scap-security-guide October 2014

scap-security-guide@lists.fedorahosted.org

16 participants
17 discussions

SSG reaction wrt to "POODLE" CVE flaw required?
by Jan Lieskovsky 15 Oct '14

15 Oct '14

Hello folks, in relation to the recent SSLv3 CVE-2014-3566 / "POODLE" flaw: [1] http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-flaw… got wondering if there's anything SSG should do to react against it. Possibly to add / update system service rules checking for system SSL version that it is higher than SSLv3? [1] suggest httpd would be one candidate, but I am sure there would be more of them. Should this be investigated further & particular rules updated? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: For those possibly wondering the proposal is not to add rule checking particular package version is >= than the updated version disabling use of SSLv3 (IOW not to perform the CVE check itself). But rather check configuration of possibly affected system services, if they aren't using SSLv3 via their configuration files (since setting default SSL version higher than SSLv3 is one thing, but actually checking if that version isn't enabled again [by administrator] an another one).

2 3

RHEL7 GDM broken with SELinux + noexec /var/tmp
by Trevor Vaughan 08 Oct '14

08 Oct '14

FYI, as of right now, if you add noexec to /var/tmp *and* enable SELinux in enforcing mode, GDM will not start. Wanted you all to know to prevent head+desk issues. Bugs have been filed, news at 11. Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information --

3 6

(RHEL7) IPTables vs FirewallD
by Crawford, Nicholas P CTR USARMY RDECOM CERDEC (US) 08 Oct '14

08 Oct '14

P { MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px } Currently it looks like the momentum is towards tables. The updates from Maura Dailey [1] for systemd fixed the majority of the checks. Additionally future editions of RHEL 7 may include nftables as it's currently in Tech Preview. . IPTables work is already done, seems to still be valid, and requires no obvious updates. . FirewallD, will require some work (see below). . NFTables, TBD. If the intent is to support both, then the logical fork would be at the currently active service. Further checks will need to rely on the results of which firewall is in use. Is it possible to logically fork in OVAL? >From the rhel7-guide and stig table it appears that our only automated checks are: 1) Is it enabled? The actual requirement is that the system provides an IPv4 and IPv6 firewall. FirewallD is both an IPv4 and and IPv6 firewall and satisfies this requirement. Resolution: `systemctl is-active firewalld` should return "active". 2) Are the default INPUT/FORWARD policies set to DROP? The actual requirement is the firewall must be DAPE (Deny All Permit by Exception), the FirewallD Zone/Target is synonymous with this requirement. firewalld always leaves the tables policy as ACCEPT, additionally firewalld doesn't use /etc/sysconfig/ip[6]tables. Thus the current check will always fail. Further, compliant /etc/sysconfig/ip[6]tables files while using firewalld could lead to a false-negative. All default zones appear to meet this requirement except trusted which defaults to ACCEPT. The end-user can create and modify zones with the ACCEPT target. A check of the active zones' targets should verify that none are set to ACCEPT. Proposal: the check should simply ensure that active zones' targets are not set to ACCEPT. `firewall-cmd --get-default-zone` , `firewall-cmd --get-active-zones` , `firewall-cmd --get-target` , `firewall-cmd --zone=<zone> --get-target`. The get-target output will be one of DROP, %%REJECT%%, ACCEPT or {chain}_{zone}. {chain}_{zone} was changed to "default" upstream with commit 267bb9d103f7134d8d0116ab0b7d3aaf38f5f3c8 [2]. As far as I can tell, as long as the target is not ACCEPT, it's a DAPE firewall. Further hardening More firewalld work is required to support ICMP hardening, suspicious source log drops, and services hardening for both implementation and evaluation. Services seems pretty simple, ICMP and suspicious source appear to require RichLanguage [3]. Whether firewalld is capable of accepting the current ICMP rules isn't immediately obvious as Fedora's [4] and Red Hat's [5] documentation only point to "icmp-block". Potentially the logic can be reversed. Change the current allow echo-reply (0), destination-unreachable (3), time-exceeded (11) and instead block the remaining firewalld supported icmp types; parameter-problem (12), redirect (5), router-advertisement (9), router-solicitation (10), source-quench (4). However, this doesn't address over 30 other defined and 200 undefined ICMP types that would be allowed because they can't be blocked by firewalld. With firewalld there may be additional checks to add. For example, the default zone "external" includes masquerading, this zone shouldn't be active unless the system is a router. To check for the presence of masquerading `firewall-cmd --zone=<zone> --query-masquerade` should return no for active zones. References [1] https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-February/… [2] https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=267bb9d103f7134d… [3] https://fedoraproject.org/wiki/FirewallD [4] http://fedoraproject.org/wiki/Features/FirewalldRichLanguage [5] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… -- Nicholas P. Crawford Senior UNIX Systems Administrator contractor, General Dynamics Information Technology NVESD Network Services Branch, US Army email: Nicholas.Crawford(a)gdit.com comm: (703) 704-2299 dsn: (312) 654-2299 cell: (571) 225-1283

