scap-security-guide May 2012

scap-security-guide@lists.fedorahosted.org

11 participants
43 discussions

[PATCH v3] Logging and Auditing
by Mike Palmiotto 15 May '12

15 May '12

Some edits to Logging and Auditing. More granular auditd data retention. Removed some logwatch checks. Mike Palmiotto (1): M1 Incomplete Guidance - Logging and Auditing .../auditd_data_retention_admin_space_left.xml | 30 ++++++++ .../checks/auditd_data_retention_mail_acct.xml | 30 ++++++++ .../input/checks/auditd_data_retention_max_log.xml | 30 ++++++++ .../checks/auditd_data_retention_max_log_file.xml | 30 ++++++++ .../checks/auditd_data_retention_space_left.xml | 30 ++++++++ .../input/checks/logwatch_configured_hostlimit.xml | 29 ++++++++ .../checks/logwatch_configured_splithosts.xml | 27 ++++++++ rhel6/src/input/profiles/common.xml | 14 ++++ rhel6/src/input/system/auditing.xml | 69 +++++++++++++++++++- rhel6/src/input/system/logging.xml | 71 ++++++++++++++++++++ 10 files changed, 359 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml create mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file.xml create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml create mode 100644 rhel6/src/input/checks/logwatch_configured_hostlimit.xml create mode 100644 rhel6/src/input/checks/logwatch_configured_splithosts.xml -- 1.7.6.5

2 3

[PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5
by Mike Palmiotto 10 May '12

10 May '12

Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com> --- .../src/input/checks/audit_rules_login_events.xml | 2 +- .../input/checks/audit_rules_session_events.xml | 2 +- rhel6/src/input/profiles/common.xml | 2 + rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++ 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_login_events.xml b/rhel6/src/input/checks/audit_rules_login_events.xml index 77a7661..06bbbff 100644 --- a/rhel6/src/input/checks/audit_rules_login_events.xml +++ b/rhel6/src/input/checks/audit_rules_login_events.xml @@ -1,7 +1,7 @@ <def-group> <definition class="compliance" id="audit_rules_login_events" version="1"> <metadata> - <title>Audit Logon/Logout Events</title> + <title>Record Attempts to Alter Logon and Logout Events</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> diff --git a/rhel6/src/input/checks/audit_rules_session_events.xml b/rhel6/src/input/checks/audit_rules_session_events.xml index e1dfc43..b3b2595 100644 --- a/rhel6/src/input/checks/audit_rules_session_events.xml +++ b/rhel6/src/input/checks/audit_rules_session_events.xml @@ -1,7 +1,7 @@ <def-group> <definition class="compliance" id="audit_rules_session_events" version="1"> <metadata> - <title>Audit Session Initiation Information</title> + <title>Record Attempts to Alter Process and Session Initiation Information</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml index 20853f5..a628a5a 100644 --- a/rhel6/src/input/profiles/common.xml +++ b/rhel6/src/input/profiles/common.xml @@ -88,6 +88,8 @@ <select idref="audit_account_changes" selected="true"/> <select idref="audit_network_modifications" selected="true"/> <select idref="audit_mac_changes" selected="true"/> +<select idref="audit_manual_logon_edits" selected="true" /> +<select idref="audit_manual_session_edits" selected="true" /> <select idref="audit_dac_actions" selected="true"/> <select idref="audit_file_access" selected="true"/> <select idref="audit_privileged_commands" selected="true"/> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index c79471f..b54ae64 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -206,6 +206,36 @@ anything other than administrator action. All changes to MAC policy should be au <ref nist="AU-2" /> </Rule> +<Rule id="audit_manual_logon_edits"> +<title> Record Attempts to Alter Logon and Logout Events</title> +<description> +The audit system already collects login info for all users and root. To watch for attempted manual edits of +files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/log/faillog -p wa -k logins +-w /var/log/lastlog -p wa -k logins +</pre> +</description> +<ident cce="14904-7" /> +<oval id="audit_rules_login_events" /> +<ref nist="TODO" /> +</Rule> + +<Rule id="audit_manual_session_edits"> +<title> Record Attempts to Alter Process and Session Initiation Information</title> +<description> +The audit system already collects process information for all users and root. To watch for attempted manual +edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/run/utmp -p wa -k session +-w /var/log/btmp -p wa -k session +-w /var/log/wtmp -p wa -k session +</pre> +</description> +<ident cce="14679-5" /> +<oval id="audit_rules_session_events" /> +<ref nist="TODO" /> +</Rule> <Rule id="audit_dac_actions"> <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control -- 1.7.6.5

