scap-security-guide November 2013

scap-security-guide@lists.fedorahosted.org

23 participants
73 discussions

[PATCH 1/3] more STIG/SSG mapping tweaks
by Steinke, Leland J Sr CTR DISA DD (US) 18 Nov '13

18 Nov '13

Reversed ruleid="nonselected" updates, per Shawn's suggestion. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/input/auxiliary/stig_overlay.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 8e89373..b2c7809 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -534,7 +534,7 @@ <overlay owner="disastig" ruleid="postfix_network_listening" ownerid="RHEL-06-000249" disa="382" severity="medium"> <title>Mail relaying must be restricted.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000251" disa="778" severity="medium"> + <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000251" disa="778" severity="medium"> <title>The operating system must uniquely identify and authenticate an organization defined list of specific devices and/or types of devices before establishing a connection.</title> </overlay> <overlay owner="disastig" ruleid="ldap_client_start_tls" ownerid="RHEL-06-000252" disa="1453" severity="medium"> @@ -564,7 +564,7 @@ <overlay owner="disastig" ruleid="service_atd_disabled" ownerid="RHEL-06-000262" disa="382" severity="low"> <title>The atd service must be disabled.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000263" disa="1250" severity="low"> + <overlay owner="disastig" ruleid="service_autofs_disabled" ownerid="RHEL-06-000263" disa="1250" severity="low"> <title>Automated file system mounting tools must not be enabled unless needed.</title> </overlay> <overlay owner="disastig" ruleid="service_ntpdate_disabled" ownerid="RHEL-06-000265" disa="382" severity="low"> -- 1.7.1

1 0

[PATCH] [Fedora] Include directory structure to support remediations. [Fedora] Add text file pattern remediation script generator. [Fedora] Add remediation for "Set password minimum length in login.defs" rule
by Jan Lieskovsky 18 Nov '13

18 Nov '13

1) This proposal includes the necessary directory structure / transform scripts, so remediation scripts could work for Fedora content too, 2) Since there (in RHEL6 content) are currently multiple remediation fixes of the form "search for text file pattern. Replace old value based on provided variable if found or append new value if not found": - accounts_maximum_age_login_defs.sh - accounts_minimum_age_login_defs.sh .. - accounts_umask_login_defs.sh .. - sshd_set_idle_timeout.sh (16 of this type in total right now), wrote 'replace or append pattern value in text file' remediation script generator (create_replace_or_append_pattern_value_in_text_file.sh), which can be used, when new remediation scripts of this type are needed. 3) Based on that script created remediation script for "Set password minimum length in login.defs" rule. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Update versioning scheme
by Jan Lieskovsky 18 Nov '13

18 Nov '13

[Fedora] Update versioning scheme: - move fedorassgrelease to be part of upstream version (instead of downstream release), - rename it to fedorassgversion to avoid name collision with actual Fedora RPM package Release tag. This patch enables possibility to bump Fedora RPM package release, when making new Fedora build just by incrementing the Release field (as expected by Fedora packaging guide). Former fedorassgrelease has been moved to Version (to be part of upstream version field), and renamed to fedorassgversion to avoid confusion / collision with Release field in the Bodhi build system. Testing: * all of make fedora-{tarball, srpm, rpm} passed, * regression Fedora Makefile rules passed too. Change pushed to master. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] accounts_password_reuse_limit.sh remediation
by Frank Caviggia 15 Nov '13

15 Nov '13

Shawn, This should be a little bit better of a match to what you wanted for the password use remediation. -Frank

2 1

[PATCH] scap-security-guide in Fedora obsoletes openscap-content
by Šimon Lukašík 15 Nov '13