4 6

RHEL 7 Direction
by Crawford, Nicholas P CTR USARMY RDECOM CERDEC (US) 06 Oct '14

06 Oct '14

P { MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px } Greetings, I had a couple of questions about the direction the RHEL 7 SSG will be going; Particularly with the below new subsystems in 7; gconf vs dconf (GNOME 2 vs GNOME 3) Has there been a decision on how to check and remediate with dconf? iptables vs firewalld Has there been a decision on which method will go forward for check / remediation? chrony vs ntpd Has there been a decision on which to use and which will go forward for check / remediation? Thank you for your time, -Nick -- Nicholas P. Crawford Senior UNIX Systems Administrator contractor, General Dynamics Information Technology NVESD Network Services Branch, US Army email: Nicholas.Crawford(a)gdit.com comm: (703) 704-2299 dsn: (312) 654-2299 cell: (571) 225-1283

5 6

scap-security-guide 0.1.19 is now live
by Jan Lieskovsky 06 Oct '14

06 Oct '14

Hello folks, I am pleased to announce the availability of scap-security-guide of version 0.1.19: [1] https://github.com/OpenSCAP/scap-security-guide/tree/v0.1.19 [2] http://repos.ssgproject.org/sources/scap-security-guide-0.1.19.tar.gz [3] https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.19.tar.gz Major Changes since v0.1.18: ---------------------- * multiple bugfixes for RHEL-6 content (the list is too long to be detailed here, but major keyword for this release is / was 'stabilization'), * enhancements of RHEL-7 RHT-CCP profile content (68 rules now enabled by default + fixes to many other rules). For detailed (pre)view of changes since v0.1.18 version have a look at: [4] https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone:0.1.19+i… You are encouraged to check [2], [3] out. As always should you encounter some issue with the content, kindly report at: [5] https://github.com/OpenSCAP/scap-security-guide/issues/new Happy hardening. Jan (on behalf of the SSG team) -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

5 7

[PATCH] [RHEL7] Replace Openswan with Libreswan
by Nick Crawford 03 Oct '14

03 Oct '14

From: neo-aeon <nick(a)null.net> Openswan has been replaced with Libreswan in 7. neo-aeon (1): Replace Openswan with Libreswan RHEL/7/input/auxiliary/stig_overlay.xml | 2 +- .../fixes/bash/package_libreswan_installed.sh | 1 + RHEL/7/input/system/network/ipsec.xml | 14 +++++++------- 3 files changed, 9 insertions(+), 8 deletions(-) create mode 100644 RHEL/7/input/fixes/bash/package_libreswan_installed.sh

2 2

[PATCH] [RHEL7] Update RHEL6 to 7 ext4 to xfs
by Nick Crawford 03 Oct '14

03 Oct '14

From: neo-aeon <nick(a)null.net> Simple system permissions update for RHEL6 to 7 neo-aeon (1): change ext4 to xfs and RHEL 6 to RHEL7 RHEL/7/input/system/permissions/permissions.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide October 2014