March 2013 - scap-security-guide - Fedora mailing-lists

note for the USGCB tickets
by Jeffrey Blank 11 Jul '13

11 Jul '13

Shawn (et al), The ticketing system shows me you'd opened up a bunch of tickets to add a "New rule" for items which were in the old RHEL 5 USGCB profile. Okay, great, this helps with ensuring there is continuation of that profile/baseline with some consistency. A few notes: 1) I've been able to close some of the tickets as "fixed", providing explanation as to why. Some of them are being handled through other mechanisms for RHEL 6. 2) If anybody starts executing on the other tickets, the goal is NOT to add new rules as the ticket says, but rather to conduct investigation to see if the Rule is applicable to RHEL 6 in the same way it was applicable to RHEL 5. 3) In the ticket titles, there is some of the odd CCE language which talks about disabling/enabling things "as appropriate". That's fine as an identifier (and the RHEL 6 USGCB did use some of this language). However, this style of language, which is intended for neither a human nor a machine, should never appear in the project's XCCDF. (Just in case anybody gets any ideas.) Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

5 10

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

scap-security-guide v0.1-10 released -- now with JBossEAP5!
by Shawn Wells 01 May '13

01 May '13

Friends, A rebase of the scap-security-guide RPM was *long* overdue! Please see the "Consume" section of the project wiki for download information: https://fedorahosted.org/scap-security-guide/ Highlights of SSG v0.1-10 include: - JBossEAP5 content! Utilizing content from the SCAP Security Guide project, on 29-JAN-2013 Red Hat corporately submitted paperwork to DISA FSO to begin the JBossEAP5 STIG process. SSG v0.1-10 reflects the OCIL, OVAL, and XCCDF content of this submission. Please refer to /usr/share/xml/scap/ssg/guide/JBossEAP5_Guide.html for details. We look forward to your feedback via the SSG mailing list! [1] - `man scap-security-guide` now provides sample usage of the content. - Several bugfixes relating to OVAL content. Many thanks to Brian Millet, Kenneth Stailey, Logan Rodrian, and all other members of the SSG community for the reports and patches! - The RHEL6 STIG profile was renamed "stig-rhel6-server" - A RHEL6 checklist has been included (/usr/share/xml/scap/ssg/guidestig-rhel6-server-guide.html). This outlines what specific rules are currently part of the profile. - A number of updates against NIST 800-53 mappings has been completed. Please see files under /usr/share/xml/scap/ssg/policytables/. [1] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

1 1

Remediation Scripts
by Shawn Wells 07 Apr '13

07 Apr '13

I've been taking a few off-list questions around remediation lately, namely from interested parties asking "where do we start?" Wanted to move those conversations to on-list. Here's a few of the common questions and my thoughts to get us started. (1) What language(s) should be used? IMO, bash. I'm leaning this way because it's included in *every* RHEL release, whereas puppet modules would require the installation of 3rd party software. I'd like to see as much done through 'native' tools as possible. There's certainly advantages to Perl (e.g., potential speed) however I don't think we want to assume Perl is installed on all RHEL machines. (2) Do we perform checking in the scripts? Defined further, should the scripts contain conditional checks to see if they should be ran? IMO, no. That's what OVAL is for. (3) Where do we begin? - Name remediation scripts after corresponding XCCDF rule - Build process includes them into final ssg-rhel6-xccdf.xml Known challenge on passing XCCDF variables through to the scripts, however I wouldn't let this hold us up. Still *tons* of work to be done while this gets sorted. There's a good bit of RHEL6 content in the Aqueduct project that (I believe) Tresys committed. Perhaps we could reuse those scripts?

