scap-security-guide January 2014

scap-security-guide@lists.fedorahosted.org

24 participants
40 discussions

Problem with Setting faillock Account Lock Time
by Spice, Adam M CTR USARMY ARL (US) 14 May '14

14 May '14

All, My systems failed the scans for CCE-26844-1 (Set Deny For Failed Password Attempts), CCE-27110-6 (Set Lockout Time For Failed Password Attempts) and CCE-27215-3 (Set Interval For Counting Failed Password Attempts). I was able to resolve the first and last by following the fix text, but CCE-27110-6 remains a problem. The fix text instructs me to add the following lines: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900 auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900 ... directly beneath the following line in /etc/pam.d/system-auth: auth required pam_env.so However, following these instructions results in a system whose GDM prompts me for a username, but never gets to the password. The logs show "gkr-pam: no password is available for user." I performed many Google searches, not really finding much that helped me other than an old message in this group: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-February/0 02601.html Unfortunately, I didn't see a resolution. The person who started that thread opened a ticket, but it doesn't look like it was addressed: https://fedorahosted.org/scap-security-guide/ticket/255 He also referenced a Red Hat Solution that provides instructions on enabling faillock; following this, I was able to restore my system to functionality. I could login; if I failed my attempt three times, I could no longer login; pam_tally2 no longer reported failed logins, but faillock did. I haven't yet spent the week to determine whether or not the unlock_time parameter is being applied (if you know of a way to report remaining time until an account unlocks, that would help). Is there any guidance available regarding passing this scan without disabling my system? Thank you! -- Adam Spice Contractor, STG Unix support, Army Research Labs

4 6

FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The updates validated with OSCAP, but the verify-references.py script spat it up. It looks good to me, otherwise. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

4 9

Rule ensure_redhat_gpgkey_installed
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The OVAL check for the Red Hat release and auxiliary key packages is passing when the packages are not installed. The check_existence and check attributes on the associated rpminfo_test elements are set to "any_exist" and "only one", respectively. Shouldn't the check_existence attribute be "at_least_one_exists" for these tests instead? Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 1

[PATCH] correct several STIG/SSG mappings
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

These are corrections to several mappings in stig_overlay.xml. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/input/auxiliary/stig_overlay.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 9b613eb..8e89373 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -66,7 +66,7 @@ <overlay owner="disastig" ruleid="no_hashes_outside_shadow" ownerid="RHEL-06-000031" disa="366" severity="medium"> <title>The /etc/passwd file must not contain password hashes.</title> </overlay> - <overlay owner="disastig" ruleid="no_uidzero_except_root" ownerid="RHEL-06-000032" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="RHEL-06-000032" disa="366" severity="medium"> <title>The root account must be the only account having a UID of 0.</title> </overlay> <overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium"> @@ -234,7 +234,7 @@ <overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="RHEL-06-000098" disa="366" severity="medium"> <title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title> </overlay> - <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_default_accept_redirects_value" ownerid="RHEL-06-000099" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="sysctl_ipv6_default_accept_redirects" ownerid="RHEL-06-000099" disa="366" severity="medium"> <title>The system must ignore ICMPv6 redirects by default.</title> </overlay> <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium"> @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -747,16 +747,16 @@ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="RHEL-06-000341" disa="366" severity="high"> <title>The snmpd service must not use a default password.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> <title>The system default umask for the bash shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> <title>The system default umask for the csh shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_etc_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> <title>The system default umask in /etc/profile must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_logindefs" ownerid="RHEL-06-000345" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_login_defs" ownerid="RHEL-06-000345" disa="366" severity="low"> <title>The system default umask in /etc/login.defs must be 077.</title> </overlay> <overlay owner="disastig" ruleid="umask_for_daemons" ownerid="RHEL-06-000346" disa="366" severity="low"> -- 1.7.1

3 6

[PATCH] update disable_user_list check and fix and add OVAL
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

