scap-security-guide April 2012

scap-security-guide@lists.fedorahosted.org

12 participants
70 discussions

[PATCH 00/13] Added CCI references
by Willy Santos 26 Apr '12

26 Apr '12

This batch of commits adds rule references to CCI numbers. Willy Santos (13): Mapped CCI-000199 to password_max_age Mapped CCI-000200 to limit_password_reuse Mapped CCI-000205 to password_min_len Mapped CCI-000206 to acccounts group. Mapped CCI-000352 to ensure_gpgcheck_globally_activated and ensure_gpgcheck_never_disabled Mapped CCI-000416 to aide_periodic_cron_checking Mapped CCI-000803 to sshd_use_approved_ciphers Mapped CCI-000888 to ssh_server group. Mapped CCI-000195 to password_require_diffchars Mapped CCI-000196 to no_hashes_outside_shadow Mapped CCI-000197 to ssh_server group Mapped CCI-000198 to password_min_age Mapped CCI-001118 to enable_iptables and enable_ip6tables rules rhel6/src/input/services/ssh.xml | 3 +++ rhel6/src/input/system/accounts/accounts.xml | 1 + rhel6/src/input/system/accounts/pam.xml | 2 ++ .../accounts/restrictions/password_expiration.xml | 3 +++ .../accounts/restrictions/password_storage.xml | 1 + rhel6/src/input/system/network/iptables.xml | 2 ++ rhel6/src/input/system/software/integrity.xml | 1 + rhel6/src/input/system/software/updating.xml | 2 ++ 8 files changed, 15 insertions(+), 0 deletions(-) -- 1.7.7.6

2 26

[PATCH] edits to httpd guidance
by Jeffrey Blank 26 Apr '12

26 Apr '12

These edits reflect Shawn's feedback. Jeffrey Blank (1): significant httpd guidance (consolidated, edited) rhel6/src/input/services/http.xml | 789 +++++++++++++++++++++++++++++++++++++ 1 files changed, 789 insertions(+), 0 deletions(-)

1 1

[PATCH] consolidated httpd XCCDF commit
by Jeffrey Blank 26 Apr '12

26 Apr '12

This patch is a consolidation of Willy's commits for XCCDF content for Apache configuration. I believe this captures the information, and will make the commit log a bit clearer. Aside from consolidation, I made the following modifications: mod_auth_digest was experimental in apache 2.0, not in 2.2, so i updated the text. Same thing for ditto for mod_cache. The Apache docs are an excellent resource, especially since 1.3 was originally shipped/supported on RHEL 5 (and we are updating for 2.2 on RHEL 6). mod_disk_cache, mod_file_cache, mod_mem_cache all require mod_cache, so I changed the rule to only require that mod_cache not exist, as our goal is to provide a compliance check against caching. It appears that chroot capability is now supported out of the box (not just via mod_security), so this is noted in the httpd_chroot section. I added a style note to the wiki (XCCDF Rule-writing section) about Rule titles: they should be imperative when possible. I also updated many of the Rule titles with initial caps, which is consistent with the rest of the document. Grammatical pet peeve: removed instances of "and/or". Minor note: using <tt> tags inside a title is fine, but it gets stripped out by shorthand2xccdf.xslt. For some reason, the XCCDF spec does not allow for XHTML tags inside a title (and despite the aesthetic loss, we should try to derive all human-readable output from valid XCCDF). I changed a few Rules to Groups. This occurred when it wasn't clear that it would be practical to create a granular check (using any mechanism) or when helpful information was being provided (versus potential compliance requirements). Some Groups may later be broken out into several Rules if there is motivation. The default permissions on /var/log/httpd are more restrictive (at 700) than what the RHEL 5 guide originally suggested (750), and so I updated this Rule. (I have not yet updated the OVAL, however.) The original Apache guidance in the SNAC guide was definitely not written in a manner that was easy to translate to XCCDF. I suspect that another round of edits may be called for, but this has already gotten two rounds of translation/edits, so I'm offering it for a commit... Jeffrey Blank (1): added significant body of apache configuration guidance rhel6/src/input/services/http.xml | 789 +++++++++++++++++++++++++++++++++++++ 1 files changed, 789 insertions(+), 0 deletions(-)

2 3

[PATCH 21/21] Mapped CCI-000194 to password_require_digits
by Shawn Wells 26 Apr '12