12 33

Signed content purpose question
by Matt Micene 04 Apr '13

04 Apr '13

A follow up from the SCAP workshops that Shawn and Jeff hosted this week (great job guys) on the topic of signed content. What is the intent for having DISA / NIST / AuthorityX signing SCAP content for delivery? Are people looking for full attestation or validation? Neither addresses the challenge of what to do with local content for waivers, but each poses different options for the local maintainer. The tooling also has different challenges if there's a need to validate a digital signature versus verifying a digest. Disjointed ancillary thought, is there an include function in the XCCDF? I haven't been able to find one in the spec so far but it could be useful for local waiver overrides while preserving the official content. There's an obvious issue (as I type this) that any sort of standard include statement would allow someone to completely override policy for a scan while still mimicking the appropriate results. Having a reporting tool that can do diffs of the results and the policy settings could catch that, but that may not be sufficient for reporting or detection time. Regards, Matt Micene Engineering Team Lead RHCA #100-002-435 DLT Solutions Direct 703-773-1195

3 4

[PATCH 21/21] Renamed OVAL no_empty_passwords.xml to match XCCDF rule name
by Shawn Wells 02 Apr '13

02 Apr '13

4 6

[PATCH 03/21] Updated package_screen_installed
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 02/21] Updated package_aide_installed
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 01/21] Updated create_package_installed template process
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 18/21] Renamed OVAL in restrict_root_console_logins to match XCCDF rule name
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 17/21] Renamed OVAL in selinux_unlabeled_device_files to match XCCDF rule name
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 16/21] Renamed OVAL in set_selinux_policy to match XCCDF rule name
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 15/21] Renamed OVAL in set_selinux_state
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 13/21] Updated OVAL name of enable_selinux_bootloader
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 11/21] Updated OVAL reference in ensure_gpgcheck_globally_activated
by Shawn Wells 02 Apr '13

02 Apr '13

2 1

[PATCH 20/21] Renamed OVAL in no_shelllogin_for_systemaccounts.xml to match XCCDF rule name
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 19/21] Renamed OVAL in restrict_serial_port_logins.xml to match XCCDF rule name
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 14/21] OVAL rule rename of no_rsh_trust_files
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 12/21] Updated OVAL rule name in ensure_gpgcheck_never_disabled.xml
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 10/21] Updated description text of ensure_redhat_gpgkey_installed
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 09/21] Updated check text of ensure_redhat_gpgkey_installed
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 08/21] Updated partition_for_home
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 07/21] Updated OVAL in partition_for_var_log_audit
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 06/21] Updated partition_for_var_log
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 05/21] Updated OVAL rule name for partition_for_var
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 04/21] Updated partition_for_tmp OVAL
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH 0/4] a few changes for the processing of fixes and a new transform
by Brian Millett 29 Mar '13

29 Mar '13

I found that the processing of fixes that had things like "2>&1" or "<<END" just didn't work, so added the translation of those in the combinefixes.py. Also added the python version of combinefixes Brian Millett (4): Changed the line to allow the combinechecks.py transform. Renamed the fix to match the rule name, otherwise it never was included Deleted the old combinefixes.sh added a new combinefixes.py writen in python and adds fixing of special characters "<",">","&" RHEL6/Makefile | 2 +- RHEL6/input/fixes/bash/disable_vsftpd.sh | 3 +++ RHEL6/transforms/combinefixes.py | 37 ++++++++++++++++++++++++++++++++ RHEL6/transforms/combinefixes.sh | 17 --------------- 4 files changed, 41 insertions(+), 18 deletions(-) create mode 100644 RHEL6/input/fixes/bash/disable_vsftpd.sh create mode 100755 RHEL6/transforms/combinefixes.py delete mode 100755 RHEL6/transforms/combinefixes.sh -- 1.8.1.4

2 10

[PATCH] Ticket 312 - Moved CCIs 218 & 219 from PF to NA
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH] ticket 311 - moved RHEL-06-000312-PF to N/A
by Shawn Wells 29 Mar '13

29 Mar '13

1 0

[PATCH] cleanup of Makefile
by Jeffrey Blank 28 Mar '13

28 Mar '13

Removal of some commented lines Removal of guides which are not desired outputs (and show "selected" bug) (The other issuances have traditionally been delivered as spreadsheets/tables instead.) Removal of _some_ tables with NIST references. If those formats are desired, a different stylesheet should likely deliver them anyway. Jeffrey Blank (1): cleanup of Makefile RHEL6/Makefile | 32 ++------------------------------ 1 files changed, 2 insertions(+), 30 deletions(-)

