scap-security-guide March 2013

scap-security-guide@lists.fedorahosted.org

30 participants
63 discussions

[PATCH] [bugfixes] additional changes from STIG feedback
by David Smith 13 Mar '13

13 Mar '13

The following issues are addressed in this patch: 1) applicability statements for xinetd, IPv6, and ip6tables 2) added trailing spaces when using grep to check disk partition information 3) modified permissions check for grub.conf (now uses "ls -lL") 4) specified "-type f" when looking for library files not owned by root David Smith (1): additional patches following STIG feedback RHEL6/input/services/obsolete.xml | 10 ++++++++-- RHEL6/input/system/accounts/physical.xml | 7 ++++++- RHEL6/input/system/network/iptables.xml | 10 ++++++++-- RHEL6/input/system/network/ipv6.xml | 2 ++ RHEL6/input/system/permissions/files.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 10 +++++----- 6 files changed, 30 insertions(+), 11 deletions(-)

2 2

Fwd: [Open-scap] openscap is "in evaluation"
by Shawn Wells 13 Mar '13

13 Mar '13

For those who may not be on the open-scap list - -------- Original Message -------- Subject: [Open-scap] openscap is "in evaluation" Date: Wed, 13 Mar 2013 09:43:07 -0400 From: Steve Grubb <sgrubb(a)redhat.com> Organization: Red Hat To: open-scap-list(a)redhat.com <open-scap-list(a)redhat.com> Hello, This is to announce that openscap is currently "in-evaluation" to be a certified scanner: http://www.redhat.com/about/news/archive/2013/3/red-hat-openscap-under-eval… -Steve _______________________________________________ Open-scap-list mailing list Open-scap-list(a)redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list

1 0

[PATCH 0/2] [bugfixes] following STIG feedback
by David Smith 13 Mar '13

13 Mar '13

Included are a number of content modifications following yesterday's meeting with FSO and Red Hat: 1) alt-titles-stig was changed to allow a Rule title to match its requirement 2) shorthand2xccdf was changed to modify the service enable macro so runlevels are now specified (2-5) 3) the other file changes largely involved allowing Fix and Check content to stand independently, as well as recommended wording changes David Smith (2): content changes reflective of FSO feedback modified macro to specify runlevels with chkconfig RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/system/accounts/session.xml | 4 ++-- RHEL6/input/system/logging.xml | 14 ++++++++++++-- RHEL6/input/system/network/kernel.xml | 6 +++--- RHEL6/input/system/permissions/files.xml | 20 ++++++++++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 2 +- 6 files changed, 39 insertions(+), 9 deletions(-)

2 3

[PATCH 0/2] [bugfixes] addressing FSO feedback
by David Smith 13 Mar '13

13 Mar '13

These patches address tickets 281 (add library directories to Check text) and 295 (pwck invocation). David Smith (2): modified pwck invocation added library directories to check text .../accounts/restrictions/account_expiration.xml | 2 +- .../accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/permissions/files.xml | 10 ++++++++-- 3 files changed, 10 insertions(+), 4 deletions(-)

2 4

12 Mar '13

With the recent DISA publication of the draft STIG, the timing seems right to host a STIG workshop. NSA IAD and Red Hat will be hosting a public STIG and SCAP workshop on _Tuesday 26-MAR-2013_. Additionally, DISA FSO will be in attendance to hear feedback from the community. You can register here: https://engage.redhat.com/forms/stig-workshop In the March 26th workshop we will: * Share knowledge on the installation of SCAP Security Guide (SSG). How to run a scan, how to customize settings, how to get a report that you can show your ISSE/ISSM, and hw to generate a certification test plan based on your customized rules. * Go a bit deeper, and understand how the code works. Answering questions like: "What is XCCDF, OVAL, and OCIL?" "How can you add your own custome rules?" * Prep your environment to submit patches back to SSG, including learning how to setup git and how to create a Fedora Hosted account. * Chat about what additional profiles are needed. How should we handle CNSSI 12-53? What about PCI compliance? We'll go through Red Hat Enterprise Linux 6 SCAP content, including the STIG, performing scans, and generating C&A artifacts. Attendees can take this setup home and use it to start providing feedback against the RHEL6 STIG. Sign up for the workshop! Date: Tuesday March 26, 2013, with three 2-hour workshop intervals to choose from. Limited availability per session! MORNING SESSION: Red Hat Office, 8260 Greensboro Drive, Suite 300, McLean, VA Morning 0800-1000 AFTERNOON SESSIONS: NSA unclassified facility in the BWI area. Address will be sent to registered attendees. Afternoon: 1200 - 1400 Afternoon: 1430 - 1630 Registration at: https://engage.redhat.com/forms/stig-workshop

