scap-security-guide May 2012

scap-security-guide@lists.fedorahosted.org

11 participants
43 discussions

[PATCH] Update bootloader password to use --encrypted instead of --md5
by Joe Nall 06 Jun '12

06 Jun '12

In https://access.redhat.com/knowledge/solutions/68828 Redhat says: Select a password and then generate a hash from it by running: # grub-crypt --sha-512 Insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-crypt as the value of password-hash) password --encrypted password-hash It should look like below. default=0 timeout=5 password --encrypted password-hash splashimage=(hd0,0)/grub/splash.xpm.gz Verify the permissions on /etc/grub.conf (which is a symlink to ../boot/grub/grub.conf): # chown root:root /etc/grub.conf # chmod 600 /etc/grub.conf grub-crypt utility is now shipped with three types of password encryption. --md5 Use MD5 to encrypt the password --sha-256 Use SHA-256 to encrypt the password --sha-512 Use SHA-512 to encrypt the password (default) Signed-off-by: Joe Nall <joe(a)nall.com> --- rhel6/src/input/checks/bootloader_password.xml | 2 +- rhel6/src/input/system/accounts/physical.xml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/rhel6/src/input/checks/bootloader_password.xml b/rhel6/src/input/checks/bootloader_password.xml index 8074097..ceff1b7 100644 --- a/rhel6/src/input/checks/bootloader_password.xml +++ b/rhel6/src/input/checks/bootloader_password.xml @@ -18,7 +18,7 @@ <ind:textfilecontent54_object id="object_bootloader_password" version="1"> <ind:path>/etc</ind:path> <ind:filename>grub.conf</ind:filename> - <ind:pattern operation="pattern match">password[\s]+--md5[\s]+.*</ind:pattern> + <ind:pattern operation="pattern match">password[\s]+--encrypted[\s]+.*</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 5c3a488..a8db13b 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -70,11 +70,11 @@ this file. <description>The grub boot loader should have password protection enabled to protect boot-time settings. To do so, select a password and then generate a hash from it by running: -<pre># grub-md5-crypt</pre> +<pre># grub-crypt --sha-512</pre> Insert the following line into <tt>/etc/grub.conf</tt> immediately -after the header comments. (Use the output from <tt>grub-md5-crypt</tt> as the +after the header comments. (Use the output from <tt>grub-crypt</tt> as the value of password-hash): -<pre>password --md5 password-hash</pre> +<pre>password --encrypted password-hash</pre> </description> <rationale> Password protection on the boot loader configuration ensures that -- 1.7.1

2 1

[PATCH 0/3] support for Values in login.defs settings
by Jeffrey Blank 31 May '12

31 May '12

This addresses multiple issues with OVAL checks and XCCDF content not supporting Values to adjust their requirements for settings in /etc/login.defs. Some remaining issues exist, such as the prose not being quite good yet, and I believe we will also break apart the OVAL check for minimum length to separately cover the settings in login.defs and pam_cracklib. But not today. Jeffrey Blank (3): updated OVAL checks which inspect login.defs to support Values (variables) updated refine-value names for password items, removed defunct/commented profile items updated guidance to permit adjustment of password warning period, min/max age, length * also added to test profile, for your testing pleasure .../checks/accounts_maximum_age_login_defs.xml | 26 ++++++--- .../checks/accounts_minimum_age_login_defs.xml | 31 +++++++---- .../checks/accounts_password_minlen_login_defs.xml | 17 +++---- .../accounts_password_warn_age_login_defs.xml | 32 +++++++----- rhel6/src/input/profiles/common.xml | 29 ++--------- rhel6/src/input/profiles/test.xml | 17 ++++++ .../accounts/restrictions/password_expiration.xml | 56 +++++++++++++------- 7 files changed, 121 insertions(+), 87 deletions(-)

3 6

[PATCH] openswan prose fixups
by Jeffrey Blank 28 May '12

28 May '12

Also, moved Rule into desktop profile. Jeffrey Blank (1): prose fixups for openswan * moved from common to desktop Profile * providing VPN tunnel availability for mobile devices was original rationale for inclusion in a Profile rhel6/src/input/profiles/common.xml | 1 - rhel6/src/input/profiles/desktop.xml | 1 + rhel6/src/input/system/network/ipsec.xml | 21 +++++++++++++++------ 3 files changed, 16 insertions(+), 7 deletions(-)

2 2

[PATCH] updates for wireless networking prose
by Jeffrey Blank 28 May '12

28 May '12

Also, introduced line breaks to some Rules. You don't have to use vim, but let's be nice to those of us that are. Jeffrey Blank (1): brought WiFi prose into the present day * removed disabling WiFi from common Profile, added to server Profile * also added many line breaks rhel6/src/input/profiles/common.xml | 1 - rhel6/src/input/profiles/server.xml | 1 + rhel6/src/input/system/network/network.xml | 36 +++++++++++++++++----- rhel6/src/input/system/network/wireless.xml | 43 +++++++++++++++++--------- 4 files changed, 56 insertions(+), 25 deletions(-)

