scap-security-guide February 2012

scap-security-guide@lists.fedorahosted.org

6 participants
42 discussions

[PATCH 1/3] Added two additional ldap checks, renamed one check to better differentiate same attrib. checks
by Kevin Spargur 29 Feb '12

29 Feb '12

From: kspargur <kspargur(a)kspargur.csb> --- .../ldap_server_config_certificate_usage.xml | 79 ++++++++++++++++++++ .../checks/ldap_server_config_olcsecurity.xml | 37 --------- .../ldap_server_config_olcsecurity_simple_bind.xml | 32 ++++++++ .../checks/ldap_server_config_olcsecurity_tls.xml | 32 ++++++++ 4 files changed, 143 insertions(+), 37 deletions(-) create mode 100644 rhel6/src/input/checks/ldap_server_config_certificate_usage.xml delete mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity.xml create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml diff --git a/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml new file mode 100644 index 0000000..13f69cb --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml @@ -0,0 +1,79 @@ +<def-group> + <definition class="compliance" + id="ldap_server_config_certificate_usage" version="1"> + <metadata> + <title>LDAP Server Should Use Strong Encryption</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO:CCE" source="CCE" /> + <description>If installed, LDAP server should be configured use strong certificate based encryption using a CA Cert, Private Key, and Public Cert.</description> + </metadata> + <criteria comment="If installed, LDAP server should be configured to use strong encryption" + operator="AND"> + <extend_definition comment="openldap server should only be present if it fulfills an operational requirement" + definition_ref="package_openldap-servers_installed" /> + <criterion test_ref="test_ldap_server_config_certificate_usage_ca" /> + <criterion test_ref="test_ldap_server_config_certificate_usage_cert" /> + <criterion test_ref="test_ldap_server_config_certificate_usage_key" /> + </criteria> + </definition> + + + <ind:textfilecontent54_test check="all" + check_existence="all_exist" + comment="Tests the value of the ^[\s]*olcTLSCACertificateFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" + id="test_ldap_server_config_certificate_usage_ca" version="1"> + <ind:object object_ref="obj_ldap_server_config_certificate_usage_ca" /> + <ind:state state_ref="state_ldap_server_config_certificate_usage_ca" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_ca" + version="1"> + <ind:subexpression operation="equals">/etc/pki/tls/CA/cacert.pem</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_ca" + version="1"> + <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> + <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> + <ind:pattern operation="pattern match">^[\s]*olcTLSCACertificateFile[\s]*:[\s]*(.*)$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" + check_existence="all_exist" + comment="Tests the value of the ^[\s]*olcTLSCertificateFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" + id="test_ldap_server_config_certificate_usage_cert" version="1"> + <ind:object object_ref="obj_ldap_server_config_certificate_usage_cert" /> + <ind:state state_ref="state_ldap_server_config_certificate_usage_cert" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_cert" + version="1"> + <ind:subexpression operation="equals">/etc/pki/tls/ldap/servercert.pem</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_cert" + version="1"> + <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> + <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> + <ind:pattern operation="pattern match">^[\s]*olcTLSCertificateFile[\s]*:[\s]*(.*)$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" + check_existence="all_exist" + comment="Tests the value of the ^[\s]*olcTLSCertificateKeyFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" + id="test_ldap_server_config_certificate_usage_key" version="1"> + <ind:object object_ref="obj_ldap_server_config_certificate_usage_key" /> + <ind:state state_ref="state_ldap_server_config_certificate_usage_key" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_key" + version="1"> + <ind:subexpression operation="equals">/etc/pki/tls/ldap/serverkey.pem</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_key" + version="1"> + <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> + <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> + <ind:pattern operation="pattern match">^[\s]*olcTLSCertificateKeyFile[\s]*:[\s]*(.*)$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml deleted file mode 100644 index e4bbe30..0000000 --- a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml +++ /dev/null @@ -1,37 +0,0 @@ -<def-group> - <definition class="compliance" - id="ldap_server_config_olcsecurity" version="1"> - <metadata> - <title>LDAP Server Should Use TLS</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <reference ref_id="TODO:CCE" source="CCE" /> - <description>If installed, LDAP server should use TLS.</description> - </metadata> - <criteria comment="If installed, LDAP server should be configured to use strong encryption" - operator="AND"> - <extend_definition comment="openldap server should only be present if it fulfills an operational requirement" - definition_ref="package_openldap-servers_installed" /> - <criterion test_ref="test_20141" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" - id="test_20141" version="1"> - <ind:object object_ref="obj_20141" /> - <ind:state state_ref="state_20141" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20141" - version="1"> - <ind:subexpression operation="equals">tls=128</ind:subexpression> - </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20141" - version="1"> - <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> - <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> - <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*(.*)$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml new file mode 100644 index 0000000..19bc8b7 --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml @@ -0,0 +1,32 @@ +<def-group> + <definition class="compliance" + id="ldap_server_config_olcsecurity_simple_bind" version="1"> + <metadata> + <title>LDAP Server Should Require Protected Binds</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO:CCE" source="CCE" /> + <description>If installed, LDAP server should require secure binds.</description> + </metadata> + <criteria comment="If installed, LDAP server should be configured to use strong encryption" + operator="AND"> + <extend_definition comment="openldap server should only be present if it fulfills an operational requirement" + definition_ref="package_openldap-servers_installed" /> + <criterion test_ref="test_ldap_server_config_olcsecurity_simple_bind" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" + check_existence="all_exist" + comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*simple_bind=128.* expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" + id="test_ldap_server_config_olcsecurity_simple_bind" version="1"> + <ind:object object_ref="obj_ldap_server_config_olcsecurity_simple_bind" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_ldap_server_config_olcsecurity_simple_bind" + version="1"> + <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> + <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> + <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*\.*simple_bind=128.*</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml new file mode 100644 index 0000000..99a422d --- /dev/null +++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml @@ -0,0 +1,32 @@ +<def-group> + <definition class="compliance" + id="ldap_server_config_olcsecurity_tls" version="1"> + <metadata> + <title>LDAP Server Should Use TLS</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO:CCE" source="CCE" /> + <description>If installed, LDAP server should use TLS.</description> + </metadata> + <criteria comment="If installed, LDAP server should be configured to use strong encryption" + operator="AND"> + <extend_definition comment="openldap server should only be present if it fulfills an operational requirement" + definition_ref="package_openldap-servers_installed" /> + <criterion test_ref="test_ldap_server_config_olcsecurity_tls" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" + check_existence="all_exist" + comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*tls=128.* expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file" + id="test_ldap_server_config_olcsecurity_tls" version="1"> + <ind:object object_ref="obj_ldap_server_config_olcsecurity_tls" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_ldap_server_config_olcsecurity_tls" + version="1"> + <ind:path>/etc/openldap/slapd.d/cn=config</ind:path> + <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename> + <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*\.*tls=128.*</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> -- 1.7.7.6

