scap-security-guide April 2018

scap-security-guide@lists.fedorahosted.org

2 participants
2 discussions

Issue with Repo GPG Checking
by Trevor Vaughan 20 Oct '18

20 Oct '18

Hi All, I've been re-roaming through the SSG and this is probably the first of a many part thread regarding different checks. TL;DR; The potential risk caused by enabling 'repo_gpgcheck' outweighs any potential benefit if TLS is enabled. In my opinion, the following check should *only* be enabled if all of your repositories are internally managed xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata. The reason for this is that YUM presently does not (to my knowledge) have any way to differentiate between package signing GPG keys and repo signing GPG keys. This means that if, for instance, I host my packages via some shared Nexus, then I have to add the Nexus GPG key to my trust list for the repo. I fundamentally do *not* want to do this! I shouldn't be allowing my Nexus maintainer to potentially install software on my system without my explicit knowledge. You should use TLS, and the repo should have a trusted certificate there and that should be sufficient for the metadata until RPM can tell the difference between these two certificates. Please let me know if I've missed something, but I don't remember seeing options to split out the two sets of certs. Additionally, this is marked as 'high' severity and that seems to be massive overkill considering that 1) the packages are still signed and validated and 2) TLS is required. -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

7 20

Re: Reg: Openscap scanning for SSH
by Dushyant Uge 20 Apr '18

20 Apr '18

Hello, I checked RHEL7.5 has been released now. My question -- Is SCAP Security Guide 0.1.36 released with RHEL7.5? Thanks & Regards, Dushyant Uge On Tue, Apr 17, 2018 at 7:17 AM, Dushyant Uge <duge(a)redhat.com> wrote: > Hello, > > I checked RHEL7.5 has been released now. > > So, Is SCAP Security Guide 0.1.36 released in RHEL7.5? > > Thanks & Regards, > Dushyant Uge > > On Mon, Nov 27, 2017 at 1:00 AM, Jan Cerny <jcerny(a)redhat.com> wrote: > >> Hi, >> >> the problem was fixed in SCAP Security Guide 0.1.36. >> >> Regards >> >> Jan Černý >> Security Technologies | Red Hat, Inc. >> >> ----- Original Message ----- >> > From: "Dushyant Uge" <duge(a)redhat.com> >> > To: "Jan Cerny" <jcerny(a)redhat.com> >> > Cc: "Jakub Jelen" <jjelen(a)redhat.com>, "tech-list" < >> tech-list(a)redhat.com>, "SCAP Security Guide" >> > <scap-security-guide(a)lists.fedorahosted.org> >> > Sent: Saturday, November 25, 2017 1:38:03 PM >> > Subject: Re: Reg: Openscap scanning for SSH >> > >> > Hello Team, >> > >> > I can see the status of below issue "Closed" >> > >> > https://github.com/OpenSCAP/scap-security-guide/issues/2296 >> > >> > What shall we update to customer now ? >> > >> > >> > On Tue, Sep 5, 2017 at 5:14 PM, Jan Cerny <jcerny(a)redhat.com> wrote: >> > >> > > Hello, >> > > >> > > Great! Thanks for clarification. >> > > >> > > I have reported this issue upstream. You can track fixing the problem >> > > there. >> > > https://github.com/OpenSCAP/scap-security-guide/issues/2296 >> > > >> > > Regards >> > > >> > > Jan Černý >> > > Security Technologies | Red Hat, Inc. >> > > >> > > ----- Original Message ----- >> > > > From: "Jakub Jelen" <jjelen(a)redhat.com> >> > > > To: "Jan Cerny" <jcerny(a)redhat.com> >> > > > Cc: "Dushyant Uge" <duge(a)redhat.com>, "tech-list" < >> tech-list(a)redhat.com>, >> > > "SCAP Security Guide" >> > > > <scap-security-guide(a)lists.fedorahosted.org> >> > > > Sent: Tuesday, September 5, 2017 1:26:01 PM >> > > > Subject: Re: Reg: Openscap scanning for SSH >> > > > >> > > > On Tue, 2017-09-05 at 07:22 -0400, Jan Cerny wrote: >> > > > > Hi, >> > > > > >> > > > > Thank you very much for letting us know. >> > > > > >> > > > > I have looked into this issue. The rule "Allow Only SSH Protocol >> 2" >> > > > > checks if /etc/sshd_config cotains string "Protocol 2". >> > > > > See the implementation of this check: >> > > > > https://github.com/OpenSCAP/scap-security-guide/blob/master/ >> shared/te >> > > > > mplates/static/oval/sshd_allow_only_protocol2.xml >> > > > > >> > > > > Jakub, do I understand it well, that since RHEL 7.4 this >> > > > > configuration >> > > > > option doesn't exist anymore? Will the system always satisfy the >> > > > > requirement >> > > > > that only SSHv2 is allowed? What way do you recommend to check >> that >> > > > > this requirement is satisfied? >> > > > > >> > > > > I think If SSH v2 is the only option on RHEL 7.4, we should remove >> > > > > this rule from SCAP Security Guide for