scap-security-guide July 2014

scap-security-guide@lists.fedorahosted.org

20 participants
35 discussions

first post
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

Hi, I'm Jared Jennings. I work under contract as an admin at the US Air Force SEEK EAGLE Office (AFSEO). Engineers here deal with the problem of aircraft-store compatibility, where "store" means "something you put on the aircraft," like a missile, bomb or fuel tank. There's lots of modelling and simulation going on here, on Windows, Linux and Mac workstations, and Linux HPC clusters. I make the Linux and Mac stuff compliant with STIGs, and document the compliance. So I've built CMITS (Configuration Management for IT Systems), out of Puppet, LaTeX and Python. Folks with DoD certificates can check it out from <https://software.forge.mil/svn/repos/dodpuppet/cmits-release>. Besides configuring RHEL5, RHEL6 and Snow Leopard hosts, it builds documentation that answers the questions, "Do we have everything covered? How are we complying with requirement X? Why are we not complying with requirement Y? Requirement Z says something should be written down; where is it?" Now, RHEL7 is out. Dave and Gunnar have been going on about it for months <http://dgshow.org/>. I want to run it. But I need a STIG to comply with. And here is a community where I can help build such a thing. Hello, community! -- Jared Jennings, RHCE, Network Administrator, SURVICE Engineering Co.

