scap-security-guide December 2013

scap-security-guide@lists.fedorahosted.org

32 participants
116 discussions

Start a nNew thread

[PATCH 05/31] Updated RHEL7 XCCDF names to match RHEL6
by Shawn Wells 27 Dec '13

27 Dec '13

1 0

[PATCH 04/31] Renamed password_require_lowercases to
by Shawn Wells 27 Dec '13

27 Dec '13

1 0

[PATCH 03/31] Renamed password_require_specials to
by Shawn Wells 27 Dec '13

27 Dec '13

1 0

[PATCH 02/31] Renamed password_require_uppercases to
by Shawn Wells 27 Dec '13

27 Dec '13

1 0

[PATCH 01/31] accounts_password_pam_cracklib_dcredit --> shared/
by Shawn Wells 27 Dec '13

27 Dec '13

1 0

Disable DHCP client (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 26 Dec '13

26 Dec '13

Classification: UNCLASSIFIED Caveats: NONE The Disable DHCP client check specifies that the value of BOOTPROTO should be "static". However, this doesn't list "static" as an option: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… Should the check be for "none" instead? [Aside: I thought this might be a carryover from RHEL5, but the RHEL5 deployment guide lists the same options: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… However, all the RHEL5 clients I've checked have had it set to "static", whereas the RHEL6 clients I've checked have it set to "none". Is setting it to anything other than "bootp" or "dhcp" the equivalent of setting it to "none"? Not that I'm arguing the check should go in that direction...just wondering how we got here.] -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

1 0

RPM build error (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 26 Dec '13

26 Dec '13

Classification: UNCLASSIFIED Caveats: NONE I'm getting the following when running "make rpm" (or just make by itself): # Don't trust the developers, clean out the build # environment before packaging cd /home/r/git/scap-security-guide/rpmbuild/scap-security-guide-0.1-16.rc1/RHEL/6/ && make clean /bin/sh: line 0: cd: /home/r/git/scap-security-guide/rpmbuild/scap-security-guide-0.1-16.rc1/RHEL/6/: No such file or directory make: *** [tarball] Error 1 Is this known? Something I'm doing wrong? I cloned a new copy of the tree just to be sure I hadn't accidentally done something weird. The only subdirectories in scap-security-guide-0.1-16.rc1 are 6 and JBossEAP5. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

2 2

[Patch] Change to no_empty_passwords.sh fix script for RHEL6
by Trayer, Jeb D CTR 24 Dec '13

24 Dec '13

In testing the community content, and trying to figure out the correctly configure PAM to meet prose guidance, found that the sym link between system-auth to system-auth-ac had gotten broken. After running in circles for awhile found that according to the man page the default action for sed -i is to break symbolic and hard links, which to be honest was kind of surprising to me. Digging back through the fixes looks like it was the no_empty_passwords.sh that was the culprit. I'm not sure if there was any kind of community consensus on whether it's better to modify the target file or to add --follow-symlinks to inline sed edits, it's spawned a lively debate here. In looking over the other fix content it looks like only password_require_minimum_class.sh has a sed command with --follow-symlinks flag. That being the case I changed no_empty_password.sh to modify /etc/pam.d/system-auth-ac instead of /etc/pam.d/system-auth since the majority of fixes don't have the --follow-symlinks flag. I considered changing password_require_minimum_class.sh to modify the target file as well for the sake of consistency, but figured I'd wait to see if there was any input from the community on modifying targets versus using the --follow-symlinks flag. I'm unable to push, so if this is accepted if someone that can, could it would be appreciated. Thanks! Jeb Signed-off-by: Jeb Trayer <jeb.d.trayer(a)uscg.mil> --- RHEL6/input/fixes/bash/no_empty_passwords.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/fixes/bash/no_empty_passwords.sh b/RHEL6/input/fixes/bash/no_empty_passwords.sh index fca40af..cb01287 100644 --- a/RHEL6/input/fixes/bash/no_empty_passwords.sh +++ b/RHEL6/input/fixes/bash/no_empty_passwords.sh @@ -1 +1 @@ -sed -i 's/\<nullok\>//g' /etc/pam.d/system-auth +sed -i 's/\<nullok\>//g' /etc/pam.d/system-auth-ac -- 1.7.1

2 2

[PATCH] [bugfix] no_empty_passwords missing --follow-symlinks
by Shawn Wells 24 Dec '13

24 Dec '13

1 1

[PATCH 25/25] Reset all RHEL7 CCEs - All RHEL7 XCCDF checks will
by Shawn Wells 23 Dec '13

23 Dec '13

1 0

← Newer
1
2
3
4
5
6
7
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide December 2013