scap-security-guide November 2015

scap-security-guide@lists.fedorahosted.org

23 participants
9 discussions

"No definition with ID: ...." errors on RHEL 7.2 / SSG 0.1.25-3
by Shawn Wells 30 Nov '15

30 Nov '15

Running on RHEL 7.2, receiving "No definition with ID: ...." errors. Known issue? # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) # yum -y install openscap-scanner scap-security-guide # rpm -qv openscap-scanner scap-security-guide openscap-scanner-1.2.5-3.el7.x86_64 scap-security-guide-0.1.25-3.el7.noarch # oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml ....... Profiles: ......... xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream # oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream \ > /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml ........ Title Enable SSH Warning Banner Rule xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner Ident CCE-27314-4 Result unknown Title Create Warning Banners for All FTP Users Rule xccdf_org.ssgproject.content_rule_ftp_present_banner Ident CCE-RHEL7-CCE-TBD Result pass OpenSCAP Error: Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:691 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:749 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:231 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:349 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:288 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:217 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:751 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:546 in result model. [oval_agent.c:188] Probe at sd=4 (systemdunitdependency) reported an error: Unknown error [oval_probe_ext.c:393] Unable to receive a message from probe [oval_probe_ext.c:579] No definition with ID: oval:ssg:def:319 in result model. [oval_agent.c:188]

3 4

Save the date -- Upcoming SCAP Security Guide Q/A Contributor Workshop (2015-11-24 09:00 => 11:00 AM Eastern Time)
by Jan Lieskovsky 24 Nov '15

24 Nov '15

Hello folks, since: * the above topic is appearing on the SSG mailing list pretty often (people searching for guidance how to possibly contribute to SSG), * the current documentation / wiki pages WRT to topic of contributing aren't well at all, we have decided to hold a SCAP Security Guide Q/A Contributor Workshop to happen on Tuesday in a week from now, 2015-11-24 for two hours (from 09:00 AM - 11:00 AM Eastern Time) with the following preliminary agenda / topics: SCAP Security Guide Q/A Contributor Workshop: ----------------------------------------------------------------------- Agenda: * Identify existing issues / problems when attempting to contribute to SSG * How to contribute a new rule? * How to design logical structure of the rule? (which existing group to place it) * Basic details about SSG contribution: * How to create and where to store XCCDF, OVAL, and remediation script? * (Possibly) Create a new group within SSG * Create all rules * Expected developer workflow (how to commit & test the proposed changes) * Test own scenario (if appropriate) * Where's the documentation? * Any other issues / problems identified during the call & subsequent feedback. The above agenda is just sketch of (possible) topics to discuss. Should you find some of the important items missing below, let me know and I will add them. As for the medium I am proposing BlueJeans. Should we need to use something else, let me know! Would you be interested in attending of this workshop (meet the SCAP Security Guide upstream online and raise your voice / questions / concerns), please let me know (OFF-LIST PREFERABLY) and I will add your name to the list of the invited guests. Thank you && Regards, Jan. -- Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream)

8 9

Question on use of pam_faillock.so in account lockout remediation
by Sean 23 Nov '15

23 Nov '15

Hi, I was curious if someone could point me toward the reasoning behind why these remediation scripts are using /etc/pam.d/system-auth and /etc/pam.d/password-auth? It seems like the man page for pam_faillock directs the usage to /etc/pam.d/login instead. Thank you kindly, --Sean

3 2

OpenStack scap content
by Jeff Pullen 19 Nov '15

19 Nov '15

I'm new here... so I apologize if this has already been discussed. It seems that not much has been done lately with the OpenStack SCAP content. So it seems like a good place to start learning how to contribute to this project. 1. I wanted to get opinions on how to tackle the quick release cycle, and various components used within OpenStack. I noticed that in RHEL it is broken into versions (5/6/7), but Fedora isn't. OpenStack has a Fedora like release cycle, and it may be difficult to maintain numerous versions. Does it make sense to just have this work with the latest version? 2. OpenStack also has different server roles that will have different requirements, and services. For example the controllers have databases and web servers, where the computes will not. What is the best way to separate these? Finally, if there are resources that can cut down on the learning curve on how all the scap files interact with each other I would really appreciate if you could send me those (off list).

5 4

are there any vulnerable images available that can be detected by the scanner?
by Su Zhang 19 Nov '15

19 Nov '15

Hello all, I am looking for an image with old version also with lots of vulnerabilities. However, even though I could find old images, they are not considered as vulnerable images by the scanner. All the tests are false based my experiences so far. For example, I followed the instruction at http://www.open-scap.org/resources/documentation/perform-vulnerability-scan… With that instruction, I scanned a centOS6 published in 2011 (image url: http://archive.kernel.org/centos-vault/6.0/isos/i386/CentOS-6.0-i386-LiveCD…). Surprisingly, no vulnerability is detected (all the vulnerability validations are false)..... Am I doing something wrong or those old images are super safe? Any suggestions will be highly appreciated! -- Su Zhang

2 1

could anyone please let me know how to obtain a vulnerability only (CVE) list output
by Su Zhang 13 Nov '15

