scap-security-guide December 2012

scap-security-guide@lists.fedorahosted.org

8 participants
36 discussions

[RFC] Some Considerations for Kernel Module Checks
by Mike Palmiotto 18 Jan '13

18 Jan '13

There was some discussion a while back about the proper method for doing kernel module checking. (see: https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-August/00…) The OVAL checks for disabling kernel modules are currently checking for `install [module] /bin/true`. I'm sure there is a reason for doing this as opposed to `install [module] /bin/false`. Just a shot in the dark: we want the install to fail and return as if a failure is expected? Would it make more sense to run /bin/false, as the actual install is failing to install? Additionally, it seems the checks are using a mixture of `install [module] /bin/true` and `alias [module] off`. Should these be made uniform, or is there a reason for the variation in method? Any and all insight is greatly appreciated. Thanks, --Mike

3 2

[PATCH 02/8] Updated verify-references.py to ignore ocil-transitional
by Shawn Wells 28 Dec '12

28 Dec '12

2 1

[PATCH] NIST reference fixes
by David Smith 28 Dec '12

28 Dec '12

added and/or modified several NIST security control references David Smith (1): added/changed NIST 800-53 references RHEL6/input/system/accounts/banners.xml | 2 +- RHEL6/input/system/auditing.xml | 33 +++++++++++--------- RHEL6/input/system/selinux.xml | 8 ++-- RHEL6/input/system/software/disk_partitioning.xml | 2 +- RHEL6/input/system/software/integrity.xml | 10 +++--- RHEL6/input/system/software/updating.xml | 6 ++-- 6 files changed, 32 insertions(+), 29 deletions(-)

2 2

[PATCH 0/2] fixes to banner and refs
by Jeffrey Blank 22 Dec '12

22 Dec '12

Per FSO feedback. Jeffrey Blank (2): CCI ref fixup banner language fixup RHEL6/input/auxiliary/srg_support.xml | 2 +- RHEL6/input/services/ssh.xml | 8 ++++---- RHEL6/input/system/accounts/banners.xml | 14 +++++++------- 3 files changed, 12 insertions(+), 12 deletions(-)

1 2

[PATCH] Replaced all RHEL 5 CCE numbers with new CCE numbers. Left the TODO alones for now.
by Michele Newman 22 Dec '12