4 5

[PATCH 4/4] updated 800-53 control references (system)
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like c20e0403 from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/input/system/auditing.xml | 58 ++++++++++++++-------------- RHEL/7/input/system/network/ipsec.xml | 2 +- RHEL/7/input/system/network/kernel.xml | 2 +- RHEL/7/input/system/network/wireless.xml | 8 ++-- RHEL/7/input/system/software/integrity.xml | 12 +++--- 5 files changed, 41 insertions(+), 41 deletions(-) diff --git a/RHEL/7/input/system/auditing.xml b/RHEL/7/input/system/auditing.xml index 9711628..aedab59 100644 --- a/RHEL/7/input/system/auditing.xml +++ b/RHEL/7/input/system/auditing.xml @@ -510,7 +510,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_adjtimex" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -538,7 +538,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_settimeofday" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -564,7 +564,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_stime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -592,7 +592,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_clock_settime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -617,7 +617,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_watch_localtime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> </Group> @@ -646,7 +646,7 @@ unexpected users, groups, or modifications should be investigated for legitimacy.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_usergroup_modification" /> -<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/> +<ref nist="AC-2(4),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/> </Rule> <Rule id="audit_network_modifications"> @@ -672,7 +672,7 @@ than administrator action. Any change to network parameters should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_networkconfig_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Rule id="file_permissions_var_log_audit"> @@ -729,7 +729,7 @@ arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_mac_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Group id="audit_dac_actions"> @@ -779,7 +779,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_chmod" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_chown"> @@ -805,7 +805,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_chown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchmod"> @@ -831,7 +831,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchmod" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchmodat"> @@ -857,7 +857,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchmodat" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchown"> @@ -883,7 +883,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchownat"> @@ -909,7 +909,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchownat" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fremovexattr"> @@ -935,7 +935,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fremovexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fsetxattr"> @@ -961,7 +961,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fsetxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lchown"> @@ -987,7 +987,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lchown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lremovexattr"> @@ -1013,7 +1013,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lremovexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lsetxattr"> @@ -1039,7 +1039,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lsetxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_removexattr"> @@ -1065,7 +1065,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_removexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_setxattr"> @@ -1091,7 +1091,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_setxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> </Group>  @@ -1108,7 +1108,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi as an attacker attempting to remove evidence of an intrusion.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_login_events" /> -<ref nist="AC-17(7),AU-1(b),IR-5" /> +<ref nist="AC-3(10),AU-1(b),IR-5" /> </Rule> <Rule id="audit_manual_session_edits"> @@ -1125,7 +1125,7 @@ storing such process information, add the following to as an attacker attempting to remove evidence of an intrusion.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_session_events" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Rule id="audit_file_access"> @@ -1146,7 +1146,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol these events could serve as evidence of potential system compromise.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_unsuccessful_file_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" /> </Rule> <Rule id="audit_privileged_commands"> @@ -1174,7 +1174,7 @@ unusual activity. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_privileged_commands" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),IR-5" disa="40" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> <tested by="DS" on="20121024"/> </Rule> @@ -1196,7 +1196,7 @@ trail should be created each time a filesystem is mounted to help identify and g loss.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_media_export" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> <tested by="DS" on="20121024"/> </Rule> @@ -1217,7 +1217,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as malicious processes that attempt to delete log files to conceal their presence.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_file_deletion_events" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_sysadmin_actions"> @@ -1235,7 +1235,7 @@ To verify that auditing is configured for system administrator actions, run the of what was executed on the system, as well as, for accountability purposes.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_sysadmin_actions" /> -<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-2(7)(b),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> <tested by="DS" on="20121024"/> </Rule> @@ -1257,7 +1257,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp to have an audit trail of modules that have been introduced into the kernel.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_kernel_module_loading" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_config_immutable"> diff --git a/RHEL/7/input/system/network/ipsec.xml b/RHEL/7/input/system/network/ipsec.xml index b05ed1a..4e8186d 100644 --- a/RHEL/7/input/system/network/ipsec.xml +++ b/RHEL/7/input/system/network/ipsec.xml @@ -19,7 +19,7 @@ transmitted over a wide area network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_openswan_installed" /> -<ref nist="AC-17, MA-4, SC-9" disa="1130,1131" /> +<ref nist="AC-17, MA-4, SC-8" disa="1130,1131" /> </Rule> </Group> diff --git a/RHEL/7/input/system/network/kernel.xml b/RHEL/7/input/system/network/kernel.xml index 3c8b75f..fe7505f 100644 --- a/RHEL/7/input/system/network/kernel.xml +++ b/RHEL/7/input/system/network/kernel.xml @@ -262,7 +262,7 @@ sign of nefarious network activity. Logging these packets enables this activity to be detected.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" /> -<ref nist="AC-17(7),CM-7" disa="126"/> +<ref nist="AC-3(10),CM-7" disa="126"/> <tested by="DS" on="20121024"/> </Rule> diff --git a/RHEL/7/input/system/network/wireless.xml b/RHEL/7/input/system/network/wireless.xml index 19b84be..869dc55 100644 --- a/RHEL/7/input/system/network/wireless.xml +++ b/RHEL/7/input/system/network/wireless.xml @@ -35,7 +35,7 @@ to reboot the system first. </rationale> <ident cce="RHEL7-CCE-TBD" />  -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> </Rule> <Rule id="deactivate_wireless_interfaces"> @@ -65,7 +65,7 @@ protocols which were not designed with security in mind. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="wireless_disable_interfaces" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> <tested by="DS" on="20121025"/> </Rule> @@ -84,7 +84,7 @@ Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_bluetooth_disabled" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> </Rule> @@ -106,7 +106,7 @@ from loading the kernel module provides an additional safeguard against its activation.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="kernel_module_bluetooth_disabled" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> </Rule> diff --git a/RHEL/7/input/system/software/integrity.xml b/RHEL/7/input/system/software/integrity.xml index a2a6921..b250460 100644 --- a/RHEL/7/input/system/software/integrity.xml +++ b/RHEL/7/input/system/software/integrity.xml @@ -41,7 +41,7 @@ The AIDE package must be installed if it is to be available for integrity checki </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_aide_installed" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28, SI-7" disa="1069"/> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28, SI-7" disa="1069"/> <tested by="DS" on="20121024"/> </Rule> @@ -61,7 +61,7 @@ of AIDE, because it changes binaries. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="disable_prelink" /> -<ref nist="CM-6(d),CM-6(3),SC-28, SI-7" /> +<ref nist="CM-6(d),SC-28, SI-7" /> </Rule> <Rule id="aide_build_database"> @@ -82,7 +82,7 @@ For AIDE to be effective, an initial database of "known-good" information about must be captured and it should be able to be verified against the installed files. </rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" /> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" /> </Rule> <Rule id="aide_periodic_cron_checking" severity="medium"> @@ -101,7 +101,7 @@ By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. </rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> </Group> @@ -142,7 +142,7 @@ The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="rpm_verify_permissions" /> -<ref nist="AC-6,CM-6(d),CM-6(3)" disa="1493,1494,1495" /> +<ref nist="AC-6,CM-6(d),SI-7" disa="1493,1494,1495" /> </Rule> <Rule id="rpm_verify_hashes"> @@ -173,7 +173,7 @@ information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="rpm_verify_hashes" /> -<ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" /> +<ref nist="CM-6(d),SI-7" disa="1496" /> </Rule> </Group> -- 1.7.1

