scap-security-guide January 2013

scap-security-guide@lists.fedorahosted.org

12 participants
74 discussions

Start a nNew thread

[PATCH] Altered references from system-auth-ac to system-auth
by Shawn Wells 17 Jan '13

17 Jan '13

3 2

[PATCH 0/2] added a Group, fixed some text
by David Smith 17 Jan '13

17 Jan '13

1) "Disable Unused Interfaces" is now a Group 2) cleaned up some of the text in ipv6.xml and wireless.xml David Smith (2): turned a Rule into a Group slight text modifications RHEL6/input/system/network/ipv6.xml | 4 ++-- RHEL6/input/system/network/network.xml | 20 +++++++++----------- RHEL6/input/system/network/wireless.xml | 4 ++-- 3 files changed, 13 insertions(+), 15 deletions(-)

2 3

PAM files ending in "-ac"
by Kenneth Stailey 16 Jan '13

16 Jan '13

Hi, I was looking at http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel… and it says to change PAM files that end in "-ac" but the rule is that the autoconf program can re-write (clobber) PAM files that end in "-ac" and if you want to avoid that you copy the "-ac" file to a new name such as one that ends in "-local" and then reset the symbolic link from pointing to the "-ac" file to pointing at you "-local" file. Can the documentation be updated to reflect this? Thanks, Ken

2 2

[PATCH] Fix reverse logic of two ssh_config tests
by Kenneth Stailey 16 Jan '13

16 Jan '13

The tests should ensure the options are disabled but the logic was reversed. The tests also allowed zero whitespace where sshd would not. Signed-off-by: Kenneth Stailey <kstailey.lists(a)gmail.com> --- RHEL6/input/checks/sshd_no_user_envset.xml | 2 +- RHEL6/input/checks/sshd_permitemptypasswords_no.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml index a68d872..985395e 100644 --- a/RHEL6/input/checks/sshd_no_user_envset.xml +++ b/RHEL6/input/checks/sshd_no_user_envset.xml @@ -28,7 +28,7 @@ version="1"> <ind:path>/etc/ssh</ind:path> <ind:filename>sshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml index 29545b6..3795e4b 100644 --- a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml +++ b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml @@ -28,7 +28,7 @@ version="1"> <ind:path>/etc/ssh</ind:path> <ind:filename>sshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> -- 1.8.1.1

2 1

[PATCH] Increase ASLR Level
by Kenneth Stailey 16 Jan '13

16 Jan '13

All, Sorry I've been away for a while, things have been very busy here. My system fails the ASLR sysctl test because is more secure than the test requires. The test checks that the ASLR control is set to "1" while setting it to "2" randomizes more of the system's memory. See Linux documentation file Documentation/sysctl/kernel.txt http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482 Thanks, Kenneth Stailey (1): Please Randomize Heap Space too RHEL6/input/checks/templates/sysctl_values.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.8.1.1

3 3

[PATCH 2/2] DISA FSO: OCIL language cleanup to RHEL6/input/system/logging.xml
by Shawn Wells 15 Jan '13

15 Jan '13

2 1

[PATCH 1/2] DISA FSO: Language changes to RHEL6/input/services/ftp.xml
by Shawn Wells 15 Jan '13

