November 2012 - scap-security-guide

It's time to branch & tag
by Shawn Wells 14 Dec '12

14 Dec '12

As we're now at a point where the project is about to submit "Informal Draft" content to DISA, it may be a good time to clean up our git branching/tagging model (err.. create one). My thoughts: (1) For every project within SSG, create a unique branch. Currently this would set us up as: MASTER |--- JBossEAP5 |--- RHEL6 (2) Each project is responsible for their own release tags. MASTER |--- JBossEAP5 |--- RHEL6 | |--- InformalDraft Comments?

3 5

[PATCH] Do not select the Group but the Rule.
by Šimon Lukašík 14 Dec '12

14 Dec '12

--- RHEL6/input/profiles/STIG-server.xml | 2 +- RHEL6/input/profiles/test.xml | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml index 5f67335..3fa5add 100644 --- a/RHEL6/input/profiles/STIG-server.xml +++ b/RHEL6/input/profiles/STIG-server.xml @@ -66,7 +66,7 @@ <refine-value idref="user_umask_value" selector="077"/> -<select idref="daemon_umask" selected="true" /> +<select idref="set_daemon_umask" selected="true" /> <refine-value idref="var_umask_for_daemons" selector="027"/> diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml index 9f0bd50..7742b31 100644 --- a/RHEL6/input/profiles/test.xml +++ b/RHEL6/input/profiles/test.xml @@ -9,7 +9,6 @@ <select idref="package_rsyslog_installed" selected="true"/> <select idref="service_rsyslog_enabled" selected="true"/> <select idref="disable_vsftpd" selected="true"/> -<select idref="set_daemon_umask" selected="true"/> <select idref="set_selinux_state" selected="true"/> <select idref="password_require_digits" selected="true"/> <select idref="tftpd_uses_secure_mode" selected="true"/> @@ -52,7 +51,7 @@ <refine-value idref="user_umask_value" selector="077"/> -<select idref="daemon_umask" selected="true" /> +<select idref="set_daemon_umask" selected="true"/> <refine-value idref="var_umask_for_daemons" selector="027"/> -- 1.7.7.6

3 4

Fixed RPM repo as of 1700 EST
by Shawn Wells 30 Nov '12

30 Nov '12

A few people reported a problem downloading packages from the EPEL repo, specifically error 404 messages. They've now been fixed. Please let us know -- via the public mailing list -- if problems continue. You may have to do a `yum clean all` if repository metadata is cached on your system. Here is the exact error that was reported: # yum install scap-security-guide ........ Downloading Packages: (1/3): openscap-0.9.2-1.el6.x86_64.rpm | 2.8 MB 00:01 (2/3): openscap-utils-0.9.2-1.el6.x86_64.rpm | 41 kB 00:00 http://repos.fedorapeople.org/repos/scap-security-guide/epel-6/noarch/scap-…: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 404" Trying other mirror. Error Downloading Packages: scap-security-guide-0.1-9.noarch: failure: scap-security-guide-0.1-9.noarch.rpm from epel-scap-security-guide: [Errno 256] No more mirrors to try.

1 0

Definition of 'files/directories'' with regard to permissions
by Robert Sanders 28 Nov '12

28 Nov '12

Got a quick question for folks regarding whether a directory should be considered a 'file' when it comes down to setting permissions. I'd asked this question in an email to the FSO and hadn't heard anything. A good poster child for this is GEN001800 ["All skeleton files (typically those in /etc/skel) must have mode 0644 or less permissive" ]. If KDE is installed on this system then /etc/skel will hold a directory '.kde'. If permissions on this directory are set to 0644 or less, and a new user is created, they will not be able to log in graphically using KDE. The routine that created the users directory from the /etc/skel files copied the permissions exactly, just changed file ownership. So the user if prevented from accessing their own $HOME/.kde directory. Another example would be GEN001280 ["Manual page files must have mode 0644 or less permissive"]. The U_Redhat_5-V1R1_STIG_Manual-xccdf.xml file (August 2012) references this, but I don't see it in the benchmark file. For GEN001800 the permissions for subdirectories needs to be at least 0744, and for GEN001280 subdirectories need 0755. If I'm being overly picky that is OK, I just would to know how others are interpreting these line items. Thanks... -Rob

