scap-security-guide May 2016

scap-security-guide@lists.fedorahosted.org

3 participants
3 discussions

Use /etc/passwd directly instead of sources in NSS
by Rodolfo Martínez 08 Jun '16

08 Jun '16

Hi List, After many hours playing with SSG and OpenSCAP and not able to do what I want I need some help. Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to SSG and I am still getting familiar. The following OVAL test searches for system accounts (UID < 500) in /etc/at.allow (I am showing just the relevant parts of RHEL/5/input/oval/at_system_accounts.xml to explain my problem): <criteria> <criterion test_ref="test_at_system_accounts_at_allow" /> </criteria> <unix:password_test check="all" check_existence="none_exist" comment="Testing system accounts in /etc/at.allow" id="test_at_system_accounts_at_allow" version="1"> <unix:object object_ref="object_at_system_accounts_at_allow" /> </unix:password_test> <unix:password_object id="object_at_system_accounts_at_allow" version="1"> <unix:username operation="equals" var_ref="var_at_system_accounts_allow_list" var_check="at least one" datatype="string" /> <filter action="include">state_at_system_accounts_at_allow_uid</filter> </unix:password_object> <local_variable id="var_at_system_accounts_allow_list" comment="Accounts Allowed" datatype="string" version="1"> <object_component item_field="subexpression" object_ref="object_at_system_accounts_allow_list" /> </local_variable> <ind:textfilecontent54_object comment="/etc/at.allow" id="object_at_system_accounts_allow_list" version="1"> <ind:filepath>/etc/at.allow</ind:filepath> <ind:pattern operation="pattern match">^(.*)$</ind:pattern> <ind:instance operation="greater than or equal" datatype="int">0</ind:instance> </ind:textfilecontent54_object> <unix:password_state id="state_at_system_accounts_at_allow_uid" version="1"> <unix:user_id datatype="int" operation="less than">500</unix:user_id> </unix:password_state> The test above gets the users information from the sources specified in NSS (/etc/nsswitch.conf) which is correct, however I want to create a version that uses /etc/passwd directly. Why? We have many (thousands?) of RHEL 5 based servers with LDAP integration, and many (thousands?) of accounts in the LDAP servers. Simple tests like RHEL/5/input/oval/at_system_accounts.xml and RHEL/5/input/oval/cron_system_accounts.xml can take hours to run because they retrieve *all* users information from the LDAP servers and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. Also, if we run OpenSCAP (oscap) at the same time in a few servers they hit the LDAP servers really bad. I have been trying to replace password_test and password_object by textfilecontent54_test and textfilecontent54_object without any luck. If you want, I can share my at_system_accounts.xml file that I thought it was going to work. I would really appreciate any help or hint? Regards -- Rodolfo Martínez

6 13

Potential SELinux inclusion in RHEL7 STIG
by Mackanick, Jason W CIV DISA RE (US) 11 May '16

11 May '16

I am here with Shawn Wells today and we would like your help in developing the requirements for a possible inclusion of SELinux requirements to be included in the RHEL7 STIG. As we move away from legacy file permissions to type enforcement, we would like to work with the community to understand security relevant configuration options such as SELinux Booleans used in operational environments. To calm any fears associated with SELinux, we are only considering targeted policy and not the MLS enablement. Shawn will be working to gather your input. Any of your input would be appreciated if we could get it by Tuesday March 22, 2016 at the end of business.

10 17

[Testing request] SCAP-Security-Guide-0.1.29 Fedora updates testing && karma appreciated
by Jan Lieskovsky 05 May '16

05 May '16

Hello folks, for those who tend use SCAP-Security-Guide on Fedora systems a kind request -- have scheduled updates for latest upstream 0.1.29 release: * https://bodhi.fedoraproject.org/updates/FEDORA-2016-bcb9f10316 (Fedora 22) * https://bodhi.fedoraproject.org/updates/FEDORA-2016-2a44222037 (Fedora 23) * https://bodhi.fedoraproject.org/updates/FEDORA-2016-e7317348b1 (Fedora 24) Testing of them (and possibly also karma) are appreciated. Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2016