scap-security-guide February 2013

scap-security-guide@lists.fedorahosted.org

24 participants
50 discussions

Inconsistent guidance and tests for disabling kernel modules (e.g. disable_protocol_dccp)
by Philip Shuman 05 Feb '13

05 Feb '13

A number of the kernel modules that need to be disabled have inconsistent guidance and tests. The guidance says to add a file in /etc/modprobe.d/ with the content: "install <module> /bin/true" However, the actual check in the scan tests for: "install <module> /bin/false" This is a list of the ones I found: $ cd scap-security-guide/RHEL6/dist/content $ grep -h install * | grep -E "rds|ticp|usb-storage|cramfs|freevsfs|jffs2|hfs|hfsplus|squashfs|udf|dccp|sctp" | grep -E "true|false" <ind:pattern operation="pattern match">^\s*install\s+hfs\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+sctp\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+rds\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+dccp\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+udf\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+/bin/false$</ind:pattern> <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+/bin/false$</ind:pattern> <xhtml:pre xml:space="preserve">install usb-storage /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install cramfs /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install freevsfs /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install jffs2 /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install hfs /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install hfsplus /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install squashfs /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install udf /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install dccp /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install sctp /bin/true</xhtml:pre> <xhtml:pre xml:space="preserve">install rds /bin/true</xhtml:pre> Either /bin/true or /bin/false should work to disable the modules. Setting our files to /bin/false causes the scans to pass right now. Thanks, Philip

3 4

[PATCH] Replace xsl:attribute name="xmlns" with xsl:element
by Gary Gapinski 04 Feb '13

04 Feb '13

libxslt 1.1.27 now (correctly) prohibits xsl:attribute with name="xmlns". This change uses an explicit xsl:element with explicit namespace. This change should be removed (in favor of just identity transform) when input document has desired explicit namespace declaration. Gary Gapinski (1): Remove invalid attempt to use xsl:attribute to set xmlns. Replace with xsl:element with explicit namespace (namely, XCCDF 1.1). Note that this overrides any namespace set in input document. This should be removed when input document has explicit namespace declaration. RHEL6/transforms/shorthand2xccdf.xslt | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 1.7.10.4

3 3

[PATCH] [bugfix] Inconsistent kernel checking
by Shawn Wells 04 Feb '13

04 Feb '13

3 2

patch to the xccdf-addfixes.xslt to get it to work
by Brian Millett 03 Feb '13

03 Feb '13

RHEL-6, libxslt-1.1.26 Ok, so now when I try to make with fixes, the following errors happen: Attribute nodes must be added before any child nodes to an element. runtime error: file transforms/xccdf-addfixes.xslt line 37 element copy The patch is [root@localhost transforms]# diff -wruN xccdf-addfixes.xslt.orig xccdf-addfixes.xslt --- xccdf-addfixes.xslt.orig 2013-02-01 14:40:40.580808238 -0600 +++ xccdf-addfixes.xslt 2013-02-01 14:35:31.607797643 -0600 @@ -11,7 +11,8 @@ <xsl:template match="xccdf:Rule"> <xsl:copy>  - <xsl:apply-templates select="@*|node()[not(self::xccdf:check)]"/> + <xsl:copy-of select="@*" /> + <xsl:apply-templates select="node()[not(self::xccdf:check)]"/> <xsl:variable name="rule_id" select="@id"/> <xsl:for-each select="$fixgroup/xccdf:fix"> And it works. Nice way to end the week! -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

2 3

Initial setup
by Christopher Anderson 03 Feb '13

03 Feb '13

Walking through the initial setup was pretty quick an easy. I had no problems with the main wiki page and the usage guide page. I did find what appear to be small errors here and there, which I'll walk through. The page titled "Becoming an SCAP Security Guide Developer" (https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper) seems to have a few issues. First, under "Establishing your Accounts", there are three items all numbered 1. Second, under "Performing your first git clone", the command example shows acquiring the source via git and the ssh protocol. This should fail as the Fedora Account setup and request to join this group (and gaining ssh access) happens in step 6 of the next section. Consider changing the protocol to git: git clone git://git.fedorahosted.org/git/scap-security-guide.git Third, under "Submitting Proposed Changes" step 1, the command example asks the user to ensure their changes are valid by running "make; make validate" without specifying a directory. With a little experimentation it is easy to figure out that "make" will work from the top level directory in the source tree, but "make validate" must be run from the RHEL6 directory. I'm not sure if validate should be added to the top level Makefile, or if a rewording of the item to clarify would be better. With the exception of that page, I haven't found anything else. The pages are well thought out and I have yet to find even a spelling error in the wiki. Chris

2 1

[PATCH] Correct prototype namespace and schema location
by Gary Gapinski 02 Feb '13

02 Feb '13

RHEL6/input/guide.xml lacked a namespace declaration for <Benchmark> as well as citing a non-existent relative URI for schema location. Gary Gapinski (1): Correct xsi:schemalocation to cite XCCDF 1.1.4 schema. Place <Benchmark> element in XCCDF namespace. RHEL6/input/guide.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.7.10.4

