scap-security-guide March 2014

scap-security-guide@lists.fedorahosted.org

23 participants
41 discussions

[PATCH 0/2] Remove unused, redundant package_vsftpd_installed.xml check
by Maura Dailey 24 Mar '14

24 Mar '14

This check isn't referenced anywhere and should be removed. It is safe to do so because the existing check package_vsftpd_removed.xml provides the same functionality and more closely reflects the desired final state of the system. - Maura Dailey Maura Dailey (2): This deletes an unnecessary check. package_vsftpd_removed is the check that is actually referenced in other OVAL definitions. vsftpd should not be in packages_installed.csv. RHEL/6/input/checks/package_vsftpd_installed.xml | 26 -------------------- .../input/checks/templates/packages_installed.csv | 1 - 2 files changed, 0 insertions(+), 27 deletions(-) delete mode 100644 RHEL/6/input/checks/package_vsftpd_installed.xml

2 3

Remove Me
by Pacheco, Onell CIV (US) DeCA HQ LEIMP 21 Mar '14

21 Mar '14

Please remove me from your Distribution list Onell Pacheco Information Technology Specialist (INFOSEC) Information Assurance Officer, Datacenter (LEITC) Defense Commissary Agency (DeCA) HQ 804.734.8000 Ext. 4-8193 (DSN: 687)

2 1

xccdf:sub elements commented out
by Šimon Lukašík 20 Mar '14

20 Mar '14

Hello, I have noticed that in the content there is often xccdf:sub element commented out (or even omitted). I wonder why these elements are commented out. I thought, perhaps there was some problem in OpenSCAP which have hold you from usage of sub elements. As a reminder, xccdf:sub elements can be used within a Rule's title, description, or fix elements. Each xccdf:sub element refers to a XCCDF variable. The value of variable depends on selected profile. During a content processing, the xccdf:sub elements shall get resolved according to the profile. I have recently reviewed and fixed OpenSCAP and SCAP-Workbench tools in regard to the xccdf:sub processing. Please consider using/uncommneting xccdf:sub elements. The following snippets from ssg-rhel6-xccdf.xml illustrate the current (non-)usage of sub elements: (1) PASS_MIN_LEN 14 (2) the following lines in <xhtml:code>/etc/default/useradd</xhtml:code>, substituting <xhtml:code>NUM_DAYS</xhtml:code> appropriately: <pre xmlns="http://www.w3.org/1999/xhtml">INACTIVE=NUM_DAYS</pre> (3) to require differing characters when changing passwords, substituting NUM appropriately. The DoD requirement is <xhtml:code>4</xhtml:code>. (4) umask 077 (5) Modify the following line, substituting ACTION appropriately: <pre xmlns="http://www.w3.org/1999/xhtml">space_left_action = ACTION</pre> Possible values for ACTION are described in the <xhtml:code>auditd.conf</xhtml:code> man page. -- Simon Lukasik Security Technologies, Red Hat, Inc.

5 4

Website content fixes
by Kachigian, Christopher R 19 Mar '14

19 Mar '14

Not sure who to contact so I am sending this out to the group, though I think this will fall on Shawn’s lap. Issue 1: The website needs an update: https://fedorahosted.org/scap-security-guide/ The links below no longer work and should be removed. Consume<https://fedorahosted.org/scap-security-guide/#Consume> Enable the open-scap and scap-security-guide yum repositories: $ wget -O /etc/yum.repos.d/epel-6-scap-security-guide.repo \ http://repos.fedorapeople.org/repos/scap-security-guide/epel-6-scap-securit… Issue 2: On the https://fedorahosted.org/scap-security-guide/wiki/downloads page: Download our source code $ git clone git://git.fedorahosted.org/git/scap-security-guide.git shouldn’t it be: $ git clone ssh://git.fedorahosted.org/git/scap-security-guide.git Or $ git clone https://git.fedorahosted.org/git/scap-security-guide.git ?? On the git site: https://git.fedorahosted.org/git/scap-security-guide.git This is stated at the bottom. Clone ssh://git.fedorahosted.org/git/scap-security-guide.git https://git.fedorahosted.org/git/scap-security-guide.git I figure a bit of consistency can’t hurt, esp. for people just getting started and some bad links might scare them away. Thanks, Chris

2 4

[PATCH] Fix check for Red Hat Enterprise Linux 6 installed.
by Šimon Lukašík 19 Mar '14

