scap-security-guide July 2014

scap-security-guide@lists.fedorahosted.org

20 participants
35 discussions

[PATCH] [RHEL/6] accounts_password_pam_cracklib_minclass XCCDF rule: * rename the remediation script to proper name * start using value of particular variable instead of hardcoded value of '3'
by Jan Lieskovsky 07 Jul '14

07 Jul '14

Rename original remediation script (password_require_minimum_class.sh) from: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=a38ece… to it's proper name (so remediation would actually perform the fix). Besides that replace the hardcoded value of '3' with evaluated value of $var_password_pam_cracklib_minclass variable (which can be actually set up to something different according to custom preferences). Also make the remediation fix implementation to complain / align more with actual requirements for the remediation fixes (include templates/support.sh etc.) Testing report: --------------- Change has been tested on RHEL-6 for both cases: * minclass already present in /etc/pam.d/system-auth, but having different value than expected / required, * minclass not present in /etc/pam.d/system-auth file and works properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

noexec and bash
by Stuart Green 03 Jul '14

03 Jul '14

Apologies if this is slightly 'offpiste'. One of the hardening parameters we use to stop execution of programs on certain partitions is noexec in fstab, this is a general C.I.S requirement. I believe the only requirement advising this in the context of this list is to do with Removable Media Partitions. I've noted myself that you can still execute bash scripts in these partitions by utilising /bin/sh (bash), in our environment /bin/sh is set to -rwxr-xr-x which I belive is an OOB setting, should this be refined to something more strict? Furthermore is there any SSG auditing on this? Thanks, Stuart

4 4

[PATCH 0/2] Allow shorthand format to accept variable_object & re-implement the audit_rules_privileged_commands OVAL check for RHEL-6
by Jan Lieskovsky 03 Jul '14

03 Jul '14

From 15f327359d03ee935c6fb7010b1f1c00c9571533 Mon Sep 17 00:00:00 2001 From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Thu, 3 Jul 2014 11:30:20 +0200 Subject: [PATCH 0/2] Allow shorthand format to accept variable_object & re-implement the audit_rules_privileged_commands OVAL check for RHEL-6 See further descriptions in each of the changes Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team Jan Lieskovsky (2): [*/transforms/idtranslate.py] Allow shorthand format to contain <ind:variable_object> definition [RHEL/6] (Re-)Implement audit_rules_privileged_commands OVAL check & start using it Fedora/transforms/idtranslate.py | 3 + OpenStack/transforms/idtranslate.py | 3 + .../checks/audit_rules_privileged_commands.xml | 188 ++++++++++++++++++--- RHEL/6/input/system/auditing.xml | 16 +- RHEL/6/transforms/idtranslate.py | 3 + RHEL/7/transforms/idtranslate.py | 3 + RHEVM3/transforms/idtranslate.py | 3 + 7 files changed, 192 insertions(+), 27 deletions(-) -- 1.8.3.1

1 0

RE: RHEL7 scanning (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 01 Jul '14

01 Jul '14

Classification: UNCLASSIFIED Caveats: NONE Hope I'm not being a bother, but if possible, would someone mind weighing in on this? Scanning on RHEL7 isn't particularly useful right now, and we'd like to lock it down as soon as possible. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support > -----Original Message----- > From: Shaw, Ray V CTR USARMY ARL (US) > Sent: Tuesday, June 24, 2014 10:31 AM > To: 'SCAP Security Guide' > Subject: RHEL7 scanning (UNCLASSIFIED) > > Classification: UNCLASSIFIED > Caveats: NONE > > By default, it looks like only the partition checks are enabled when > scanning with the stig-rhel7-server-upstream profile (on RHEL7). If I > edit > the profile to enable all of the ones that RHEL6 has enabled (and then > remove the few that don't exist for RHEL7), I get a total of 56 checks. > > [If anyone is curious, out of the box it passes 35 and fails 21, > assuming > it's partitioned correctly.] > > We're starting on RHEL7 to prepare our configuration management system, > etc. > for when 7 is blessed and we can deploy it, and of course STIGs are a > big > part of that. Is it reasonable to expect that they will closely > parallel > the RHEL6 STIG? Permissions/ownership, audit rules, sysctl, GDM, etc. > > Thanks, > > -- > Ray Shaw (Contractor, STG) > Army Research Laboratory > CIO, Unix Support > > > > Classification: UNCLASSIFIED > Caveats: NONE > Classification: UNCLASSIFIED Caveats: NONE

5 5

[PATCH] [RHEL] Make new 0.1.18 release
by Jan Lieskovsky 01 Jul '14

01 Jul '14

Hello folks, another 55 changes have been committed in between since the last 0.1.17 release: $ git log --format=%h --since=09-May-2014 | wc -l 56 so made a new 0.1.18 release: [1] http://repos.ssgproject.org/sources/scap-security-guide-0.1.18.tar.gz The attached patch has been (after testing) pushed to master (that's the 56-th change). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2014