2 2

Account lockout problems in RHEL6.3
by Philip Shuman 02 Feb '13

02 Feb '13

I'm in the process of implementing lockdowns for RHEL 6.3 based on the draft scap-security-guide as downloaded via git. The account lockout timeouts in /etc/pam.d/ have proven problematic for me. There are a couple issues I wanted to bring up. First, the current security guide checks for unlock_time=100000000 in the /etc/pam.d/ files; however, the max value that pam_faillock.so will accept is 604800. Anything larger than this value results in unlock_time defaulting back to 600 seconds. >From Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c: ... #define MAX_TIME_INTERVAL 604800 /* 7 days */ ... else if (strncmp(argv[i], "unlock_time=", 12) == 0) { unsigned int temp; if (sscanf(argv[i]+12, "%u", &temp) != 1 || temp > MAX_TIME_INTERVAL) { pam_syslog(pamh, LOG_ERR, "Bad number supplied for unlock_time argument"); } else { opts->unlock_time = temp; } } Second, the STIG guidance asks for the authfail and authsucc lines to be added directly below pam_env.so. I've found that causes login prompt to never reach asking for a password, both on the console and when running X. I am using the example provided below additionally uses the preauth line before pam_unix.so and that is working as I would expect: https://access.redhat.com/knowledge/solutions/62949 auth required pam_env.so auth required pam_faillock.so preauth silent audit deny=3 unlock_time=600 auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail audit deny=3 auth sufficient pam_faillock.so authsucc audit deny=3 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so (Tip: remove the "silent" from the preauth line for testing. faillock will tell you when it is kicking in to block a user. Remove for production so you don't leak valid usernames.) Third, when implemented, this long lock time does not persist a reboot. A locked user is able to login after rebooting the machine. Is this expected? I apprciate any help or working example system-auth or password-auth files. Best regards, Philip

2 5

libxslt-1.2.27 appears to be really brain dead
by Brian Millett 01 Feb '13

01 Feb '13

[bpm]$ rpm -qa | grep libxslt libxslt-1.1.27-2.fc18.x86_64 libxslt-devel-1.1.27-2.fc18.x86_64 libxslt-python-1.1.27-2.fc18.x86_64 Ok, so I've been working really hard to understand why the xsltproc commands just were not working as advertised in the make file for the latest (20130201) git clone of scap-security-guide. I've got a fedora 18 system with the libxslt1.1.27-2 packages. Well, the build just breaks. The following commands work, they just do not produce the desired output xsltproc -stringparam notes "../input/auxiliary/transition_notes.xml" -o output/table-rhel5-stig-manual-withnotes.html \ transforms/xccdf2table-stig.xslt \ references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o output/table-stig-rhel6-server-shorttitles.html \ transforms/xccdf2table-profileccirefs.xslt \ output/unlinked-rhel6-xccdf.xml xsltproc -stringparam alttitles "../input/auxiliary/alt-titles-stig.xml" -o output/unlinked-stig-rhel6-xccdf.xml \ transforms/xccdf-alt-titles.xslt \ output/unlinked-rhel6-xccdf.xml xsltproc -stringparam profile "stig-rhel6-server" -o output/table-stig-rhel6-server.html \ transforms/xccdf2table-profileccirefs.xslt \ output/unlinked-stig-rhel6-xccdf.xml xsltproc --html -o output/table-stig-rhel6-server.html transforms/table-add-vulnids.xslt output/table-stig-rhel6-server.html xsltproc -stringparam profile "stig-rhel6-server" -stringparam format "flat" -o output/table-stig-rhel6-server-flat.html \ transforms/xccdf2table-profileccirefs.xslt \ output/unlinked-stig-rhel6-xccdf.xml So I did a git clone on a new RHEL-6 box which has libxslt-1.1.26 and guess what?? IT WORKS. So, this is beyond my pay grade. But at least I know that for this, I'm not insane. I had my doughts after spending 2 days staring at the xccdf2table-profileccirefs.xslt and xccdf-addfixes.xslt wondering why they were not working. So, I'll stay on RHEL-6 for now to understand the build process better. Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

1 0

[PATCH] [bugfix] var_accounts_passwords_pam_faillock_unlock_time value exceeded MAX_TIME_INTERVAL
by Shawn Wells 01 Feb '13

01 Feb '13

Thanks to Philip S. for reporting this!

1 0

patch to the RHEL6/Makefile
by Brian Millett 01 Feb '13

01 Feb '13

When running make, I get the following error Duplicate ID, which will not be added: state_mode_0000 Duplicate ID, which will not be added: state_uid_0 Duplicate ID, which will not be added: state_gid_0 xmllint --format --output output/unlinked-rhel6-oval.xml output/unlinked-rhel6-oval.xml transforms/cpe_generate.py output/unlinked-rhel6-oval.xml input/checks/platform/rhel6-cpe-dictionary.xml ssg transforms/relabelids.py unlinked-rhel6-xccdf.xml ssg transforms/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml ssg mkdir -p dist/guide dist/content dist/policytables cp output/rhel6-guide.html dist/guide cp output/ssg-rhel6-xccdf.xml dist/content cp output/ssg-rhel6-oval.xml dist/content cp: cannot stat ‘output/ssg-rhel6-oval.xml’: No such file or directory patch to get it to make correctly [bpm]$ diff -wruN Makefile.orig Makefile --- Makefile.orig 2013-01-30 13:47:55.554661112 -0600 +++ Makefile 2013-01-30 13:48:07.914662435 -0600 @@ -109,6 +109,7 @@ $(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml $(ID) $(TRANS)/relabelids.py unlinked-rhel6-xccdf.xml $(ID) $(TRANS)/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml $(ID) + $(TRANS)/relabelids.py unlinked-rhel6-oval.xml $(ID) # not ready until oscap resolve behavior resolved content-stig: shorthand2xccdf guide checks -- Brian Millett "I'd like to live just long enough to be there when they cut off your head and stick it on a pike as a warning to the next ten generations that some favors some with too high a price. I want to look up into your lifeless eyes and wave like this. Can you and your associates arrange that for me, Mr. Morden?" -- [ Vir (re: What do you want?), "In the Shadow of Z'Ha'Dum"]

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide February 2013