22 Dec '12

--- RHEL6/input/services/avahi.xml | 2 +- RHEL6/input/services/base.xml | 20 +++--- RHEL6/input/services/cron.xml | 10 ++-- RHEL6/input/services/dhcp.xml | 30 +++++----- RHEL6/input/services/dns.xml | 14 ++-- RHEL6/input/services/ftp.xml | 20 +++--- RHEL6/input/services/http.xml | 58 +++++++++--------- RHEL6/input/services/imap.xml | 16 +++--- RHEL6/input/services/ldap.xml | 36 ++++++------ RHEL6/input/services/mail.xml | 4 +- RHEL6/input/services/nfs.xml | 32 +++++----- RHEL6/input/services/ntp.xml | 4 +- RHEL6/input/services/obsolete.xml | 24 ++++---- RHEL6/input/services/printing.xml | 8 +- RHEL6/input/services/smb.xml | 6 +- RHEL6/input/services/snmp.xml | 6 +- RHEL6/input/services/squid.xml | 4 +- RHEL6/input/services/ssh.xml | 28 ++++---- RHEL6/input/services/xorg.xml | 4 +- RHEL6/input/system/accounts/banners.xml | 6 +- RHEL6/input/system/accounts/pam.xml | 22 ++++---- RHEL6/input/system/accounts/physical.xml | 22 ++++---- .../accounts/restrictions/password_expiration.xml | 8 +- .../accounts/restrictions/password_storage.xml | 4 +- .../system/accounts/restrictions/root_logins.xml | 8 +- RHEL6/input/system/accounts/session.xml | 14 ++-- RHEL6/input/system/auditing.xml | 64 ++++++++++---------- RHEL6/input/system/logging.xml | 24 ++++---- RHEL6/input/system/network/iptables.xml | 12 ++-- RHEL6/input/system/network/ipv6.xml | 22 ++++---- RHEL6/input/system/network/kernel.xml | 30 +++++----- RHEL6/input/system/network/network.xml | 4 +- RHEL6/input/system/network/uncommon.xml | 8 +- RHEL6/input/system/network/wireless.xml | 10 ++-- RHEL6/input/system/permissions/execution.xml | 14 ++-- RHEL6/input/system/permissions/files.xml | 38 ++++++------ RHEL6/input/system/permissions/mounting.xml | 30 +++++----- RHEL6/input/system/permissions/partitions.xml | 22 ++++---- RHEL6/input/system/selinux.xml | 12 ++-- RHEL6/input/system/software/disk_partitioning.xml | 10 ++-- RHEL6/input/system/software/integrity.xml | 4 +- RHEL6/input/system/software/updating.xml | 6 +- 42 files changed, 360 insertions(+), 360 deletions(-) diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml index af7dd1c..f7ad4c9 100644 --- a/RHEL6/input/services/avahi.xml +++ b/RHEL6/input/services/avahi.xml @@ -27,7 +27,7 @@ port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted. </rationale> -<ident cce="4365-3" /> +<ident cce="27087-6" /> <oval id="service_avahi-daemon_disabled" /> <ref nist="CM-6, CM-7" disa="366"/> </Rule> diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml index 74b3a11..6c040fa 100644 --- a/RHEL6/input/services/base.xml +++ b/RHEL6/input/services/base.xml @@ -38,7 +38,7 @@ programs. such as laptops or desktops. For other systems, such as servers, it may permit accidental or trivially achievable denial of service situations and disabling it is appropriate.</rationale> -<ident cce="4298-6" /> +<ident cce="27061-1" /> <oval id="service_acpid_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -127,7 +127,7 @@ provides benefit. Traditionally this has included laptops (to enhance battery li but may also apply to server or desktop environments where conserving power is highly desirable or necessary. </rationale> -<ident cce="4051-9" /> +<ident cce="26973-8" /> <oval id="service_cpuspeed_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -147,7 +147,7 @@ deals with removable media or devices. that use removable media or devices, but can be disabled for systems that do not require these. </rationale> -<ident cce="4364-6" /> +<ident cce="27086-8" /> <oval id="service_haldaemon_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -163,7 +163,7 @@ multiple processors. <ocil><service-disable-check-macro service="irqbalance" /></ocil> <rationale>In an environment with multiple processors (now common), the irqbalance service provides potential speedups for handling interrupt requests.</rationale> -<ident cce="4123-6" /> +<ident cce="26990-2" /> <oval id="service_irqbalance_enabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -178,7 +178,7 @@ crash, which can load information from the crashed kernel for analysis. <ocil><service-disable-check-macro service="kdump" /></ocil> <rationale>Unless the system is used for kernel development or testing, there is little need to run the kdump service.</rationale> -<ident cce="3425-6" /> +<ident cce="26850-8" /> <oval id="service_kdump_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -212,7 +212,7 @@ RAID setups do not use this service). <ocil><service-disable-check-macro service="mdmonitor" /></ocil> <rationale>If software RAID monitoring is not required (and it is uncommon), there is no need to run the service.</rationale> -<ident cce="3854-7" /> +<ident cce="27193-2" /> <oval id="service_mdmonitor_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -233,7 +233,7 @@ it could be a target for attack. However, disabling D-Bus is likely to be impractical for any system which needs to provide a graphical login session. </rationale> -<ident cce="3822-4" /> +<ident cce="26913-4" /> <oval id="service_messagebus_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -347,7 +347,7 @@ package selection is selected during installation. The qpidd service listens for network connections which increases the attack surface of the system. If the system is not intended to receive AMQP traffic then the <tt>qpidd</tt> service is not needed and should be disabled or removed.</rationale> -<ident cce="3854-7" /> +<ident cce="26928-2" /> <oval id="service_qpidd_disabled" /> <ref nist="CM-6, CM-7" disa="382" /> </Rule> @@ -407,7 +407,7 @@ RHN server or satellite and managed as such. system security, management by a system outside the enterprise enclave is not desirable for some environments. However, if the system is being managed by RHN or RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale> -<ident cce="3416-5" /> +<ident cce="26846-6" /> <oval id="service_rhnsd_disabled" /> <ref nist="CM-6, CM-7" disa="382" /> <tested by="DS" on="20121024"/> @@ -467,7 +467,7 @@ relay an appropriate warning. service due to failing hardware. Nevertheless, if it is not needed or the system's drives are not SMART-capable (such as solid state drives), it can be disabled.</rationale> -<ident cce="3455-3" /> +<ident cce="26853-2" /> <oval id="service_smartd_disabled" /> <ref nist="CM-6, CM-7" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml index a365de8..d9dce38 100644 --- a/RHEL6/input/services/cron.xml +++ b/RHEL6/input/services/cron.xml @@ -17,7 +17,7 @@ maintenance tasks, such as notifying root of system activity. <rationale>Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential. </rationale> -<ident cce="4324-0" /> +<ident cce="27070-2" /> <oval id="service_crond_enabled" /> <ref nist="CM-6, CM-7" /> <tested by="DS" on="20121024"/> @@ -45,7 +45,7 @@ attack surface for an intruder.</description> <description>The system crontab /etc/crontab should be owned by the root user. This file is provided for backwards compatibility by the RPM package crontabs and it will be read by the crond service. RHEL6 will not add jobs to it by default.</description> -<ident cce="3851-3" /> +<ident cce="26923-3" /> <oval id="file_user_owner_etc_crontab" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -55,7 +55,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by default.</de <description>The file /etc/crontab should be owned by the root group. This file is provided for backwards compatibility by the RPM package crontabs and it will be read by the crond service. RHEL6 will not add jobs to it by default.</description> -<ident cce="3626-9" /> +<ident cce="26876-3" /> <oval id="file_group_owner_etc_crontab" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -65,7 +65,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by default.</de <description>The file /etc/crontab should be mode 600. This file is provided for backwards compatibility by the RPM package crontabs and it will be read by the crond service. RHEL6 will not add jobs to it by default.</description> -<ident cce="4388-5" /> +<ident cce="27102-3" /> <oval id="file_mode_etc_crontab" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -122,7 +122,7 @@ access to these files should be disabled.</description> Many of the periodic or delayed execution features of the at daemon can be provided through the cron daemon instead. </rationale> -<ident cce="14466-7" /> +<ident cce="26548-8" /> <oval id="service_atd_disabled" /> <ref nist="CM-6, CM-7" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml index 7cf381b..c464cab 100644 --- a/RHEL6/input/services/dhcp.xml +++ b/RHEL6/input/services/dhcp.xml @@ -45,7 +45,7 @@ Unmanaged or unintentionally activated DHCP servers may provide faulty informati to clients, interfering with the operation of a legitimate site DHCP server if there is one. </rationale> -<ident cce="4336-4" /> +<ident cce="27074-4" /> <oval id="service_dhcpd_disabled" /> <ref nist="CM-6, CM-7" disa="366"/> <tested by="DS" on="20121024"/> @@ -62,7 +62,7 @@ the dhcp package can be uninstalled. Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation. </rationale> -<ident cce="4464-4" /> +<ident cce="27120-5" /> <oval id="package_dhcpd_removed" /> <ref nist="CM-6, CM-7" disa="366"/> <tested by="DS" on="20121024"/> @@ -100,7 +100,7 @@ the DHCP server will attempt to act as a Dynamic DNS client. As long as the DNS server itself is correctly configured to reject DDNS attempts, an incorrect ddns-update-style setting on the client is harmless (but should be fixed as a best practice).</warning> -<ident cce="4257-2" /> +<ident cce="27049-6" />   </Rule> @@ -115,7 +115,7 @@ that it does not consider the lease offered by the server to be valid. By issuing many DHCPDECLINE messages, a malicious client can exhaust the DHCP server's pool of IP addresses, causing the DHCP server to forget old address allocations.</rationale> -<ident cce="4403-2" /> +<ident cce="27106-4" />   </Rule> @@ -130,7 +130,7 @@ support for the bootp protocol by adding or correcting the global option. for this simpler protocol is not needed, it should be disabled to remove attack vectors against the DHCP server. </rationale> -<ident cce="4345-5" /> +<ident cce="27077-7" />   </Rule> @@ -159,13 +159,13 @@ to request much of the above information from the DHCP server. In particular, domain-name, domain-name-servers, and routers are configured via DHCP. These settings are typically necessary for proper network functionality, but are also usually static across machines at a given site.</warning> - +   </Group> @@ -180,7 +180,7 @@ reported by the dhcpd process.</description> <rationale>By default, dhcpd logs notices to the daemon facility. Sending all daemon messages to a dedicated log file is part of the syslog configuration outlined in the Logging and Auditing section</rationale> -<ident cce="3733-3" /> +<ident cce="26898-7" />   </Rule> @@ -229,7 +229,7 @@ DHCP relies on trusting the local network. If the local network is not trusted, then it should not be used. However, the automatic configuration provided by DHCP is commonly used and the alternative, manual configuration, presents an unacceptable burden in many circumstances.</rationale> -<ident cce="4191-3" /> +<ident cce="27021-5" /> <oval id="sysconfig_networking_bootproto_ifcfg" /> <ref nist="CM-6, CM-7" disa="366"/> <tested by="DS" on="20121024"/> @@ -287,7 +287,7 @@ protocol is not in use. It is necessary to supersede settings for unused services so that they cannot be set by a hostile DHCP server. If an option is set to an empty string, dhclient will typically not attempt to configure the service.</warning> - +   </Group> diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml index 0bdaa8e..23412e3 100644 --- a/RHEL6/input/services/dns.xml +++ b/RHEL6/input/services/dns.xml @@ -26,7 +26,7 @@ nameservers. All network services involve some risk of compromise due to implementation flaws and should be disabled if possible. </rationale> -<ident cce="3578-2" /> +<ident cce="26873-0" /> <oval id="service_named_disabled" /> <ref nist="CM-6, CM-7" disa="366"/> </Rule> @@ -42,7 +42,7 @@ implementation flaws and should be disabled if possible. If there is no need to make DNS server software available, removing it provides a safeguard against its activation. </rationale> -<ident cce="4219-2" /> +<ident cce="27030-6" /> <oval id="package_bind_removed" /> <ref nist="CM-6, CM-7" disa="366"/> </Rule> @@ -61,7 +61,7 @@ attacks on nameservers more difficult.</description> a high-risk service which must frequently be made available to the entire Internet, it is strongly recommended that no other services be offered by machines which act as organizational DNS servers.</description> - +   </Group> @@ -97,9 +97,9 @@ configuration file. That is, when this guide recommends editing <tt>/etc/named.conf</tt>, you should instead edit <tt>/var/named/chroot/etc/named.conf</tt>. </warning> -<ident cce="3985-9" /> -<ident cce="4487-5" /> -<ident cce="4258-0" /> +<ident cce="26957-1" /> +<ident cce="27127-0" /> +<ident cce="26961-3" />   </Rule> @@ -327,7 +327,7 @@ updates must be allowed, IP-based ACLs are insufficient protection, since they are easily spoofed. Instead, use TSIG keys (see the previous section for an example), and consider using the update-policy directive to restrict changes to only the precise type of change needed.</rationale> -<ident cce="4399-2" /> +<ident cce="27105-6" />   </Rule> diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index fc60df1..4594415 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -28,7 +28,7 @@ of attack, and should be disabled if not needed. Furthermore, the FTP protocol is unencrypted and creates a risk of compromising sensitive information. </rationale> -<ident cce="3919-8" /> +<ident cce="26948-0" /> <oval id="service_vsftpd_disabled" /> <ref nist="CM-6, CM-7" disa="1436"/> </Rule> @@ -45,7 +45,7 @@ a risk of compromising sensitive information. Removing the vsftpd package decreases the risk of its accidental activation. </rationale> -<ident cce="14881-7" /> +<ident cce="26687-4" /> <oval id="package_vsftpd_removed" /> <ref nist="CM-6, CM-7" disa="1436"/> </Rule> @@ -62,7 +62,7 @@ accidental activation. </description> <rationale>After RHEL 2.1, Red Hat switched from distributing wu-ftpd with RHEL to distributing vsftpd. For security and for consistency with future Red Hat releases, the use of vsftpd is recommended.</rationale> -<ident cce="14881-7" /> +<ident cce="27187-4" /> <oval id="package_vsftpd_installed" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -98,7 +98,7 @@ If the server_argsline is missing or does not include the vsftpd configur <rationale>The modifications above ensure that all commands sent to the ftp server are logged using the verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log.</rationale> <warning category="general">If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log</warning> -<ident cce="4549-2" /> +<ident cce="27142-9" />   </Rule> @@ -110,7 +110,7 @@ by default. Add or correct the following configuration options. <pre>banner_file=/etc/issue</pre> </description> <rationale>This setting will cause the system greeting banner to be used for FTP connections as well.</rationale> -<ident cce="4554-2" /> +<ident cce="27145-2" /> <ref disa="48" />   @@ -138,7 +138,7 @@ using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration fil If non-anonymous FTP logins are necessary, follow the guidance in the remainder of this section to secure these logins as much as possible.</description> <rationale>The use of non-anonymous FTP logins is strongly discouraged. Since SSH clients and servers are widely available, and since SSH provides support for a transfer mode which resembles FTP in user interface, there is no good reason to allow password-based FTP access. </rationale> -<ident cce="4443-8" /> +<ident cce="27115-5" />   </Rule> @@ -156,7 +156,7 @@ If anonymous access is also required, add the anonymous usernames to <tt>/etc/vs ftp</pre> </description> <rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option userlist deny=NO is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale> - +   </Group> @@ -174,7 +174,7 @@ as much as possible.</description> common to have a need to allow unauthenticated users to place files on the FTP server. If this must be done, it is necessary to ensure that files cannot be uploaded and downloaded from the same directory. </rationale> -<ident cce="4461-0" /> +<ident cce="27117-1" />   </Rule> @@ -185,7 +185,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam be used to verify that this directory is on its own partition.</description> <rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent these users from filling a disk used by other services.</rationale> - +   </Rule> @@ -204,7 +204,7 @@ FTP is an older protocol which is not very compatible with firewalls. During the and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an FTP server to operate on a machine which is running a firewall.