scap-security-guide August 2013

scap-security-guide@lists.fedorahosted.org

34 participants
57 discussions

New Member Intro
by Vincenzo Pierorazio 27 Aug '13

27 Aug '13

Hey everyone - I'm new to this project. I'm a complete novice when it comes with SCAP so please be patient haha. I'm currently having issues with my SSH keys I believe so I've been just pulling the latest repo daily. In the mean time, until I can figure out the disconnect, I believe I have some patches someone can hopefully commit. Add a refine-value tag for the variable to accept a timeout of 15 minutes or less in the CS2 profile. File: .\input\profiles\CS2.xml Line: 271 <refine-value idref="sshd_idle_timeout_value" selector="15_minutes" operator="less than or equal" /> In turn, add a value of 15_minutes/900 in the check for the newly defined value above: FIle: .\input\services\ssh.xml Line: 18 <value selector="15_minutes">900</value> Hopefully that makes some sense and is useful. Still trying to wrap my head around this stuff. Thanks! -- Vincenzo Pierorazio, CISSP, GPEN, C|HFI, OSCP, OSWP Secure Innovations, LLC 443-445-8635 (Office) 443-866-9608 (Cell)

3 2

SSG Happy Hour: Weds 8/28, 4:30pm @ DuClaws Arundel Mills
by Shawn Wells 26 Aug '13

26 Aug '13

It's been awhile since many of us in the MD/DC/VA area have gotten together! This Wednesday Jeff Blank, Dave Smith and I are meeting up at DuClaws Arundel Mills [1] for a happy hour, and we wanted to extend an invite for those in the area to join us. Gives us a chance to plan a few things out (e.g. the remaining OVAL testing, integration of bash scripts, needed profiles like FedRAMP) in a very informal setting. Current plan is to meetup at 4:30 at the Arundel Mills location (it's over near the movie theature): 7000 Arundel Mills Circle Suite R4 Hanover, MD 21076 Feel free to join us! Note this isn't a sponsored event by RH or the government, just an opportunity for locals + interested parties to get together. We'll post "meeting minutes" back to the mailing list... if we can remember them after a few pints ;) Hope to see you there! [1] http://www.duclaw.com/locations.aspx

1 0

rhel6 and ptp
by Grant Street 25 Aug '13

25 Aug '13

Hello We have a requirement to not mount portable storage devices and we have implemented the USB blocking but it appears that gphoto has access to camera's and android phones using PTP. This mounting is done at teh gnome layer as the the device is not visibly mounted from the command line, but can be seen in nautilus under computer:/// I tried the "2.2.2.e. Disable GNOME Automounting" but it still mounts. Any one found a solution to this? Grant

1 1

RHEL-06-000292 - The DHCP client must be disabled if not needed
by Robert Sanders 23 Aug '13

23 Aug '13

Quick question on this one. If I follow the prose directory then any interface on the system that doesn't have a file in /etc/sysconfig/network-scripts is a finding. On my box I've got the virbr0 and virbr0-nic interfaces due to the virtualization stuff installed. Should there be some language in here related to these virtual nics? -Rob

2 2

[PATCH] Some changes to the prose, as well as minor copy editing
by David Smith 23 Aug '13

23 Aug '13

This patchset does the following: 1) files.xml was modified so the titles of the SGID and SUID rules were uniform 2) the introductory text to the DHCP section was heavily modified 3) minor copy editing in the rest of the changed files David Smith (1): Prose changes and copy editing RHEL6/input/services/base.xml | 20 ++++++++++---------- RHEL6/input/services/dhcp.xml | 24 ++++++------------------ RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/services/ssh.xml | 3 +-- RHEL6/input/system/permissions/files.xml | 2 +- 5 files changed, 19 insertions(+), 32 deletions(-)

2 2

[PATCH] OCIL content generation fixup
by Jeffrey Blank 23 Aug '13

23 Aug '13

This patch takes the "conditional clause" attribute from the contrived "ocil-transitional" check system and uses it to create a question for users. This should allow the scap-security-guide content to act as a bridge between the robotic and special "this is a finding" phrasing found in DISA STIGs, and OCIL designed for human interaction. We can generate both. Jeffrey Blank (1): added interrogatory phrase to OCIL questions RHEL6/transforms/xccdf-create-ocil.xslt | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-)

2 2

[PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing
by Maura Dailey 22 Aug '13

