scap-security-guide December 2012

scap-security-guide@lists.fedorahosted.org

8 participants
36 discussions

Start a nNew thread

[PTCH 1/28] Housekeeping of OVAL references
by Shawn Wells 13 Dec '12

13 Dec '12

1 0

[PATCH 3/3] Bugfix
by Shawn Wells 12 Dec '12

12 Dec '12

2 1

[PATCH 1/3] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml
by Shawn Wells 12 Dec '12

12 Dec '12

2 1

[PATCH 2/3] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml
by Shawn Wells 12 Dec '12

12 Dec '12

2 1

[PATCH 0/3] adding check content to SRG output
by Jeffrey Blank 10 Dec '12

10 Dec '12

This should take care of presenting the "check text" related to satisfying SRG items that are accompanied by a presentation of evidence and assertion that they are met/unmeetable (versus those that contain actionable guidance for admins). Jeffrey Blank (3): ensure guide generation does not trample other tempfiles include check instructions in SRG mapping tables adding new column with check instructions RHEL6/Makefile | 4 ++-- RHEL6/transforms/table-add-srgitems.xslt | 2 +- RHEL6/transforms/table-srgmap.xslt | 6 ++++++ 3 files changed, 9 insertions(+), 3 deletions(-)

1 3

[PATCH 0/4] new transform to include SRG items alongside automated Rules
by Jeffrey Blank 07 Dec '12

07 Dec '12

This transform adds rows from an SRG mapping table to the STIG rules table, so that the resulting table includes information for every SRG item. It is incomplete: it still needs to grab the correct "check" text which describes how the RHEL product satisfies (or cannot satisfy) a particular SRG requirement. In some cases, this text still needs to be written. This can be resolved in short order through changes to the output in the SRG mapping table. Jeffrey Blank (4): added xhtml files to gitignore in output new transform to add items from an SRG mapping table to a Rule table added new Rules to create Rule table, including any SRG items not tied to specific configuration action fixed characters to escape ampersand RHEL6/Makefile | 4 ++- RHEL6/input/system/software/integrity.xml | 2 +- RHEL6/output/.gitignore | 1 + RHEL6/transforms/table-add-srgitems.xslt | 56 +++++++++++++++++++++++++++++ 4 files changed, 61 insertions(+), 2 deletions(-) create mode 100644 RHEL6/transforms/table-add-srgitems.xslt