</rationale> - +   </Group> diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml index e484b12..893ffec 100644 --- a/RHEL6/input/services/http.xml +++ b/RHEL6/input/services/http.xml @@ -34,7 +34,7 @@ and removed from the system. Running web server software provides a network-based avenue of attack, and should be disabled if not needed. </rationale> -<ident cce="4338-0" /> +<ident cce="27075-1" /> <oval id="service_httpd_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -51,7 +51,7 @@ of attack, and should be disabled if not needed. If there is no need to make the web server software available, removing it provides a safeguard against its activation. </rationale> -<ident cce="4514-6" /> +<ident cce="27133-8" /> <oval id="package_httpd_removed" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -70,7 +70,7 @@ package group during the system installation process. The Web Server package group includes many packages which are likely extraneous, while the command-line method installs only the required <tt>httpd</tt> package itself. </description> - +   @@ -119,7 +119,7 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>: Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. </rationale> -<ident cce="4474-3" /> +<ident cce="27123-9" /> <oval id="httpd_servertokens_prod" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -137,7 +137,7 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>: Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. </rationale> -<ident cce="3756-4" /> +<ident cce="26900-1" /> <oval id="httpd_serversignature_off" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -214,7 +214,7 @@ If the above functionality is unnecessary, comment out the related module: Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale>--> - +   </Group> @@ -230,7 +230,7 @@ If this functionality is unnecessary, comment out the related module: Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -248,7 +248,7 @@ unnecessary, comment out the related module: Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -266,7 +266,7 @@ If LDAP is to be used, SSL encryption should be used as well. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -287,7 +287,7 @@ supplied data should be encoded to prevent cross-site scripting vulnerabilities. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -303,7 +303,7 @@ is likely extraneous. If its functionality is unnecessary, comment out the relat Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -324,7 +324,7 @@ server that is DAV enabled should be protected by access controls. Minimizing the number of loadable modules available to the web server, reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -344,7 +344,7 @@ configuration. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -363,7 +363,7 @@ an access control list to restrict access to the information. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -380,7 +380,7 @@ This functionality weakens server security by making site enumeration easier. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -405,7 +405,7 @@ are a security risk. <tt>mod_proxy_balancer</tt> enables load balancing, but req Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -426,7 +426,7 @@ If caching is required, it should not be enabled for any limited-access content. Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -452,7 +452,7 @@ CGI scripts to run as a specified user/group instead of as the server's user/gro Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -480,7 +480,7 @@ are not using these directives), comment out the associated module: Minimizing the number of loadable modules available to the web server reduces risk by limiting the capabilities allowed by the web server. </description> - +   </Group> @@ -506,7 +506,7 @@ the possibility of unwanted or malicious configuration files to be automatically part of the server's running configuration.  </description> - +   </Group> @@ -537,7 +537,7 @@ The <tt>httpd</tt> root directory should always have the most restrictive config The Web Server's root directory content should be protected from unauthorized access by web clients. </rationale> - +   </Rule> @@ -563,7 +563,7 @@ Ensure that this policy is adhered to by altering the related section of the con Access to the web server's directory hierarchy could allow access to unauthorized files by web clients. Following symbolic links could also allow such access. </rationale> - +   </Rule> @@ -580,7 +580,7 @@ should be used to deny access by default, allowing access only where necessary. Directories accessible from a web client should be configured with the least amount of access possible in order to avoid unauthorized access to restricted content or server information. </rationale> - +   </Rule> @@ -607,7 +607,7 @@ are limited to the WebDAV protocol. Minimizing the number of available methods to the web client reduces risk by limiting the capabilities allowed by the web server. </rationale> - +   </Rule> @@ -647,7 +647,7 @@ Install the <tt>mod_ssl</tt> module: content is transmitted in plain text which could be passively monitored and accessed by unauthorized parties. </rationale> - + <oval id="package_mod_ssl_installed" />  </Rule> @@ -678,7 +678,7 @@ Install the <tt>security</tt> module: enabling the administrator to implement content access policies and filters at the application layer. </rationale> - + <oval id="package_mod_security_installed" />  </Rule> @@ -771,7 +771,7 @@ This is its default setting. Access to the web server's log files may allow an unauthorized user or attacker to access information about the web server or alter the server's log files. </rationale> -<ident cce="4574-0" /> +<ident cce="27150-2" /> <oval id="dir_perms_var_log_httpd" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -786,7 +786,7 @@ Set permissions on the web server configuration directory to 750: Access to the web server's configuration files may allow an unauthorized user or attacker to access information about the web server or alter the server's configuration files. </rationale> - + <oval id="dir_perms_etc_httpd_conf" />  </Rule> @@ -801,7 +801,7 @@ Set permissions on the web server configuration files to 640: Access to the web server's configuration files may allow an unauthorized user or attacker to access information about the web server or to alter the server's configuration files. </rationale> -<ident cce="4386-9" /> +<ident cce="27099-1" /> <oval id="file_permissions_httpd_server_conf_files" /> <ref nist="CM-6, CM-7" /> </Rule> diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml index 0e7b6f6..ea75dd0 100644 --- a/RHEL6/input/services/imap.xml +++ b/RHEL6/input/services/imap.xml @@ -24,7 +24,7 @@ POP3 server, the dovecot software should be disabled and removed. Running an IMAP or POP3 server provides a network-based avenue of attack, and should be disabled if not needed. </rationale> -<ident cce="3847-1" /> +<ident cce="26922-5" /> <oval id="service_dovecot_disabled" /> </Rule> @@ -41,7 +41,7 @@ with the following command. If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation. </rationale> -<ident cce="4239-0" /> +<ident cce="27039-7" /> <oval id="package_dovecot_removed" /> </Rule> @@ -74,10 +74,10 @@ client to use the STARTTLS command before authenticating. Configuring Dovecot to only support the protocols the protocols needed by your site reduces the risk of an attacker using one of the unused protocols to base an attack.</rationale> -<ident cce="4384-4" /> -<ident cce="3887-7" /> -<ident cce="4530-2" /> -<ident cce="4547-6" /> +<ident cce="27097-5" /> +<ident cce="26933-2" /> +<ident cce="27135-3" /> +<ident cce="27140-3" />  </Rule> @@ -106,7 +106,7 @@ protecting user credentials, mail as it is downloaded, and clients may use SSL certificates to authenticate the server, preventing another system from impersonating the server. </rationale> - + <oval id="dovecot_enable_ssl" /> </Rule> @@ -163,7 +163,7 @@ or correct the following line. Using plain text authentication to the mail server could allow an attacker access to credentials by monitoring network traffic. </rationale> -<ident cce="4552-6" /> +<ident cce="27144-5" /> <oval id="dovecot_disable_plaintext_auth" /> </Rule> diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml index 5295cdb..4f2d047 100644 --- a/RHEL6/input/services/ldap.xml +++ b/RHEL6/input/services/ldap.xml @@ -40,7 +40,7 @@ To ensure LDAP is configured to use TLS for all transactions, run the following not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL.</rationale> <ref disa="776,778,1453" /> -<ident cce="14894-0" /> +<ident cce="26690-8" /> <oval id="ldap_client_start_tls" /> <tested by="DS" on="20121024"/> </Rule> @@ -65,7 +65,7 @@ tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA.</rationale> <ref disa="776,778,1453" /> -<ident cce="14894-0" /> +<ident cce="27189-0" /> <oval id="ldap_client_tls_cacertpath" /> <tested by="DS" on="20121024"/> </Rule> @@ -99,7 +99,7 @@ The output should show the following. <pre>package openldap-servers is not installed</pre> </ocil> <rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale> -<ident cce="3501-4" /> +<ident cce="26858-1" /> <oval id="package_openldap-servers_removed" /> <ref nist="CM-6, CM-7" disa="366"/> <tested by="DS" on="20121024"/> @@ -118,7 +118,7 @@ where dc=example,dc=com is the same root you will use on the LDAP clients. These are basic LDAP configuration directives. The suffix parameter gives the root name of all information served by this LDAP server, and should be some name related to your domain. The rootdn parameter names LDAP's privileged user, who is allowed to read or write all data managed by this LDAP server. </description> -<ident cce="3501-4" /> +<ident cce="27191-6" /> <oval id="ldap_server_config_olcsuffix" /> <ref nist="AC-2, CM-7" /> </Rule> @@ -191,18 +191,18 @@ that certificate is encrypted, and to the public certificate file belonging to t for the key to be protected further, so that processes running as ldap could not read it. If this were done, the LDAP server process would need to be restarted manually whenever the server rebooted. </description> -<ident cce="4360-4" /> -<ident cce="4378-6" /> -<ident cce="4492-5" /> -<ident cce="4263-0" /> -<ident cce="3502-2" /> -<ident cce="4449-5" /> -<ident cce="4361-2" /> -<ident cce="4427-1" /> -<ident cce="4321-6" /> -<ident cce="4339-8" /> -<ident cce="4105-3" /> -<ident cce="3718-4" /> +<ident cce="27082-7" /> +<ident cce="27096-7" /> +<ident cce="27129-6" /> +<ident cce="27051-2" /> +<ident cce="26859-9" /> +<ident cce="27116-3" /> +<ident cce="27083-5" /> +<ident cce="27111-4" /> +<ident cce="27068-6" /> +<ident cce="27076-9" /> +<ident cce="26989-4" /> +<ident cce="26895-3" /> <oval id="ldap_server_config_certificate_files" /> <ref nist="AC-6, CM-7, SC-11, SC-12, SC-13, SC-17" /> </Rule> @@ -354,8 +354,8 @@ be able to change data without an explicit access statement. Some manual methods of inserting information into the LDAP database may leave these files with incorrect permissions. This will prevent slapd from starting correctly. </description> -<ident cce="4484-2" /> -<ident cce="4502-1" /> +<ident cce="27125-4" /> +<ident cce="27131-2" /> <oval id="ldap_server_config_directory_file_security" /> <ref nist="AC-6, CM-7" /> </Rule> diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml index b0f2bb8..2e2fe35 100644 --- a/RHEL6/input/services/mail.xml +++ b/RHEL6/input/services/mail.xml @@ -36,7 +36,7 @@ recommended to leave this service enabled for local mail delivery. <rationale>Local mail delivery is essential to some system maintenance and notification tasks. </rationale> -<ident cce="14068-1" /> +<ident cce="26325-1" /> <oval id="service_postfix_enabled" /> <ref nist="CM-6" /> <tested by="DS" on="20121024"/> @@ -84,7 +84,7 @@ This ensures <tt>postfix</tt> accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack. </rationale> -<ident cce="15018-5" /> +<ident cce="26780-7" /> <oval id="postfix_network_listening_disabled" /> <ref nist="CM-7" disa="382"/> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml index c67abd0..f21d309 100644 --- a/RHEL6/input/services/nfs.xml +++ b/RHEL6/input/services/nfs.xml @@ -37,7 +37,7 @@ server. If the local machine is not configured to mount NFS filesystems then this service should be disabled. <service-disable-macro service="nfslock" /> </description> -<ident cce="4396-8" /> +<ident cce="27104-9" /> <oval id="service_nfslock_disabled" /> </Rule> @@ -50,7 +50,7 @@ client-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. <service-disable-macro service="rpcgssd" /> </description> -<ident cce="3535-2" /> +<ident cce="26864-9" /> <oval id="service_rpcgssd_disabled" /> </Rule> @@ -61,7 +61,7 @@ and GID numbers on NFSv4 mounts. If NFS is not in use on the local system then this service should be disabled. <service-disable-macro service="rpcidmapd" /> </description> -<ident cce="3568-3" /> +<ident cce="26870-6" /> <oval id="service_rpcidmapd_disabled" /> </Rule> </Group> @@ -82,7 +82,7 @@ system somewhat against accidental or malicious changes to <tt>/etc/fstab</tt> and against flaws in the netfs script itself. <service-disable-macro service="netfs" /> </description> -<ident cce="4533-6" /> +<ident cce="27137-9" /> <oval id="service_netfs_disabled" /> </Rule> </Group> @@ -212,7 +212,7 @@ your network. Restrict service to always use a given port, so that firewalling can be done effectively. </rationale> -<ident cce="4559-1" /> +<ident cce="27149-4" /> <oval id="nfs_fixed_lockd_tcp_port" /> </Rule> @@ -229,7 +229,7 @@ your network. <rationale> Restrict service to always use a given port, so that firewalling can be done effectively. </rationale> -<ident cce="4310-9" /> +<ident cce="27063-7" /> <oval id="nfs_fixed_lockd_udp_port" /> </Rule> @@ -244,7 +244,7 @@ Where <tt>statd-port</tt> is a port which is not used by any other service on yo <rationale> Restrict service to always use a given port, so that firewalling can be done effectively. </rationale> -<ident cce="3667-3" /> +<ident cce="26889-6" /> <oval id="nfs_fixed_statd_port" /> </Rule> @@ -259,7 +259,7 @@ Where <tt>mountd-port</tt> is a port which is not used by any other service on y <rationale> Restrict service to always use a given port, so that firewalling can be done effectively. </rationale> -<ident cce="4438-8" /> +<ident cce="27114-8" /> <oval id="nfs_fixed_mountd_port" /> </Rule> @@ -300,7 +300,7 @@ If properly configured, the output should look like: <pre>nfs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre> </ocil> <rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale> -<ident cce="4473-5" /> +<ident cce="27199-9" /> <oval id="service_nfs_disabled" /> <tested by="DS" on="20121025"/> </Rule> @@ -317,8 +317,8 @@ RPC then this service should be disabled. <service-disable-check-macro service="rpcsvcgssd" /> </ocil> <rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale> -<ident cce="4473-5" /> -<ident cce="4491-7" /> +<ident cce="27122-1" /> +<ident cce="27128-8" /> <oval id="service_rpcsvcgssd_disabled" /> <tested by="DS" on="20121025"/> </Rule> @@ -350,7 +350,7 @@ All NFS mounts should show the <tt>nodev</tt> setting in parentheses. </ocil> <rationale>Legitimate device files should only exist in the /dev directory. NFS mounts should not present device files to users.</rationale> -<ident cce="4368-7" /> +<ident cce="27090-0" /> <oval id="mount_option_nodev_remote_filesystems" /> <tested by="DS" on="20121025"/> </Rule> @@ -367,7 +367,7 @@ All NFS mounts should show the <tt>nosuid</tt> setting in parentheses. </ocil> <rationale>NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem.</rationale> -<ident cce="4024-6" /> +<ident cce="26972-0" /> <oval id="mount_option_nosuid_remote_filesystems" /> <tested by="DS" on="20121025"/> </Rule> @@ -450,7 +450,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>no_root_squ </description> <rationale>If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system.</rationale> -<ident cce="4544-3" /> +<ident cce="27138-7" /> <oval id="TO:DO" /> </Rule> @@ -466,7 +466,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure</t <rationale>Allowing client requests to be made from ports higher than 1024 could allow a unprivileged user to initiate an NFS connection. If the unprivileged user account has been compromised, an attacker could gain access to data on the NFS server.</rationale> -<ident cce="4465-1" /> +<ident cce="27121-3" /> <oval id="TO:DO" /> </Rule> @@ -490,7 +490,7 @@ To verify insecure file locking has been disabled, run the following command. <rationale>Allowing insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user. </rationale> -<ident cce="TO:DO" /> +<ident cce="27167-6" /> <oval id="TO:DO" /> <ref disa="764" /> </Rule> diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml index 606ad67..3ab4f58 100644 --- a/RHEL6/input/services/ntp.xml +++ b/RHEL6/input/services/ntp.xml @@ -45,7 +45,7 @@ a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.</rationale> -<ident cce="4376-0" /> +<ident cce="27093-4" /> <oval id="service_ntpd_enabled" /> <ref disa="160" /> <tested by="DS" on="20121024"/> @@ -72,7 +72,7 @@ server ntpserver</pre> to collate system logs from multiple sources or correlate computer events with real time events. Using a trusted NTP server provided by your organization is recommended.