26 Apr '12

2 1

[PATCH 0/1] Added 800-53 content to partition rules.
by Willy Santos 26 Apr '12

26 Apr '12

This commit was missed this morning when others of the kind got committed and ACKd by Shawn Wells. In the interest of preserving this information and working from the the same base, I'm submitting for ACK. See Shawn's commment below on the previous ACK: "Given that we're converting the mappings from NIST over to the CCIs (which get us things like NIST 800-53 and OS SRG for free) these patches will have a short lifespan, however they do provide us with a foundation for identifying what potential CCIs the rules apply to. Ack for the patchset, so that these can provide a base for mapping to appropriate CCIs." Willy Santos (1): Added 800-53 references where missing. rhel6/src/input/system/permissions/partitions.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) -- 1.7.7.6

2 2

[PATCH 0/1] M1 IMAP content - Corrections
by Willy Santos 26 Apr '12

26 Apr '12

This patch makes the necessary corrections to previously submitted IMAP content. Willy Santos (1): Corrected Dovecot content and OVAL checks for version 2 relevancy. .../checks/dovecot_disable_plaintext_auth.xml | 4 +- rhel6/src/input/checks/dovecot_enable_ssl.xml | 28 ++++ .../checks/dovecot_login_process_per_conn_yes.xml | 28 ---- .../dovecot_mail_drop_priv_before_exec_yes.xml | 28 ---- rhel6/src/input/services/imap.xml | 130 ++++++++------------ 5 files changed, 81 insertions(+), 137 deletions(-) create mode 100644 rhel6/src/input/checks/dovecot_enable_ssl.xml delete mode 100644 rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml delete mode 100644 rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml -- 1.7.7.6

1 0

[PATCH 4/4] OVAL check for Dovecot setting mail_drop_priv_before_exec.
by Willy Santos 26 Apr '12

26 Apr '12

Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- .../dovecot_mail_drop_priv_before_exec_yes.xml | 28 ++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) create mode 100644 rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml diff --git a/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml b/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml new file mode 100644 index 0000000..edb721a --- /dev/null +++ b/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml @@ -0,0 +1,28 @@ +<def-group> + <definition class="compliance" + id="dovecot_mail_drop_priv_before_exec_yes" version="1"> + <metadata> + <title>Enable login_process_per_connection in Dovecot</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4410-7" source="CCE" /> + <description>login_process_per_connection should be enabled.</description> + </metadata> + <criteria comment="Enable login_process_per_connection in Dovecot"> + <criterion test_ref="test_dovecot_mail_drop_priv_before_exec_yes" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Tests the value of the mail_drop_priv_before_exec[\s]*(<:nocomment:>*) setting in the /etc/dovecot.conf file" + id="test_dovecot_mail_drop_priv_before_exec_yes" version="1"> + <ind:object object_ref="obj_dovecot_mail_drop_priv_before_exec_yes" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_dovecot_mail_drop_priv_before_exec_yes" + version="1"> + <ind:path>/etc</ind:path> + <ind:filename>dovecot.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]*mail_drop_priv_before_exec[\s]*=[\s]*yes\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> -- 1.7.7.6

1 0

[PATCH 3/4] OVAL check for Dovecot setting login_process_per_connection.
by Willy Santos 26 Apr '12

26 Apr '12

Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- .../checks/dovecot_login_process_per_conn_yes.xml | 28 ++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) create mode 100644 rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml diff --git a/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml b/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml new file mode 100644 index 0000000..d1569ea --- /dev/null +++ b/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml @@ -0,0 +1,28 @@ +<def-group> + <definition class="compliance" + id="dovecot_login_process_per_conn_yes" version="1"> + <metadata> + <title>Enable login_process_per_connection in Dovecot</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4410-7" source="CCE" /> + <description>login_process_per_connection should be enabled.</description> + </metadata> + <criteria comment="Enable login_process_per_connection in Dovecot"> + <criterion test_ref="test_dovecot_login_process_per_conn_yes" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Tests the value of the login_process_per_connection[\s]*(<:nocomment:>*) setting in the /etc/dovecot.conf file" + id="test_dovecot_login_process_per_conn_yes" version="1"> + <ind:object object_ref="obj_dovecot_login_process_per_conn_yes" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_dovecot_login_process_per_conn_yes" + version="1"> + <ind:path>/etc</ind:path> + <ind:filename>dovecot.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]*login_process_per_connection[\s]*=[\s]*yes\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> -- 1.7.7.6