2 2

periodical XCCDF test scans
by Petr Lautrbach 25 May '12

25 May '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, We periodically run XCCDF evaluation of sce-community-content [1] and I'd like to inform you that we also included scap-security-guide XCCDF into our automated test system [2]. Tests are run on RHEL-6.3 virtual system installed from kickstart similar to USCGB kickstart. If you add <fix> remediations to your content, we can merge them into used kickstart and reinstall system. We use oscap tool from openscap package in version 0.8.2 (built from git sources). This tool validates input content, evaluates XCCDF and also validates output data. If there is no problem in the scan, columns '# pass', '# failed' and '# other' are filled with values based on result in results.xml, link "full report" refers to report.html made by oscap and "git revision" link refers to git web frontend used with used git revision. If there is any problem during scan, "full report" refers to oscap log. [1] https://fedorahosted.org/sce-community-content/wiki/Results [2] https://fedorahosted.org/sce-community-content/raw-attachment/wiki/Results_… Regards, Petr - -- Petr Lautrbach <plautrba(a)redhat.com>, Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPv3wjAAoJEGOorUuYLENza8oP/2vawoytYQlVGv29KE51nfF/ 2mbbEjOkQ+lBc1EILXxEk+2BMxBRCQtFWgzqT0XadWj4IvAZEjOKUNCzDshlciqv CC1X3sMoCgH2etLZRng11Ej6YKHmp4ikwjzRUWfnUrDNcMU8rCJkOFCfS+zOrx4Q mDO/oCWjpIWv4cyGF/Jr63lUubtaybx1PQIMq32lzaKSLlALsuuAt+9AdkAEdHA1 dUU+m0YKxXiOV5VSPtRueoXdrh7Xt4qTwhUYb93PGUIUvM3xsD6FqneFgIhWuP3t A3wBg+JuRt3e5QDWSv7aQkVL18OZDXEq4YaO/A6ADSurXeC5dXamFVAtLimJzV3x GU679Y/sN1sMj71jotSlfjGs+YmyFDIiPvo7XQYyLdyyfN32yP6uVGY5i/LiuGZk mEjiO+bBNkOPA5OFb9Di88bsT84xa9buzx8etpGYx64B6oJxuyWUnW1TrRmZKC4m 5FacoCiPtSvDSIJ5y9Wa2DuO38wX+vW+tyZ5KVfAwfYXuFYCbwxRQjho7bsYsSoo 9K+lHSq0JZh5DSQgiOJDW+CkwJ5AyPiXL3BMEcuhuxVBlj+LjXGIC3i4VL6CmQXN USN83Ze6UaYLStuu5nC8Q5cpdK2Yb3rSYMe4BwJ7k7CjhJX48IgsX/GxXmicEHVL TqmnmdsHfeegXaWkf3Vc =UE5K -----END PGP SIGNATURE-----

2 1

[PATCH] Updated srg_aux
by Shawn Wells 24 May '12

24 May '12

2 1

How do I track these warnings down?
by Joe Nall 24 May '12

24 May '12

oscap xccdf generate guide --profile allrules output/rhel6-xccdf.xml > output/rhel6-guide.html WARNING: Processing an unresolved XCCDF document. This may have unexpected results. xmlwf input/checks/*.xml transforms/combinechecks.py input/checks > output/rhel6-oval.xml Duplicate ID, which will not be added: var_removable_partition Duplicate ID, which will not be added: var_removable_partition Duplicate ID, which will not be added: var_ssh_config_directory Duplicate ID, which will not be added: state_uid_root Duplicate ID, which will not be added: object_etc_skel_files Duplicate ID, which will not be added: var_samba_private_directory joe

2 1

Howdy
by Patrick Rutledge 23 May '12

23 May '12

Hello all. I am new to the list. My name is Patrick Rutledge, I am a Sr. Consultant at Red Hat. I have been working closely in the federal space for the last 7+ years so I am somewhat in tune with their security needs and focus. Recently I spent almost a year working on a project in which I deployed a hardened version of ESXi using a modified distribution containing a special kickstart and other OS tweaks in order to have it easily deployed overseas to comply with DISA STIGs. Before that I was working for 7 years at a government customer where I was deeply involved with the scanning and hardening of Unix and Linux systems. Another security related interest I have is high bandwidth one way data transfers, in which I hope to start an open source project on soon. Im ramping up right now with SCAP and hope to be able to provide a RHEL+KVM solution as my first attempt. In doing so, I will also spend some time looking at the current RHEL configurations to fill in any missing pieces. I look forward to working with you all on this project! Thanks, pat

2 1

netfs test
by Joe Nall 23 May '12

23 May '12

In order to pass the netfs test, I had to chkconfig --level 0123456 netfs off instead of just chkconfig --del netfs because <unix:runlevel_state comment="not configured to start" id="state_service_netfs_off" version="1"> <unix:start datatype="boolean">false</unix:start> <unix:kill datatype="boolean">true</unix:kill> checks that there is a kill script at every level instead of just testing for not starting. Is just testing <unix:runlevel_state comment="not configured to start" id="state_service_netfs_off" version="1"> <unix:start datatype="boolean">false</unix:start> at every init level sufficient? joe