</rationale> -<ident cce="4385-1" /> +<ident cce="27098-3" /> <oval id="ntp_remote_server" /> <ref disa="160" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index c7b4431..3ed4dcc 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -36,7 +36,7 @@ which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself. </rationale> -<ident cce="4252-3" /> +<ident cce="27046-2" /> <oval id="service_xinetd_disabled" /> <ref disa="305"/> <tested by="DS" on="20121026"/> @@ -52,7 +52,7 @@ attacks against xinetd itself. Removing the <tt>xinetd</tt> package decreases the risk of the xinetd service's accidental (or intentional) activation. </rationale> -<ident cce="4164-0" /> +<ident cce="27005-8" /> <oval id="package_xinetd_removed" /> <ref disa="305"/> <tested by="DS" on="20121026"/> @@ -79,7 +79,7 @@ all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks. </rationale> -<ident cce="3390-2" /> +<ident cce="26836-7" /> <oval id="service_telnetd_disabled" /> <ref disa="68,1436,197,877,888" /> <tested by="DS" on="20121026"/> @@ -95,7 +95,7 @@ the following command: Removing the <tt>telnet-server</tt> package decreases the risk of the telnet service's accidental (or intentional) activation. </rationale> -<ident cce="4330-7" /> +<ident cce="27073-6" /> <oval id="package_telnet-server_removed" /> <ref disa="305,381"/> <tested by="DS" on="20121026"/> @@ -122,7 +122,7 @@ network services. Removing it decreases the risk of those services' accidental (or intentional) activation. </rationale> -<ident cce="4308-3" /> +<ident cce="27062-9" /> <oval id="package_rsh-server_removed" /> <ref disa="305,381"/> <tested by="DS" on="20121026"/> @@ -141,7 +141,7 @@ means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. </rationale> -<ident cce="undefined" /> +<ident cce="27208-8" /> <oval id="service_rexec_disabled" /> <ref disa="68,1436"/> <tested by="DS" on="20121026"/> @@ -160,7 +160,7 @@ means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. </rationale> -<ident cce="4141-8" /> +<ident cce="26994-4" /> <oval id="service_rsh_disabled" /> <ref disa="68,1436" /> <tested by="DS" on="20121026"/> @@ -179,7 +179,7 @@ means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. </rationale> -<ident cce="3537-8" /> +<ident cce="26865-6" /> <oval id="service_rlogin_disabled" /> <ref disa="1436" /> <tested by="DS" on="20121026"/> @@ -228,7 +228,7 @@ the following command: <rationale>Removing the <tt>ypserv</tt> package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services. </rationale> -<ident cce="4348-9" /> +<ident cce="27079-3" /> <oval id="package_ypserv_removed" /> <ref disa="305,381"/> <tested by="DS" on="20121026"/> @@ -245,7 +245,7 @@ a NIS or NIS+ domain, should be disabled. Disabling the <tt>ypbind</tt> service ensures the system is not acting as a client in a NIS or NIS+ domain. </rationale> -<ident cce="3705-1" /> +<ident cce="26894-6" /> <oval id="service_ypbind_disabled" /> <ref disa="305"/> <tested by="DS" on="20121026"/> @@ -273,7 +273,7 @@ found.</description> Disabling the <tt>tftp</tt> service ensures the system is not acting as a tftp server, which does not provide encryption or authentication. </rationale> -<ident cce="4273-9" /> +<ident cce="27055-3" /> <oval id="service_tftp_disabled" /> <ref disa="1436" /> <tested by="DS" on="20121026"/> @@ -291,7 +291,7 @@ as a tftp server, which does not provide encryption or authentication. Removing the <tt>tftp-server</tt> package decreases the risk of the accidental (or intentional) activation of tftp services. </rationale> -<ident cce="3916-4" /> +<ident cce="26946-4" /> <oval id="package_tftp-server_removed" /> <ref disa="305"/> <tested by="DS" on="20121026"/> diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml index 2247dfc..21e1339 100644 --- a/RHEL6/input/services/printing.xml +++ b/RHEL6/input/services/printing.xml @@ -16,7 +16,7 @@ homepage and more detailed documentation are available at http://www.cups.org. <ocil><service-disable-check-macro service="cups" /></ocil> <rationale>Turn off unneeded services to reduce attack surface. </rationale> -<ident cce="3755-6" /> +<ident cce="26899-5" /> <oval id="service_cups_disabled" /> <ref nist="CM-7" /> </Rule> @@ -32,7 +32,7 @@ homepage and more detailed documentation are available at http://www.cups.org. port are not allowed. If the print server does need to be accessed this exception should be added to the firewall configuration. </rationale> -<ident cce="3649-1" /> +<ident cce="26884-7" />  <ref nist="CM-7" /> </Rule> @@ -57,7 +57,7 @@ the CUPS print service, can be configured to listen to these broadcasts and add and configure these printers for immediate use. By disabling this browsing capability, the machine will no longer generate or receive such broadcasts. </rationale> -<ident cce="4420-6" /> +<ident cce="27108-0" /> <oval id="cups_disable_browsing" /> </Rule> @@ -80,7 +80,7 @@ broadcasts, or remote users will still be able to see the locally configured printers, even if they cannot actually print to them. To limit print serving to a particular set of users, use the Policy directive. </rationale> -<ident cce="4407-3" /> +<ident cce="27107-2" /> <oval id="cups_disable_printserver" /> <ref nist="TODO:NIST" /> </Rule> diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml index 60bfe54..c844e8b 100644 --- a/RHEL6/input/services/smb.xml +++ b/RHEL6/input/services/smb.xml @@ -32,7 +32,7 @@ sharing functionality. Running a Samba server provides a network-based avenue of attack, and should be disabled if not needed. </rationale> -<ident cce="4551-8" /> +<ident cce="27143-7" /> <oval id="service_smb_disabled" /> <ref disa="1436" /> </Rule> @@ -201,7 +201,7 @@ Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit. </rationale> -<ident cce="14075-6" /> +<ident cce="26328-5" /> <oval id="smb_client_signing_smb_conf" /> </Rule> @@ -226,7 +226,7 @@ The output should show either <tt>krb5i</tt> or <tt>ntlmv2i</tt> in use. Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit. </rationale> -<ident cce="15029-2" /> +<ident cce="26792-2" /> <oval id="mount_option_smb_client_signing" /> </Rule> diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml index df8b2cf..567abe3 100644 --- a/RHEL6/input/services/snmp.xml +++ b/RHEL6/input/services/snmp.xml @@ -26,7 +26,7 @@ installed and activated, the software should be disabled and removed. Running SNMP software provides a network-based avenue of attack, and should be disabled if not needed. </rationale> -<ident cce="3765-5" /> +<ident cce="26906-8" /> <oval id="service_snmpd_disabled" /> </Rule> @@ -43,7 +43,7 @@ If there is no need to run SNMP server software, removing the package provides a safeguard against its activation. </rationale> -<ident cce="14081-4" /> +<ident cce="26332-7" /> <oval id="package_net-snmp_removed" /> </Rule> @@ -66,7 +66,7 @@ stations</li> <li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li> <li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul> </description> - +  <Rule id="snmpd_use_newer_protocol" severity="medium"> diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml index 7aa01cb..388c0e9 100644 --- a/RHEL6/input/services/squid.xml +++ b/RHEL6/input/services/squid.xml @@ -27,7 +27,7 @@ and removed. Running proxy server software provides a network-based avenue of attack, and should be removed if not needed. </rationale> -<ident cce="4556-7" /> +<ident cce="27146-0" /> <oval id="service_squid_disabled" /> </Rule> @@ -43,7 +43,7 @@ of attack, and should be removed if not needed. If there is no need to make the proxy server software available, removing it provides a safeguard against its activation. </rationale> -<ident cce="4076-6" /> +<ident cce="26977-9" /> <oval id="package_squid_removed" /> </Rule> </Group> diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 30890b3..4851b82 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -26,7 +26,7 @@ However, if it can be disabled, do so. This is unusual, as SSH is a common method for encrypted and authenticated remote access. </description> -<ident cce="4268-9" /> +<ident cce="27054-6" /> <oval id="service_sshd_disabled" /> <tested by="DS" on="20121024"/> </Rule> @@ -47,7 +47,7 @@ remote access. If inbound SSH connections are not expected, disallowing access to the SSH port will avoid possible exploitation of the port by an attacker. </rationale> -<ident cce="4295-2" /> +<ident cce="27060-3" /> <oval id="iptables_sshd_disabled" /> </Rule> @@ -78,7 +78,7 @@ SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. </rationale> -<ident cce="4325-7" /> +<ident cce="27072-8" /> <oval id="sshd_protocol_2" /> <ref disa="776,774,1436" /> <tested by="DS" on="20121024"/> @@ -97,7 +97,7 @@ Where <tt>USER1</tt> and <tt>USER2</tt> are valid user names. Specifying which accounts are allowed SSH access into the system reduces the possibility of unauthorized access to the system. </rationale> - +  </Rule> @@ -167,7 +167,7 @@ Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another. </rationale> -<ident cce="3845-5" /> +<ident cce="26919-1" /> <oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/> <ref disa="879,1133"/> <tested by="DS" on="20121024"/> @@ -191,7 +191,7 @@ If properly configured, output should be: This ensures a user login will be terminated as soon as the <tt>ClientAliveCountMax</tt> is reached. </rationale> -<ident cce="14061-6" /> +<ident cce="26282-4" /> <oval id="sshd_clientalivecountmax" /> <ref disa="879,1133"/> <tested by="DS" on="20121024"/> @@ -215,7 +215,7 @@ following line in <tt>/etc/ssh/sshd_config</tt>: SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. </rationale> -<ident cce="4475-0" /> +<ident cce="27124-7" /> <oval id="sshd_rsh_emulation_disabled" /> <ref disa="765,766"/> </Rule> @@ -240,7 +240,7 @@ following line: SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. </rationale> -<ident cce="4370-3" /> +<ident cce="27091-8" /> <oval id="sshd_hostbasedauthentication" /> <ref disa="765,766"/> <tested by="DS" on="20121024"/> @@ -262,7 +262,7 @@ Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password. </rationale> -<ident cce="4387-7" /> +<ident cce="27100-7" /> <oval id="sshd_permitrootlogin_no" /> <ref disa="770" /> <tested by="DS" on="20121024"/> @@ -285,7 +285,7 @@ Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere. </rationale> -<ident cce="3660-8" /> +<ident cce="26887-0" /> <oval id="sshd_permitemptypasswords_no" /> <ref disa="765,766"/> <tested by="DS" on="20121024"/> @@ -309,7 +309,7 @@ reinforces policy awareness during the logon process. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. </rationale> -<ident cce="4431-3" /> +<ident cce="27112-2" /> <oval id="sshd_banner_set" /> <ref disa="48" /> <tested by="DS" on="20121024"/> @@ -333,7 +333,7 @@ If properly configured, output should be: SSH environment options potentially allow users to bypass access restriction in some configurations. </rationale> -<ident cce="4422-2" /> +<ident cce="27201-3" /> <oval id="sshd_no_user_envset" /> <ref disa="1414" /> <tested by="DS" on="20121024"/> @@ -358,7 +358,7 @@ The output should contain only those ciphers which are FIPS-approved. Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance. </rationale> -<ident cce="14491-5" /> +<ident cce="26555-3" /> <oval id="sshd_use_approved_ciphers" /> <ref disa="803,1144,1145,1146" /> <tested by="DS" on="20121024"/> @@ -382,7 +382,7 @@ and replace it with: <rationale> Restricting SSH access to only trusted network segments reduces exposure of the SSH server to attacks from unauthorized networks.</rationale> - +  </Group> diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml index 7ee53e8..c2dbbe1 100644 --- a/RHEL6/input/services/xorg.xml +++ b/RHEL6/input/services/xorg.xml @@ -27,7 +27,7 @@ The output should show the following: <pre>id:3:initdefault:</pre> </ocil> <rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale> -<ident cce="4462-8" /> +<ident cce="27119-7" /> <oval id="xwindows_runlevel_setting" /> <ref disa="366" /> <tested by="DS" on="20121025"/> @@ -48,7 +48,7 @@ The output should be: <pre>package xorg-x11-server-common is not installed</pre> </ocil> <rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale> -<ident cce="4422-2" /> +<ident cce="27198-1" /> <oval id="package_xorg-x11-server-common_removed" /> <ref disa="366" /> <tested by="DS" on="20121025"/> diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index 782cfb4..6464c4d 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -77,7 +77,7 @@ run the following command: Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. </rationale> -<ident cce="4060-0" /> +<ident cce="26974-6" /> <oval id="banner_etc_issue" value="login_banner_text"/> <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> <tested by="DS" on="20121026"/> @@ -114,7 +114,7 @@ If properly configured, the <tt>default</tt> value should be <tt>true</tt>. Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. </rationale> -<ident cce="4188-9" /> +<ident cce="27195-7" /> <oval id="banner_gui_enabled" /> <ref nist="AC-3, CM-6, AC-8" disa="48,50" /> </Rule> @@ -142,7 +142,7 @@ If properly configured, the proper banner text will appear within this schema. Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. </rationale> -<ident cce="4188-9" /> +<ident cce="27017-3" /> <oval id="banner_gui_text_set" value="login_banner_text" /> <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> </Rule> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 95b21c1..3e893a9 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -195,7 +195,7 @@ requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module. </rationale> -<ident cce="15054-0" /> +<ident cce="26795-5" /> <oval id="accounts_password_pam_cracklib_retry" value="var_password_pam_cracklib_retry"/> <ref nist="IA-5" disa="1092" /> <tested by="DS" on="20121024"/> @@ -238,7 +238,7 @@ This would appear as <tt>dcredit=-1</tt>. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. </rationale> -<ident cce="14113-5" /> +<ident cce="26374-9" /> <oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/> <ref nist="IA-5,194" disa="194"/> <tested by="DS" on="20121024"/> @@ -263,7 +263,7 @@ This would appear as <tt>ucredit=-1</tt>. Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space. </rationale> -<ident cce="14672-0" /> +<ident cce="26601-5" /> <oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/> <ref nist="IA-5" disa="192" /> <tested by="DS" on="20121024"/> @@ -288,7 +288,7 @@ This would appear as <tt>ocredit=-1</tt>. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space. </rationale> -<ident cce="14122-6" /> +<ident cce="26409-3" /> <oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/> <ref nist="IA-5" disa="1619" /> <tested by="DS" on="20121024"/> @@ -313,7 +313,7 @@ This would appear as <tt>lcredit=-1</tt>. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space. </rationale> -<ident cce="14712-4" /> +<ident cce="26631-2" /> <oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/> <ref nist="IA-5" disa="193" /> <tested by="DS" on="20121024"/> @@ -339,7 +339,7 @@ Requiring a minimum number of different characters during password changes ensur newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. </rationale> -<ident cce="14701-7" /> +<ident cce="26615-5" /> <oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/> <ref nist="IA-5" disa="195"/> <tested by="DS" on="20121024"/> @@ -386,7 +386,7 @@ The output should show <tt>deny=3</tt>. Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. </rationale> -<ident cce="3410-8" /> +<ident cce="26844-1" /> <oval id="accounts_passwords_pam_faillock_deny" value="var_accounts_passwords_pam_faillock_deny"/> <ref nist="AC-7, CM-6" disa="1452,44,47" /> </Rule> @@ -408,7 +408,7 @@ The output should show the following at the end of the line: <rationale> Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. </rationale> -<ident cce="14939-3" /> +<ident cce="26741-9" /> <oval id="accounts_password_reuse_limit" value="password_history_retain_number" /> <ref nist="IA-5" disa="200" /> <tested by="DS" on="20121024"/> @@ -442,7 +442,7 @@ ensure that the <tt>pam_unix.so</tt> module includes the argument <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> - +  <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> @@ -462,7 +462,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following line appears: <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> - +  <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> @@ -484,7 +484,7 @@ in the <tt>[default]</tt> section: <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> - +  <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121026"/> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 05f54e7..e914c6a 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -33,7 +33,7 @@ or modification of the file. <rationale> Only root should be able to modify important boot parameters. </rationale> -<ident cce="4144-2" /> +<ident cce="26995-1" /> <oval id="file_user_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -51,7 +51,7 @@ destruction or modification of the file. The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. </rationale> -<ident cce="4197-0" /> +<ident cce="27022-3" /> <oval id="file_group_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -68,7 +68,7 @@ is the default. Proper permissions ensure that only the root user can modify important boot parameters. </rationale> -<ident cce="3923-0" /> +<ident cce="26949-8" /> <oval id="file_permissions_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -97,7 +97,7 @@ users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. </rationale> -<ident cce="3818-2" /> +<ident cce="26911-8" /> <oval id="bootloader_password" /> <ref nist="CM-7, IA-5, AC-3" disa="213" /> <tested by="DS" on="20121026"/> @@ -128,7 +128,7 @@ This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password. </rationale> -<ident cce="4241-6" /> +<ident cce="27040-5" /> <oval id="singleuser_password" /> <ref nist="AC-6, IA-5" disa="213" /> <tested by="DS" on="20121024"/> @@ -185,7 +185,7 @@ Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security. </rationale> -<ident cce="4245-7" /> +<ident cce="27043-9" /> <oval id="interactive_boot_disable" /> <ref nist="CM-7, IA-4, SC-2" disa="213"/> <tested by="DS" on="20121024"/> @@ -263,7 +263,7 @@ Setting the idle delay controls when the screensaver will start, and can be combined with screen locking to prevent access from passersby. </rationale> -<ident cce="3315-9" /> +<ident cce="26828-4" /> <oval id="gconf_gnome_screensaver_idle_delay" value="inactivity_timeout_value" /> <ref nist="AC-3, CM-6, CM-7, AC-11" disa="57"/> </Rule> @@ -289,7 +289,7 @@ real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area. </rationale> -<ident cce="14604-3" /> +<ident cce="26600-7" /> <oval id="gconf_gnome_screensaver_idle_activation_enabled" /> <ref nist="CM-6, CM-7" disa="57" /> </Rule> @@ -314,7 +314,7 @@ Enabling the activation of the screen lock after an idle period ensures password entry will be required in order to access the system, preventing access by passersby. </rationale> -<ident cce="14023-6" /> +<ident cce="26235-2" /> <oval id="gconf_gnome_screensaver_lock_enabled" /> <ref nist="AC-3, CM-6, CM-7, AC-11" disa="57" /> </Rule> @@ -339,7 +339,7 @@ If properly configured, the output should be <tt>blank-only</tt> Setting the screensaver mode to blank-only conceals the contents of the display from passersby. </rationale> -<ident cce="14735-5" /> +<ident cce="26638-7" /> <oval id="gconf_gnome_screensaver_mode_blank" /> <ref nist="CM-6, CM-7" disa="60" /> </Rule> @@ -371,7 +371,7 @@ The console can now be locked with the following key combination: Installing <tt>screen</tt> ensures a console locking capability is available for users who may need to suspend console logins. </rationale> -<ident cce="3910-7" /> +<ident cce="26940-7" /> <ref nist="CM-6, CM-7" disa="58" /> <tested by="DS" on="20121026"/> </Rule> diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index a4e3873..fd26a64 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -101,7 +101,7 @@ search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. </rationale> -<ident cce="4154-1" /> +<ident cce="27002-5" /> <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/> <tested by="DS" on="20121026"/> @@ -128,7 +128,7 @@ Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement. </rationale> -<ident cce="4180-6" /> +<ident cce="27013-2" /> <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/> <ref nist="CM-6, IA-5" disa="198"/> <tested by="DS" on="20121026"/> @@ -156,7 +156,7 @@ periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.