2 2

Alternate way to to graphical login banner, with logging of acceptence
by Robert Sanders 27 Nov '12

27 Nov '12

Greetings all, As I mentioned in the conference call, we have a slightly different way of doing the login banner that also gets the user's acknowledgement sent to /var/log/secure (or the equivalent). I should note that our tool helps with remediating a box against several different guidelines. Hence we tried to find as 'simple' a way to do this as possible, without large banners looking seriously cramped (IE - cram the full DoD login banner into the default authentication dialog on a small screen). We also tried to support both pure Gnome (GDM) and KDE (kdm). I'll handwave through the details (ping me if you'd like more info). Basically we add wording to the main login with text along the lines of: All users will be required to read and accept a 'Consent to Monitor' statement before being allowed to login. The response will be logged. This text fits nicely on most of the OS's we support, and is shown on every graphical login attempt on the main authentication display. Currently for GDM on Fedora/RHEL6 we make these changes to /apps/gdm/simple-greeter/*, most of the other Linux boxes we'll change the /etc/X11/gdm/gdm.conf or /etc/gdm/custom.conf file instead. For KDM it all goes to /usr/share/config/kdm/kdmrc. To display the actual required login banner we tweak the /etc/X11/gdm/PreSession/Default (Solaris), /etc/X11/xdm/Xsession (RH4), or /etc/X11/xinit/Xsession (everyone else) file to call a script that uses zenity or kdialog (use first one found) to display the text of the banner. Since we do support other guidelines that may just require notification, we have our dialog may just have an acknowledgement button or an explicit accept/deny button. The user's response is logged using the first of /usr/sbin/logger, /sbin/logger, /usr/bin/logger, or /bin/logger with authpriv.notice. Obviously if the user hits deny we fail out back to the authentication screen. Disadvantages : change to expected login procedure/alternate login mananger, extra script on login Advantages : acknowledgement tied that the login banner was accepted/read to a particular user, better framing of potentially large banner text Sincerely, Rob Sanders =========================== Rob Sanders Sr. Secure Systems Engineer Raytheon Trusted Computer Solutions 12950 Worldgate Drive, Suite 600 Herndon, Virginia 20170 Security Blanket Support: 1-866-230-1317 Security Blanket Email: SecurityBlanket(a)TrustedCS.com Office: 703-896-4762 Fax: 703-318-5041 Email: RSanders(a)TrustedCS.com

5 6

Announcing the SCAP Security Guide EPEL-6 Repo, and v0.1-8
by Shawn Wells 27 Nov '12

27 Nov '12

I've created an SCAP Security Guide RPM yum repository off fedorahosted.org. Moving forward official RPMs will be housed here. To enable the repository: $ wget -O /etc/yum.repos.d/epel-6-scap-security-guide.repo http://repos.fedorapeople.org/repos/scap-security-guide/epel-6-scap-securit… To download the latest content: $ sudo sh -c "yum install scap-security-guide" v0.1-8 is now available in the repository. This minor update reflects copy editing patches, and does not contain any OVAL updates.

1 0

[PATCH] Releasing 0.1-8
by Shawn Wells 27 Nov '12

27 Nov '12

1 0

[PATCH] Undoing inclusion of supplemental mappings into XCCDF/STIG Profile
by Shawn Wells 27 Nov '12

27 Nov '12

https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-November/… Considering this an "emergency fix" and pushing.

