scap-security-guide July 2014

scap-security-guide@lists.fedorahosted.org

20 participants
35 discussions

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

Baseline configs & DevOps code-a-thon
by Greg Elin 27 Aug '14

27 Aug '14

Double posting to Scap-Security-Guide and OpenSCAP mailing list... Can I get a show of hands a late September or early October, one or two day code-a-thon around baseline configurations and integrating compliance tools with DevOps? The space of SCAP, baselines, and general integration of security with DevOps seems to be getting frothy lately with activity. Examples: http://bit.ly/DevOpsAudit, OpenSCAP on Github, https://github.com/fisma-ready/ubuntu-lts. We also have some work, like http://martin.preisler.me/2014/07/openscap-html-report-redesign/ that could benefit from some shared face time and coding. I think there would be a nice turn out in DC for such an event. Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

5 8

Anyone using rhel6 ssg for centos6?
by Pettorino, Jeffrey D CTR USAF USAFA USAFA/DFAN 22 Aug '14

22 Aug '14

I have been trying to get oscap working on my CentOS6.5 network core, without luck. Everything comes back with "Result notapplicable". I am pretty new to SCAP and XCCDF, but am a long-time user of Nessus and Security Center (prior to ACAS program by DISA). Does anyone have suggestions where I can find some in depth guidance to adjust the rhel6 configs to CentOS? -- Jeff v/r, Jeffrey D. Pettorino, GCIH, CISSP Systems Engineer High Performance Computing Research Center United States Air Force Academy Jeffrey.Pettorino.ctr(a)USAFA.edu 719/333-9391 ---- The use of the Unix philosophy just for UNIX was a great waste. Fortunately, Linux came along. - Bellevue Linux User Group member, 2005

17 39

[PATCH 0/3][bugfix] - sshd OVAL false positives
by Gabe Alford 08 Aug '14

08 Aug '14

These patches fix some OVAL false positives for SSH configuration checks that were showing that they had passed even when they were not configured in sshd_config. Thanks, Gabe Gabe (3): [bugfix] - disable_host_auth OVAL false positive [bugfix] - sshd_disable_rhosts OVAL false positive [bugfix] - sshd_disable_root_login OVAL false positive shared/oval/disable_host_auth.xml | 4 ++-- shared/oval/sshd_disable_rhosts.xml | 4 ++-- shared/oval/sshd_disable_root_login.xml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) -- 2.0.0

2 16

[PATCH] add oval for aide cron job
by Gabe Alford 29 Jul '14

29 Jul '14

Add oval for aide to check that it is running in a cron job. Thanks, Gabe Alford Gabe (1): add aide cron oval check RHEL/6/input/checks/aide_cron_checking.xml | 39 +++++++++++++++++++++++++++ RHEL/6/input/fixes/bash/aide_cron_checking.sh | 1 + RHEL/6/input/system/software/integrity.xml | 1 + 3 files changed, 41 insertions(+) create mode 100644 RHEL/6/input/checks/aide_cron_checking.xml create mode 100644 RHEL/6/input/fixes/bash/aide_cron_checking.sh -- 2.0.0

2 3

[PATCH 0/1] (Resubmit) add oval for aide cron job
by Gabe Alford 29 Jul '14

29 Jul '14

Add oval for aide to check that it is running in a cron job. This is a resubmit. Thanks, Gabe Alford Gabe (1): add aide cron oval check .../6/input/checks/aide_periodic_cron_checking.xml | 39 ++++++++++++++++++++++ .../fixes/bash/aide_periodic_cron_checking.sh | 1 + RHEL/6/input/system/software/integrity.xml | 1 + 3 files changed, 41 insertions(+) create mode 100644 RHEL/6/input/checks/aide_periodic_cron_checking.xml create mode 100644 RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh -- 2.0.0

1 1

Fixed typo in common profile
by Kordell, Luke T 29 Jul '14

29 Jul '14

2 2

modified CSCF profile
by Kordell, Luke T 28 Jul '14

28 Jul '14

2 3

[PATCH 0/4] Apply David Smith's NIST SP 800-53 reference updates to RHEL7 content
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 27 Jul '14