1 0

[PATCH 2/4] OVAL check for disabling plaintext authentication in Dovecot.
by Willy Santos 26 Apr '12

26 Apr '12

Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- .../checks/dovecot_disable_plaintext_auth.xml | 28 ++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) create mode 100644 rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml diff --git a/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml new file mode 100644 index 0000000..ecc4795 --- /dev/null +++ b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml @@ -0,0 +1,28 @@ +<def-group> + <definition class="compliance" + id="dovecot_disable_plaintext_auth" version="1"> + <metadata> + <title>Disable Plaintext Authentication in Dovecot</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4552-6" source="CCE" /> + <description>Plaintext authentication of mail clients should be disabled.</description> + </metadata> + <criteria comment="Disable Plaintext Authentication in Dovecot"> + <criterion test_ref="test_dovecot_disable_plaintext_auth" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Tests the value of the disable_plaintext_auth[\s]*(<:nocomment:>*) setting in the /etc/dovecot.conf file" + id="test_dovecot_disable_plaintext_auth" version="1"> + <ind:object object_ref="obj_dovecot_disable_plaintext_auth" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_dovecot_disable_plaintext_auth" + version="1"> + <ind:path>/etc</ind:path> + <ind:filename>dovecot.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> -- 1.7.7.6

1 0

[PATCH 1/4] Added content referenced in Trac ticket #38.
by Willy Santos 26 Apr '12