1 0

[PATCH 0/3] [bugfixes] based on STIG feedback
by David Smith 11 Mar '13

11 Mar '13

This patchset resolves tickets based on STIG feedback. David Smith (3): [bugfix] ticket 285 - added Check language allowing forwarding for routers [bugfix] ticket 337 - added language to make Rules NA if no NFS [bugfix] ticket 334 - added text allowing for Postfix to not be installed if CDS RHEL6/input/services/mail.xml | 6 ++---- RHEL6/input/services/nfs.xml | 6 ++++-- RHEL6/input/system/network/kernel.xml | 1 + 3 files changed, 7 insertions(+), 6 deletions(-)

3 5

[PATCH 0/5] [bugfixes] more ticket resolution
by David Smith 11 Mar '13

11 Mar '13

pushing more fixes to resolve tickets David Smith (5): [bugfix] ticket 297 - added maxlogins value [bugfix] ticket 334 - added text exempting CDSes from Postfix requirement [bugfix] ticket 293 - added info to Ctrl-Alt-Del Rule [bugfix] ticket 299 - added finding statement [bugfix] ticket 332 - cleaned up file deletion audit Rule RHEL6/input/services/mail.xml | 5 ++++- RHEL6/input/system/accounts/physical.xml | 8 ++++---- .../accounts/restrictions/account_expiration.xml | 3 ++- RHEL6/input/system/accounts/session.xml | 8 +++----- RHEL6/input/system/auditing.xml | 2 -- 5 files changed, 13 insertions(+), 13 deletions(-)

1 6

[PATCH 0/4] [bugfixes] various changes for ticket resolution
by David Smith 11 Mar '13

11 Mar '13

Resolved a number of tickets with these. David Smith (4): changed Rule to enable postfix changed LSM to SELinux changed unwieldy check command specified "-type f" for permissions check RHEL6/input/auxiliary/alt-titles-stig.xml | 8 ++++---- RHEL6/input/services/mail.xml | 2 +- RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/permissions/files.xml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-)

3 6

RE: scap-security-guide 0.1-10 help
by Rodrian, Logan P (IS) 11 Mar '13

11 Mar '13

Has this always been the case that the CPE/Dictionary is needed for oscap execution? I ask because if this is a new feature, I will ping the SecState list about when they will be including the Dictionary as an argument to their program. Currently, secstate imports only an xccdf and will not work with the SSG v0.1-10....trying to resolve why this is. Logan Rodrian ________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)redhat.com] Sent: Thursday, March 07, 2013 11:05 To: scap-security-guide(a)lists.fedorahosted.org Subject: EXT :Re: scap-security-guide 0.1-10 help On 3/7/13 8:51 AM, Rodrian, Logan P (IS) wrote: It appears that the full command is needed. The scan won't run without the cpe/dictionary reference. The minimal command needed is as follows: oscap xccdf eval --profile <profile> \ --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml Ah, yes. The --cpe is *very* much needed as it provides some platform checks. The others (--report, etc) are optional.