2 2

who uses CCE ids for RHEL guidance?
by Jeffrey Blank 25 Mar '13

25 Mar '13

A question for the list: Who uses CCE identifiers (and for what)? I find them (informally) useful since they provide a unique identifier for a particular knob. Of course, internal to the project, the XCCDF Rule id fulfills a similar role, though we'll have both. (I also have some reservations about CCE implementation and format, but those are not related to this inquiry, nor am I soliciting for those!) I'm simply curious about uses of CCE in RHEL security guidance, particularly that which would be derived from the project. Thanks!

3 2

[PATCH] Modified find command
by Shawn Wells 21 Mar '13

21 Mar '13

1 0

[PATCH] ticket 273 - snmp version 3 protocol check content
by Shawn Wells 20 Mar '13

20 Mar '13

1 0

[PATCH] ticket 338 - improve check text for noexec on removable media
by Shawn Wells 20 Mar '13

20 Mar '13

1 0

[PATCH] ticket 330 - adjust language to permit halt for admin_space_left_action
by Shawn Wells 20 Mar '13

20 Mar '13

1 0

[PATCH] ticket 317: Update RHEL-06-000372-PF, reconsider as permanent finding: display to the user the number of unsuccessful logon/access
by Shawn Wells 20 Mar '13

20 Mar '13

2 1

[PATCH 0/2] CCE fixups, additions
by Jeffrey Blank 18 Mar '13

18 Mar '13

This patchset is working toward the goal of having CCE identifiers assigned to all Rules which involve adjustment of a specific, granular "control knob" on the RHEL platform. (And a few that may involve a specific quality, such as lacking any world-writable files.) Jeffrey Blank (2): added block of available CCE numbers to references * this will help us manage our assignment of them to Rules minor fixups of CCE ids .../accounts/restrictions/account_expiration.xml | 2 + RHEL6/input/system/accounts/session.xml | 1 + RHEL6/input/system/permissions/execution.xml | 1 - RHEL6/input/system/permissions/mounting.xml | 2 - RHEL6/references/cce-rhel6-avail.txt | 550 ++++++++++++++++++++ 5 files changed, 553 insertions(+), 3 deletions(-) create mode 100644 RHEL6/references/cce-rhel6-avail.txt

2 3

Re: scap-security-guide Digest, Vol 19, Issue 20
by Brian G. Maddox 18 Mar '13

18 Mar '13

On 03/18/2013 08:00 AM, scap-security-guide-request(a)lists.fedorahosted.org wrote: > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 17 Mar 2013 13:41:24 -0400 > From: Jeffrey Blank <blank(a)eclipse.ncsc.mil> > To: "scap-security-guide(a)lists.fedorahosted.org" > <scap-security-guide(a)lists.fedorahosted.org> > Subject: who uses CCE ids for RHEL guidance? > Message-ID: <51460044.2060400(a)eclipse.ncsc.mil> > Content-Type: text/plain; charset=ISO-8859-1 > > A question for the list: > > Who uses CCE identifiers (and for what)? > > I find them (informally) useful since they provide a unique identifier > for a particular knob. Of course, internal to the project, the XCCDF > Rule id fulfills a similar role, though we'll have both. > > (I also have some reservations about CCE implementation and format, but > those are not related to this inquiry, nor am I soliciting for those!) > > I'm simply curious about uses of CCE in RHEL security guidance, > particularly that which would be derived from the project. > > Thanks! > > > The IA's I work with use CCE's for the things we put together for the USMC. I end up copying and pasting the info for them just to make their lives easier. --

1 0

[PATCH] [bugfix] ticket 377: RHEL-06-000061 breaks sudo
by Shawn Wells 14 Mar '13

14 Mar '13

1 0

[PATCH] Add support for zipfile creation
by Shawn Wells 14 Mar '13

14 Mar '13

6 7

[PATCH] [bugfixes] additional changes from STIG feedback
by David Smith 13 Mar '13