1 0

[PATCH 1/1] The sysctl_values.csv has values that don't match the text. For example allowing source redirects.
by Joe Nall 22 May '12

22 May '12

--- .../sysctl_net_ipv4_conf_all_accept_redirects.xml | 10 +++++----- ...ysctl_net_ipv4_conf_all_accept_source_route.xml | 10 +++++----- .../sysctl_net_ipv4_conf_all_secure_redirects.xml | 10 +++++----- .../sysctl_net_ipv4_conf_all_send_redirects.xml | 10 +++++----- ...sctl_net_ipv4_conf_default_accept_redirects.xml | 10 +++++----- ...l_net_ipv4_conf_default_accept_source_route.xml | 10 +++++----- ...sctl_net_ipv4_conf_default_secure_redirects.xml | 10 +++++----- ...sysctl_net_ipv4_conf_default_send_redirects.xml | 10 +++++----- ...sctl_net_ipv6_conf_default_accept_redirects.xml | 14 ++++++-------- rhel6/src/input/checks/templates/sysctl_values.csv | 18 +++++++++--------- 10 files changed, 55 insertions(+), 57 deletions(-) diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml index a11a8bd..eb21415 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4217-6" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml index 2753ef6..94f8766 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_source_route" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_source_route" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4236-6" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_source_route" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml index 2e48ff9..5ddfeec 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_all_secure_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.all.secure_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-3472-8" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_secure_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml index 8df01ac..8beb66f 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_all_send_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.all.send_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4155-8" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_send_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml index 9c942a2..f14f6f2 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4186-3" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml index ce3f564..4c45bca 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_source_route" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_source_route" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4091-5" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_source_route" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml index 2e604ac..bf829cd 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_default_secure_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.default.secure_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-3339-9" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_secure_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml index b0784d9..a4594e8 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv4_conf_default_send_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv4.conf.default.send_redirects" Check</title> @@ -6,15 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4151-7" source="CCE" /> - <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description> </metadata> <criteria> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" /> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" /> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" /> </unix:sysctl_test> @@ -24,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_send_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml index ce710b9..7978ba7 100644 --- a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml +++ b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml @@ -1,4 +1,5 @@ <def-group> +  <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_redirects" version="1"> <metadata> <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_redirects" Check</title> @@ -6,17 +7,14 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <reference ref_id="CCE-4365-3" source="CCE" /> - <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "1".</description> -  + <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description> </metadata> - <criteria operator="OR"> - <extend_definition comment="IPv6 disabled or..." - definition_ref="kernel_module_ipv6_option_disabled" /> - <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" /> + <criteria> + <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" /> </criteria> </definition> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1"> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1"> <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" /> <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" /> </unix:sysctl_test> @@ -26,6 +24,6 @@ </unix:sysctl_object> <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_redirects" version="1"> - <unix:value datatype="int" operation="equals">1</unix:value> + <unix:value datatype="int" operation="equals">0</unix:value> </unix:sysctl_state> </def-group> diff --git a/rhel6/src/input/checks/templates/sysctl_values.csv b/rhel6/src/input/checks/templates/sysctl_values.csv index 549e847..75e2c6a 100644 --- a/rhel6/src/input/checks/templates/sysctl_values.csv +++ b/rhel6/src/input/checks/templates/sysctl_values.csv @@ -1,19 +1,19 @@ kernel.exec-shield,1,4168-1 kernel.randomize_va_space,1,4146-7 -net.ipv4.conf.all.accept_redirects,1,4217-6 -net.ipv4.conf.all.accept_source_route,1,4236-6 +net.ipv4.conf.all.accept_redirects,0,4217-6 +net.ipv4.conf.all.accept_source_route,0,4236-6 net.ipv4.conf.all.log_martians,1,4320-8 net.ipv4.conf.all.rp_filter,1,4080-8 -net.ipv4.conf.all.secure_redirects,1,3472-8 -net.ipv4.conf.all.send_redirects,1,4155-8 -net.ipv4.conf.default.accept_redirects,1,4186-3 -net.ipv4.conf.default.accept_source_route,1,4091-5 +net.ipv4.conf.all.secure_redirects,0,3472-8 +net.ipv4.conf.all.send_redirects,0,4155-8 +net.ipv4.conf.default.accept_redirects,0,4186-3 +net.ipv4.conf.default.accept_source_route,0,4091-5 net.ipv4.conf.default.rp_filter,1,3840-6 -net.ipv4.conf.default.secure_redirects,1,3339-9 -net.ipv4.conf.default.send_redirects,1,4151-7 +net.ipv4.conf.default.secure_redirects,0,3339-9 +net.ipv4.conf.default.send_redirects,0,4151-7 net.ipv4.icmp_echo_ignore_broadcasts,1,3644-2 net.ipv4.icmp_ignore_bogus_error_responses,1,4133-5 net.ipv4.ip_forward,0,3561-8 net.ipv4.tcp_syncookies,1,4265-5 net.ipv6.conf.all.disable_ipv6,1,4298-6 -net.ipv6.conf.default.accept_redirects,1,4365-3 +net.ipv6.conf.default.accept_redirects,0,4365-3 -- 1.7.1

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2012