2 1

[PATCH 3/4] updated 800-53 control references (services)
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like 62466610 from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/input/services/base.xml | 18 +++++++++--------- RHEL/7/input/services/obsolete.xml | 28 ++++++++++++++-------------- RHEL/7/input/services/ssh.xml | 4 ++-- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/RHEL/7/input/services/base.xml b/RHEL/7/input/services/base.xml index 4f2c05a..61c4ac0 100644 --- a/RHEL/7/input/services/base.xml +++ b/RHEL/7/input/services/base.xml @@ -22,7 +22,7 @@ vulnerabilities in software executing on the local machine, as well as sensitive information from within a process's address space or registers.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_abrtd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="381" /> +<ref nist="CM-7" disa="381" /> </Rule> <Rule id="service_acpid_disabled"> @@ -153,7 +153,7 @@ crash, which can load information from the crashed kernel for analysis. is little need to run the kdump service.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_kdump_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> </Rule> @@ -205,7 +205,7 @@ kernel panics, which is not common. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_netconsole_disabled" /> -<ref nist="AC-17(8),CM-7" disa="381" /> +<ref nist="CM-7" disa="381" /> </Rule> <Rule id="service_ntpdate_disabled"> @@ -224,7 +224,7 @@ reboots. In any event, the functionality of the ntpdate service is now available in the ntpd program and should be considered deprecated.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_ntpdate_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -260,7 +260,7 @@ preventing conflicting usage of ports in the reserved port range, but it can be disabled if not needed.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_portreserve_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> <tested by="DS" on="20121024"/> </Rule> @@ -298,7 +298,7 @@ the system is not intended to receive AMQP traffic, then the <tt>qpidd</tt> service is not needed and should be disabled or removed.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_qpidd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> </Rule> <Rule id="service_quota_nld_disabled"> @@ -337,7 +337,7 @@ some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rdisc_disabled" /> -<ref nist="AC-17(8),AC-4,CM-7" disa="382" /> +<ref nist="AC-4,CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -356,7 +356,7 @@ desirable for some environments. However, if the system is being managed by RHN RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rhnsd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -395,7 +395,7 @@ use Kerberos and LDAP. For others, however, in which only local files may be consulted, it is not necessary and should be disabled.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_saslauthd_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> <tested by="DS" on="20121024"/> </Rule> diff --git a/RHEL/7/input/services/obsolete.xml b/RHEL/7/input/services/obsolete.xml index c1f594f..5c88422 100644 --- a/RHEL/7/input/services/obsolete.xml +++ b/RHEL/7/input/services/obsolete.xml @@ -41,7 +41,7 @@ attacks against xinetd itself. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_xinetd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -60,7 +60,7 @@ xinetd service's accidental (or intentional) activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_xinetd_removed" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -87,7 +87,7 @@ subject to man-in-the-middle attacks. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_telnetd_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" /> +<ref nist="CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" /> <tested by="DS" on="20121026"/> </Rule> @@ -103,7 +103,7 @@ telnet service's accidental (or intentional) activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_telnet-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> </Group> @@ -128,7 +128,7 @@ activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_rsh-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> @@ -147,7 +147,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rexec_disabled" /> -<ref nist="AC-17(8),CM-7" disa="68,1436"/> +<ref nist="CM-7" disa="68,1436"/> <tested by="DS" on="20121026"/> </Rule> @@ -166,7 +166,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rsh_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436" /> +<ref nist="CM-7,IA-5(1)(c)" disa="68,1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -202,7 +202,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rlogin_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="1436" /> +<ref nist="CM-7,IA-5(1)(c)" disa="1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -225,7 +225,7 @@ of an Rsh trust relationship. used in conjunction with the R-services, they can allow unauthenticated access to a system.</rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="AC-17(8),CM-7" disa="1436" /> +<ref nist="CM-7" disa="1436" /> <oval id="no_rsh_trust_files" /> <tested by="DS" on="20121026"/> </Rule> @@ -252,7 +252,7 @@ accidental (or intentional) activation of NIS or NIS+ services. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_ypserv_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> @@ -269,7 +269,7 @@ as a client in a NIS or NIS+ domain. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_ypbind_disabled" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> </Group> @@ -297,7 +297,7 @@ as a TFTP server, which does not provide encryption or authentication. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_tftp_disabled" /> -<ref nist="AC-17(8),CM-7" disa="1436" /> +<ref nist="CM-7" disa="1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -315,7 +315,7 @@ accidental (or intentional) activation of tftp services. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_tftp-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -346,7 +346,7 @@ server_args = -s /var/lib/tftpboot</pre> </ocil> <ident cce="RHEL7-CCE-TBD" /> <oval id="tftpd_uses_secure_mode" /> -<ref nist="AC-17(8),CM-7" disa="366"/> +<ref nist="CM-7" disa="366"/> </Rule> </Group> diff --git a/RHEL/7/input/services/ssh.xml b/RHEL/7/input/services/ssh.xml index cf41bc1..9461da5 100644 --- a/RHEL/7/input/services/ssh.xml +++ b/RHEL/7/input/services/ssh.xml @@ -81,7 +81,7 @@ should not be used. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sshd_allow_only_protocol2" /> -<ref nist="AC-17(7),IA-5(1)(c)" disa="776,774,1436" /> +<ref nist="AC-3(10),IA-5(1)(c)" disa="776,774,1436" /> <tested by="DS" on="20121024"/> </Rule> @@ -363,7 +363,7 @@ implementation. These are also required for compliance. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sshd_use_approved_ciphers" /> -<ref nist="AC-3,AC-17(2),AU-10(5),IA-5(1)(c),IA-7" disa="803,1144,1145,1146" /> +<ref nist="AC-3,AC-17(2),SI-7,IA-5(1)(c),IA-7" disa="803,1144,1145,1146" /> <tested by="DS" on="20121024"/> </Rule> -- 1.7.1