13 Mar '13

The following issues are addressed in this patch: 1) applicability statements for xinetd, IPv6, and ip6tables 2) added trailing spaces when using grep to check disk partition information 3) modified permissions check for grub.conf (now uses "ls -lL") 4) specified "-type f" when looking for library files not owned by root David Smith (1): additional patches following STIG feedback RHEL6/input/services/obsolete.xml | 10 ++++++++-- RHEL6/input/system/accounts/physical.xml | 7 ++++++- RHEL6/input/system/network/iptables.xml | 10 ++++++++-- RHEL6/input/system/network/ipv6.xml | 2 ++ RHEL6/input/system/permissions/files.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 10 +++++----- 6 files changed, 30 insertions(+), 11 deletions(-)

2 2

Fwd: [Open-scap] openscap is "in evaluation"
by Shawn Wells 13 Mar '13

13 Mar '13

For those who may not be on the open-scap list - -------- Original Message -------- Subject: [Open-scap] openscap is "in evaluation" Date: Wed, 13 Mar 2013 09:43:07 -0400 From: Steve Grubb <sgrubb(a)redhat.com> Organization: Red Hat To: open-scap-list(a)redhat.com <open-scap-list(a)redhat.com> Hello, This is to announce that openscap is currently "in-evaluation" to be a certified scanner: http://www.redhat.com/about/news/archive/2013/3/red-hat-openscap-under-eval… -Steve _______________________________________________ Open-scap-list mailing list Open-scap-list(a)redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list

1 0

[PATCH 0/2] [bugfixes] following STIG feedback
by David Smith 13 Mar '13

13 Mar '13

Included are a number of content modifications following yesterday's meeting with FSO and Red Hat: 1) alt-titles-stig was changed to allow a Rule title to match its requirement 2) shorthand2xccdf was changed to modify the service enable macro so runlevels are now specified (2-5) 3) the other file changes largely involved allowing Fix and Check content to stand independently, as well as recommended wording changes David Smith (2): content changes reflective of FSO feedback modified macro to specify runlevels with chkconfig RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/system/accounts/session.xml | 4 ++-- RHEL6/input/system/logging.xml | 14 ++++++++++++-- RHEL6/input/system/network/kernel.xml | 6 +++--- RHEL6/input/system/permissions/files.xml | 20 ++++++++++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 2 +- 6 files changed, 39 insertions(+), 9 deletions(-)

2 3

[PATCH 0/2] [bugfixes] addressing FSO feedback
by David Smith 13 Mar '13

13 Mar '13

These patches address tickets 281 (add library directories to Check text) and 295 (pwck invocation). David Smith (2): modified pwck invocation added library directories to check text .../accounts/restrictions/account_expiration.xml | 2 +- .../accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/permissions/files.xml | 10 ++++++++-- 3 files changed, 10 insertions(+), 4 deletions(-)

2 4

Register Now: STIG & SCAP Workshop, Tues 26-MAR-2013
by Shawn Wells 12 Mar '13

12 Mar '13

With the recent DISA publication of the draft STIG, the timing seems right to host a STIG workshop. NSA IAD and Red Hat will be hosting a public STIG and SCAP workshop on _Tuesday 26-MAR-2013_. Additionally, DISA FSO will be in attendance to hear feedback from the community. You can register here: https://engage.redhat.com/forms/stig-workshop In the March 26th workshop we will: * Share knowledge on the installation of SCAP Security Guide (SSG). How to run a scan, how to customize settings, how to get a report that you can show your ISSE/ISSM, and hw to generate a certification test plan based on your customized rules. * Go a bit deeper, and understand how the code works. Answering questions like: "What is XCCDF, OVAL, and OCIL?" "How can you add your own custome rules?" * Prep your environment to submit patches back to SSG, including learning how to setup git and how to create a Fedora Hosted account. * Chat about what additional profiles are needed. How should we handle CNSSI 12-53? What about PCI compliance? We'll go through Red Hat Enterprise Linux 6 SCAP content, including the STIG, performing scans, and generating C&A artifacts. Attendees can take this setup home and use it to start providing feedback against the RHEL6 STIG. Sign up for the workshop! Date: Tuesday March 26, 2013, with three 2-hour workshop intervals to choose from. Limited availability per session! MORNING SESSION: Red Hat Office, 8260 Greensboro Drive, Suite 300, McLean, VA Morning 0800-1000 AFTERNOON SESSIONS: NSA unclassified facility in the BWI area. Address will be sent to registered attendees. Afternoon: 1200 - 1400 Afternoon: 1430 - 1630 Registration at: https://engage.redhat.com/forms/stig-workshop

