scap-security-guide July 2012

scap-security-guide@lists.fedorahosted.org

12 participants
83 discussions

Start a nNew thread

[PATCH 2/4] Mapped CCI-000057 to enable_screensaver_after_idle
by Shawn Wells 25 Jul '12

25 Jul '12

2 1

[PATCH 1/4] Remapped CCI-000056 from install_vlock_package to met_inherently
by Shawn Wells 25 Jul '12

25 Jul '12

2 1

OS SRG mappings -- items differing
by Jeffrey Blank 24 Jul '12

24 Jul '12

Below is a list of items initially tagged in the OS SRG mapping, but which may have additional considerations. This email thread is to allow for further discussion on how these requirements could be met and to drive adjustments to the OS SRG mapping. CCI-000040: In addition to auditing use of all identified setuid programs, would it be possible also to audit all processes with system UIDs started by interactive UIDs? Something along the lines of -a always,exit -F auid>=500 -F auid!=4294967295 -F uid<500 CCI-000040: It is also a good idea to audit use of the sudo(8) command. CCI-000048: Do not forget FTP and SSH login banners. CCI-000054: Do not forget the MaxSessions configuration in sshd_config(5). CCI-000056: Is there a setting for the gconftool-2 command to set mandatory screen locking enforcement? CCI-000057: This is the same as CCI-000056 with mandatory screensaver timeout enforcement. CCI-000060: When this check was coded for RHEL5 in OVAL, we limited the screensaver options to appropriate values among those included with the RPM. CCI-000067: Ensure logging of all FTP and SSH sessions, as well. CCI-000068: Disable and remove rcmd, rsh, and rlogind services. CCI-000068: Enable SNMP encryption, preferably using FIPS 140-2 approved encryption algorithms. CCI-000085: Disable all firewire and Bluetooth facilities and remove them from the system. CCI-000086: Disable all firewire and Bluetooth facilities and remove them from the system. CCI-000130: Enable FTP daemon logging. CCI-000130, et seq.: Unless there is no way to configure auditd such that it will not capture the required information, the product does not meet the requirement by design. CCI-000134: Enable xinetd(8) logging. CCI-000135, et seq.: Can illustrative examples be provided? CCI-000136: The system must use a remote logging host for audit data. CCI-000160: At least two NTP servers must be configured. CCI-000160: Unless the system is an NTP server for the local enclave, all its NTP servers must be in the local enclave. CCI-000166: Please provide an example. CCI-000171: How can "designated organizational personnel" be identified as such under RHEL6? CCI-000185: Are DoD certificates signed by "established CAs"? CCI-000187: How are PKI-authenticated identities mapped to user accounts? CCI-000196: Disabling telnet is covered in CCI-000196. CCI-000196: Password hashes must be generated using FIPS 140-2 approved algorithms. CCI-000196: There must be no .netrc files on the system. CCI-000196: There must be no passwords stored in the ldap.conf configuration file. CCI-000200: The pam_unix.so module has the "remember=n" option to retain n generations of user passwords. CCI-000205: The system must use password hashes that are computed using the entire password provided by the end-user. CCI-000347: Please provide examples. CCI-000370, et seq.: I identified these as not applicable, but a third-party application may satisfy these requirements (NA-DEP). CCI-000374: The system must utilize a file-integrity tool. CCI-000382: The SCTP, DCCP, UDP-Lite, IPX, AppleTalk, DECnet, RDS, and TIPC protocols must be disabled unless required. CCI-000416: Can AIDE track the addition of devices to the system without blowing up after system reboots? CCI-000764: The system must not have special privilege accounts, such as shutdown and halt. CCI-000764: The Linux NFS Server must not have the insecure file locking option. CCI-000764: All accounts on the system must have unique user or account names. CCI-000764: All accounts must be assigned unique User Identification Numbers (UIDs). CCI-000765, et seq.: If there is a canonical method for enabling PKI under RHEL6, please provide it. CCI-000770: Direct logins must not be permitted to shared, default, application, or utility accounts. CCI-000770: The root account must not be used for direct log in. CCI-000770: The system must prevent the root account from directly logging in except from the system console. CCI-000880: Please provide examples. CCI-001084: Please provide examples. CCI-001090: Please provide examples. CCI-001154: The system must not have a public Instant Messaging (IM) client installed. CCI-001233: The system package management tool must not automatically obtain updates. CCI-001297: Please provide configuration examples. CCI-001356: Please provide examples of an RHEL6-included log analysis package checking for atypical use patterns. CCI-001436: Disable rpcbind, X, UUCP, peer-to-peer applications, samba, SWAT, and NIS/NIS+ over UDP, unless required. CCI-001436: The SSH daemon and client must use only version 2 of the SSH protocol. CCI-001453: Enable SNMP encryption, preferably using FIPS 140-2 approved encryption algorithms. CCI-001453: If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms. CCI-001462: Does this requirement imply session replaying? I don't know. CCI-001493, et seq.: The ownerships and permissions are ostensibly correct at startup. Do they automatically correct themselves should they be tampered with? CCI-001589: Please provide configuration examples. CCI-001632: This looks more like an out-of-band network management requirement. Does RHEL6 support VLAN functionality that would separate management traffic? CCI-001674: Please explain how RHEL6 would implement the organization-defined responses and alternative actions?