19 Mar '14

From: Simon Lukasik <slukasik(a)redhat.com> The previous version of the check generated false positives. It was even matching on even Fedora system. Also this new check asserts for any variant of Red Hat Enterprise Linux 6. --- RHEL/6/input/checks/installed_OS_is_rhel6.xml | 35 ++++++++++----------------- 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/RHEL/6/input/checks/installed_OS_is_rhel6.xml b/RHEL/6/input/checks/installed_OS_is_rhel6.xml index 1ffeb53..7f77491 100644 --- a/RHEL/6/input/checks/installed_OS_is_rhel6.xml +++ b/RHEL/6/input/checks/installed_OS_is_rhel6.xml @@ -14,10 +14,8 @@ <criteria> <criterion comment="Installed operating system is part of the unix family" test_ref="test_unix_family" /> - <criterion comment="Red Hat Enterprise Linux 6 Workstation is installed" - test_ref="test_rhel_workstation" /> - <criterion comment="Red Hat Enterprise Linux 6 Server is installed" - test_ref="test_rhel_server" /> + <criterion comment="Red Hat Enterprise Linux 6 is installed" + test_ref="test_rhel_6" /> </criteria> </definition> @@ -30,25 +28,18 @@ </ind:family_state> <ind:family_object id="obj_unix_family" version="1" /> - <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-workstation is version 6" id="test_rhel_workstation" version="1"> - <linux:object object_ref="obj_rhel_workstation" /> - <linux:state state_ref="state_rhel_workstation" /> + <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-* is version 6" id="test_rhel_6" version="1"> + <linux:object object_ref="obj_rhel_release" /> + <linux:state state_ref="state_rhel_6" /> </linux:rpminfo_test> - <linux:rpminfo_state id="state_rhel_workstation" version="1"> - <linux:version operation="pattern match">^6Workstation$</linux:version> + <linux:rpminfo_state id="state_rhel_6" version="1"> + <linux:name operation="pattern match">^redhat-release</linux:name> + <linux:version operation="pattern match">^6[^\d]</linux:version> </linux:rpminfo_state> - <linux:rpminfo_object id="obj_rhel_workstation" version="1"> - <linux:name>redhat-release-workstation</linux:name> - </linux:rpminfo_object> + <linux:rpmverifyfile_object id="obj_rhel_release" version="1"> +  + <linux:filepath>/etc/redhat-release</linux:filepath> + </linux:rpmverifyfile_object> - <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-server is version 6" id="test_rhel_server" version="1"> - <linux:object object_ref="obj_rhel_server" /> - <linux:state state_ref="state_rhel_server" /> - </linux:rpminfo_test> - <linux:rpminfo_state id="state_rhel_server" version="1"> - <linux:version operation="pattern match">^6Server$</linux:version> - </linux:rpminfo_state> - <linux:rpminfo_object id="obj_rhel_server" version="1"> - <linux:name>redhat-release-server</linux:name> - </linux:rpminfo_object> </def-group> -- 1.8.5.3

3 2

[PATCH] Fix check for Red Hat Enterprise Linux 7 installed.
by Šimon Lukašík 18 Mar '14

18 Mar '14

From: Simon Lukasik <slukasik(a)redhat.com> The previous version of the check generated false positives. It was even matching on even Fedora system. Also the version of the redhat-release package has been changed during the past year (it no longer include Server or Workstation string). --- RHEL/7/input/checks/installed_OS_is_rhel7.xml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/RHEL/7/input/checks/installed_OS_is_rhel7.xml b/RHEL/7/input/checks/installed_OS_is_rhel7.xml index dc6c629..060206c 100644 --- a/RHEL/7/input/checks/installed_OS_is_rhel7.xml +++ b/RHEL/7/input/checks/installed_OS_is_rhel7.xml @@ -14,10 +14,12 @@ <criteria> <criterion comment="Installed operating system is part of the unix family" test_ref="test_unix_family" /> - <criterion comment="Red Hat Enterprise Linux 7 Workstation is installed" - test_ref="test_rhel_workstation" /> - <criterion comment="Red Hat Enterprise Linux 7 Server is installed" - test_ref="test_rhel_server" /> + <criteria operator="OR"> + <criterion comment="Red Hat Enterprise Linux 7 Workstation is installed" + test_ref="test_rhel_workstation" /> + <criterion comment="Red Hat Enterprise Linux 7 Server is installed" + test_ref="test_rhel_server" /> + </criteria> </criteria> </definition> @@ -30,23 +32,23 @@ </ind:family_state> <ind:family_object id="obj_unix_family" version="1" /> - <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-workstation is version 7" id="test_rhel_workstation" version="1"> + <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="test_rhel_workstation" version="1"> <linux:object object_ref="obj_rhel_workstation" /> <linux:state state_ref="state_rhel_workstation" /> </linux:rpminfo_test> <linux:rpminfo_state id="state_rhel_workstation" version="1"> - <linux:version operation="pattern match">^7Workstation$</linux:version> + <linux:version operation="pattern match">^7\.\d+$</linux:version> </linux:rpminfo_state> <linux:rpminfo_object id="obj_rhel_workstation" version="1"> <linux:name>redhat-release-workstation</linux:name> </linux:rpminfo_object> - <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-server is version 7" id="test_rhel_server" version="1"> + <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="test_rhel_server" version="1"> <linux:object object_ref="obj_rhel_server" /> <linux:state state_ref="state_rhel_server" /> </linux:rpminfo_test> <linux:rpminfo_state id="state_rhel_server" version="1"> - <linux:version operation="pattern match">^7Server$</linux:version> + <linux:version operation="pattern match">^7\.\d+$</linux:version> </linux:rpminfo_state> <linux:rpminfo_object id="obj_rhel_server" version="1"> <linux:name>redhat-release-server</linux:name> -- 1.8.5.3

