scap-security-guide November 2013

scap-security-guide@lists.fedorahosted.org

23 participants
73 discussions

[PATCH] correct several STIG/SSG mappings
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

These are corrections to several mappings in stig_overlay.xml. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/input/auxiliary/stig_overlay.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 9b613eb..8e89373 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -66,7 +66,7 @@ <overlay owner="disastig" ruleid="no_hashes_outside_shadow" ownerid="RHEL-06-000031" disa="366" severity="medium"> <title>The /etc/passwd file must not contain password hashes.</title> </overlay> - <overlay owner="disastig" ruleid="no_uidzero_except_root" ownerid="RHEL-06-000032" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="RHEL-06-000032" disa="366" severity="medium"> <title>The root account must be the only account having a UID of 0.</title> </overlay> <overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium"> @@ -234,7 +234,7 @@ <overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="RHEL-06-000098" disa="366" severity="medium"> <title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title> </overlay> - <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_default_accept_redirects_value" ownerid="RHEL-06-000099" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="sysctl_ipv6_default_accept_redirects" ownerid="RHEL-06-000099" disa="366" severity="medium"> <title>The system must ignore ICMPv6 redirects by default.</title> </overlay> <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium"> @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -747,16 +747,16 @@ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="RHEL-06-000341" disa="366" severity="high"> <title>The snmpd service must not use a default password.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> <title>The system default umask for the bash shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> <title>The system default umask for the csh shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_etc_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> <title>The system default umask in /etc/profile must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_logindefs" ownerid="RHEL-06-000345" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_login_defs" ownerid="RHEL-06-000345" disa="366" severity="low"> <title>The system default umask in /etc/login.defs must be 077.</title> </overlay> <overlay owner="disastig" ruleid="umask_for_daemons" ownerid="RHEL-06-000346" disa="366" severity="low"> -- 1.7.1

3 6

[PATCH] Initial GConf2 fixups
by Maura Dailey 06 Jan '14

06 Jan '14

Several of the GConf checks were using xmlfilecontent, which I liked, so I changed the ones that weren't to use it. However, the checks that had been using xmlfilecontent were improperly pointing to /etc/gconf/gconf.xml.defaults, when we wanted to be peering into gconf.xml.mandatory instead (this is where the gconf2-tool instructions were writing their values). To add support to ensure these checks will no longer report a failure on machines that aren't using X, I added an extended definition check and the appropriate package checks to point to the lowest level package that installs GConf settings, namely the GConf2 package. On servers that don't have this package installed, the check will pass. - Maura Dailey Maura Dailey (1): Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). .../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh

6 19

FW: [PATCH] look for uid greater than 499, not 500
by Steinke, Leland J Sr CTR DISA DD (US) 10 Dec '13

10 Dec '13

The original prose check ignored UID 500. The associated OVAL includes UID 500, though. Regards, -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

4 4

[PATCH] fix for find command parameters in RHEL6/input/fixes/bash/file_permissions_library_dirs.sh
by Trayer, Jeb D CTR 05 Dec '13

05 Dec '13

A colleague found during testing, that the find command for checking/fixing group or world writeable files in library directories had the -perm flag set as -022 (all bits set) instead of /022 (any bits set). I updated RHEL6/input/fixes/bash/file_permissions_library_dirs.sh and generated this patch to update the fix content. I can't push this patch so if its approved, so if someone that could, doesn't mind it's appreciated. Thanks! Jeb Trayer, CTR Ace Info Solutions, Inc. USCG Operations System Center Jeb.D.Trayer(a)uscg.mil Signed-off-by: Jeb Trayer <jeb.d.trayer(a)uscg.mil> --- .../fixes/bash/file_permissions_library_dirs.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh b/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh index 263612f..7de0740 100644 --- a/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh +++ b/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh @@ -1,4 +1,4 @@ DIRS="/lib /lib64 /usr/lib /usr/lib64" for dirPath in $DIRS; do - find $dirPath -perm -022 -type f -exec chmod go-w '{}' \; + find $dirPath -perm /022 -type f -exec chmod go-w '{}' \; done -- 1.7.1

3 3

PATCH] [RHEL6] Add remediation for Disable Prelinking rule
by Jan Lieskovsky 02 Dec '13

02 Dec '13

Proposal for the "2.1.3.1.b. Disable Prelinking" rule remediation. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

3 3

[PATCH] [Fedora] Add OVAL check for 'Set SSH Idle Timeout Interval' rule
by Jan Lieskovsky 29 Nov '13

29 Nov '13

This patch adds OVAL check for sshd's Idle Timeout Interval / ClientAliveInterval rule for Fedora. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Add remediation for sshd's ClientAliveCountMax rule
by Jan Lieskovsky 29 Nov '13

29 Nov '13

This patch adds remediation for the sshd's ClientAliveCountMax rule. Installing openssh-server package or enabling the sshd service isn't necessary, since if: * openssh-server isn't installed or * sshd is disabled the underlying OVAL check would pass. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Add OVAL check for 'Set SSH Client Alive Count' rule
by Jan Lieskovsky 29 Nov '13

29 Nov '13

This patch adds OVAL check for sshd's 'Set SSH Client Alive Count' rule for Fedora. Since it (alternatively) depends on: * openssh-server package removed and / or * sshd service disabled it adds checks for these two conditions too. Also adds automated 'package removed' functionality. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Add remediation for Disable Prelinking rule
by Jan Lieskovsky 28 Nov '13

28 Nov '13

Based on: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-November/… add remediation for the "Disable Prelinking" rule also for Fedora. (Test and works for me, but) Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Disable selected rules in the common profile (those rules that don't have OVAL check / remediation implemented in RHEL6 at all yet)
by Jan Lieskovsky 28 Nov '13

28 Nov '13

Disable: * no_root_webbrowsing * root_path_default * gid_passwd_group_same rules in the Fedora common profile from running by default, since they don't have particular OVAL check / remediation implemented at all yet or the implementation wouldn't be that straigtforward. Pushed to master (since this is question just commenting of selected rules out). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2013