2 1

OS SRG mappings -- items unclear/impractical
by Jeffrey Blank 24 Jul '12

24 Jul '12

Below is a list of items initially tagged as impractical, out of scope, or unclear in the OS SRG mapping, along with suggestions/questions on how to meet the requirements. This email thread is to allow for further discussion on how these requirements could be met, or provide documentation as such. CCI-000024: BIOS settings, such as enabling hardware virtualization and setting the BIOS password, are examples of security-relevant information. CCI-000037: Can RHEL6 mimic Solaris RBAC functionality via SELinux? CCI-000066: Wouldn't an appropriate IPtables configuration satisfy this requirement? CCI-000213: The system must require authentication upon booting into single-user and maintenance modes. CCI-000213: System BIOS or system controllers supporting password protection must have administrator accounts/passwords configured, and no others. CCI-000213: The system boot loader must require authentication against hashes computed with FIPS 140-2 approved algorithms. CCI-000224: All files and directories must have a valid owner and group. (Borrowed from CCI-000366) CCI-000535, et seq.: Does RHEL6 include any backup software, or is this NA-DEP? CCI-000553: All file systems must employ transaction-based file systems. CCI-001111: The operating system must not terminate virtual private network (VPN) client sessions, unless it is documented as a VPN concentrator. CCI-001112: Can RHEL6 force proxy settings on mail and web traffic? CCI-001126: Can RHEL6 iptables be set to default to "deny all" when the iptables service is stopped? It looks like changing "set_policy ACCEPT" to "set_policy DROP" in /etc/init.d/iptables might do the trick, but that's profoundly evil. CCI-001169, et seq.: NA, dependent upon application (browser, etc.) requiring DoD-signed content. CCI-001239: NA-DEP CCI-001291: NA-DEP CCI-001352: Get these audit records to a remote log server ASAP? CCI-001372, et seq.: NA-DEP CCI-001401: Regarding the "binding of organization-defined security attributes to information in transmission", might a combination of non-squashed UID mapping with tight controls on which remote systems are allowed non-squashed NFS access cover this requirement? CCI-001414: Use IPtables? CCI-001555, et seq.: NA-DEP CCI-001668: The system must use and update a DoD-approved virus scan program. CCI-001682: NA-DEP CCI-001695: NA-DEP

4 3

[PATCH 02/16] Mapped ftp_present_banner to CCI-000048
by Shawn Wells 24 Jul '12

24 Jul '12

3 2

[PATCH] Swapped bogus_error_messages for bogus_error_responses
by Shawn Wells 24 Jul '12

24 Jul '12

3 2

[PATCH 16/16] Mapped CCI-001414 to enable_ip6tables, enable_iptables, set_iptables_default_rule
by Shawn Wells 24 Jul '12

24 Jul '12

2 1

[PATCH 15/16] Mapped CCI-001352 to rsyslog_send_messages_to_logserver
by Shawn Wells 24 Jul '12

24 Jul '12

2 1

[PATCH 14/16] Mapped CCI-000213 to bootloader_password and require_singleuser_auth
by Shawn Wells 24 Jul '12

24 Jul '12

2 1

[PATCH 13/16] Mapped CCI-000066 to iptables sections
by Shawn Wells 24 Jul '12

24 Jul '12

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2012