4 3

RE: [PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package
by Mike Palmiotto 10 May '12

10 May '12

>The following sections detail commands to enforce idle activation of the screen saver, > screen locking, a blank-screen screensaver, and an idle > activation time. >+<ref disa="56" /> It appears that a ref tag snuck its way inside the gui_screen_locking group's description tag. The tag has disa's 56, 57, and 60. > <br /><br /> > Because users should be trained to lock the screen when they >@@ -288,7 +289,7 @@ for users who may need to suspend console logins. > </rationale> > <ident cce="3910-7" /> > <oval id="package_vlock_installed" /> >-<ref nist="CM-6, CM-7" /> >+<ref nist="CM-6, CM-7" disa="56" /> > </Rule> > </Group> > </Group> I think it should suffice to pull it down to the next <ref> tag, just before the end of the Rule. Thoughts? There was another error with the key-sequence 'inactivity_timeout_value'. I checked the OVAL and XCCDF shorthand and everything seems to check out, yet this error still pops up when trying to run a make validate: "No match found for key-sequence ['inactivity_timeout_value'] of keyref '{http://checklists.nist.gov/xccdf/1.1}valueIdKeyRef'." --Mike

4 4

[PATCH] documenting SRG satisfaction (outside of Rule/Group references)
by Jeffrey Blank 07 May '12

07 May '12

The attached patch enables documentation of OS SRG satifaction (or dissatisfaction) outside of the XCCDF content that will be "shipped" in the guide or any baselines. It does so by inserting files in the new input/auxiliary directory, and then removing their Groups (via a new transform, xccdf-removeaux) following the generation of tables. This may not be the most elegant solution, but it meets our needs. It does impose some ordering requirements on the generation of some outputs, but Make handles such things as long as we keep it in mind... Jeffrey Blank (1): added support for Groups that exist only for some outputs * this is intended to allow documentation of SRG satisfaction, for that table (but not final XCCDF output) rhel6/src/Makefile | 2 +- rhel6/src/input/auxiliary/srg_support.xml | 37 +++++++++++++++++++++++++++++ rhel6/src/input/guide.xslt | 2 + rhel6/src/transforms/xccdf-removeaux.xslt | 22 +++++++++++++++++ 4 files changed, 62 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/auxiliary/srg_support.xml create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt

2 2

Re: [PATCH] documenting SRG satisfaction (outside of Rule/Group references)
by Jeffrey Blank 06 May '12

06 May '12

Oh, git send-email... do what I mean, not what I say! Here, "y" meant to accept my default email address, not invent a new one. Anyway, patch for consideration. You know where it came from. On 05/06/2012 02:23 PM, y(a)magellan.eclipse.ncsc.mil wrote: > From: Jeffrey Blank <blank(a)eclipse.ncsc.mil> > > The attached patch enables documentation of OS SRG satifaction (or > dissatisfaction) outside of the XCCDF content that will be "shipped" in the > guide or any baselines. It does so by inserting files in the new > input/auxiliary directory, and then removing their Groups (via a new transform, > xccdf-removeaux) following the generation of tables. This may not be the most > elegant solution, but it meets our needs. It does impose some ordering > requirements on the generation of some outputs, but Make handles such things as > long as we keep it in mind... > > > Jeffrey Blank (1): > added support for Groups that exist only for some outputs * this > is intended to allow documentation of SRG satisfaction, for > that table (but not final XCCDF output) > > rhel6/src/Makefile | 2 +- > rhel6/src/input/auxiliary/srg_support.xml | 37 +++++++++++++++++++++++++++++ > rhel6/src/input/guide.xslt | 2 + > rhel6/src/transforms/xccdf-removeaux.xslt | 22 +++++++++++++++++ > 4 files changed, 62 insertions(+), 1 deletions(-) > create mode 100644 rhel6/src/input/auxiliary/srg_support.xml > create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt > >

1 0

RE: [PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5
by Mike Palmiotto 04 May '12