1 5

[PATCH 01/12] Changed content as per ticket #147.
by Michele Newman 07 Dec '12

07 Dec '12

--- RHEL6/input/system/auditing.xml | 48 +++++++++++++++++++------------------- 1 files changed, 24 insertions(+), 24 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 67cce9a..c14f3dc 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -88,7 +88,7 @@ disk. <service-enable-macro service="auditd" /> </description> <ocil><service-enable-check-macro service="auditd" /></ocil> -<rationale>Ensuring that the <tt>auditd</tt> service is active ensures that +<rationale>Ensuring the <tt>auditd</tt> service is active ensures audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist. </rationale> @@ -100,7 +100,7 @@ actions will be taken if other obstacles exist. <Rule id="enable_auditd_bootloader" severity="medium"> <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title> -<description>To ensure that all processes can be audited, even +<description>To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument <tt>audit=1</tt> to the kernel line in <tt>/etc/grub.conf</tt>, in the manner below: <pre>kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1</pre> @@ -114,7 +114,7 @@ auditing is enabled at boot time. Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although <tt>auditd</tt> takes care of enabling this for all processes which launch after it -does, adding the kernel argument ensures that it is set for every +does, adding the kernel argument ensures it is set for every process during boot. </rationale> <ident cce="15026-8" /> @@ -293,7 +293,7 @@ page. These include: Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation occurs. This is the default. The setting is case-insensitive. </description> -<ocil clause="the system hasn't been properly set up to rotate audit logs"> +<ocil clause="the system has not been properly set up to rotate audit logs"> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to rotate logs when they reach their maximum size: @@ -344,7 +344,7 @@ These include: Set this to <tt>email</tt> (instead of the default, which is <tt>suspend</tt>) as it is more likely to get prompt attention. </description> -<ocil clause="the system isn't configured to send an email to the system administrator when +<ocil clause="the system is not configured to send an email to the system administrator when disk space is starting to run low"> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to email the administrator when @@ -383,7 +383,7 @@ mode for corrective action. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. </description> -<ocil clause="the system isn't configured to switch to single user +<ocil clause="the system is not configured to switch to single user mode for corrective action"> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to switch to single user mode @@ -408,7 +408,7 @@ in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified via email for those situations: <pre>action_mail_acct = root</pre> </description> -<ocil clause="auditd isn't configured to send emails per identified actions"> +<ocil clause="auditd is not configured to send emails per identified actions"> Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to determine if the system is configured to send email to an account when it needs to notify an administrator: @@ -465,7 +465,7 @@ editing as needed, the new rules can be activated as follows: <Group id="audit_time_rules"> <title>Records Events that Modify Date and Time Information</title> <description>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time. All changes to the system time should be audited.</description> @@ -484,11 +484,11 @@ desired, but is not required. See an example of multiple combined syscalls: <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre> </description> -<ocil clause="the system isn't configured to audit time changes"> +<ocil clause="the system is not configured to audit time changes"> <audit-syscall-check-macro syscall="adjtimex" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -512,11 +512,11 @@ desired, but is not required. See an example of multiple combined syscalls: <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre> </description> -<ocil clause="the system isn't configured to audit time changes"> +<ocil clause="the system is not configured to audit time changes"> <audit-syscall-check-macro syscall="settimeofday" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -538,11 +538,11 @@ See an example of multiple combined syscalls: <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre> </description> -<ocil clause="the system isn't configured to audit time changes"> +<ocil clause="the system is not configured to audit time changes"> <audit-syscall-check-macro syscall="stime" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -566,11 +566,11 @@ desired, but is not required. See an example of multiple combined syscalls: <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre> </description> -<ocil clause="the system isn't configured to audit time changes"> +<ocil clause="the system is not configured to audit time changes"> <audit-syscall-check-macro syscall="clock_settime" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -587,7 +587,7 @@ The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. </description> -<ocil clause="the system isn't configured to audit time changes"> +<ocil clause="the system is not configured to audit time changes"> To determine if the system is configured to audit attempts to alter time via the /etc/localtime file, run the following command: @@ -595,7 +595,7 @@ command: If the system is configured to audit this activity, it will return a line. </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files as well as to confuse network services that +nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -616,7 +616,7 @@ to capture events that modify account changes: -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes</pre> </description> -<ocil clause="the system isn't configured to audit account changes"> +<ocil clause="the system is not configured to audit account changes"> To determine if the system is configured to audit account changes, run the following command: <pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre> @@ -643,7 +643,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre> </description> -<ocil clause="the system isn't configured to audit changes of the network configuration"> +<ocil clause="the system is not configured to audit changes of the network configuration"> To determine if the system is configured to audit changes to its network configuration, run the following command: <pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre> @@ -697,7 +697,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio <description>Add the following to <tt>/etc/audit/audit.rules</tt>: <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre> </description> -<ocil clause="the system isn't configured to audit attempts to change the MAC policy"> +<ocil clause="the system is not configured to audit attempts to change the MAC policy"> To determine if the system is configured to audit changes to its SELinux configuration files, run the following command: <pre># auditctl -l | grep "dir=/etc/selinux"</pre> @@ -760,7 +760,7 @@ If the system is 64 bit then also add the following: gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> -<ocil clause="the system isn't configured to audit permission changes"> +<ocil clause="the system is not configured to audit permission changes"> <audit-syscall-check-macro syscall="chmod" /> </ocil> <warning category="general">Note that these rules can be configured in a @@ -1233,7 +1233,7 @@ appropriate for your system: <audit-syscall-check-macro syscall="renameat" /> </ocil> <rationale>Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting as well as detecting +from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.</rationale> <ident cce="14820-5" /> <oval id="audit_rules_file_deletion_events" /> @@ -1252,7 +1252,7 @@ To verify that auditing is configured for system administrator actions, run the <pre># auditctl -l | grep "watch=/etc/sudoers"</pre> </ocil> <rationale>The actions taken by system administrators should be audited to keep a record -of what was executed on the system as well as for accountability purposes.</rationale> +of what was executed on the system, as well as, for accountability purposes.</rationale> <ident cce="14824-7" /> <oval id="audit_rules_sysadmin_actions" /> <ref nist="AU-2" disa="126"/> -- 1.7.1

2 13

[PATCH] Renamed STIG-server to "stig-rhel6-server"
by Shawn Wells 06 Dec '12

06 Dec '12

2 1

[PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml
by Shawn Wells 03 Dec '12

03 Dec '12

2 1

[PATCH] DISA FSO requested updates to RHEL6/input/system/permissions/mounting.xml
by Shawn Wells 03 Dec '12

03 Dec '12

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide December 2012