</rationale> -<ident cce="4092-3" /> +<ident cce="26985-2" /> <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180,199" /> <tested by="DS" on="20121026"/> @@ -182,7 +182,7 @@ The DoD requirement is 7. Setting the password warning age enables users to make the change at a practical time. </rationale> -<ident cce="4097-2" /> +<ident cce="26988-6" /> <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" /> <ref nist="CM-6, CM-7, IA-5, AC-3" /> <tested by="DS" on="20121026"/> diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 8222f67..21de2d2 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -36,7 +36,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments. </rationale> -<ident cce="4238-2" /> +<ident cce="27038-9" /> <oval id="accounts_pam_no_nullok" /> <ref nist="AC-3, CM-6, IA-5" /> <tested by="DS" on="20121024"/> @@ -62,7 +62,7 @@ The hashes for all user account passwords should be stored in the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>, which is readable by all users. </rationale> -<ident cce="14300-8" /> +<ident cce="26476-2" /> <oval id="accounts_password_all_shadowed" /> <ref nist="IA-5" disa="201" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index 2d1ea24..35bac20 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -57,7 +57,7 @@ Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account. </rationale> -<ident cce="3485-0" /> +<ident cce="26855-7" /> <oval id="securetty_root_login_console_only" /> <ref nist="CM-6, CM-7" disa="770" /> <tested by="DS" on="20121024"/> @@ -82,7 +82,7 @@ Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account. </rationale> -<ident cce="4256-4" /> +<ident cce="27047-0" /> <oval id="securetty_no_serial" /> <ref nist="AC-3, AC-6" disa="770" /> <tested by="DS" on="20121024"/> @@ -139,7 +139,7 @@ Do not perform the steps in this section on the root account. Doing so might cause the system to become inaccessible. </warning> -<ident cce="3987-5" /> +<ident cce="26966-2" /> <oval id="accounts_nologin_for_system" /> <ref nist="AC-3, CM-6" disa="178" /> <tested by="DS" on="20121024"/> @@ -165,7 +165,7 @@ guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner. </rationale> -<ident cce="4009-7" /> +<ident cce="26971-2" /> <oval id="accounts_no_uid_except_zero" /> <ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml index 09409b8..1958bb7 100644 --- a/RHEL6/input/system/accounts/session.xml +++ b/RHEL6/input/system/accounts/session.xml @@ -87,7 +87,7 @@ These empty elements have the same effect as a single <tt>.</tt> character. Including these entries increases the risk that root could execute code from an untrusted location. </rationale> -<ident cce="3301-9" /> +<ident cce="26826-8" /> <oval id="accounts_dangerous_path_for_root" /> <ref nist="CM6, CM-7"/> </Rule> @@ -110,7 +110,7 @@ Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code. </rationale> -<ident cce="14957-5" /> +<ident cce="26768-2" /> <oval id="accounts_root_path_dirs_no_write" /> <ref nist="CM6, CM-7"/> </Rule> @@ -145,7 +145,7 @@ to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs. </rationale> -<ident cce="4090-7" /> +<ident cce="26981-1" /> <oval id="file_permissions_home_dirs" /> <ref nist="AC-3, CM-6"/> </Rule> @@ -225,7 +225,7 @@ umask 077 umask 077</pre> </ocil> -<ident cce="3844-8" /> +<ident cce="26917-5" /> <oval id="accounts_umask_bash_users" value="umask_user_value"/> <ref nist="CM-6, CM-7" disa="366"/> <tested by="swells" on="20120929"/> @@ -249,7 +249,7 @@ All output must show the value of <tt>umask</tt> set to 077, as shown in the bel <pre># grep "umask" /etc/csh.cshrc umask 077</pre> </ocil> -<ident cce="4227-5" /> +<ident cce="27034-8" /> <oval id="accounts_umask_csh" value="umask_user_value"/> <ref nist="CM-6, CM-7" disa="366"/> <tested by="swells" on="20120929"/> @@ -265,7 +265,7 @@ add or correct the <tt>umask</tt> setting in <tt>/etc/profile</tt> to read as fo <rationale>The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and/or written to by unauthorized users.</rationale> -<ident cce="14847-8" /> +<ident cce="26669-2" /> <ocil clause="the above command returns no output, or if the umask is configured incorrectly"> Verify the <tt>umask</tt> setting is configured correctly in the <tt>/etc/profile</tt> file by running the following command: @@ -297,7 +297,7 @@ All output must show the value of <tt>umask</tt> set to 077, as shown in the bel <pre># grep "umask" /etc/login.defs umask 077</pre> </ocil> -<ident cce="14107-7" /> +<ident cce="26371-5" /> <oval id="accounts_umask_login_defs" value="umask_user_value" /> <ref nist="CM-6, CM-7" disa="366"/> <tested by="swells" on="20120929" /> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index f823a89..f5e617a 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -91,7 +91,7 @@ disk. audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist. </rationale> -<ident cce="4292-9" /> +<ident cce="27058-7" /> <oval id="service_auditd_enabled" /> <ref nist="CM-6, CM-7" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> <tested by="DS" on="20121024"/> @@ -116,7 +116,7 @@ takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot. </rationale> -<ident cce="15026-8" /> +<ident cce="26785-6" /> <oval id="bootloader_audit_argument" /> <ref nist="AU-2" disa="1464,130" /> </Rule> @@ -489,7 +489,7 @@ desired, but is not required. See an example of multiple combined syscalls: nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> -<ident cce="14051-7" /> +<ident cce="26242-8" /> <oval id="audit_rules_time_adjtimex" /> <ref nist="AU-2(a)" /> <ref disa="1487,169" /> @@ -517,7 +517,7 @@ desired, but is not required. See an example of multiple combined syscalls: nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> -<ident cce="14051-7" /> +<ident cce="27203-9" /> <oval id="audit_rules_time_settimeofday" /> <ref nist="AU-2(a)" /> <ref disa="1487,169" /> @@ -543,7 +543,7 @@ See an example of multiple combined syscalls: nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> -<ident cce="14051-7" /> +<ident cce="27169-2" /> <oval id="audit_rules_time_stime" /> <ref nist="AU-2(a)" /> <ref disa="1487,169" /> @@ -571,7 +571,7 @@ desired, but is not required. See an example of multiple combined syscalls: nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> -<ident cce="14051-7" /> +<ident cce="27170-0" /> <oval id="audit_rules_time_clock_settime" /> <ref nist="AU-2(a)" /> <ref disa="1487,169" /> @@ -596,7 +596,7 @@ If the system is configured to audit this activity, it will return a line. nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> -<ident cce="14051-7" /> +<ident cce="27172-6" /> <oval id="audit_rules_time_watch_localtime" /> <ref nist="AU-2(a)" /> <ref disa="1487,169" /> @@ -625,7 +625,7 @@ each file specified (and with <tt>perm=wa</tt> for each). will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.</rationale> -<ident cce="14829-6" /> +<ident cce="26664-3" /> <oval id="audit_rules_usergroup_modification" /> <ref nist="AU-2(a)" disa="18,1403,1404,1405,1684,1683,1685,1686"/> </Rule> @@ -651,7 +651,7 @@ each file specified (and <tt>perm=wa</tt> should be indicated for each). <rationale>The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.</rationale> -<ident cce="14816-3" /> +<ident cce="26648-6" /> <oval id="audit_rules_networkconfig_modification" /> <ref nist="AU-2(a)" /> </Rule> @@ -706,7 +706,7 @@ configuration, a line should be returned (including <rationale>The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.</rationale> -<ident cce="14821-3" /> +<ident cce="26657-7" /> <oval id="audit_rules_mac_modification" /> <ref nist="AU-2" /> </Rule> @@ -766,7 +766,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="26280-8" /> <oval id="audit_rules_dac_modification_chmod" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -794,7 +794,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27173-4" /> <oval id="audit_rules_dac_modification_chown" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -822,7 +822,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27174-2" /> <oval id="audit_rules_dac_modification_fchmod" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -850,7 +850,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27175-9" /> <oval id="audit_rules_dac_modification_fchmodat" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -878,7 +878,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27177-5" /> <oval id="audit_rules_dac_modification_fchown" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -906,7 +906,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27178-3" /> <oval id="audit_rules_dac_modification_fchownat" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -934,7 +934,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27179-1" /> <oval id="audit_rules_dac_modification_fremovexattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -962,7 +962,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27180-9" /> <oval id="audit_rules_dac_modification_fsetxattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -990,7 +990,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27181-7" /> <oval id="audit_rules_dac_modification_lchown" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1018,7 +1018,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27182-5" /> <oval id="audit_rules_dac_modification_lremovexattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1046,7 +1046,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27183-3" /> <oval id="audit_rules_dac_modification_lsetxattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1074,7 +1074,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27184-1" /> <oval id="audit_rules_dac_modification_removexattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1102,7 +1102,7 @@ number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient. </warning> -<ident cce="14058-2" /> +<ident cce="27185-8" /> <oval id="audit_rules_dac_modification_setxattr" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1119,7 +1119,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi </description> <rationale>Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.</rationale> -<ident cce="14904-7" /> +<ident cce="26691-6" /> <oval id="audit_rules_login_events" />  </Rule> @@ -1136,7 +1136,7 @@ storing such process information, add the following to </description> <rationale>Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.</rationale> -<ident cce="14679-5" /> +<ident cce="26610-6" /> <oval id="audit_rules_session_events" />  </Rule> @@ -1159,7 +1159,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol </ocil> <rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.</rationale> -<ident cce="14917-9" /> +<ident cce="26712-0" /> <oval id="audit_rules_unsuccessful_file_modification" /> <ref nist="AU-2.1 (v),AU-2 d" disa="126" /> </Rule> @@ -1187,7 +1187,7 @@ which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. </rationale> -<ident cce="14296-8" /> +<ident cce="26457-2" /> <oval id="audit_rules_privileged_commands" /> <ref nist="AU-2" disa="40" /> <tested by="DS" on="20121024"/> @@ -1209,7 +1209,7 @@ To verify that auditing is configured for all media exportation events, run the where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.</rationale> -<ident cce="14569-8" /> +<ident cce="26573-6" /> <oval id="audit_rules_media_export" /> <ref nist="AU-2" disa="126"/> <tested by="DS" on="20121024"/> @@ -1233,7 +1233,7 @@ appropriate for your system: <rationale>Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.</rationale> -<ident cce="14820-5" /> +<ident cce="26651-0" /> <oval id="audit_rules_file_deletion_events" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1251,7 +1251,7 @@ To verify that auditing is configured for system administrator actions, run the </ocil> <rationale>The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.</rationale> -<ident cce="14824-7" /> +<ident cce="26662-7" /> <oval id="audit_rules_sysadmin_actions" /> <ref nist="AU-2" disa="126"/> <tested by="DS" on="20121024"/> @@ -1273,7 +1273,7 @@ to capture kernel module loading and unloading events, setting ARCH to either b3 <rationale>The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.</rationale> -<ident cce="14688-6" /> +<ident cce="26611-4" /> <oval id="audit_rules_kernel_module_loading" /> <ref nist="AU-2" disa="126"/> </Rule> @@ -1289,7 +1289,7 @@ audit rules.</description> well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation</rationale> -<ident cce="14692-8" /> +<ident cce="26612-2" /> <oval id="audit_rules_immutable" /> <ref nist="AU-2" /> </Rule> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml index 514859d..9a490eb 100644 --- a/RHEL6/input/system/logging.xml +++ b/RHEL6/input/system/logging.xml @@ -30,7 +30,7 @@ Rsyslog is installed by default. The rsyslog package provides the rsyslog daemon, which provides system logging services. </rationale> -<ident cce="17742-8" /> +<ident cce="26809-4" /> <oval id="package_rsyslog_installed" /> <ref nist="AU-2, AU-9, CM-6" disa="1311,1312"/> <tested by="DS" on="20121024"/> @@ -48,7 +48,7 @@ system logging services. <rationale>The <tt>rsyslog</tt> service must be running in order to provide logging services, which are essential to system administration. </rationale> -<ident cce="17698-2" /> +<ident cce="26807-8" /> <oval id="service_rsyslog_enabled" /> <ref nist="AU-12, CM-6" disa="1557,1312,1311" /> <tested by="DS" on="20121024"/> @@ -111,7 +111,7 @@ permissions: <rationale>If a log file referenced by rsyslog does not exist, rsyslog will not create it and important log messages can be lost. </rationale> -<ident cce="18095-0" /> +<ident cce="26818-5" /> <ref nist="AC-3, CM-6" /> </Rule> @@ -135,7 +135,7 @@ To see the owner of a given log file, run the following command: <rationale>The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.</rationale> -<ident cce="17857-4" /> +<ident cce="26812-8" /> <oval id="rsyslog_files_ownership" /> <ref nist="AC-3, CM-6" disa="1314"/> <tested by="DS" on="20121024"/> @@ -161,7 +161,7 @@ To see the group-owner of a given log file, run the following command: <rationale>The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.</rationale> -<ident cce="18240-2" /> +<ident cce="26821-9" /> <oval id="rsyslog_files_groupownership" /> <ref nist="AC-3, CM-6" disa="1314"/> <tested by="DS" on="20121024"/> @@ -190,7 +190,7 @@ The permissions should be 600, or more restrictive. configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value. </rationale> -<ident cce="18095-0" /> +<ident cce="27190-8" /> <oval id="rsyslog_files_permissions" /> <ref nist="AC-3, CM-6" disa="1314"/> <tested by="DS" on="20121024"/> @@ -260,7 +260,7 @@ system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise. </rationale> -<ident cce="17248-6" /> +<ident cce="26801-1" /> <oval id="rsyslog_remote_loghost" /> <ref nist="AU-2, AU-9" disa="1348, 136" /> </Rule> @@ -296,7 +296,7 @@ Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for rsyslog by configuring it not to listen on the network. </rationale> -<ident cce="17639-6" /> +<ident cce="26803-7" /> <oval id="rsyslog_nolisten" /> <ref nist="AU-2, AU-9" /> </Rule> @@ -371,7 +371,7 @@ periodically in order to perform its log rotation function.</description> <rationale>Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.</rationale> -<ident cce="4182-2" /> +<ident cce="27194-0" /> <ref nist="AU-2, AU-9, CM-6" disa="366"/> </Rule> --> @@ -386,7 +386,7 @@ if the /var/log partition becomes full.</rationale> <ocil> <service-enable-check-macro service="logrotate" /> </ocil> -<ident cce="4182-2" /> +<ident cce="27014-0" /> <oval id="logrotate_rotate_all_files" /> <ref nist="AU-2, AU-9, CM-6" disa="366" /> </Rule> @@ -404,7 +404,7 @@ Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/c on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it is running. <pre> HostLimit = no </pre> </description> -<ident cce="4323-2" /> +<ident cce="27197-3" /> <oval id="logwatch_configured_hostlimit" /> </Rule> @@ -415,7 +415,7 @@ If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that information is almost always necessary <pre> SplitHosts = yes </pre> </description> -<ident cce="4323-2" /> +<ident cce="27069-4" /> <oval id="logwatch_configured_splithosts" /> </Rule> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index 30319ac..141705d 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -57,7 +57,7 @@ The <tt>ip6tables</tt> default rules are essentially the same.