04 May '12

I NACK myself. Some errors in the oval_id's and missing profile entries. Correcting and sending out a revision patch. --Mike ________________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Michael Palmiotto [mpalmiotto(a)tresys.com] Sent: Friday, May 04, 2012 2:52 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: [PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5 Received an auto-ACK from Jeff. Going to go ahead and push these commits. Michael Palmiotto (1): Fixed titles for CCEs 14904-7 and 14697-5 .../src/input/checks/audit_rules_login_events.xml | 2 +- .../input/checks/audit_rules_session_events.xml | 2 +- rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) -- 1.7.6.5 _______________________________________________ scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/scap-security-guide

1 0

[PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5
by Mike Palmiotto 04 May '12

04 May '12

Received an auto-ACK from Jeff. Going to go ahead and push these commits. Michael Palmiotto (1): Fixed titles for CCEs 14904-7 and 14697-5 .../src/input/checks/audit_rules_login_events.xml | 2 +- .../input/checks/audit_rules_session_events.xml | 2 +- rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) -- 1.7.6.5

1 1

[PATCH 00/14] Mapped more CCI numbers to SSG content
by Willy Santos 04 May '12

04 May '12

More CCI mappings to SSG content. Willy Santos (14): Mapped CCI-000056 to gui_screen_locking group and install_vlock_package Mapped CCI-000057 to gui_screen_locking group Mapped CCI-000058 to install_vlock_package Mapped CCI-000060 to gui_screen_locking Mapped CCI-000068 to ssh_server group Mapped CCI-000087 to mountopt_noexec_on_removable_partitions Mapped CCI-000192 to password_require_uppercases Mapped CCI-000193 to password_require_lowercases Mapped CCI-001384 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001385 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001386 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001387 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001388 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001069 to aide group rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/accounts/banners.xml | 4 ++-- rhel6/src/input/system/accounts/pam.xml | 4 ++-- rhel6/src/input/system/accounts/physical.xml | 3 ++- rhel6/src/input/system/permissions/partitions.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-) -- 1.7.7.6

2 15

[PATCH v2 0/2] M1 Incomplete Guidance - Tickets #23, 26
by Mike Palmiotto 04 May '12

04 May '12

Here are the revisions to previous patches for Tickets #23,26. Michael Palmiotto (1): M1 Incomplete Guidance - Account and Access Control Mike Palmiotto (1): M1 Incomplete Guidance - Logging and Auditing .../checks/accounts_disabled_after_expiration.xml | 24 ++++ ...counts_login_shell_timeout_implemented_bash.xml | 45 ++++++++ ...counts_login_shell_timeout_implemented_tcsh.xml | 25 +++++ .../input/checks/accounts_netrc_files_checked.xml | 25 +++++ .../accounts_user_dot_files_not_world_writable.xml | 33 ++++++ .../checks/audit_rules_logon_modification.xml | 34 ++++++ .../checks/audit_rules_session_modification.xml | 47 ++++++++ .../checks/libuser_login_defs_userdefaults.xml | 50 +++++++++ .../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++ .../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++ rhel6/src/input/profiles/common.xml | 42 +++++++- rhel6/src/input/system/accounts/accounts.xml | 27 +++++ rhel6/src/input/system/accounts/pam.xml | 38 +++++++- rhel6/src/input/system/accounts/physical.xml | 63 +++++++++++ .../system/accounts/restrictions/restrictions.xml | 114 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 24 ++++ rhel6/src/input/system/auditing.xml | 77 +++++++++++++- rhel6/src/input/system/logging.xml | 67 ++++++++++++ 18 files changed, 873 insertions(+), 3 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml -- 1.7.6.5

3 5

[PATCH] fixed bug so that table-srgmap will also map Groups
by Jeffrey Blank 03 May '12

03 May '12

The idea here is that discussion inside a Group may provide evidence that an OS SRG requirement is being met. Many Groups have already gotten refs for OS SRG items. A future patch will allow additional discussion to be included, from Groups in an auxiliary file (that will not be part of any other output). Jeffrey Blank (1): fixed table-srgmap to also map Groups rhel6/src/Makefile | 4 ++-- rhel6/src/transforms/table-srgmap.xslt | 17 +++++++++-------- 2 files changed, 11 insertions(+), 10 deletions(-)

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2012