scap-security-guide January 2014

scap-security-guide@lists.fedorahosted.org

24 participants
40 discussions

Start a nNew thread

[PATCH 03/10] Moved sshd_disable_rhosts to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 02/10] Moved sshd_set_keepalive to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

Anyone going to Red Hat Summit?
by Shawn Wells 24 Jan '14

24 Jan '14

Red Hat Summit is this coming April [1] and there's a number of security talks planned. One about SSG, "Applied SCAP: Automating security compliance & remediation" was accepted [2] :) Summit passes increased from $995 to $1,495 this week and future increases planned [3]. If anyone from the SSG community would like to attend summit, contact me */_off list_/* and we'll be able to get you registered with the original 'super saver' price. Applies to anyone in the community (note that govvies can register @ $995 at any time by default, so this largely helps out system integrators and commercial guys). No, I don't get secret commissions on this or anything.... we just want to enable as much of the SSG community to attend as possible! Again, contact me /_*off list*_/. [1] http://www.redhat.com/summit/ [2] http://www.redhat.com/summit/sessions/index.html#441 [3] https://redhat.g2planet.com/summit2014/register

1 0

Remaining false positives
by Andrew Gilmore 22 Jan '14

22 Jan '14

I did a fresh git pull on Monday, and ran the stig-rhel6-server-upstream scan. The set of false positives has shrunk, but is still not zero. 1) mountopt_noexec_on_removable_partitions exits with error, when there are no removable partitions configured in fstab 2) file_ownership_library_dirs complains about an /usr/libexec suid abrt file 3) no_files_unowned_by_* are still broken and looking for any files in / 4) enable_execshield and sysctl_kernel_randomize_va_space are failing, although sysctl shows correct results 5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev directories 6) enable_gdm_login_banner didn't get the gconf mandatory check fixed, although all the rest did (YAY!) 7) sysctl_ipv6_default_accept_redirects and service_ip6tables_enabled fail when ipv6 has been disabled via modprobe.d entries 8) install_openswan is obsoleted by libreswan 9) audit_file_access does not check for open_by_handle_at, and fails when the audit rules lines do not contain exactly the content specified. I was very glad to see almost all of the sysctl and gconf false positives fixed! Andrew Gilmore

3 5

Self Introduction
by Graham Williamson 22 Jan '14

22 Jan '14

Hi everyone, My name is Graham (Willo) Williamson and I'm an employee of Northrop Grumman Australia. I'm currently being sub contracted back to very familiar ground, the Australian DoD. I'm one of those lucky people who are working in this latest cyber craze (like that'll last). :) I was in the Royal Australian Air Force for about 14 years and got out to start "earning the big bucks" back in Mar 2011. For basically, the last 6 and a bit years of my time in the Air Force, I was doing CND and some IA on various systems. I originally self taught myself Linux on Fedora Core 2 and one of those big yellow Wiley 'Bible' series books and haven't looked back. Been a fan ever since. I'm looking forward to getting involved and I am willing and able to contribute. Like a couple of the others on this list, git is definitely not my strong suit, but I'm using it daily at the moment and becoming more at one with the force with every passing day. Anyway, I've already joined the git group and Shawn's already hooked me up and approved my membership, so I'm very keen to crack on and get amongst it. Cheers, Willo -- Graham Williamson