27 Jul '14

These are David Smith's changes emailed to the scap-security-guide list on Thu Jul 17 18:21:29 UTC 2014, but applied to the RHEL/7 directory. Also I found a typo and fixed it both in RHEL/6 and RHEL/7. I'm attempting to send these patches using Outlook. This may fail. Jared Jennings (4): correct punctuation error in NIST SP800-53 reference updated transforms to reflect 800-53 rev4 updated 800-53 control references (services) updated 800-53 control references (system) RHEL/6/input/system/auditing.xml | 2 +- RHEL/7/input/services/base.xml | 18 ++++---- RHEL/7/input/services/obsolete.xml | 28 +++++++------- RHEL/7/input/services/ssh.xml | 4 +- RHEL/7/input/system/auditing.xml | 58 ++++++++++++++-------------- RHEL/7/input/system/network/ipsec.xml | 2 +- RHEL/7/input/system/network/kernel.xml | 2 +- RHEL/7/input/system/network/wireless.xml | 8 ++-- RHEL/7/input/system/software/integrity.xml | 12 +++--- RHEL/7/transforms/constants.xslt | 2 +- RHEL/7/transforms/xccdf2html.xslt | 4 +- 11 files changed, 70 insertions(+), 70 deletions(-)

3 2

[PATCH 00/21] DISA FSO Patch Sync
by Shawn Wells 27 Jul '14

27 Jul '14

DISA FSO has provided the following patches based on end-user feedback and updates done amongst the DISA FSO staff. Submitting to list on their behalf. -shawn Leland Steinke (21): Update aide_build_database Add VMS/DPMS mappings in stig_overlay Update VRelease attributes for DISA FSO VMS tags Add set_ip6tables_default_rule to common, map to STIG RHEL-06-000523 Update VRelease attribute for RHEL-06-000008 (ensure_redhat_gpgkey_installed) Add reload to set_ip6tables_default_rule [bugfix] modify file_permissions_library_dirs to follow symlinks [bugfix] Modify file_permissions_binary_dirs to follow symlinks Increment VRelease for sysctl_ipv6_default_accept_redirects/RHEL-06-000099 Check syscall audits explicitly to avoid partial matches Add applicability statement to audit_rules_time_stime/RHEL-06-000169 Give SELinux precedence over HBSS in install_hids/RHEL-06-000285 Update install_antivirus/RHEL-06-000284 from uvscan to VSEL/nails Remove display_login_attempts/RHEL-06-000506 from RHEL 6 STIG Add display_login_attempts/RHEL-06-000372 to STIG [bugfix] Update selinux_all_devicefiles to "any_exist" Increment OVAL version for selinux_all_devicefiles_labeled Update OVAL version for sysctl_net_ipv6_conf_default_accept_redirects Fix lowercase in system/auditing.xml Update severity of aide_build_database in stig_overlay.xml [bugfix] Correct static sysctl.conf check regex and increment versions RHEL/6/input/auxiliary/stig_overlay.xml | 87 +++++++++++--------- .../checks/selinux_all_devicefiles_labeled.xml | 2 +- RHEL/6/input/checks/sysctl_fs_suid_dumpable.xml | 2 +- .../input/checks/sysctl_kernel_dmesg_restrict.xml | 2 +- RHEL/6/input/checks/sysctl_kernel_exec_shield.xml | 2 +- .../checks/sysctl_kernel_randomize_va_space.xml | 2 +- .../sysctl_net_ipv4_conf_all_accept_redirects.xml | 2 +- ...ysctl_net_ipv4_conf_all_accept_source_route.xml | 2 +- .../sysctl_net_ipv4_conf_all_log_martians.xml | 2 +- .../checks/sysctl_net_ipv4_conf_all_rp_filter.xml | 2 +- .../sysctl_net_ipv4_conf_all_secure_redirects.xml | 2 +- .../sysctl_net_ipv4_conf_all_send_redirects.xml | 2 +- ...sctl_net_ipv4_conf_default_accept_redirects.xml | 2 +- ...l_net_ipv4_conf_default_accept_source_route.xml | 2 +- .../sysctl_net_ipv4_conf_default_rp_filter.xml | 2 +- ...sctl_net_ipv4_conf_default_secure_redirects.xml | 2 +- ...sysctl_net_ipv4_conf_default_send_redirects.xml | 2 +- ...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml | 2 +- ..._net_ipv4_icmp_ignore_bogus_error_responses.xml | 2 +- RHEL/6/input/checks/sysctl_net_ipv4_ip_forward.xml | 2 +- .../checks/sysctl_net_ipv4_tcp_syncookies.xml | 2 +- .../sysctl_net_ipv6_conf_default_accept_ra.xml | 2 +- ...sctl_net_ipv6_conf_default_accept_redirects.xml | 2 +- RHEL/6/input/checks/templates/template_sysctl | 2 +- RHEL/6/input/profiles/common.xml | 1 + RHEL/6/input/system/accounts/pam.xml | 2 +- RHEL/6/input/system/auditing.xml | 3 + RHEL/6/input/system/network/iptables.xml | 2 + RHEL/6/input/system/permissions/files.xml | 4 +- RHEL/6/input/system/software/integrity.xml | 27 ++++-- 30 files changed, 97 insertions(+), 75 deletions(-)

1 44

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2014