</description> <rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling capability for IPv6 and ICMPv6. </rationale> -<ident cce="4167-3" /> +<ident cce="27006-6" /> <oval id="service_ip6tables_enabled" /> <ref nist="CM-6, CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414"/> <tested by="DS" on="20121024"/> @@ -73,7 +73,7 @@ capability for IPv6 and ICMPv6. The <tt>iptables</tt> service provides the system's host-based firewalling capability for IPv4 and ICMP. </rationale> -<ident cce="4189-7" /> +<ident cce="27018-1" /> <oval id="service_iptables_enabled" /> <ref nist="CM-6, CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414" /> <tested by="DS" on="20121024"/> @@ -128,7 +128,7 @@ the applicable rules in the table are examined for a match. Setting the default policy to <tt>DROP</tt> implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.</rationale> -<ident cce="14264-6" /> +<ident cce="26444-0" /> <oval id="iptables_default_policy_drop" /> <ref nist="AC-4, CM-6" disa="66,1109,1154,1414" /> </Rule> @@ -152,7 +152,7 @@ accepted.</rationale> The output should be similar to the following: <pre># grep ":FORWARD" /etc/sysconfig/iptables :FORWARD DROP [0:0</pre></ocil> -<ident cce="14264-6" /> +<ident cce="27186-6" /> <ref nist="AC-4, CM-6" disa="1109" /> </Rule> @@ -177,7 +177,7 @@ could add another IPv6 address to the interface or alter important network setti <ref nist="AC-4, CM-6" /> <rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the operation- of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale> - +  </Group> @@ -224,7 +224,7 @@ If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your ne The following rule will log all traffic originating from a site-local address, which is deprecated address space: <pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</pre> </description> - +  <ref nist="AC-4, AC-17, CM-6" /> </Group> diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml index a82325d..8f26e56 100644 --- a/RHEL6/input/system/network/ipv6.xml +++ b/RHEL6/input/system/network/ipv6.xml @@ -43,7 +43,7 @@ lines in all files in <tt>/etc/modprobe.d</tt> and the deprecated Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation. </rationale> -<ident cce="CCE-3562-6" /> +<ident cce="27153-6" /> <oval id="kernel_module_ipv6_option_disabled" /> <ref nist="CM-6, CM-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -136,7 +136,7 @@ operator="equals" interactive="0"> <rationale> An illicit router advertisement message could result in a man-in-the-middle attack. </rationale> -<ident cce="CCE-4269-7" /> +<ident cce="27164-3" /> <oval id="sysctl_net_ipv6_conf_default_accept_ra" /> <ref nist="CM-7" /> </Rule> @@ -152,7 +152,7 @@ An illicit router advertisement message could result in a man-in-the-middle atta <rationale> An illicit ICMP redirect message could result in a man-in-the-middle attack. </rationale> -<ident cce="CCE-4313-3" /> +<ident cce="27166-8" /> <oval id="sysctl_net_ipv6_conf_default_accept_redirects" value="sysctl_net_ipv6_conf_default_accept_redirects_value" /> <ref nist="CM-6, CM-7" disa="1551"/> </Rule> @@ -185,7 +185,7 @@ hardware over its lifetime using its traffic. If it is important for a system's IP address to not trivially reveal its hardware address, this setting should be applied. </description> -<ident cce="CCE-3842-2" /> +<ident cce="27154-4" /> <oval id="network_ipv6_privacy_extensions" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -238,13 +238,13 @@ addresses can be assigned to each interface. The default is 16, but it should be set to exactly the number of statically configured global addresses required. </description> -<ident cce="CCE-4221-8" /> -<ident cce="CCE-4137-6" /> -<ident cce="CCE-4159-0" /> -<ident cce="CCE-3895-0" /> -<ident cce="CCE-4287-9" /> -<ident cce="CCE-4058-4" /> -<ident cce="CCE-4128-5" /> +<ident cce="27163-5" /> +<ident cce="27161-9" /> +<ident cce="27162-7" /> +<ident cce="27157-7" /> +<ident cce="27165-0" /> +<ident cce="27158-5" /> +<ident cce="27160-1" /> <oval id="network_ipv6_limit_requests" /> <ref nist="CM-6, CM-7" /> </Rule> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml index 50ebccd..08190ba 100644 --- a/RHEL6/input/system/network/kernel.xml +++ b/RHEL6/input/system/network/kernel.xml @@ -22,7 +22,7 @@ of network traffic.</description> <rationale>Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for routers.</rationale> -<ident cce="4151-7" /> +<ident cce="27001-7" /> <oval id="sysctl_net_ipv4_conf_default_send_redirects" /> <ref nist="AC-4, SC-5, SC-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -39,7 +39,7 @@ only appropriate for routers.</rationale> <rationale>Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for routers.</rationale> -<ident cce="4155-8" /> +<ident cce="27004-1" /> <oval id="sysctl_net_ipv4_conf_all_send_redirects" /> <ref nist="CM-6" disa="1551"/> <tested by="DS" on="20121024"/> @@ -56,7 +56,7 @@ only appropriate for routers.</rationale> <rationale>IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for routers.</rationale> -<ident cce="3561-8" /> +<ident cce="26866-4" /> <oval id="sysctl_net_ipv4_ip_forward" /> <ref nist="AC-3, CM-6, CM-7, SC-5" disa="366"/> <tested by="DS" on="20121024"/> @@ -207,7 +207,7 @@ operator="equals" interactive="0"> </ocil> <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="4236-6" /> +<ident cce="27037-1" /> <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" /> <ref nist="CM-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -223,7 +223,7 @@ uses. It should be disabled unless it is absolutely required.</rationale> </ocil> <rationale>Accepting ICMP redirects has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="4217-6" /> +<ident cce="27027-2" /> <oval id="sysctl_net_ipv4_conf_all_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" /> <ref nist="CM-7" disa="1503,1551"/> <tested by="DS" on="20121024"/> @@ -241,7 +241,7 @@ uses. It should be disabled unless it is absolutely required.</rationale> <rationale>Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="3472-8" /> +<ident cce="26854-0" /> <oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" /> <ref nist="CM-7, AC-4" disa="1503,1551"/> <tested by="DS" on="20121024"/> @@ -259,7 +259,7 @@ absolutely required.</rationale> as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.</rationale> -<ident cce="4320-8" /> +<ident cce="27066-0" /> <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" /> <ref nist="CM-7" disa="126"/> <tested by="DS" on="20121024"/> @@ -276,7 +276,7 @@ to be detected.</rationale> </ocil> <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="4091-5" /> +<ident cce="26983-7" /> <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" /> <ref nist="AC-4, SC-5, SC-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -293,7 +293,7 @@ uses. It should be disabled unless it is absolutely required.</rationale> </ocil> <rationale>This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="4186-3" /> +<ident cce="27015-7" /> <oval id="sysctl_net_ipv4_conf_default_accept_redirects" /> <ref nist="AC-4, SC-5, SC-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -311,7 +311,7 @@ uses. It should be disabled unless it is absolutely required.</rationale> <rationale>Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.</rationale> -<ident cce="3339-9" /> +<ident cce="26831-8" /> <oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" /> <ref nist="AC-4, SC-5, SC-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -329,7 +329,7 @@ absolutely required.</rationale> <rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. </rationale> -<ident cce="3644-2" /> +<ident cce="26883-9" /> <oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" /> <ref nist="AC-3, CM-6, CM-7, SC-5" disa="1551"/> <tested by="DS" on="20121024"/> @@ -346,7 +346,7 @@ addresses makes the system slightly more difficult to enumerate on the network. </ocil> <rationale>Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.</rationale> -<ident cce="4133-5" /> +<ident cce="26993-6" /> <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" /> <ref nist="AC-3, CM-6, CM-7, SC-5" /> <tested by="DS" on="20121024"/> @@ -367,7 +367,7 @@ verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests. </rationale> -<ident cce="4265-5" /> +<ident cce="27053-8" /> <oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" /> <ref nist="CM-6, CM-7" disa="1092, 1095" /> <tested by="DS" on="20121024"/> @@ -386,7 +386,7 @@ that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.</rationale> -<ident cce="4080-8" /> +<ident cce="26979-5" /> <oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" /> <ref nist="AC-4, SC-5, SC-7" disa="1551"/> <tested by="DS" on="20121024"/> @@ -405,7 +405,7 @@ that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.</rationale> -<ident cce="3840-6" /> +<ident cce="26915-9" /> <oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" /> <ref nist="AC-4, SC-5, SC-7" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/network/network.xml b/RHEL6/input/system/network/network.xml index a1d306d..2c775e1 100644 --- a/RHEL6/input/system/network/network.xml +++ b/RHEL6/input/system/network/network.xml @@ -47,7 +47,7 @@ scripts add entries to the system's routing table for these addresses. Zeroconf address assignment commonly occurs when the system is configured to use DHCP but fails to receive an address assignment from the DHCP server. </rationale> -<ident cce="CCE-14054-1" /> +<ident cce="27151-0" /> <oval id="sysconfig_nozeroconf_yes" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -63,7 +63,7 @@ to determine if any interface is running in promiscuous mode: or wireshark) is likely to be using the interface and this should be investigated. </rationale> -<ident cce="CCE-15013-6" /> +<ident cce="27152-8" /> <oval id="network_sniffer_disabled" /> <ref nist="CM-6, CM-7, MA-3" /> </Rule> diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml index 8743268..9817bd2 100644 --- a/RHEL6/input/system/network/uncommon.xml +++ b/RHEL6/input/system/network/uncommon.xml @@ -27,7 +27,7 @@ streaming media and telephony. Disabling DCCP protects the system against exploitation of any flaws in its implementation. </rationale> -<ident cce="14268-7" /> +<ident cce="26448-1" /> <oval id="kernel_module_dccp_disabled" /> <ref nist="CM-6, CM-7" disa="382"/> <tested by="DS" on="20121024"/> @@ -50,7 +50,7 @@ within one connection. Disabling SCTP protects the system against exploitation of any flaws in its implementation. </rationale> -<ident cce="14132-5" /> +<ident cce="26410-1" /> <oval id="kernel_module_sctp_disabled" /> <ref nist="CM-6, CM-7" disa="382"/> <tested by="DS" on="20121024"/> @@ -72,7 +72,7 @@ low-latency communications between nodes in a cluster. Disabling RDS protects the system against exploitation of any flaws in its implementation. </rationale> -<ident cce="14027-7" /> +<ident cce="26239-4" /> <oval id="kernel_module_rds_disabled" /> <ref nist="CM-6, CM-7" disa="382"/> <tested by="DS" on="20121024"/> @@ -94,7 +94,7 @@ cluster. Disabling TIPC protects the system against exploitation of any flaws in its implementation. </rationale> -<ident cce="14911-2" /> +<ident cce="26696-5" /> <oval id="kernel_module_tipc_disabled" /> <ref nist="CM-6, CM-7" disa="382"/> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml index 3246b17..fb07f39 100644 --- a/RHEL6/input/system/network/wireless.xml +++ b/RHEL6/input/system/network/wireless.xml @@ -33,7 +33,7 @@ boot.</description> activation of the wireless interface, generally requiring administrators to reboot the system first. </rationale> -<ident cce="3628-5" /> +<ident cce="26878-9" />  <ref nist="CM-7" disa="85" /> </Rule> @@ -63,7 +63,7 @@ interface file from <tt>/etc/sysconfig/network-scripts</tt>: launch network-based attacks against systems, including those against local LAN protocols which were not designed with security in mind. </rationale> -<ident cce="4276-2" /> +<ident cce="27057-9" /> <oval id="wireless_disable_interfaces" /> <ref nist="CM-7" disa="85" /> <tested by="DS" on="20121025"/> @@ -81,7 +81,7 @@ an administrator or malware to activate a wireless interface, by introducing the need to install such a driver first. </rationale> <warning category="general">This command must also be repeated every time the kernel is upgraded.</warning> -<ident cce="4170-7" /> +<ident cce="27009-0" /> <oval id="wireless_disable_drivers" /> <ref nist="CM-7" disa="85" /> </Rule> @@ -98,7 +98,7 @@ the need to install such a driver first. connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.</rationale> -<ident cce="4355-4" /> +<ident cce="27081-9" /> <oval id="service_bluetooth_disabled" /> <ref nist="AC-18, CM-6, CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> @@ -120,7 +120,7 @@ install bluetooth /bin/true</pre> <rationale>If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.</rationale> -<ident cce="14948-4" /> +<ident cce="26763-3" /> <oval id="kernel_module_bluetooth_disabled" /> <ref nist="AC-18, CM-6, CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml index 03e1c44..f04432a 100644 --- a/RHEL6/input/system/permissions/execution.xml +++ b/RHEL6/input/system/permissions/execution.xml @@ -45,7 +45,7 @@ The output should show either <tt>022</tt> or <tt>027</tt>. <rationale>The umask influences the permissions assigned to files created by a process at run time. An unnecessarily permissive umask could result in files being created with insecure permissions.</rationale> -<ident cce="4220-0" /> +<ident cce="27031-4" /> <oval id="umask_for_daemons" value="var_umask_for_daemons"/> <ref nist="AC-3, CM-6"/> </Rule> @@ -87,7 +87,7 @@ The output should be: <rationale>A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.</rationale> -<ident cce="4225-9" /> +<ident cce="27033-0" /> <oval id="core_dumps_limitsconf" /> <ref nist="SC-5" /> </Rule> @@ -102,7 +102,7 @@ sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.</rationale> -<ident cce="4247-3" /> +<ident cce="27044-7" /> <oval id="core_dump_suid_progs_limits_conf" /> <ref nist="SI-11" /> </Rule> @@ -130,7 +130,7 @@ control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range.</rationale> -<ident cce="4168-1" /> +<ident cce="27007-4" /> <oval id="sysctl_kernel_exec_shield" /> <ref nist="CM-7" /> <tested by="DS" on="20121024"/> @@ -146,7 +146,7 @@ into a process's address space during an attempt at exploitation. Additionally, makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques. </rationale> -<ident cce="4146-7" /> +<ident cce="26999-3" /> <oval id="sysctl_kernel_randomize_va_space" /> <ref nist="AC-3, CM-6" /> <tested by="DS" on="20121024"/> @@ -186,7 +186,7 @@ installed on older systems that do not support the XD or NX bit, as this may prevent them from booting.</warning> <rationale>On 32-bit systems that support the XD or NX bit, the vendor-supplied PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.</rationale> -<ident cce="4172-3" /> +<ident cce="27010-8" /> <ref nist="CM-7" /> </Rule> @@ -198,7 +198,7 @@ under a Security section. Look for Execute Disable (XD) on Intel-based systems a on AMD-based systems.</description> <rationale>Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will allow users to turn the feature on or off at will.</rationale> -<ident cce="4177-2" /> +<ident cce="27012-4" /> <ref nist="CM-6" /> </Rule> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 8453eff..d9940aa 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -26,7 +26,7 @@ system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.</rationale> -<ident cce="3918-0" /> +<ident cce="26947-2" /> <oval id="file_owner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -38,7 +38,7 @@ which could weaken the system security posture.</rationale> <ocil><filegroupowner-check-macro file="/etc/shadow" group="root"/></ocil> <rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is critical for system security.</rationale> -<ident cce="3988-3" /> +<ident cce="26967-0" /> <oval id="file_groupowner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -53,7 +53,7 @@ system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.</rationale> -<ident cce="4130-1" /> +<ident cce="26992-8" /> <oval id="file_permissions_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -65,7 +65,7 @@ which could weaken the system security posture.</rationale> <ocil><fileowner-check-macro file="/etc/group" owner="root"/></ocil> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured on the system. Protection of this file is important for system security.</rationale> -<ident cce="3276-3" /> +<ident cce="26822-7" /> <oval id="file_owner_etc_group" /> <ref nist="AC-3, CM-6"/> <tested by="DS" on="20121026"/> @@ -77,7 +77,7 @@ on the system. Protection of this file is important for system security.</ration <ocil><filegroupowner-check-macro file="/etc/group" group="root"/></ocil> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured on the system. Protection of this file is important for system security.</rationale> -<ident cce="3883-6" /> +<ident cce="26930-8" /> <oval id="file_groupowner_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -89,7 +89,7 @@ on the system. Protection of this file is important for system security.</ration <ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured on the system. Protection of this file is important for system security.</rationale> -<ident cce="3967-7" /> +<ident cce="26954-8" /> <oval id="file_permissions_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -101,7 +101,7 @@ on the system. Protection of this file is important for system security.</ration <ocil><fileowner-check-macro file="/etc/gshadow" owner="root"/></ocil> <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file is critical for system security.</rationale> -<ident cce="4210-1" /> +<ident cce="27026-4" /> <oval id="file_owner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -113,7 +113,7 @@ is critical for system security.