On 3/28/14, 3:56 PM, Kordell, Luke T wrote:

Here is a profile I have been developing. Some of the rules within the profile contradict each other, but the future plan is to break-up this profile into a few different releases. We will eventually have an HPC, Cluster, US and generic version of this profile each with slightly different rule selections. The selinux ploicy rule will always be refined to check that selinux is implementing the mls policy type. Let me know if you have any questions or suggestions!

Luke K From ef47e8e213acb0f72830096d01d48db93d125573 Mon Sep 17 00:00:00 2001 From: lukek1 luke.t.kordell@lmco.com Date: Thu, 27 Mar 2014 13:19:21 -0400 Subject: [PATCH] MLS_CSCF-profile

---

RHEL/6/input/profiles/MLS_CSCF.xml | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/RHEL/6/input/profiles/MLS_CSCF.xml b/RHEL/6/input/profiles/MLS_CSCF.xml index 1a1c321..9819835 100644 --- a/RHEL/6/input/profiles/MLS_CSCF.xml +++ b/RHEL/6/input/profiles/MLS_CSCF.xml @@ -1,5 +1,5 @@ -<Profile id="cscf-baseline"> -<title>CSCF baseline-launchpoint</title> +<Profile id="MLS_CSCF"> +<title>CSCF baseline general use</title> <description> this is an incomplete profile </description>

<select idref="account_disable_post_pw_expiration" selected="true" /> @@ -46,6 +46,7 @@ <select idref="configure_auditd_audispd" selected="true" /> <select idref="configure_auditd_max_log_file" selected="true" /> <select idref="configure_auditd_max_log_file_action" selected="true" /> +<refine-value idref="var_auditd_max_log_file_action" selector="keep_logs" /> <select idref="configure_auditd_num_logs" selected="true" /> <select idref="auditd_data_retention_space_left_action" selected="true" /> <select idref="cups_disable_browsing" selected="true" /> @@ -63,7 +64,7 @@ <select idref="disable_dhcp_server" selected="true" /> <select idref="disable_dns_server" selected="true" /> <select idref="disable_gnome_thumbnailers" selected="true" /> -<!-- <select idref="disable_httpd" selected="true" /> Only for UV --> +<select idref="disable_httpd" selected="true" /> <select idref="kernel_module_ipv6_option_disabled" selected="true" /> <select idref="kernel_module_cramfs_disabled" selected="true" /> <select idref="kernel_module_freevxfs_disabled" selected="true" /> @@ -83,11 +84,12 @@ <select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" /> <select idref="sysctl_ipv4_all_send_redirects" selected="true" /> <select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true" /> +<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true" /> +<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true" /> <select idref="sysctl_ipv4_ip_forward" selected="true" /> <select idref="disable_telnet_service" selected="true" /> <select idref="disable_tftp" selected="true" /> <select idref="disable_vsftpd" selected="true" /> -<select idref="disable_xinetd" selected="true" /> <select idref="disable_ypbind" selected="true" /> <select idref="dns_server_authenticate_zone_transfers" selected="true" /> <select idref="enable_auditd_bootloader" selected="true" /> @@ -124,23 +126,22 @@ <select idref="mount_option_var_tmp_bind_var" selected="true" /> <select idref="mountopt_nodev_on_nonroot_partitions" selected="true" /> <!-- we do not have any removable media that has a mount point defined in fstab <select idref="mountopt_nodev_on_removable_partitions" selected="true" /> --> -<!--<select idref="mountopt_noexec_on_removable_partitions" selected="true" /> --> -<!-- <select idref="mountopt_nosuid_on_removable_partitions" selected="true" />--> +<select idref="mountopt_noexec_on_removable_partitions" selected="true" /> +<select idref="mountopt_nosuid_on_removable_partitions" selected="true" /> <select idref="accounts_max_concurrent_login_sessions" selected="true" /> -<!-- need to refince from 10 to 3 --> +<refine-value idref="var_accounts_max_concurrent_login_sessions" selector="3" /> <select idref="network_disable_zeroconf" selected="true" /> <select idref="network_ipv6_disable_rpc" selected="true" /> <select idref="network_sniffer_disabled" selected="true" /> <select idref="no_empty_passwords" selected="true" /> <select idref="no_files_unowned_by_group" selected="true" /> -<select idref="no_files_unowned_by_user" selected="true" /> + <select idref="no_files_unowned_by_user" selected="true" /> <select idref="accounts_password_all_shadowed" selected="true" /> <select idref="no_netrc_files" selected="true" /> -<select idref="no_rsh_trust_files" selected="true" /> <select idref="accounts_no_uid_except_zero" selected="true" /> <select idref="no_direct_root_logins" selected="true" /> <select idref="no_unpackaged_sgid_files" selected="true" /> -<select idref="no_unpackaged_suid_files" selected="true" /> +<select idref="no_unpackaged_suid_files" selected="true" /> <select idref="ntpd_specify_multiple_servers" selected="true" /> <select idref="ntpd_specify_remote_server" selected="true" /> <select idref="package_aide_installed" selected="true" /> @@ -150,7 +151,9 @@ <select idref="partition_for_var_log" selected="true" /> <select idref="partition_for_var_log_audit" selected="true" /> <select idref="accounts_maximum_age_login_defs" selected="true" /> +<refine-value idref="var_accounts_maximum_age_login_defs" selector="180" /> <select idref="accounts_password_minlen_login_defs" selected="true" /> +<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" /> <select idref="password_require_consecrepeat" selected="true" /> <select idref="accounts_password_pam_cracklib_difok" selected="true" /> <select idref="accounts_password_pam_cracklib_dcredit" selected="true" /> @@ -168,8 +171,8 @@ <select idref="rpm_verify_hashes" selected="true" /> <select idref="rpm_verify_permissions" selected="true" /> <select idref="rsyslog_accept_remote_messages_none" selected="true" /> -<!-- may be un-necessary<select idref="rsyslog_accept_remote_messages_tcp" selected="true" /> --> -<!-- may be un-necessary <select idref="rsyslog_accept_remote_messages_udp" selected="true" /> --> +<select idref="rsyslog_accept_remote_messages_tcp" selected="true" /> +<select idref="rsyslog_accept_remote_messages_udp" selected="true" /> <select idref="rsyslog_send_messages_to_logserver" selected="true" /> <select idref="selinux_confinement_of_daemons" selected="true" /> <select idref="selinux_all_devicefiles_labeled" selected="true" /> @@ -231,7 +234,7 @@ <select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true" /> <select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" /> <!-- not necessary if ipv6 is disabled <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" /> --> -<!-- may need to be refined <select idref="set_system_login_banner" selected="true" /> --> +<select idref="set_system_login_banner" selected="true" /> <select idref="sshd_allow_only_protocol2" selected="true" /> <select idref="sshd_disable_root_login" selected="true" /> <select idref="sshd_use_approved_ciphers" selected="true" /> @@ -245,7 +248,6 @@ <select idref="uninstall_telnet_server" selected="true" /> <select idref="uninstall_tftp-server" selected="true" /> <select idref="uninstall_vsftpd" selected="true" /> -<select idref="uninstall_xinetd" selected="true" /> <select idref="uninstall_ypserv" selected="true" /> <!-- the following may need refinement --> <select idref="file_owner_etc_group" selected="true" /> @@ -255,7 +257,6 @@ <select idref="userowner_shadow_file" selected="true" /> <select idref="wireless_disable_in_bios" selected="true" /> <select idref="world_writable_files_system_ownership" selected="true" /> -<select idref="install_openswan" selected="true" /> <select idref="disable_interactive_boot" selected="true" /> <select idref="install_hids" selected="true" /> <select idref="install_antivirus" selected="true" /> @@ -264,6 +265,7 @@ <select idref="bios_enable_execution_restrictions" selected="true" /> <select idref="disable_setuid_coredumps" selected="true" /> <select idref="disable_xwindows_with_runlevel" selected="true" /> +<select idref="world_writeable_files" selected="true" /> </Profile>