This patch includes OVAL for the disable_user_list Rule. It also updates the check and fix to look at the same thing. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 2

Cron and faillog/lastlog
by Kayse, Josh 16 Feb '14

16 Feb '14

Per the RHEL6 Guide I have configured my system to utilize faillock and lastlog. Now I have found that cron no longer works. I have tracked it down to being an SELinux problem. crond_t is trying to read/write lastlog_t and faillog_t files. Has anyone else run in to this problem or have recommendations? My findings so far have shown that cron requires auth, account, and session from password-auth. Inside password-auth we have the appropriate faillock/lastlog lines in auth/account/session. Previously we have put the faillock/lastlog lines in the individual services that users can use to access the system (gdm, sshd, login, etc) but this was not compliant with the SSG/STIG. Should we go back to placing these lines in the individual services or grant the permission to crond_t? Could this be because we disable the unconfined domain? Thanks, -josh -- 404.407.6630

3 7

System UIDs/GIDs in RHEL7 (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 10 Feb '14

10 Feb '14

Classification: UNCLASSIFIED Caveats: NONE https://lists.fedoraproject.org/pipermail/devel/2011-May/151663.html Will UID_MIN and GID_MIN default to 1000 in RHEL7 as well? I have not had (and do not have, sadly) time to check out the RHEL7 beta, but a quick search of several of the documentation pages didn't mention this. I would imagine so, given things like: https://bugzilla.redhat.com/show_bug.cgi?id=907312 If so, should we expect the STIG for RHEL7 to reflect this, counting everything 1000 and below as a "system" account/group for relevant rules? Just trying to get a head start on potentially necessary UID/GID changes. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

5 6

Re: [PATCH 0/2] Pushing SCAP workbook
by Eric Christensen 30 Jan '14

30 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Mon, Jan 27, 2014 at 11:06:54PM -0500, Shawn Wells wrote: > From 4b23a6a448a97a9edc67da602a298a97857e606d Mon Sep 17 00:00:00 2001 > From: Shawn Wells <shawn(a)redhat.com> > Date: Mon, 27 Jan 2014 23:03:13 -0500 > Subject: [PATCH 0/2] Pushing SCAP workbook > > Pushing the SCAP workbook ODT into the source tree. Long-term goal to convert to DocBook, however want to get the content into the community in support of upcoming trainings. I thought I already had it up there but I might have just seen it there from when you pushed it. I mostly marked up chapter five yesterday and committed that to the repo. Still need to markup chapter four and then go back to all the spots where I was lazy and didn't want to do the annoying markups. Robin made lots of notes on his [physical] copy of the guide and so I'm hoping to create patches from that to start a discussion here on potential changes to the document. - -- Eric - -------------------------------------------------- Eric "Sparks" Christensen Red Hat, Inc - Product Security Team sparks(a)redhat.com - sparks(a)fedoraproject.org 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJS6SlBAAoJEB/kgVGp2CYviwUL/1DxHrA+syC1JnIEg+UT1Wl7 SPFhS62JvWhf6u8KK+a/1LXDyzewmQjnvekjlPT0gK/ftb+bAbsG77WNf78MTLI6 gkVobdOUevTk6RH7K1lDK46aZN+EBBsHN7QF3FNxkrSxgEhW3a9bF1yEIKxVOLzQ e3woTzwGy9CW5B3DagwfNzNH225EMJfaEiLbm2ukBLzw8YeaUqGZtcpxNhUq6rrm HhWxWPfprnGOejLg94qDcyA6fSW4KgwWZrk39PYiP0HYTElIJDpz6LTYvOFLGDZu b/FZmMginvcrYnEGZdgF55jMoTArflpG3GvVdmGO0s6bMYxbg9zQpCqNSSZBd8Ed +jQNa0JLngSKzNSf6H3LniAvSn17aioWljepckB4Uqe1dQmnEiYx0ByzqDYd7Mkn KkJsg31/G54H33tVnaYb/uCwHnEooC3CaYScai8Fj1ffUuu5FdU2n1GY31kY9Zil BCcvpEWffLpp2pgJaslNvWVVT3ylOIkJxrLJbQHstA== =+roG -----END PGP SIGNATURE-----