2 1

[PATCH 2/4] updated transforms to reflect 800-53 rev4
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like fee5b77c from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/transforms/constants.xslt | 2 +- RHEL/7/transforms/xccdf2html.xslt | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL/7/transforms/constants.xslt b/RHEL/7/transforms/constants.xslt index afe719b..c252c3e 100644 --- a/RHEL/7/transforms/constants.xslt +++ b/RHEL/7/transforms/constants.xslt @@ -7,7 +7,7 @@ <xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>  -<xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…</xsl:variable> +<xsl:variable name="nist800-53uri">http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf</xsl:variable> <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable> <xsl:variable name="dcid63uri">not_officially_available</xsl:variable> <xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable> diff --git a/RHEL/7/transforms/xccdf2html.xslt b/RHEL/7/transforms/xccdf2html.xslt index bdf04f7..92d6e6a 100644 --- a/RHEL/7/transforms/xccdf2html.xslt +++ b/RHEL/7/transforms/xccdf2html.xslt @@ -556,7 +556,7 @@ <xsl:when test='./@href = "http://iase.disa.mil/cci/index.html"'> <a href="{@href}">DISA CCI-<xsl:value-of select="text()"/></a> </xsl:when> - <xsl:when test='./@href = "http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…"'> + <xsl:when test='./@href = "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"'> <a href="{@href}">NIST <xsl:value-of select="text()"/></a> </xsl:when> <xsl:otherwise> @@ -664,7 +664,7 @@ <xsl:when test='./@href = "http://iase.disa.mil/cci/index.html"'> <a href="{@href}">DISA CCI-<xsl:value-of select="text()"/></a> </xsl:when> - <xsl:when test='./@href = "http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…"'> + <xsl:when test='./@href = "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"'> <a href="{@href}">NIST <xsl:value-of select="text()"/></a> </xsl:when> <xsl:otherwise> -- 1.7.1