1 0

[PATCH 01/11] Added per ticket #122.
by Michele Newman 27 Nov '12

27 Nov '12

--- RHEL6/input/auxiliary/alt-titles-stig.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index b7f36d5..0576b1b 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -38,6 +38,9 @@ A file integrity tool must be installed. <title rule="aide_periodic_cron_checking" shorttitle="Configure Periodic Execution of AIDE"> A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries. </title> +<title rule="rpm_verify_hashes" shorttitle="Verify File Hashes with RPM"> +The system package management tool must verify contents of all files associated with packages. +</title> <title rule="rpm_verify_permissions" shorttitle="Verify File Permissions with RPM"> The system package management tool must verify permissions on all file and directories associated with packages. </title> -- 1.8.0

2 12

rpm_verify_hashes breaks build
by Shawn Wells 27 Nov '12

27 Nov '12

$ make all cd RHEL6 && make make[1]: Entering directory `/var/www/html/scap-security-guide/RHEL6' xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml input/system/software/integrity.xml:184: parser error : xmlParseEntityRef: no name <pre># rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'</pre> ^ input/system/software/integrity.xml:184: parser error : xmlParseEntityRef: no name <pre># rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'</pre> Entered this as https://fedorahosted.org/scap-security-guide/ticket/164, assigned to Michele Newman per git blame ;)

1 0

Restructuring/Update of Trac
by Shawn Wells 25 Nov '12

25 Nov '12

Hey Guys, I had some time to go in and (finally!) restructure Trac, the Fedora Hosted provided ticketing system. In short: - Killed off stale milestones and reassigned open tickets to new ones which make sense. Note many items, such as CCE mappings, I'm considering a ticket of a milestone (vs a milestone itself). To my knowledge we cannot setup "sub milestones," so this approach seems best for now. Current OPEN milestones are below: * Remediation Content Synchronization (adding in TBD remediation scripts) * RHEL6 STIG - DISA InitialDraft Submission Feedback - Updated "Components" of the project, which allows users to place tickets against specific subsections. The updated list: * Build System * OVAL Content * Remediation Content * Tools * XCCDF Content - By default all new tickets will be owned by Michele Newman, who will screen them and pass along as appropriate. For those interested, here is a list of all open tickets by milestone: https://fedorahosted.org/scap-security-guide/report/3 -Shawn

2 1

Fwd: [Open-scap] openscap-0.9.2
by Shawn Wells 21 Nov '12

21 Nov '12

For those not on the open-scap tool mailing list -------- Original Message -------- Subject: [Open-scap] openscap-0.9.2 Date: Mon, 19 Nov 2012 16:13:28 +0100 From: Petr Lautrbach <plautrba(a)redhat.com> To: open-scap-list(a)redhat.com Hi all, a new OpenSCAP release is available - openscap-0.9.2. Changes: - rewritten the heuristic for pattern matching on path and filepath - CPE 2.3 language applicability testing - new ds_sds_index API providing a datastream overview - CPEs in source datastreams are automatically registered and used for XCCDF evaluation - --cpe option autodetects CPE dictionary and language - CVE support (validate feed, print CVEs) - introduced info module - made "$oscap xccdf generate custom" work again -> man page update - bug fixes Download: https://fedorahosted.org/releases/o/p/openscap/openscap-0.9.2.tar.gz SHA1: 4c1e6a2b612bc5d882889198a87b0df25b12317d Note: If you use RHEL-5 with libxml2-2.6.26-2, you won't be able to validate various XML content using XML schemas, see [1]. As a workaround, it's possible to build and use oscap with the version of libxml2 from RHEL-6 installed. [1] https://bugzilla.redhat.com/show_bug.cgi?id=877348 Petr -- Petr Lautrbach, Red Hat, Inc. http://cz.redhat.com _______________________________________________ Open-scap-list mailing list Open-scap-list(a)redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list

2 1

odd copy editing requests
by Jeffrey Blank 21 Nov '12

21 Nov '12

(Trying to catch back up now.) Why are we changing colons to periods? If there are style requests that decrease readability (but are required for some peculiar reason), please try to macro these out so that at least some outputs look literate.