13 Nov '15

Hello everyone, I am new to scap project. I played with OVAL long time ago. I remember OVAL was able to output a list of CVEs with true or false status indicating if there is a vulnerability or not within the target system. However, while I am playing with scap, I can not see such list in the report.html. Instead, I can only see succeed or failed tests against certain properties. And only vectors like CCE, CWE are mentioned in the outcome report. Is there any option I can use to create a CVE only report? Thanks a lot! -- Su Zhang

3 7

auditing gnome use of elevated privileges (e.g. reboot/shutdown)?
by Robert Jacobson 06 Nov '15

06 Nov '15

How does one audit when the user performs an action that normally requires elevated privileges? Right now I'm allowing my users to shutdown/reboot systems, using the Gnome menu item(s) and/or power button on the login screen. I would like to audit this specific event but I don't know how to do it. Just auditing the execution of /sbin/shutdown doesn't give me sufficient information in order to determine that the reboot was a result of a user clicking the gnome GUI item. I don't even see a message that indicates the uid of the user in connection with the shutdown event. Here's an excerpt of the audit.log for when a normal user performs a reboot: 37 type=SYSCALL msg=audit(1446729410.820:6348): arch=c000003e syscall=59 success=yes exit=0 a0=7e2700 a1=7e0bf0 a2=7e0780 a3=7f fce02dad00 items=2 ppid=8633 pid=8634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses =4294967295 comm="shutdown" exe="/sbin/shutdown" subj=system_u:system_r:shutdown_t:s0-s0:c0.c1023 key="power" 38 type=EXECVE msg=audit(1446729410.820:6348): argc=3 a0="/sbin/shutdown" a1="-r" a2="now" 39 type=CWD msg=audit(1446729410.820:6348): cwd="/" 40 type=PATH msg=audit(1446729410.820:6348): item=0 name="/sbin/shutdown" inode=501 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=0 0:00 obj=system_u:object_r:shutdown_exec_t:s0 nametype=NORMAL 41 type=PATH msg=audit(1446729410.820:6348): item=1 name=(null) inode=1649 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj= system_u:object_r:ld_so_t:s0 nametype=NORMAL 42 type=SYSCALL msg=audit(1446729410.861:6349): arch=c000003e syscall=2 success=yes exit=5 a0=7fc8c1147db3 a1=80002 a2=7fc8c114 7db3 a3=fffffffffffffdcf items=1 ppid=8633 pid=8634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="shutdown" exe="/sbin/shutdown" subj=system_u:system_r:shutdown_t:s0-s0:c0.c1023 key="session " 43 type=CWD msg=audit(1446729410.861:6349): cwd="/" 44 type=PATH msg=audit(1446729410.861:6349): item=0 name="/var/run/utmp" inode=262150 dev=fd:03 mode=0100664 ouid=0 ogid=22 rde v=00:00 obj=system_u:object_r:initrc_var_run_t:s0 nametype=NORMAL Unless I'm missing it, I don't see anything that indicates the action originated from a gnome GUI item. I think this falls under AC-6. Below is a link to my current audit.rules (based on an older security baseline, not the current scap-security-guide) http://pastebin.com/KvxNNBjZ -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Robert Jacobson Robert.C.Jacobson(a)nasa.gov Lead System Admin Solar Dynamics Observatory (SDO) Bldg 14, E222 (301) 286-1591

4 8

when is dual ARCH required in audit.rules?
by Robert Jacobson 04 Nov '15

04 Nov '15

I've recently been trying to reconcile the audit.rules on my systems vs. the scap-security-guide, and I'm confused about the ARCH rules. When is it required to check both 32- and 64-bit architectures? e.g. the guide says both 32- and 64-bit rules are required to check for unauthorized access attempts: # Unauthorized Access attempts (audit_rules_unsuccessful_file_modification) -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access But for modifying the network environment, only the 64-bit rule is required: # Network changes ( audit_rules_networkconfig_modification ) -a always,exit -F arch=b64 -S sethostname -S setdomainname -k audit_rules_networkconfig_modification I don't understand why the 32-bit check is required for open() calls but not sethostname() calls? -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Robert Jacobson Robert.C.Jacobson(a)nasa.gov Lead System Admin Solar Dynamics Observatory (SDO) Bldg 14, E222 (301) 286-1591

5 7

7th Anniversary and a New Website
by Martin Preisler 04 Nov '15

04 Nov '15

Dear OpenSCAP and SCAP Security Guide community, today is the 7th anniversary of OpenSCAP! It has been a very exciting 7 years. We have seen OpenSCAP grow from humble beginnings into a respected and widely used project. On the occasion of the anniversary we have released a new website for all the OpenSCAP projects. We changed the concept of the website from a technical wiki site for developers to a more hands-on, practical website suitable for users. The URL -- http://www.open-scap.org/ -- is about the only thing we kept as it was :-) We hope you like the changes. Please use https://github.com/OpenSCAP/website/issues/new to provide feedback and report any issues. PS: Check out this amazing OpenSCAP anniversary cake by Lenka Horakova :-) http://www.open-scap.org/wp-content/uploads/2015/11/openscap_cake.jpg -- On behalf of the OpenSCAP team, Martin Preisler

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2015