scap-security-guide September 2012

scap-security-guide@lists.fedorahosted.org

18 participants
92 discussions

Start a nNew thread

[PATCH 5/8] Signed off on user_umask_profile
by Shawn Wells 27 Sep '12

27 Sep '12

1 0

[PATCH 4/8] Signed off on user_umask_logindefs
by Shawn Wells 27 Sep '12

27 Sep '12

1 0

[PATCH 3/8] Added persistent config test to sysctl-check-macro
by Shawn Wells 27 Sep '12

27 Sep '12

1 0

[PATCH 2/8] Updated sysctl-desc-macro to check for persistent config
by Shawn Wells 27 Sep '12

27 Sep '12

1 0

[PATCH 1/8] Copy-edit of enable_randomize_va_space
by Shawn Wells 27 Sep '12

27 Sep '12

1 0

new testing tag
by Jeffrey Blank 27 Sep '12

27 Sep '12

A new <tested> tag can now be added to Rules. This will be a way to document when: 1) The fix text has been proofread and exercised. 2) The check text has been proofread and exercised. 3) A positive and negative test result can be obtained using the fix text (description) and its check text. This should ensure at least syntactic correctness for all Rules. A second round of testing (from a different person) will involve verification that the system behaves as configured. I'll be adding support to the transforms to show this in tables (with color coding), and also to move the information into comments (or some other valid storage area in XCCDF). Michael mentioned that he's going to start testing, so hopefully this will enable that. See example tag below (at bottom): <Rule id="partition_for_tmp"> <title>Ensure /tmp Located On Separate Partition</title> <description> The <tt>/tmp</tt> directory is a world-writable directory used for temporary file storage. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM. </description> <ocil><partition-check-macro part="/tmp"/></ocil> <rationale> The <tt>/tmp</tt> partition is used as temporary storage by many programs. Placing <tt>/tmp</tt> in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it. </rationale> <ident cce="14161-4"/> <oval id="mount_tmp_own_partition" /> <ref nist="CM-6" /> <tested by="MM" on="20120927"> </Rule>

1 0

[PATCH] additional OCIL check text
by David Smith 27 Sep '12

27 Sep '12

added several OCIL checks David Smith (1): additional OCIL checks RHEL6/input/services/ldap.xml | 7 +++++++ RHEL6/input/services/nfs.xml | 25 +++++++++++++++++++++++++ RHEL6/input/services/ntp.xml | 8 ++++++++ RHEL6/input/services/ssh.xml | 6 ++++++ RHEL6/input/system/logging.xml | 5 ++--- RHEL6/input/system/permissions/mounting.xml | 6 ++++++ 6 files changed, 54 insertions(+), 3 deletions(-)

3 4

MISC additions query
by Michael J. McConachie 27 Sep '12

27 Sep '12

Jeff, I finished adding "this is a finding" clauses to pre-existing <ocil> tags; I would like to start on the blank rows in the OCIL/check text column and insert (at a minimum) <ocil clause="(this is a finding)"> on each one, so that at least we have that step done for every row on the ST page. The we can auto-fill the bulk of the verbiage that's left to do with macros at a later time as they are established, right? Does this sound good? If so, I'll get started on adding the checks to those remaining blank boxes. R/S -- Red Hat Consulting Michael J. McConachie, RHCE Consultant - Red Hat, Inc. michael(a)redhat.com

2 3

[PATCH] new sshd check macro
by Jeffrey Blank 27 Sep '12

27 Sep '12

For SSH (and other configurations), we want to preserve the ability to not flag non-compliance if the default (unspecified) is compliant. It reduces costs, which makes for a more compelling (less uncompelling?) argument for C&A activities. The wording of this is rough and definitely not final. After all the other checks and profile inclusion adjustments are complete, and when we get to copy editing, it will undoubtedly be improved. Jeffrey Blank (1): added new macro for SSH checks (rough wording for now), and used it RHEL6/input/services/ssh.xml | 15 +++++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 21 ++++++++++++++++++++- 2 files changed, 35 insertions(+), 1 deletions(-)

2 2

[PATCH] added OCIL check text
by David Smith 27 Sep '12

27 Sep '12

added and modified a few things, including using gconftool-2 itself to query gconf values David Smith (1): OCIL text additions and modifications RHEL6/input/services/nfs.xml | 10 +++++++ RHEL6/input/system/accounts/physical.xml | 26 ++++++++++---------- .../accounts/restrictions/password_expiration.xml | 2 +- 3 files changed, 24 insertions(+), 14 deletions(-)

1 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2012