1 0

Only get (null) results when executing scap-security-guide-0.1-7
by Peter Gustafsson 19 Nov '12

19 Nov '12

Hi, I only get (null) result on almost all test when using scap-security-guide-0.1-6 or scap-security-guide-0.1-7. I'm executing the test on a rhel 6.3 box having below version of openscap installed: openscap-utils-0.8.0-2.el6.x86_64 openscap-0.8.0-2.el6.x86_64 # oscap xccdf eval --profile server /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml Rule ID: partition_for_tmp Title: Ensure /tmp Located On Separate Partition Result: (null) Rule ID: partition_for_var Title: Ensure /var Located On Separate Partition Result: (null) Rule ID: partition_for_var_log Title: Ensure /var/log Located On Separate Partition Result: (null) Rule ID: partition_for_var_log_audit Title: Ensure /var/log/audit Located On Separate Partition Result: (null) Rule ID: partition_for_home Title: Ensure /home Located On Separate Partition Result: (null) ...... Br, Peter Gustafsson

5 5

[PATCH 13/13] DISA FSO provided copy editing of RHEL6/input/services/obsolete.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 12/13] DISA FSO copy editing of RHEL6/input/services/ntp.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 11/13] DISA FSO provided copy editing of RHEL6/input/services/nfs.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 09/13] DISA FSO provided copy editing of RHEL6/input/services/ldap.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 08/13] DISA FSO provided copy editing of RHEL6/input/services/imap.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 07/13] DISA FSO provided copy editing of RHEL6/input/services/ftp.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 06/13] DISA FSO provided copy editing of RHEL6/input/services/dns.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 04/13] DISA FSO copy editing of RHEL6/input/services/cron.xml
by Shawn Wells 16 Nov '12

16 Nov '12

1 1

[PATCH 03/13] DISA FSO
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 02/13] Further auxiliary titles copy editing
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

[PATCH 01/13] DISA FSO
by Shawn Wells 16 Nov '12

16 Nov '12

2 1

Invalid Output using the scap-security-guide-0.1-6.noarch.rpm
by Bueschel, Eric W CTR (US) 12 Nov '12

12 Nov '12

Just upgraded from the 0.1-1 rpm to the 0.1-6 rpm. System is a RHEL 6.3 system, openscap-utils is version 8.0. I am attempting to run, from the /usr/share/xml/scap//ssg/content directory: oscap xccdf eval --profile server --results xccdf-results.xml ssg-rhel6-xccdf.xml I have also tried the stig-server profile. In each case the results field is "null". It also generates multiple errors at the end of the eval: 1 1871 In file 'xccdf-results.xml' on line 15992: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 15995: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 15998: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 16001: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 16008: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 16011: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 16014: Element '{http://checklists.nist.gov/xccdf/1.1}ident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1}result ). 1 1871 In file 'xccdf-results.xml' on line 16769: Element '{http://checklists.nist.gov/xccdf/1.1}TestResult': Missing child element(s). Expected is one of ( {http://checklists.nist.gov/xccdf/1.1}rule-result, {http://checklists.nist.gov/xccdf/1.1}score ). XCCDF Results are NOT exported correctly. OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. The prior version, 0.1-1, generated a useful output which I was able to convert to a useable document with: oscap xccdf generate report xccdf-results.xml > $HOSTNAME-openscap.html I would appreciate any help possible, Eric B

6 26

[PATCH 01/10] Added example command.
by Michele Newman 02 Nov '12

02 Nov '12

--- RHEL6/input/system/accounts/pam.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index ce0f202..dec081f 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -438,6 +438,7 @@ This is the default. Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and ensure that the <tt>pam_unix.so</tt> module includes the argument <tt>sha512</tt>. +<tt># grep sha512 /etc/pam.d/system-auth</tt> </ocil> <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. -- 1.8.0

2 20

[PATCH 1/4] removing scratch files
by Shawn Wells 01 Nov '12

01 Nov '12

2 1

[PATCH 2/2] Added RPM dependency on openscap-utils >= 0.9.1
by Shawn Wells 01 Nov '12

01 Nov '12

1 0

[PATCH 1/2] Releasing 0.1-7 RPM
by Shawn Wells 01 Nov '12

01 Nov '12

1 0

[PATCH 4/4] Commented out erronious text in configure_logwatch_on_logserver
by Shawn Wells 01 Nov '12

01 Nov '12

1 0

[PATCH 3/4] ensure_logrotate_activated comment not ended appropriatel
by Shawn Wells 01 Nov '12

01 Nov '12

1 0

[PATCH 2/4] Updated STIG-server, fixed typo in rule of "service_postfix_enable"
by Shawn Wells 01 Nov '12

01 Nov '12

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2012