15 Nov '13

From: Simon Lukasik <slukasik(a)redhat.com> Openscap-content has been created for Fedora 14 and it becomes increasingly outdated. The scap-security-guide package in Fedora has been designed as a next generation of Fedora content. With OpenSCAP-0.9.13 release we decided to obsolete openscap-content and advice users to use scap-security-guide instead. However, we need to put the obsoletes directive to scap-security-guide.spec in order to avoid nasty update issues like (rhbz#1028706). --- Fedora/scap-security-guide.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec index dc21c7d..4a31a5c 100644 --- a/Fedora/scap-security-guide.spec +++ b/Fedora/scap-security-guide.spec @@ -9,7 +9,7 @@ Name: scap-security-guide Version: 0.1 -Release: %{fedorassgrelease}%{?dist} +Release: %{fedorassgrelease}.1%{?dist} Summary: Security guidance and baselines in SCAP formats Group: Applications/System License: Public Domain @@ -18,6 +18,7 @@ Source0: http://fedorapeople.org/~jlieskov/%{name}-%{version}-%{fedorassgrelease BuildArch: noarch BuildRequires: libxslt, expat, python, openscap-utils >= 0.9.1, python-lxml Requires: xml-common, openscap-utils >= 0.9.1 +Obsoletes: openscap-content < 0:0.9.13 %description The scap-security-guide project provides a guide for configuration of the @@ -53,6 +54,9 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man %doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html %changelog +* Fri Nov 15 2013 Šimon Lukašík <slukasik(a)redhat.com> - 0.1-3.1 +- Rebuild to obsolete openscap-content package (#1028706) + * Tue Oct 22 2013 Jan iankko Lieskovsky <jlieskov(a)redhat.com> 0.1-3 - Add .gitignore for Fedora output directory - Set up Fedora release name and CPE based on build system properties -- 1.8.3.1

3 3

[PATCH] include mapped STIG ID in overlay
by Steinke, Leland J Sr CTR DISA DD (US) 15 Nov '13

15 Nov '13

These are tweaks to facilitate mapping between STIG and SSG content. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/transforms/xccdf-apply-overlay-stig.xslt | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/transforms/xccdf-apply-overlay-stig.xslt b/RHEL6/transforms/xccdf-apply-overlay-stig.xslt index 0bbe84b..a7bf3cb 100644 --- a/RHEL6/transforms/xccdf-apply-overlay-stig.xslt +++ b/RHEL6/transforms/xccdf-apply-overlay-stig.xslt @@ -28,8 +28,8 @@ <Group id="{$overlay_id}"> <title>SRG-OS-ID</title> <description></description> - <Rule id="{$overlay_id}_rule" severity="{$overlay_severity}" > - <version><value-of select="$overlay_id"/></version> + <Rule id="{$overlay_rule}" severity="{$overlay_severity}" > + <version><xsl:value-of select="$overlay_id"/></version> <title><xsl:value-of select="$overlay_title"/></title> <description><xsl:copy-of select="xccdf:rationale/node()" /></description> <check system="C-{$overlay_id}_chk"> -- 1.7.1

3 2

Fwd: [Open-scap] SCAP Newbie Questions for simple RHEL6 XCCDF example.
by Matthew Mariani 13 Nov '13