26 Apr '12

Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/services/imap.xml | 172 ++++++++++++++++++++++++++++++++++++- 1 files changed, 170 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/services/imap.xml b/rhel6/src/input/services/imap.xml index 93dedce..cb6c644 100644 --- a/rhel6/src/input/services/imap.xml +++ b/rhel6/src/input/services/imap.xml @@ -40,6 +40,174 @@ removing it provides a safeguard against its activation. <oval id="package_dovecot_removed" /> </Rule> -</Group> -</Group> +</Group>  + +<Group id="configure_dovecot"> +<title>Configure Dovecot if Necessary</title> +<description>If the system will operate as an IMAP or +POP3 server, the dovecot software should be configured securely by following +the recommendations below. +</description> + +<Rule id="dovecot_support_necessary_protocols"> +<title>Support Only the Necessary Protocols</title> +<description>Dovecot supports the IMAP and POP3 protocols, as well as +SSL-protected versions of those protocols. Configure the Dovecot server +to support only the protocols needed by your site. Edit <tt>/etc/dovecot.conf</tt>. +Add or correct the following lines, replacing <tt>PROTOCOL</tt> with +only the subset of protocols (<tt>imap</tt>, <tt>imaps</tt>, +<tt>pop3</tt>, <tt>pop3s</tt>) required: +<pre>protocols = PROTOCOL</pre> +If possible, require SSL protection for all transactions. The SSL +protocol variants listen on alternate ports (995 instead of 110 for +pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. +An alternate approach is to listen on the standard port and require the +client to use the STARTTLS command before authenticating. +</description> + +<rationale> +Configuring Dovecot to only support the protocols the protocols needed by +your site reduces the risk of an attacker using one of the unused protocols +to base an attack.</rationale> +<ident cce="4384-4" /> +<ident cce="3887-7" /> +<ident cce="4530-2" /> +<ident cce="4547-6" /> + +</Rule> + +<Group id="dovecot_enable_ssl"> +<title>Enable SSL Support</title> +<description>SSL should be used to encrypt network traffic between the +Dovecot server and its clients. Users must authenticate to the Dovecot +server in order to read their mail, and passwords should never be +transmitted in clear text. In addition, protecting mail as it is +downloaded is a privacy measure, and clients may use SSL certificates +to authenticate the server, preventing another system from impersonating +the server. +</description> + +<Rule id="dovecot_configure_ssl_cert"> +<title>Configure Dovecot to Use the SSL Certificate</title> +<description>These options tell Dovecot where to find the TLS +configuration, allowing clients to make encrypted connections. + +Edit <tt>/etc/dovecot.conf</tt> and add or correct the following +lines (ensuring they reference the appropriate files): +<pre>ssl_cert_file = /etc/pki/tls/imap/servercert.pem +ssl_key_file = /etc/pki/tls/imap/serverkey.pem +ssl_ca_file = /etc/pki/tls/CA/cacert.pem +</pre> +</description> +<rationale> +SSL certificates are used by the client to authenticate the identity +of the server, as well as to encrypt credentials and message traffic. +Not using SSL to encrypt mail server traffic could allow unauthorized +access to credentials and mail messages since they are sent in plain +text over the network. +</rationale> + + +</Rule> + +<Rule id="dovecot_disable_plaintext_auth"> +<title>Disable Plaintext Authentication</title> +<description>To prevent Dovecot from attempting plaintext +authentication of clients, edit <tt>/etc/dovecot.conf</tt> and add +or correct the following line: +<pre>disable_plaintext_auth = yes</pre> +</description> +<rationale> +Using plain text authentication to the mail server could allow an +attacker access to credentials by monitoring network traffic. +</rationale> +<ident cce="4552-6" /> +<oval id="dovecot_disable_plaintext_auth" /> +</Rule> + +</Group>  + +<Group id="dovecot_enable_code_flaw_protect"> +<title>Enable Dovecot Options to Protect Against Code Flaws</title> +<description>IMAP and POP3 are remote authenticated protocols, meaning that +the server must accept remote connections from anyone, but provide substantial +services only to clients who have successfully authenticated. To protect +against security problems, Dovecot splits these functions into separate +server processes. The <tt>imap-login</tt> and/or <tt>pop3-login</tt> +processes accept connections from unauthenticated users, and only spawn +<tt>imap</tt> or <tt>pop3</tt> processes on successful authentication. + +However, the <tt>imap-login</tt> and <tt>pop3-login</tt> processes +themselves may contain vulnerabilities. Since each of these processes +operates as a daemon, handling multiple sequential client connections +from different users, bugs in the code could allow unauthenticated users +to steal credential data. If the <tt>login_process_per_connection</tt> option +is enabled, then a separate <tt>imap-login</tt> or <tt>pop3-login</tt> +process is created for each new connection, protecting against this class +of problems. This option has an efficiency cost, but is strongly recommended. + +If the <tt>mail_drop_priv_before_exec</tt> option is on, the <tt>imap-login</tt> +or <tt>pop3-login</tt> process will drop privileges to the userâs ID after +authentication and before executing the <tt>imap</tt> or <tt>pop3</tt> +process itself. Under some very limited circumstances, this could protect +against privilege escalation by authenticated users. However, if the +mail executable option is used to run code before starting each userâs session, +it is important to drop privileges to prevent the custom code from running as root. +</description> + +<Rule id="dovecot_login_process_per_conn_yes"> +<title>login_process_per_connection set to yes</title> +<description>Setting <tt>login_process_per_connection = yes</tt>, prevents +possible bugs in the code from allowing unauthenticated users to steal +credential data when handling multiple sequential client connections +from different users by creating a separate <tt>imap-login</tt> or +<tt>pop3-login</tt> process for each new connection. + +Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line: +<pre>login_process_per_connection = yes</pre> +</description> +<rationale> +This setting could protect against an attacker trying to exploit a bug in +the dovecot code.</rationale> +<ident cce="4410-7" /> +<oval id="dovecot_login_process_per_conn_yes" /> +</Rule> + +<Rule id="dovecot_mail_drop_priv_before_exec_yes"> +<title>mail_drop_priv_before_exec set to yes</title> +<description>Setting <tt>mail_drop_priv_before_exec = yes</tt>, causes +the <tt>imap-login</tt> or <tt>pop3-login</tt> process will drop +privileges to the userâs ID after authentication and before executing +the <tt>imap</tt> or <tt>pop3</tt> process itself. + +Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line: +<pre>mail_drop_priv_before_exec = yes</pre> +</description> +<rationale> +This setting could protect against privilege escalation by authenticated +users.</rationale> +<ident cce="4371-1" /> +<oval id="dovecot_mail_drop_priv_before_exec_yes" /> +</Rule> + +</Group>  + +<Group id="dovecot_allow_imap_access"> +<title>Allow IMAP Clients to Access the Server</title> +<description>The default iptables configuration does not allow inbound +access to any services. This modification will allow remote hosts to +initiate connections to the IMAP daemon, while keeping all other ports +on the server in their default protected state. + +Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring +that it appears before the final <tt>LOG</tt> and <tt>DROP</tt> lines +for the <tt>RH-Firewall-1-INPUT</tt> chain: +<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT</pre> +</description> + +</Group>  + +</Group>  + +</Group>  -- 1.7.7.6

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2012