2 1

git push error: no DAV locking support
by Mercer, Rodney 30 Jan '14

30 Jan '14

List Members: Can anyone give advise on overcoming this "git push" problem? [root@wahoo scap-security-guide]# git push -v Pushing to https://git.fedorahosted.org/git/scap-security-guide.git error: no DAV locking support on https://git.fedorahosted.org/git/scap-security-guide.git/ fatal: git-http-push failed Here is my .git/config [root@wahoo scap-security-guide]# vim .git/config [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] fetch = +refs/heads/*:refs/remotes/origin/* url = https://git.fedorahosted.org/git/scap-security-guide.git [branch "master"] remote = origin merge = refs/heads/master TIA, Rodney.

3 6

[PATCH] Resubmitting Modified no_files_unowned_by_user.xml
by Mercer, Rodney 28 Jan '14

28 Jan '14

Shawn, Due to the change in directory structure, RHEL6 vs. RHEL/{6,7}, I was not able to “git push” this modification into the project, so I performed another "git commit" after a fresh "git clone" I need a "re-ack" please and I will promptly "git push" See https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-January/0… for the original ack. Rodney. ------- Based on comments and recommendations from the following thread, I've submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0036… This only checks /etc/passwd and not any other authorization databases. 8<==================== >From a03058b43bd3aec3c8c02c34911f7d5751b7b796 Mon Sep 17 00:00:00 2001 From: Rodney Mercer <rmercer(a)harris.com> Date: Tue, 28 Jan 2014 15:01:58 +0000 Subject: [PATCH] modified completely broken no_files_unowned_by_user.xml to properly check all files on the system to make sure that they are owned by a user that resides in /etc/passwd. --- RHEL/6/input/checks/no_files_unowned_by_user.xml | 51 ++++++++++++---------- 1 files changed, 28 insertions(+), 23 deletions(-) diff --git a/RHEL/6/input/checks/no_files_unowned_by_user.xml b/RHEL/6/input/checks/no_files_unowned_by_user.xml index a73183a..f3f1276 100644 --- a/RHEL/6/input/checks/no_files_unowned_by_user.xml +++ b/RHEL/6/input/checks/no_files_unowned_by_user.xml @@ -1,38 +1,43 @@ <def-group> - <definition class="compliance" - id="no_files_unowned_by_user" version="1"> + <definition class="compliance" id="no_files_unowned_by_user" version="1"> <metadata> <title>Find files unowned by a user</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - user</description> + <description>All files should be owned by a user</description> + <reference source="rmercer" ref_id="20131218" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a user" - negate="true" - test_ref="test_20050" /> + <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no user owner" - id="test_20050" version="1"> - <notes> - <note>This will enumerate all files on local - partitions</note> - </notes> - <unix:object object_ref="obj_20022" /> - <unix:state state_ref="state_20050" /> - </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20050" version="1"> - <unix:user_id datatype="int">0</unix:user_id> + + <unix:file_state id="file_permissions_unowned_userid_list_match" version="1"> + <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" /> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20022" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + + <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1"> + <object_component item_field="subexpression" object_ref="file_permissions_unowned_userid_list_object" /> + </local_variable> + + <ind:textfilecontent54_object id="file_permissions_unowned_userid_list_object" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern> + <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1"> + <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> + <filter action="exclude">file_permissions_unowned_userid_list_match</filter> </unix:file_object> + + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + check="all" check_existence="none_exist" comment="Check user ids on all files on the system" + id="no_files_unowned_by_user_test" version="1"> + <unix:object object_ref="file_permissions_unowned_object" /> + </unix:file_test> </def-group> + -- 1.7.1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2014