13 Nov '13

As recommended, moving this thread to the SSG mailing list. Background: We are working on developing an SSG profile definition for RH certified cloud providers. In addition to these XCCDF-based checks, I need to also detect any non-RedHat packages installed on the system. The question to the group is: are there any recommendations or examples on how this may have been done previously. As example, suppose a cloud image has a monitoring package or hypervisor para-virt rpms install, I want to be made aware and have those reported by the check. An OVAL path was suggested below. Does anyone have additional guidance on how/if I can do this with SCAP-related tools? Thanks, -Matt Matthew Mariani Partner Solution Architect M: +1-717-756-6834 mmariani(a)redhat.com ----- Original Message ----- From: "Shawn Wells" <shawn(a)redhat.com> To: open-scap-list(a)redhat.com Sent: Sunday, October 13, 2013 11:30:26 PM Subject: Re: [Open-scap] SCAP Newbie Questions for simple RHEL6 XCCDF example. On 10/10/13 4:44 PM, Matthew Mariani wrote: Danny, Thanks, very helpful. -Matt ----- Original Message ----- From: "Dan Haynes" <dhaynes(a)mitre.org> To: "Matthew Mariani" <mmariani(a)redhat.com> , open-scap-list(a)redhat.com Sent: Wednesday, October 9, 2013 2:45:35 PM Subject: RE: SCAP Newbie Questions for simple RHEL6 XCCDF example. Hi Matthew, Comments inline below. Hope this helps. Thanks, Danny From: open-scap-list-bounces(a)redhat.com [ mailto:open-scap-list-bounces@redhat.com ] On Behalf Of Matthew Mariani Sent: Wednesday, October 09, 2013 1:11 PM To: open-scap-list(a)redhat.com Subject: [Open-scap] SCAP Newbie Questions for simple RHEL6 XCCDF example. Hi list, 'SCAP newbie here. I'm working with the attached XCCDF profile definition to be used with a RHEL6 system. The end goal is to define a standard RHEL cloud image security profile. I have two questions: 1. I believe I need additional XML syntax in the file to have valid XCCDF content. When I try both testing with the 'info' function and running an 'eval', I get an Unknown document type error. [root@rhel6client ~]# oscap info rht-ccp.xml OpenSCAP Error: Unknown document type: 'rht-ccp.xml' [oscapxml.c:554] [root@rhel6client ~]# oscap xccdf eval --profile rht-ccp --results /root/rht-ccp.results.xml --report /root/rht-ccp.report.html rht-ccp.xml Profile "rht-ccp" was not found. Looking at some of the xccdf examples referenced here http://www.open-scap.org/page/Documentation , I'm thinking I need a <Benchmark> wrapper around my profile. Am I on the right track, and if so is there a basic <Benchmark> syntax example available? I'm finding it difficult to id what's required and what's not in examples referenced on the Documentation page. [Danny]: Yes, you will need to include the <Benchmark> component. You may want to look at the RHEL6 STIG SCAP content being developed in the scap-security-guide project ( https://fedorahosted.org/scap-security-guide/ ). It should serve as a good example and you may be able to reuse some of the content. They also have some tools that you could leverage to help generate the content. Matt pinged me offline re: the Red Hat CCP profile. I've now merged it into SSG: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=363324… You should now be able to clone the source and run a scan: https://fedorahosted.org/scap-security-guide/wiki/downloads aka $ sudo yum install git openscap-utils python-lxml $ cd /tmp ; git clone git://git.fedorahosted.org/git/scap-security-guide.git ; cd scap-security-guide/RHEL6 $ make content $ sudo oscap xccdf eval --profile rht-ccp \ --results /root/ssg-results-`date`.xml \ --report /root/ssg-results-`date`.html \ --cpe output/ssg-rhel6-cpe-dictionary.xml \ output/ssg-rhel6-xccdf.xml <blockquote> 2. Looking forward, in addition to these XCCDF checks, I have the need to detect non-RedHat signed packaged installed on the system. Does anyone have guidance on how/if I can do that with SCAP tools. As example, suppose a cloud image has a monitoring package or hypervisor para-virt rpms install, I want to be made aware and have those reported by the check. [Danny]: Yes, you should be able to check for any non-Red Hat signed packages using OVAL which is an language for checking the state of an endpoint. There is the linux-def:rpminfo_test ( http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-… ) which you can use to check various metadata about the packages installed on the system including the signature key ID. With that in mind, you should be able to collect all RPMs on the system and filter out any RPMs that are signed by Red Hat leaving only those that haven’t been signed by Red Hat. I have attached an OVAL definition which shows how you might do this. Of course, you may need to modify it to include the appropriate signature key IDs. Any help is appreciated. Thanks, -Matt </blockquote> Since this is largely content related, feel free to kick over the conversation to the SSG mailing list: https://fedorahosted.org/scap-security-guide/ https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide Our friends and allies within the OpenSCAP tooling community let us content guys play here, but content questions (for SSG) should be kicked over to the SSG community list :) _______________________________________________ Open-scap-list mailing list Open-scap-list(a)redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list

4 9

[PATCH] accounts_password_reuse_limit.sh remediation
by Frank Caviggia 12 Nov '13

12 Nov '13

Shawn, This should be a little bit better of a match to what you wanted for the password use remediation. -Frank

1 0

[PATCH] accounts_password_reuse_limit.sh remediation
by Frank Caviggia 12 Nov '13

12 Nov '13

All, Here is a remediation fix for account password reuse in SSG. Updated to use the '/etc/pam.d/system-auth' file. Regards, Frank Caviggia -- Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com

2 1

[PATCH] Added the OVAL id to the xccdf rule for file_ownership_binary_dirs so that the check functions.
by Caleb Cooper 12 Nov '13

12 Nov '13

Signed-off-by: Caleb Cooper <coopercd(a)ornl.gov> --- RHEL6/input/system/permissions/files.xml | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index a35bf0b..75e8c70 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -330,6 +330,7 @@ and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted. </rationale> <ident cce="27623-8"/> +<oval id="file_ownership_binary_dirs" /> <ref nist="AC-6" disa="1499"/> </Rule> -- 1.7.1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2013