22 Aug '13

Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- ...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++--------- 1 files changed, 15 insertions(+), 13 deletions(-) diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml index a5e6334..e0abd50 100644 --- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml +++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml @@ -1,36 +1,38 @@ <def-group> - <definition class="compliance" id="mount_option_nodev_nonroot_local_partitions" version="1"> + <definition class="compliance" + id="mount_option_nodev_nonroot_local_partitions" version="1"> <metadata> <title>Add nodev Option to Non-Root Local Partitions</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The nodev mount option prevents files from being - interpreted as character or block devices. Legitimate character and block - devices should exist in the /dev directory on the root partition or - within chroot jails built for system services. All other locations should not - allow character and block devices.</description> + <description>The nodev mount option prevents files from being interpreted + as character or block devices. Legitimate character and block devices + should exist in the /dev directory on the root partition or within chroot + jails built for system services. All other locations should not allow + character and block devices.</description> + <reference source="MED" ref_id="20130821" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="nodev on local filesystems" test_ref="test_nodev_nonroot_local_partitions" /> + <criterion comment="nodev on local filesystems" + test_ref="test_nodev_nonroot_local_partitions" negate="true" /> </criteria> </definition> - - <linux:partition_test check="all" check_existence="all_exist" id="test_nodev_nonroot_local_partitions" version="1" comment="nodev on local filesystems"> + <linux:partition_test check="all" check_existence="all_exist" + id="test_nodev_nonroot_local_partitions" version="1" + comment="nodev on local filesystems"> <linux:object object_ref="object_non_root_partitions" /> <linux:state state_ref="state_local_nodev" /> </linux:partition_test> - <linux:partition_object id="object_non_root_partitions" version="1">  <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point> <filter action="include">state_local_nodev</filter> </linux:partition_object> - <linux:partition_state id="state_local_nodev" version="1">  <linux:device operation="pattern match">^/dev/.*$</linux:device> - <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options> + <linux:mount_options datatype="string" entity_check="all" + operation="not equal">nodev</linux:mount_options> </linux:partition_state> - </def-group> -- 1.7.1

4 8

SSG line item references
by Robert Sanders 22 Aug '13

22 Aug '13

Quick question - I'm looking at the SSG content files and trying to determine the 'line item' number for a particular check. The DISA STIG content is layed out so that the line item information (i.e., rhel-06-0000001) is inline with a particular check. The SSG content doesn't appear to have this inline, and I suspect that the line items are being generated programmatically via the oscap command but I haven't drilled down to see what oscap is actually doing. Considering that the SSG is the upstream document for the RHEL6 STIG - is DISA responsible for remapping the SSG items to the STIG items, or will DISA adopt the way that the SSG is generating line items? If the latter, could this result in line item x.z.y from version A be a *very* different best than line item x.y.z from version B? -Rob

4 8

[PATCH] Another big batch of updates
by Maura Dailey 21 Aug '13

21 Aug '13

I went through a whole bunch more checks, tested them, tweaked their regex as necessary, and corrected comment fields. I also ran them through tidy and fixed them up a little. A few checks had "dead states" which were never referenced in a test field, so I deleted those. I also added rsyslog to the template file for installed packages, since it was apparently missing, even though the compiled check had been added in a previous commit. - Maura Dailey Maura Dailey (1): Another batch of tested checks. Includes some checks that had their comments expanded or were renamed from random values. RHEL6/input/checks/banner_etc_issue.xml | 1 + .../checks/dovecot_disable_plaintext_auth.xml | 10 ++++--- RHEL6/input/checks/dovecot_enable_ssl.xml | 12 ++++---- .../input/checks/logwatch_configured_hostlimit.xml | 8 ++--- .../checks/logwatch_configured_splithosts.xml | 10 +++---- RHEL6/input/checks/network_sniffer_disabled.xml | 1 + RHEL6/input/checks/ntp_remote_server.xml | 27 +++++++++---------- .../checks/postfix_network_listening_disabled.xml | 26 +++++++++--------- RHEL6/input/checks/postfix_server_banner.xml | 17 ++++-------- RHEL6/input/checks/restrict_serial_port_logins.xml | 7 +++-- .../checks/securetty_root_login_console_only.xml | 5 ++- RHEL6/input/checks/selinux_mode.xml | 9 ++++-- RHEL6/input/checks/selinux_policytype.xml | 18 +++++-------- .../set_password_hashing_algorithm_libuserconf.xml | 3 +- .../set_password_hashing_algorithm_logindefs.xml | 5 ++- RHEL6/input/checks/singleuser_password.xml | 19 ++++++-------- RHEL6/input/checks/smb_client_signing_smb_conf.xml | 23 +++++++++-------- .../sysconfig_networking_bootproto_ifcfg.xml | 20 +++++++------- RHEL6/input/checks/sysconfig_nozeroconf_yes.xml | 22 +++++++--------- .../input/checks/system_info_architecture_x86.xml | 22 ++++++++-------- .../checks/system_info_architecture_x86_64.xml | 22 ++++++++-------- .../input/checks/templates/packages_installed.csv | 3 +- RHEL6/input/checks/tftpd_uses_secure_mode.xml | 3 +- RHEL6/input/checks/xwindows_runlevel_setting.xml | 3 +- 24 files changed, 146 insertions(+), 150 deletions(-)

3 3

False Pass: PASS_MIN_DAYS /etc/login.defs
by Stuart Green 21 Aug '13

21 Aug '13

Just happened across this while I was modding an incorrect parameter. Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs seems to pass regardless of the number being higher than 1. Mine was set to 7 and was passing, so I set it to 100 for another run through and it still passed. Note: I'm not sure if these login.defs are actually necessary, well not in a PAM environment. When PAM's handling the restrictions login.defs is not involved. Citation: http://www.linuxmanpages.com/man5/login.defs.5.php (bug section) Cheers, Stu

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2013