3 2

SSG v0.1-10 Bugs/Notes
by Rodrian, Logan P (IS) 08 Mar '13

08 Mar '13

I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have found some bugs/notes. Each of the following seems to be an issue with the OVAL content/test. * Ensure All Files Are Owned by a User * This reports PASS for me, but is a false positive. Running 'find / -xdev -nouser -print' reveals files that have a user owner that is not local to the system. * Ensure All Files Are Owned by a Group * This reports PASS for me, but is a false positive. Running 'find / -xdev -nogroup -print' reveals files that have a group that is not local to the system. * Set Daemon Umask * The test states it is looking for a umask of 022 or 027. In my /etc/init.d/functions, the umask is 022, but the test reports FAIL. This is a false positive. * Set GNOME Login Inactivity Timeout * GNOME Desktop Screensaver Mandatory Use * Enable Screen Lock Activation After Idle Period * Implement Blank Screen Saver * Enable GUI Warning Banner Text * Each of these tests assume that the execution is on an X system. My system does not have X installed or running, so the tests report FAIL. The test should first check if it is applicable to the test system and if not report NOT APPLICABLE or something similar versus FAIL. * Modify the System Login Banner * This test appears to check for exactly the DoD banner text. Since the verbage states "a message compliant with the local site policy", suggest modifying the test to check for the presence of content in /etc/issue, but perhaps not an exact match, as not all deployments may be DoD systems. * Ensure Host Logs Sent to Remote Host * For TCP, this checks for the following in the rsyslog file: *.* @@loghost.example.com * Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in general they are? In my configuration, I have *.info versus the *.* and the test reports FAIL. I would like to understand the intent on this one so I can comply. * Additionally, my filter portion excludes some logs marked via other ways (read in from files) with the string "*.info;local0.none @@dest-ip" and I want to make sure that even if my string needs to be modified to "*.*;local0.none @@dest-ip" to comply that the test will pass. i.e. that the test is robust enough to understand the negation in the rsyslog configuration and report the correct assessment value. * Configure auditd space_left Action on Low Disk Space * Configure auditd admin_space_left Action on Low Disk Space * For both of these, the contents of /etc/audit/auditd.conf contain the correct key with a case-insensitive value (all caps value of one of the possible values) and the test reports FAIL. THis is a false negative. Suggest making the test case-insensitive in the value match portion. * Disable Network Console (netconsole) * Disable Network Router Discovery Daemon (rdisc) * For both of these, the service is not active/installed, but the test reports FAIL. This is a false negative. * Disable SSH Support for .rhosts Files * Disable Host-Based Authentication * Disable SSH Root Login * For all of these, the required value is present in its entirety, but is preceeded by the comment character, making it inactive. The test reports PASS, which is a false positive. * Additionally, for the SSH Root Login test, the commented value is incorrect and the test reports PASS. In addition to these bugs, I found that the following items did not have any check content ref specified in the XCCDF, thus reported NOTCHECKED. I realize some of the check cannot be performed automatically, but each of these can be, but is not. * Disable Ctrl-Alt-Del Reboot Activation * Install the screen Package * Set GUI Warning Banner Text * Set Default IPTables Policy for Forwarded Packets * Disable ntpdate Service (ntpdate) * Ensure Insecure File Locking is Not Allowed * Verify No netrc Files Exist * Ensure All Accounts on the System Have Unique Names * Set Password to Maximum of Three Consecutive Repeating Characters * Set Password Hashing Algorithm in /etc/pam.d/system-auth * Set Password Hashing Algorithm in /etc/login.defs * Set Password Hashing Algorithm in /etc/libuser.conf * Verify that Shared Library Files Have Restrictive Permissions * Verify that Shared Library Files Have Root Ownership * Verify that System Executables Have Restrictive Permissions * Verify that System Executables Have Root Ownership * Ensure No World-Writable Files Exist * Each of the 5 above can be tested using one of: * `find $dir -xdev -perm /o=w ! $ -type d -perm /o=t $ ! -type l -print` * `find $dir -xdev ! -user root ! -type d ! -type l -print` * Limit the Number of Concurrent Login Sessions Allowed Per User * For this one, perhaps check that the key is present, as the value is up to the system owner. * Uninstall Sendmail Package * Additionally, suggest naming this "Ensure sendmail not installed" or something of that flavor more indicative of what the test is checking for, versus an action. * Enable Logging of All FTP Transactions * Create Warning Banners for All FTP Users * Configure SNMP Service to Use Only SNMPv3 or Newer * Ensure Default Password Is Not Used * For the previous 4, the test must first check applicability (much like the GNOME tests), as my system does not have/support FTP or SNMP and should not have FAIL reported. And the last item--each of the following reports UNKNOWN as the check-content-ref element in the XCCDF references a non-existent id in the OVAL. * Ensure Log Files Are Owned By Appropriate Group * Ensure System Log Files Have Correct Permissions * Ensure Logrotate Runs Periodically --Logan Rodrian

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2013