</rationale> <ocil><filegroupowner-check-macro file="/etc/gshadow" group="root"/></ocil> <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file is critical for system security.</rationale> -<ident cce="4064-2" /> +<ident cce="26975-3" /> <oval id="file_groupowner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -125,7 +125,7 @@ is critical for system security.</rationale> <ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil> <rationale>The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.</rationale> -<ident cce="3932-1" /> +<ident cce="26951-4" /> <oval id="file_permissions_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -137,7 +137,7 @@ is critical for system security.</rationale> <ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil> <rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on the system. Protection of this file is critical for system security.</rationale> -<ident cce="3958-6" /> +<ident cce="26953-0" /> <oval id="file_owner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -149,7 +149,7 @@ the system. Protection of this file is critical for system security.</rationale> <ocil><filegroupowner-check-macro file="/etc/passwd" group="root"/></ocil> <rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on the system. Protection of this file is critical for system security.</rationale> -<ident cce="3495-9" /> +<ident cce="26856-5" /> <oval id="file_groupowner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -163,7 +163,7 @@ the system. Protection of this file is critical for system security.</rationale> world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.</rationale> -<ident cce="3566-7" /> +<ident cce="26868-0" /> <oval id="file_permissions_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> <tested by="DS" on="20121026"/> @@ -330,7 +330,7 @@ or those designed to be temporary file repositories. The setting is normally re used by the system, and by users for temporary file storage - such as /tmp - and for directories requiring global read/write access. </rationale> -<ident cce="3399-3" /> +<ident cce="26840-9" /> <oval id="dir_perms_world_writable_sticky_bits" /> <ref nist="CM-6"/> <tested by="swells" on="20120929"/> @@ -354,7 +354,7 @@ user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.</rationale> -<ident cce="3795-2" /> +<ident cce="26910-0" /> <ref nist="CM-6"/> </Rule> @@ -374,7 +374,7 @@ To find world-writable files, run the following command: the owner of the file. SGID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.</rationale> -<ident cce="14970-8" /> +<ident cce="26769-0" /> <oval id="file_permissions_unauthorized_sgid" /> <ref nist="CM-6"/> </Rule> @@ -395,7 +395,7 @@ To find world-writable files, run the following command: the owner of the file. SUID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.</rationale> -<ident cce="14340-4" /> +<ident cce="26497-8" /> <oval id="file_permissions_unauthorized_suid" /> <ref nist="AC-3, CM-6"/> </Rule> @@ -423,7 +423,7 @@ to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. </rationale> -<ident cce="4223-4" /> +<ident cce="27032-2" /> <oval id="file_permissions_unowned" /> <ref nist="AC-3, CM-6" disa="224"/> </Rule> @@ -450,7 +450,7 @@ to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. </rationale> -<ident cce="3573-3" /> +<ident cce="26872-2" /> <oval id="file_permissions_ungroupowned" /> <ref nist="AC-3, CM-6" disa="224"/> </Rule> @@ -476,7 +476,7 @@ undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users. </rationale> -<ident cce="14794-2" /> +<ident cce="26642-9" /> <oval id="dir_perms_world_writable_system_owned" /> <ref nist="AC-3, CM-6"/> <tested by="swells" on="20120929"/> diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 5c60da7..c1b0618 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -34,7 +34,7 @@ and xdm. If this user is the first to log into the physical console variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale> -<ident cce="3685-5" /> +<ident cce="27192-4" /> <oval id="console_device_restrict_access_desktop" /> <ref nist="AC-6, CM-6, CM-7" /> </Rule> @@ -53,7 +53,7 @@ and xdm. If this user is the first to log into the physical console variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale> -<ident cce="3685-5" /> +<ident cce="26892-0" /> <oval id="console_device_restrict_access_server" /> <ref nist="AC-6, CM-6, CM-7" /> </Rule> @@ -73,7 +73,7 @@ module, but will not prevent an administrator (or another program) from using th <rationale>USB storage devices such as thumb drives can be used to introduce unauthorized software and other vulnerabilities. Support for these devices should be disabled and the devices themselves should be tightly controlled.</rationale> -<ident cce="4187-1" /> +<ident cce="27016-5" /> <oval id="kernel_module_usb-storage_disabled" /> <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -95,7 +95,7 @@ will need to be repeated every time the kernel is updated.</description> <rationale>USB storage devices such as thumb drives can be used to introduce unauthorized software and other vulnerabilities. Support for these devices should be disabled and the devices themselves should be tightly controlled.</rationale> -<ident cce="4006-3" /> +<ident cce="26970-4" /> <oval id="kernel_module_usb-storage_removed" /> <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -114,7 +114,7 @@ mice, or printers. This guidance is inappropriate for systems which require USB <rationale>Disabling the USB subsystem within the Linux kernel at system boot will also disable USB storage devices if they are plugged into the system. Support for these devices should be disabled and the devices themselves should be tightly controlled.</rationale> -<ident cce="4173-1" /> +<ident cce="27011-6" /> <oval id="bootloader_nousb_argument" /> <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -129,7 +129,7 @@ the section titled "Set BIOS Password" to prevent unauthorized configuration cha <rationale>Booting a system from a USB device would allow an attacker to circumvent any security measures offered by the native OS. Attackers could mount partitions and modify the configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale> -<ident cce="3944-6" /> +<ident cce="26952-2" />  <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -157,7 +157,7 @@ If properly configured, the output should be the following: <rationale>All filesystems that are required for the successful operation of the system should be explicitly listed in /etc/fstab by and administrator. New filesystems should not be arbitrarily introduced via the automounter.</rationale> -<ident cce="4072-5" /> +<ident cce="26976-1" /> <oval id="service_autofs_disabled" /> <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -186,7 +186,7 @@ policy. Disabling USB storage as described in the USB section will prevent the u this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and DVDs. </rationale> -<ident cce="4231-7" /> +<ident cce="27035-5" /> <oval id="gconf_gnome_disable_automount" /> <ref nist="CM-6, CM-7" disa="1250,85" /> </Rule> @@ -199,7 +199,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14089-7" /> +<ident cce="26340-0" /> <oval id="kernel_module_cramfs_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -212,7 +212,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14457-6" /> +<ident cce="26544-7" /> <oval id="kernel_module_freevxfs_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -225,7 +225,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14853-6" /> +<ident cce="26670-0" /> <oval id="kernel_module_jffs2_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -238,7 +238,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="15087-0" /> +<ident cce="26800-3" /> <oval id="kernel_module_hfs_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -251,7 +251,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14093-9" /> +<ident cce="26361-6" /> <oval id="kernel_module_hfsplus_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -264,7 +264,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14118-4" /> +<ident cce="26404-4" /> <oval id="kernel_module_squashfs_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -277,7 +277,7 @@ This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.</rationale> -<ident cce="14871-8" /> +<ident cce="26677-5" /> <oval id="kernel_module_udf_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml index 8dd7720..10d4ea1 100644 --- a/RHEL6/input/system/permissions/partitions.xml +++ b/RHEL6/input/system/permissions/partitions.xml @@ -28,7 +28,7 @@ interpreted as character or block devices. The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set <tt>nodev</tt> on these filesystems.</rationale> -<ident cce="4249-9" /> +<ident cce="27045-4" /> <oval id="mount_option_nodev_nonroot_local_partitions" /> <ref nist="CM-6, CM-7, AC-6"/> </Rule> @@ -46,7 +46,7 @@ jails built for system services. located on the root partition. An exception to this is chroot jails, and it is not advised to set <tt>nodev</tt> on partitions which contain their root filesystems. </rationale> -<ident cce="3522-0" /> +<ident cce="26860-7" /> <oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -69,7 +69,7 @@ To verify that binaries cannot be directly executed from removable media, run th <pre># grep noexec /etc/fstab</pre> The output should show <tt>noexec</tt> in use. </ocil> -<ident cce="4275-4" /> +<ident cce="27196-5" /> <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" /> <ref nist="CM-7, MP-2" disa="87" /> </Rule> @@ -87,7 +87,7 @@ files into the system via partitions mounted from removeable media. <rationale>The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from partitions mounted off of removable media.</rationale> -<ident cce="4275-4" /> +<ident cce="27056-1" /> <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -103,7 +103,7 @@ within temporary directories like <tt>/tmp</tt>. </description> <rationale>The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.</rationale> -<ident cce="14412-1" /> +<ident cce="26499-4" /> <oval id="mount_option_tmp_nodev" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -117,7 +117,7 @@ from being executed out of <tt>/tmp</tt>. <rationale>Allowing users to execute binaries from world-writeable directories such as <tt>/tmp</tt> should never be necessary in normal operation and can expose the system to potential compromise.</rationale> -<ident cce="14927-8" /> +<ident cce="26720-3" /> <oval id="mount_option_tmp_noexec" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -131,7 +131,7 @@ should not be required in these world-writeable directories. </description> <rationale>The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale> -<ident cce="14940-1" /> +<ident cce="26762-5" /> <oval id="mount_option_tmp_nosuid" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -146,7 +146,7 @@ within temporary directories like <tt>/dev/shm</tt>. </description> <rationale>The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.</rationale> -<ident cce="15007-8" /> +<ident cce="26778-1" /> <oval id="mount_option_dev_shm_nodev" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -161,7 +161,7 @@ from world-writeable temporary storage directories such as <tt>/dev/shm</tt>. </description> <rationale>Allowing users to execute binaries from world-writeable directories such as /dev/shm can expose the system to potential compromise.</rationale> -<ident cce="14703-3" /> +<ident cce="26622-1" /> <oval id="mount_option_dev_shm_noexec" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -175,7 +175,7 @@ be required in these world-writeable directories. </description> <rationale>The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale> -<ident cce="14306-5" /> +<ident cce="26486-1" /> <oval id="mount_option_dev_shm_nosuid" /> <ref nist="CM-7, MP-2"/> </Rule> @@ -192,7 +192,7 @@ See the mount(8) man page for further explanation of bind mounting. <rationale>Having multiple locations for temporary storage is not required. Unless absolutely necessary to meet requirements, the storage location /var/tmp should be bind mounted to /tmp and thus share the same protections.</rationale> -<ident cce="14584-7" /> +<ident cce="26582-7" /> <oval id="mount_option_var_tmp_bind" /> <ref nist="CM-6"/> </Rule> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 543f3a9..c1f85a8 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -98,7 +98,7 @@ Disabling a major host protection feature, such as SELinux, at boot time prevent it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation. </rationale> -<ident cce="3977-6" /> +<ident cce="26956-3" /> <oval id="selinux_bootloader_notdisabled" /> <ref nist="AC-3, CM-6" disa="22,32"/> <tested by="DS" on="20121024"/> @@ -121,7 +121,7 @@ potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. </rationale> -<ident cce="3999-0" /> +<ident cce="26969-6" /> <oval id="selinux_mode" value="var_selinux_state_name"/> <ref nist="CM-6, CM-7" disa="22,32,26"/> <tested by="DS" on="20121024"/> @@ -147,7 +147,7 @@ Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. </rationale> -<ident cce="3624-4" /> +<ident cce="26875-5" /> <oval id="selinux_policytype" value="var_selinux_policy_name"/> <ref nist="CM-6, CM-7" disa="22,32"/> <tested by="DS" on="20121024"/> @@ -166,7 +166,7 @@ security context. <rationale>The <tt>restorecond</tt> service helps ensure that the default SELinux file context is applied to files. This allows automatic correction of file contexts created by some programs.</rationale> -<ident cce="4129-3" /> +<ident cce="26991-0" /> <oval id="service_restorecond_enabled" /> <ref nist="AC-3, CM-6" /> </Rule> @@ -201,7 +201,7 @@ which use category labelling.</description> <Rule id="disable_mcstransd"> <title>Disable mcstrans Service</title> <description>The MCS Translation Service (mcstrans) should be disabled.</description> -<ident cce="3668-1" /> +<ident cce="26891-2" /> <oval id="service_mcstrans_disabled" /> <ref nist="CM-6, CM-7" /> </Rule> @@ -242,7 +242,7 @@ It should produce no output in a well-configured system.</ocil> If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux cannot properly restrict access to the device file. </rationale> -<ident cce="14991-4" /> +<ident cce="26774-0" /> <oval id="selinux_all_devicefiles_labeled" /> <ref nist="CM-6, CM-7" disa="22,32"/> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 932e6e8..6af7172 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -37,7 +37,7 @@ The <tt>/tmp</tt> partition is used as temporary storage by many programs. Placing <tt>/tmp</tt> in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it. </rationale> -<ident cce="14161-4"/> +<ident cce="26435-8"/> <oval id="mount_tmp_own_partition" /> <ref nist="CM-6" disa="1208"/> <tested by="MM" on="20120928"/> @@ -57,7 +57,7 @@ system services such as daemons or other programs which use it. It is not uncommon for the <tt>/var</tt> directory to contain world-writable directories, installed by other software packages. </rationale> -<ident cce="14777-7"/> +<ident cce="26639-5"/> <oval id="mount_var_own_partition" /> <ref nist="CM-6" disa="1208"/> <tested by="MM" on="20120928"/> @@ -76,7 +76,7 @@ Placing <tt>/var/log</tt> in its own partition enables better separation between log files and other files in <tt>/var/</tt>. </rationale> -<ident cce="14011-1" /> +<ident cce="26215-4" /> <oval id="mount_var_log_own_partition" /> <ref nist="CM-6, AU-9" disa="1208"/> <tested by="MM" on="20120928"/> @@ -98,7 +98,7 @@ and other files, and helps ensure that auditing cannot be halted due to the partition running out of space. </rationale> -<ident cce="14171-3" /> +<ident cce="26436-6" /> <oval id="mount_var_log_audit_own_partition" /> <ref nist="CM-6, AU-9" disa="137,138,1208"/> <tested by="MM" on="20120928"/> @@ -119,7 +119,7 @@ Ensuring that <tt>/home</tt> is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage. </rationale> -<ident cce="14559-9" /> +<ident cce="26557-9" /> <oval id="mount_home_own_partition" /> <ref nist="CM-6" disa="1208"/> <tested by="MM" on="20120928"/> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index bc96e7d..6104100 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -37,7 +37,7 @@ Install the AIDE package with the command: <rationale> The AIDE package must be installed if it is to be available for integrity checking. </rationale> -<ident cce="4209-3" /> +<ident cce="27024-9" /> <oval id="package_aide_installed" /> <ref nist="CM-6, CM-7, SC-28, SI-7" disa="1069"/> <tested by="DS" on="20121024"/> @@ -159,7 +159,7 @@ Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.</rationale> -<ident cce="14931-0" /> +<ident cce="26731-0" /> <oval id="rpm_verify_permissions" /> <ref nist="SI-7" disa="1493,1494,1495" /> </Rule> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 2bd9fa4..1c26f58 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -36,7 +36,7 @@ The command should return the string below: This key is necessary to cryptographically verify packages are from Red Hat. </rationale> -<ident cce="14440-2"/> +<ident cce="26506-6"/> <oval id="package_red_hat_gpgkeys_installed" /> <ref nist="SI-2, SI-7, SC-13" disa="351"/> <tested by="MM" on="20120928"/> @@ -68,7 +68,7 @@ Ensuring the validity of packages' cryptographic signatures prior to installation ensures the provenance of the software and protects against malicious tampering. </rationale> -<ident cce="14914-6" /> +<ident cce="26709-6" /> <oval id="yum_gpgcheck_global_activation" /> <ref nist="SI-2" disa="352,663" /> <tested by="MM" on="20120928"/> @@ -93,7 +93,7 @@ Ensuring all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering. </rationale> -<ident cce="14813-0" /> +<ident cce="26647-8" /> <oval id="yum_gpgcheck_never_disabled" /> <ref nist="SI-2" disa="352,663"/> <tested by="MM" on="20120928"/> -- 1.7.1