6 8

fix CCE-27032-2 no_files_unowned_by_user.xml
by Mercer, Rodney 22 Jan '14

22 Jan '14

Based on comments and recommendations from the following thread, I've submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0036… This only checks /etc/passwd and not any other authorization databases. 8<==================== >From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001 From: Rodney Mercer <rmercer(a)harris.com> Date: Wed, 18 Dec 2013 15:01:25 +0000 Subject: [PATCH] Modified no_files_unowned_by_user.xml modified completely broken no_files_unowned_by_user.xml to properly check all files on the system to make sure that they are owned by a user that resides in /etc/passwd. --- RHEL6/input/checks/no_files_unowned_by_user.xml | 51 ++++++++++++---------- 1 files changed, 28 insertions(+), 23 deletions(-) diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml b/RHEL6/input/checks/no_files_unowned_by_user.xml index a73183a..f3f1276 100644 --- a/RHEL6/input/checks/no_files_unowned_by_user.xml +++ b/RHEL6/input/checks/no_files_unowned_by_user.xml @@ -1,38 +1,43 @@ <def-group> - <definition class="compliance" - id="no_files_unowned_by_user" version="1"> + <definition class="compliance" id="no_files_unowned_by_user" version="1"> <metadata> <title>Find files unowned by a user</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - user</description> + <description>All files should be owned by a user</description> + <reference source="rmercer" ref_id="20131218" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a user" - negate="true" - test_ref="test_20050" /> + <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no user owner" - id="test_20050" version="1"> - <notes> - <note>This will enumerate all files on local - partitions</note> - </notes> - <unix:object object_ref="obj_20022" /> - <unix:state state_ref="state_20050" /> - </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20050" version="1"> - <unix:user_id datatype="int">0</unix:user_id> + + <unix:file_state id="file_permissions_unowned_userid_list_match" version="1"> + <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" /> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20022" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + + <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1"> + <object_component item_field="subexpression" object_ref="file_permissions_unowned_userid_list_object" /> + </local_variable> + + <ind:textfilecontent54_object id="file_permissions_unowned_userid_list_object" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern> + <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1"> + <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> + <filter action="exclude">file_permissions_unowned_userid_list_match</filter> </unix:file_object> + + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + check="all" check_existence="none_exist" comment="Check user ids on all files on the system" + id="no_files_unowned_by_user_test" version="1"> + <unix:object object_ref="file_permissions_unowned_object" /> + </unix:file_test> </def-group> + -- 1.7.1

2 1

OSCAP Anaconda Addon 0.4 available
by Vratislav Podzimek 15 Jan '14

15 Jan '14

A new version of the OSCAP Anaconda Addon integrating the OpenSCAP toolkit with the Anaconda installer is now available for testing. Links, checksums and documentation are available at project's main page: https://fedorahosted.org/oscap-anaconda-addon/ [new in version 0.4] * fixing unreported issues revealed during testing * UX improvements (http://vpodzime.fedorapeople.org/oaa-0.4-changes.webm) * bugs rhbz#1050913, rhbz#1049989, rhbz#1032846 * support for XCCDF tailoring * checking session validity also when using XCCDF benchmark [plans for 0.5] * automatic detection of scap-security-guide if it is available in the compose * support for data stream + tailoring in an archive/RPM * content integrity checking (probably sha256sum as something to start with) -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

1 0

XCCDF and OVAL Editor
by joescap＠mm.st 13 Jan '14

13 Jan '14

Can any one recommend a XCCDF/OVAL editor? I'm just looking for a GUI that us relatively easy to get running and can modify a few of the checks in the content to conform to our organizations policy (password failed attempts for example). I've seen a few, but would like some recommendations. Thanks

3 2

Red Hat and the CentOS Project
by Nunez, Luis K 13 Jan '14

13 Jan '14

I noticed the recent news of Red Hat's intent to partner and collaborate with the CentOS Project and was wondering if SSG will branch on CentOS content? From time to time folks have asked about running SCAP content on the CentOS platform. Could CentOS leverage the shared directory? I am just throwing this out to see the interest level. http://www.redhat.com/about/news/press-archive/2014/1/red-hat-and-centos-joi n-forces Luis Nunez J83B - Industry Collaboration The MITRE Corporation www.mitre.org

4 3

PATCH] [RHEL-7] Silence three 'Double hyphen within comment' RHEL-7 make shorthand2xccdf parser errors
by Jan Lieskovsky 12 Jan '14

12 Jan '14

Running 'make' / 'make shorthand2xccdf' on current RHEL-7 content returns: # make shorthand2xccdf xsltproc -o output/rhel7-shorthand.xml input/guide.xslt input/guide.xml input/services/ssh.xml:389: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:157: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:279: parser error : Double hyphen within comment:  ^ Fix the issues by adding missing enclosing comments (after the change 'make shorthand2xccdf' on RHEL-7 content doesn't issue errors anymore). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2014