2 1

[PATCH 1/4] correct punctuation error in NIST SP800-53 reference
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/6/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml index e25f890..a7efc37 100644 --- a/RHEL/6/input/system/auditing.xml +++ b/RHEL/6/input/system/auditing.xml @@ -1174,7 +1174,7 @@ unusual activity. </rationale> <ident cce="26457-2" /> <oval id="audit_rules_privileged_commands" /> -<ref nist="AC-3(10)),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> <tested by="JL" on="20140703"/> </Rule> -- 1.7.1

2 1

[PATCH] [RHEL/7] Include SCAP Security Guide logo into generated HTML guide
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, this change adds support to display SSG logo in the generated HTML guide for RHEL-7 product (depends on the two transformations to be placed in the shared/ directory, IOW my previous patch). Testing status: --------------- Tested via: oscap xccdf generate guide --profile allrules --output /tmp/el7.html ssg-rhel7-xccdf.xml where 'ssg-rhel7-xccdf.xml' was benchmark built within the RPM build process on both Fedora (with openscap 1.0.9) & RHEL-6 (with openscap 1.0.8) versions. The change works as expected (in both cases). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH] [shared] Create shared/transforms directory [shared] Move includelogo.xslt & oscapsupportssvg.py transforms into shared/ directory
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, shortly after submitting the "Fedora logo" change for review: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-July/0058… I have realized the includelogo.xslt & oscapsupportssvg.py transformations are identical for both products, thus created shared/transforms directory, and moved them into shared/ (to save place in the repository) by updating the appropriate entries in RHEL/6 & Fedora directories. Testing status: --------------- Retested both scenarios: * building RHEL-6 content on both of RHEL-6 & Fedora, and * building Fedora content on both of RHEL-6 & Fedora and the proposed changes still work OK. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: This way more of the transformations could be joined (to save the space). Would just need to go trough various of them in */transforms subdirectories to see which of them are identical & could be merged into one place.

2 1

[PATCH] [Fedora] Include SCAP Security Guide logo into generated HTML guide
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, similar change like in: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-July/0058… but this time for the Fedora product. Testing status: ---------------- Tested & confirmed logo is included when content built on Fedora (with openscap 1.0.9), and current state is kept when building Fedora content on RHEL-6 (with openscap 1.0.8). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH] [RHEL/6] Include SCAP Security Guide logo into generated HTML guide (if underlying openscap version supports <svg> XHTML element to be present within <front-matter> element)
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, the attached change adds support for displaying of SCAP Security Guide (horizontal) logo in the HTML form of the guide (within it's <front-matter> element). Since the <svg> inclusion requires openscap of version v1.0.9 (at least) to be able to handle SVG images within benchmark's description / front-matter / rear-matter elements properly, the display of the logo has been made conditional: * the version of openscap package on the system is < 1.0.9, there will be no change wrt to current <front-matter> content, * the version of openscap package on the system is >= 1.0.9 (currently on Fedora only), the SCAP Security Guide logo will be displayed (for now just as plain image, without a href to Fedorahosted instance - this is another feature that needs to be implemented in openscap first). You can see the new output after applying the patch & building the RPM on Fedora (with openscap = 1.0.9). On RHEL-6 there won't be any difference (for now). Testing report: Tested the change on all of RHEL-6, RHEL-7 & Fedora-20, and seems to be working properly (no change on RHEL-6, RHEL-7 & equipped with logo on Fedora). Similar changes for RHEL-7 & Fedora transforms will follow shortly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

openscap HTML report redesign
by Martin Preisler 18 Jul '14

18 Jul '14

Hi, I wrote a blog post about the ongoing HTML report redesign. http://martin.preisler.me/2014/07/openscap-html-report-redesign/ Please give it a look and consider providing feedback. -- Martin Preisler

7 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2014