rhel6 checks]# ./testcheck.py
    audit_rules_dac_modification_lchown.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/audit_rules_dac_modification_lchownmX0BTK.xml<br>
    Writing results to :
    /tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results<br>
    Definition oval:scap-security-guide.testing:def:175: false<br>
    Definition oval:scap-security-guide.testing:def:137: true<br>
    Evaluation done.<br>
    <br>
    <br>
    Please send relevant lines from audit.rules<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im"><br>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div>206-211  No telnet installed or turned on<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              These are both automated checks. Unless the package name
              is wrong, I don't know why they'd give false positives.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    This is broke. I forgot who originally reported, but we still need
    to update the telnet checks to use the xinet templates.<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div>240  /etc/ssh/sshd_config Banner<br>
                  </div>
                </div>
              </blockquote>
              The OVAL check was definitely working on my system when I
              last tested it.</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    I'm able to reproduce...<br>
    <br>
    [root@rhel6 checks]# cat /etc/issue<br>
    You are accessing a U.S. Government (USG) Information System (IS)
    that is provided for USG-authorized use only. By using this IS
    (which includes any device attached to this IS), you consent to the
    following conditions: <br>
    -The USG routinely intercepts and monitors communications on this IS
    for purposes including, but not limited to, penetration testing,
    COMSEC monitoring, network operations and defense, personnel
    misconduct (PM), law enforcement (LE), and counterintelligence (CI)
    investigations. <br>
    -At any time, the USG may inspect and seize data stored on this IS.
    <br>
    -Communications using, or data stored on, this IS are not private,
    are subject to routine monitoring, interception, and search, and may
    be disclosed or used for any USG-authorized purpose. <br>
    -This IS includes security measures (e.g., authentication and access
    controls) to protect USG interests -- not for your personal benefit
    or privacy. <br>
    -Notwithstanding the above, using this IS does not constitute
    consent to PM, LE or CI investigative searching or monitoring of the
    content of privileged communications, or work product, related to
    personal representation or services by attorneys, psychotherapists,
    or clergy, and their assistants. Such communications and work
    product are private and confidential. See User Agreement for
    details.<br>
    <br>
    [root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml <br>
    Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml<br>
    Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results<br>
    Definition oval:scap-security-guide.testing:def:193: false<br>
    Definition oval:scap-security-guide.testing:def:191: false<br>
    Definition oval:scap-security-guide.testing:def:190: false<br>
    Evaluation done.<br>
    <br>
    Maura, do you want to take a stab at this (noticed your signoff on
    the OVAL)?<br>
    <br>
    FWIW, if I used the USGCB banner everything worked OK.<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>271  If there are no removable partitions this
                      is not a finding.<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              Working on testing this one now...</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    Skipping in my testing then<br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im"><br>
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>278  If the file permissions are more
                      restrictive then it is not a finding.<br>
                    </div>
                  </div>
                </blockquote>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    This pairs with rpm_verify_permissions, which has the following
    criterion checks:<br>
    <blockquote type="cite">    &lt;criteria operator="AND"&gt;<br>
            &lt;criterion test_ref="test_verify_all_rpms_user_ownership"
      comment="user ownership of all files matches local rpm database"
      /&gt;<br>
            &lt;criterion
      test_ref="test_verify_all_rpms_group_ownership" comment="group
      ownership of all files matches local rpm database" /&gt;<br>
            &lt;criterion test_ref="test_verify_all_rpms_mode"
      comment="mode of all files matches local rpm database" /&gt;<br>
          &lt;/criteria&gt;</blockquote>
    <br>
    Can you send what files are being reported? It should only hit on
    ownership mismatches.<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div> </div>
                    <div>324  No X running<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              Agreed, the GNOME checks need to be rewritten to have
              extended definitions to exclude machines that don't have X
              installed.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    Which package(s) should we check for? xorg-x11-server-Xorg?
    gnome-desktop?<br>
    <br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div>326   "  <br>
                  </div>
                </div>
              </blockquote>
              ?</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    Same thing as 324<br>
    <br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>346  Finding reported on umask 022<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              This is DEFINITELY a bug. The check section is actually
              pointing to a different check. The actual check for this
              rule was never written.</div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    The XCCDF (set_daemon_umask) points to:<br>
    <br>
    &lt;oval id="umask_for_daemons" value="var_umask_for_daemons"/&gt;<br>
    <br>
    so, to test:<br>
    [shawn@rhel6 checks]$ grep umask /etc/init.d/functions <br>
    # Make sure umask is sane<br>
    umask 022<br>
    [shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
    var_umask_for_daemons<br>
    [shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml <br>
    external_variable with id : var_umask_for_daemons<br>
    Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml<br>
    Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results<br>
    Definition oval:scap-security-guide.testing:def:212: false<br>
    Evaluation done.<br>
    <br>
    <br>
    but then in the OVAL code, it's looking at the wrong place:<br>
    &lt;ind:textfilecontent54_object id="object_umask_for_daemons"
    version="1"&gt;<br>
        &lt;ind:path&gt;/etc/sysconfig&lt;/ind:path&gt;<br>
        &lt;ind:filename&gt;init&lt;/ind:filename&gt;<br>
        &lt;ind:pattern operation="pattern
    match"&gt;umask[\s]+(.*)&lt;/ind:pattern&gt;<br>
        &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;<br>
      &lt;/ind:textfilecontent54_object&gt;<br>
    <br>
    verified no other XCCDF rule was using this OVAL:<br>
    [shawn@rhel6 input]$ grep -rin umask_for_daemons system/*<br>
    system/permissions/execution.xml:18:&lt;Value
    id="var_umask_for_daemons" type="string" operator="equals"
    interactive="0"&gt;<br>
    system/permissions/execution.xml:47:&lt;oval id="umask_for_daemons"
    value="var_umask_for_daemons"/&gt;<br>
    <br>
    .... wrote a patch to fix the pattern match expression, and file
    path things seem OK now:<br>
    [shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
    var_umask_for_daemons<br>
    [shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml <br>
    external_variable with id : var_umask_for_daemons<br>
    Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml<br>
    Writing results to : /tmp/umask_for_daemons394CCR.xml-results<br>
    Definition oval:scap-security-guide.testing:def:212: true<br>
    Evaluation done.<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div class="im">
                <blockquote type="cite">
                  <div dir="ltr">
                    <div>348  No vsftp installed, thus no file.<br>
                    </div>
                  </div>
                </blockquote>
              </div>
              No OVAL check exists in SSG.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    Created <a class="moz-txt-link-freetext" href="https://fedorahosted.org/scap-security-guide/ticket/411">https://fedorahosted.org/scap-security-guide/ticket/411</a> to
    track<br>
    <br>
    <br>
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <div>506  "hushlogin"<br>
                  </div>
                </div>
              </blockquote>
              This one isn't in the SSG at all.<br>
              <blockquote type="cite">
                <div dir="ltr">
                  <div>507  PrintLastLog<br>
                  </div>
                </div>
              </blockquote>
              This one isn't in the SSG at all.<br>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    Not sure how/why DISA FSO slid these in. Leland?<br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>