RHEL7 completely. >> > > > >> > > > I would not remove it. Some people might be running the old openssh >> > > > from RHEL7.3. I would say that every OpenSSH RPM package >=7.4 will >> > > > satisfy this rule. If we have older version, I would leave the >> check as >> > > > it was. Though not sure how to write it in your language :) >> > > > >> > > > Jakub >> > > > >> > > > > Dushyant, FYI, rules for OpenSCAP comes from "SCAP Security Guide" >> > > > > project, >> > > > > https://github.com/OpenSCAP/scap-security-guide >> > > > > which has a special mailing list: >> > > > > https://lists.fedorahosted.org/admin/lists/scap-security-gui >> de.lists. >> > > > > fedorahosted.org/ >> > > > > If you run in similar problem in future, you can ask there >> directly >> > > > > :D >> > > > > I'm including the mailing list to this thread so that experts can >> > > > > chime in. >> > > > > >> > > > > >> > > > > Regards >> > > > > >> > > > > Jan Černý >> > > > > Security Technologies | Red Hat, Inc. >> > > > > >> > > > > ----- Original Message ----- >> > > > > > From: "Jakub Jelen" <jjelen(a)redhat.com> >> > > > > > To: "Dushyant Uge" <duge(a)redhat.com> >> > > > > > Cc: "tech-list" <tech-list(a)redhat.com>, jcerny(a)redhat.com >> > > > > > Sent: Tuesday, September 5, 2017 10:29:19 AM >> > > > > > Subject: Re: Reg: Openscap scanning for SSH >> > > > > > >> > > > > > On Tue, 2017-09-05 at 08:07 +0530, Dushyant Uge wrote: >> > > > > > > Hello Jakub Jelen, >> > > > > > > >> > > > > > > Thank you for your response. >> > > > > > > >> > > > > > > > > The rules in OpenSCAP needs to be updated to reflect this >> > > > > > > >> > > > > > > So, Are we in the process of updating OpenSCAP scanning rules? >> > > > > > > or Do we need to file a bugzilla ? >> > > > > > >> > > > > > I am not sure if the OpenSCAP team or SGG is aware of this >> issue. I >> > > > > > added Jan, who should know better. >> > > > > > >> > > > > > > >> > > > > > > On Mon, Sep 4, 2017 at 5:08 PM, Jakub Jelen < >> jjelen(a)redhat.com> >> > > > > > > wrote: >> > > > > > > >> > > > > > > > On Mon, 2017-09-04 at 11:02 +0530, Dushyant Uge wrote: >> > > > > > > > > Hello, >> > > > > > > > > >> > > > > > > > > While scanning RHEL7 system with openscap below are >> results >> > > > > > > > > for >> > > > > > > > > ssh >> > > > > > > > > protocol2 >> > > > > > > > > >> > > > > > > > > ------------------------------------- >> > > > > > > > > oval:ssg-sshd_allow_only_protocol2:def:1 false >> compliance >> > > > > > > > > [20140414], >> > > > > > > > > [sshd_allow_only_protocol2] Ensure Only Protocol 2 >> > > > > > > > > Connections >> > > > > > > > > Allowed >> > > > > > > > > ------------------------------------- >> > > > > > > > > >> > > > > > > > > Customer has below concern -- >> > > > > > > > > >> > > > > > > > > The description in the openscap-workbench: >> > > > > > > > > Only SSH protocol version 2 connections should be >> permitted. >> > > > > > > > > The >> > > > > > > > > default >> > > > > > > > > setting in /etc/ssh/sshd_config is correct, and can be >> > > > > > > > > verified >> > > > > > > > > by >> > > > > > > > > ensuring >> > > > > > > > > that the following line appears: Protocol 2 >> > > > > > > > > >> > > > > > > > > While doing Since this is the default, the check should >> NOT >> > > > > > > > > be >> > > > > > > > > for >> > > > > > > > > "2", but >> > > > > > > > > to make sure that "1" is NOT present. >> > > > > > > > > >> > > > > > > > > Is this a valid implementation request ? >> > > > > > > > > >> > > > > > > > > Please suggest. >> > > > > > > > > >> > > > > > > > >> > > > > > > > The SSH-1 protocol was removed in RHEL7.4 (openssh-7.4p1 and >> > > > > > > > newer) >> > > > > > > > therefore the configuration files will not contain Protocol >> > > > > > > > option >> > > > > > > > nor >> > > > > > > > sshd -T will output it. The rules in OpenSCAP needs to be >> > > > > > > > updated >> > > > > > > > to >> > > > > > > > reflect this >> > > > > > > > >> > > > > > > > https://access.redhat.com/articles/3022681 >> > > > > > > > >> > > > > > >> > > > > > -- >> > > > > > Jakub Jelen >> > > > > > Software Engineer >> > > > > > Security Technologies >> > > > > > Red Hat, Inc. >> > > > > > >> > > > -- >> > > > Jakub Jelen >> > > > Software Engineer >> > > > Security Technologies >> > > > Red Hat, Inc. >> > > > >> > > >> > >> > >> > >> > -- >> > Warm Regards, >> > Dushyant Uge >> > Red Hat Global Support >> > >> > > > > -- > Warm Regards, > Dushyant Uge > Red Hat Global Support > -- Warm Regards, Dushyant Uge Red Hat Global Support

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2018