Hey Luke!

This is a great start! A few small things:

(1) Patch Stream Do you have the full patch stream (or, ideally, a single commit/patch) of the profile? Your attached patch reflects it is a patch to a patch, that is to say, there must be a commit that previously created the profile. Ensure any desired changes are committed locally then issue:

$ git format-patch origin

This should generate patches outlining all commits local to your repo that are not upstream yet.

(2) Patch title & description What do you think of elaborating the <title> and <description>? Perhaps:

Profile ID: "MLS_CSCF" --> "CSCF-RHEL6-MLS" Reasoning: We'll want to include RHEL6 in the profile name as other OS' ship within SSG. While we've yet to officialize style guides, underscores are frowned upon and inconsistent with other profile names.

Title: "CSCF Baseline General Use" --> "CSCF RHEL6 MLS Core Baseline" Reasoning: Again, reinforcement of RHEL6. The term 'general use' reflects, well, general use (non-MLS). Given your reference to future deviations, e.g. HPC, what about the term "core" or even more generic "server"?

Description: A bit more elaboration would be welcome. What about something like: "This profile reflects the Centralized Super Computing Facility (CSCF) baseline for Red Hat Enterprise Linux 6. This baseline has received government ATO through the ICD 503 process, utilizing the CNSSI 1253 cross domain overlay. This profile should be considered in active development. Additional tailoring will be needed, such as the creation of RBAC roles, for production deployment."

This is a really, really great start. Looking forward to the full patch set!

Shawn