15 Jan '13

2 1

[PATCH] Speling errror corection.
by Christopher Anderson 15 Jan '13

15 Jan '13

Corrected several misspelled words including acknowledgement, aleart, anauthorized, appliations, apropriate, atlernate, circumstatnces, commmand, communciations, Compatiblity, complinace, contigency, crptographic, defintion, defniition, DEPRECTATED, desginated, destication, dissemenates, dissiminates, distinquish, distrubution, documente, employes, enabeld, Enteprise, existance, existince, feasable, fillowing, freqency, frequencyof, furtuer, Iincluding, implimentation, informaiton, informatin, informatio, invenotires, labelling, locahost, locatioin, logio, magnitue, maintaenance, maitaining, mannger, mechanicsms, miscellanous, occures, oeprational, operaitonal, organizaiton, organizatin, organizationk, organizatoin, organiztion, organzation, organziation, origanization, permissios, personel, premissions, proceedure, produciton, prolicies, protocal, renameat, Reposition, Repostiory, reqirement, resynchronization, reuqirements, securiy, seleted, seperate, strenght, superceded, superceeded, timout, toorganization, traning, trhough, uathorization, untrested, writeable, plus a few misspellings of or references to Red Hat. Chris Christopher Anderson (1): Corrected a few speling errrors. JBossEAP5/eap5-ocil.xml | 10 +- RHEL6/README | 2 +- RHEL6/input/auxiliary/nist_support.xml | 2 +- RHEL6/input/auxiliary/transition_notes.xml | 18 ++-- .../input/checks/audit_rules_dac_modification.xml | 2 +- .../file_permissions_httpd_server_conf_files.xml | 2 +- .../checks/file_permissions_ldap_server_files.xml | 2 +- .../checks/gconf_gnome_screensaver_idle_delay.xml | 2 +- .../ldap_server_config_bdb_file_security.xml | 2 +- .../ldap_server_config_directory_file_security.xml | 2 +- RHEL6/input/checks/mount_option_dev_shm_noexec.xml | 2 +- RHEL6/input/checks/mount_option_dev_shm_nosuid.xml | 2 +- RHEL6/input/checks/mount_option_tmp_noexec.xml | 2 +- RHEL6/input/checks/mount_option_tmp_nosuid.xml | 2 +- ...mail_relay_smtp_auth_for_untrusted_networks.xml | 2 +- RHEL6/input/checks/rpm_verify_hashes.xml | 2 +- RHEL6/input/checks/sshd_idle_timeout.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 6 +- RHEL6/input/services/ldap.xml | 2 +- RHEL6/input/system/permissions/files.xml | 4 +- RHEL6/input/system/permissions/partitions.xml | 10 +- RHEL6/input/system/software/updating.xml | 2 +- RHEL6/references/cce-rhel5.xml | 18 ++-- RHEL6/references/disa-cci-list.xml | 114 ++++++++++----------- RHEL6/references/disa-os-srg-v1r1.xml | 4 +- RHEL6/references/disa-stig-rhel5-v1r0.6-oval.xml | 14 +-- .../disa-stig-rhel5-v1r0.6-xccdf-manual.xml | 26 ++--- RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf.xml | 6 +- RHEL6/references/usgcb-rhel5desktop-oval.xml | 16 +-- RHEL6/references/usgcb-rhel5desktop-xccdf.xml | 26 ++--- 30 files changed, 153 insertions(+), 153 deletions(-) -- 1.7.11.7

2 1

[PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
by Shawn Wells 15 Jan '13

15 Jan '13

2 1

[PATCH 0/5] various fixes
by David Smith 15 Jan '13

15 Jan '13

1 - fixed a number of typos (found by FSO) 2 - began preparing content for CCE submission David Smith (5): text fixes from DISA FSO tag escape fix turned a group into a rule removed a rule began adding CCE elements to build table of needed CCEs RHEL6/input/services/http.xml | 3 --- RHEL6/input/services/printing.xml | 2 +- RHEL6/input/system/accounts/banners.xml | 20 +++++++++++--------- RHEL6/input/system/accounts/pam.xml | 9 ++++++--- RHEL6/input/system/accounts/physical.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 2 +- RHEL6/input/system/auditing.xml | 8 +++++++- RHEL6/input/system/network/iptables.xml | 4 ++-- RHEL6/input/system/network/ipv6.xml | 4 ++++ RHEL6/input/system/network/network.xml | 8 ++++---- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/input/system/software/integrity.xml | 2 ++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 13 files changed, 43 insertions(+), 29 deletions(-)

2 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2013