3 2

Unable to see list of zip files
by Alvarez, Angelo CIV NMFC_JTWC 17 Mar '14

17 Mar '14

Aloha. According to the Wiki downloads page (https://fedorahosted.org/scap-security-guide/wiki/downloads), I can download the SCAP content in a zip file here: http://repos.fedorapeople.org/repos/scap-security-guide/epel-6/ZIPs/ This URL does not work. v/r Angelo Alvarez, CISSP System Administrator Joint Typhoon Warning Center (JTWC) http://www.usno.navy.mil/NOOC/JTWC email: angelo.alvarez(a)navy.mil (NIPR) email: angelo.alvarez(a)navy.smil.mil (SIPR) email: pfalvan(a)dodiis.ic.gov (JWICS) phone: 808.471.3645

1 0

Custom epel6-ssg-repo is outdated
by Šimon Lukašík 17 Mar '14

17 Mar '14

Hello Security Guides! On a page, https://fedorahosted.org/scap-security-guide/wiki/downloads we advice users to install SSG custom repo in order to install SSG. I believe that this is no longer needed. Jan does amazing job doing things right and pushing SSG through official repositories (fedoras, epel6, and maybe even rhel6). On Friday, I have pushed SSG to epel7 as well. Not only we no longer need this custom repo. But it is already outdated, it does not contain latest 2 versions of SSG. That last fact has bitten us now, when we started crafting better OpenSCAP documentation and we used older SSG packages. The older packages contain different file paths than the latest one. Would it be possible to remove instructions leading to the repo. And perhaps remove the repo as well? Thanks! -- Simon Lukasik Security Technologies, Red Hat, Inc.

2 1

[PATCH] Move disable_prelink OVAL check to shared
by Jan Lieskovsky 13 Mar '14

13 Mar '14

Patch summary: [shared] Move disable_prelink OVAL check to shared [shared] disable_prelink: Allow spaces around PRELINKING=no expression [shared] disable_prelink: Allow comments [Fedora] Start using shared version [RHEL/6] The same Patch details: Based on definition in /etc/cron.daily/prelink: #!/bin/sh . /etc/sysconfig/prelink ... the /etc/sysconfig/prelink file should follow the syntax / format recognized by Bash scripts (i.e. no spaces allowed around the '=' character, comments starting with #, whitespace ignored etc.). Based on that modify the definition of disable_prelink.xml OVAL check it to support this format (IOW allow it to pass also in case like: \tPRELINKING=no\t# This setting should disable prelinking ). Besides that move RHEL/6/ and Fedora disable_prelink.xml version to shared/ directory. Update script versioning and test attestations. The change tested on both RHEL-6 and Fedora systems and seems to be working properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

Choosing security policy in the installer as a proposed Fedora 21 feature
by Vratislav Podzimek 13 Mar '14

13 Mar '14

Hello everybody, I've just created a Fedora 21 feature proposal [1] with the goal of adding the OSCAP Anaconda Addon and SCAP Security Guide to the default/official Fedora 21 installer images (composes) to improve user experience by allowing users to choose security policy for their newly installed system and to promote the two projects, make them more widely used and to attract more developers and contributors. [1] https://fedoraproject.org/wiki/Changes/SecurityPolicyInTheInstaller -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2014