1 2

RFC: -k field value
by Shawn Wells 29 Feb '12

29 Feb '12

I'd like to see the audit -k field names match whatever we call the actual check. Right now they're (fairly arbitrary) strings from the stig.rules file. Any objection to changing them to match the rule name?

3 2

RFC: "-F auid>=500 -F auid!=4294967295" in audit rules
by Shawn Wells 29 Feb '12

29 Feb '12

I noticed many of the audit rules apply the "-F auid>=500 -F auid!=4294967295" fields, and I'm not fully sure I agree with it. It looks like these were taken from the stig.rules sample file that ships with RHEL. This presumes that system administrators are following UID naming schemes. I suppose we could create a "no UIDs < 500" check, but I'd rather eliminate the "-F auid>=500 -F auid!=4294967295" from the audit rules to ensure those with less than noble intent can't create a UID < 500 and escape auditing. By reference, all our Common Criteria profiles to not have the auid checks. What's the consensus -- keep or remove auid flags?

2 1

Embarrassing question: SSH keys for commits
by Shawn Wells 28 Feb '12

28 Feb '12

Trying to sync the commit repo, get key failures. For the life of me I can't figure out where to upload my SSH keys to, and my google-foo is failing. Any tips?

2 2

[PATCH 24/24] Updated audit_file_deletions to include linking and rename events
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

[PATCH 23/24] Updated audit_dac_actions to watch umask settings
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

[PATCH 22/24] Updated audit_login_config to include PAM config
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

[PATCH 21/24] Created audit_sysctl_parameters
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

[PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

[PATCH 19/24] Added a check for /etc/modprobe.d/ to audit_kernel_module_loading
by Shawn Wells 28 Feb '12

28 Feb '12

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide February 2012