2 2

[PATCH 0/2] improvements to account lockout Rules
by Jeffrey Blank 22 Dec '12

22 Dec '12

Thanks to DISA FSO for this patch. Jeffrey Blank (2): adding additional, granular account lockout Rules adding additional lockout Rules to STIG profile RHEL6/input/auxiliary/alt-titles-stig.xml | 6 ++ RHEL6/input/profiles/stig-rhel6-server.xml | 7 +++ RHEL6/input/system/accounts/pam.xml | 81 ++++++++++++++++++++++++++-- 3 files changed, 89 insertions(+), 5 deletions(-)

1 2

[PATCH 0/2] handling update process requirement, ref update
by Jeffrey Blank 20 Dec '12

20 Dec '12

Thanks to Michele for this patch; this helps with SRG-OS-000190 viewable in table-stig-rhel6-server-flat-srgs.html Jeffrey Blank (2): language requiring establishment of automatic/regular updates per SRG adding ref to ip6tables to stay in sync with iptables RHEL6/input/auxiliary/srg_support.xml | 17 +++++++++++++++++ RHEL6/input/system/network/iptables.xml | 2 +- 2 files changed, 18 insertions(+), 1 deletions(-)

1 2

[PATCH 0/4] SRG reference fixups, new Rules for acct expiration
by Jeffrey Blank 20 Dec '12

20 Dec '12

This continues the effort to document how the guidance or product satisfies (or does not satisfy) requirements from the OS SRG. Thanks to DISA FSO for this feedback/patches. Jeffrey Blank (4): improved checks and text so that unlabeled devices are recursively sought added new Rule for temporary account expiration, also to stig profile SRG mapping fixups per FSO, new alt-titles minor wording tweaks to account expiration, for consistency RHEL6/input/auxiliary/alt-titles-stig.xml | 5 +++- RHEL6/input/auxiliary/srg_support.xml | 2 +- .../checks/selinux_all_devicefiles_labeled.xml | 1 + RHEL6/input/profiles/stig-rhel6-server.xml | 1 + .../accounts/restrictions/account_expiration.xml | 29 ++++++++++++++++++- RHEL6/input/system/network/iptables.xml | 2 +- RHEL6/input/system/selinux.xml | 2 +- 7 files changed, 36 insertions(+), 6 deletions(-)

1 4

[PATCH 0/2] punctuation fixes and changed rule text
by David Smith 20 Dec '12

20 Dec '12

Here we have a fix for Ticket #49, the guidance now calls for using the "screen" package instead of "vlock" for console locking. References to installation of vlock were edited to reflect the change - both in the applicable profiles and the alt-titles-stig file. David Smith (2): changed periods back to colons, where appropriate changed rule to use "screen" instead of "vlock" RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/manual_remediation.xml | 2 +- RHEL6/input/services/ldap.xml | 46 +++++++++++++------------- RHEL6/input/services/mail.xml | 28 ++++++++-------- RHEL6/input/services/ntp.xml | 4 +- RHEL6/input/services/obsolete.xml | 10 +++--- RHEL6/input/system/accounts/physical.xml | 28 +++++++--------- 8 files changed, 59 insertions(+), 63 deletions(-)

2 3

[PATCH] bugfix for dropped SRG rows
by Jeffrey Blank 19 Dec '12

19 Dec '12

This has already been pushed, as it's a bugfix. Jeffrey Blank (1): bugfix for dropping SRGs (lacking Rules which reference them) from flat table output RHEL6/transforms/shorthand2xccdf.xslt | 2 +- RHEL6/transforms/table-srgmap.xslt | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide December 2012