1 0

[PATCH 0/3] [bugfixes] based on STIG feedback
by David Smith 11 Mar '13

11 Mar '13

This patchset resolves tickets based on STIG feedback. David Smith (3): [bugfix] ticket 285 - added Check language allowing forwarding for routers [bugfix] ticket 337 - added language to make Rules NA if no NFS [bugfix] ticket 334 - added text allowing for Postfix to not be installed if CDS RHEL6/input/services/mail.xml | 6 ++---- RHEL6/input/services/nfs.xml | 6 ++++-- RHEL6/input/system/network/kernel.xml | 1 + 3 files changed, 7 insertions(+), 6 deletions(-)

3 5

[PATCH 0/5] [bugfixes] more ticket resolution
by David Smith 11 Mar '13

11 Mar '13

pushing more fixes to resolve tickets David Smith (5): [bugfix] ticket 297 - added maxlogins value [bugfix] ticket 334 - added text exempting CDSes from Postfix requirement [bugfix] ticket 293 - added info to Ctrl-Alt-Del Rule [bugfix] ticket 299 - added finding statement [bugfix] ticket 332 - cleaned up file deletion audit Rule RHEL6/input/services/mail.xml | 5 ++++- RHEL6/input/system/accounts/physical.xml | 8 ++++---- .../accounts/restrictions/account_expiration.xml | 3 ++- RHEL6/input/system/accounts/session.xml | 8 +++----- RHEL6/input/system/auditing.xml | 2 -- 5 files changed, 13 insertions(+), 13 deletions(-)

1 6

[PATCH 0/4] [bugfixes] various changes for ticket resolution
by David Smith 11 Mar '13

11 Mar '13

Resolved a number of tickets with these. David Smith (4): changed Rule to enable postfix changed LSM to SELinux changed unwieldy check command specified "-type f" for permissions check RHEL6/input/auxiliary/alt-titles-stig.xml | 8 ++++---- RHEL6/input/services/mail.xml | 2 +- RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/permissions/files.xml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-)

3 6

RE: scap-security-guide 0.1-10 help
by Rodrian, Logan P (IS) 11 Mar '13

11 Mar '13

Has this always been the case that the CPE/Dictionary is needed for oscap execution? I ask because if this is a new feature, I will ping the SecState list about when they will be including the Dictionary as an argument to their program. Currently, secstate imports only an xccdf and will not work with the SSG v0.1-10....trying to resolve why this is. Logan Rodrian ________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)redhat.com] Sent: Thursday, March 07, 2013 11:05 To: scap-security-guide(a)lists.fedorahosted.org Subject: EXT :Re: scap-security-guide 0.1-10 help On 3/7/13 8:51 AM, Rodrian, Logan P (IS) wrote: It appears that the full command is needed. The scan won't run without the cpe/dictionary reference. The minimal command needed is as follows: oscap xccdf eval --profile <profile> \ --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml Ah, yes. The --cpe is *very* much needed as it provides some platform checks. The others (--report, etc) are optional.

3 2

SSG v0.1-10 Bugs/Notes
by Rodrian, Logan P (IS) 08 Mar '13

08 Mar '13

I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have found some bugs/notes. Each of the following seems to be an issue with the OVAL content/test. * Ensure All Files Are Owned by a User * This reports PASS for me, but is a false positive. Running 'find / -xdev -nouser -print' reveals files that have a user owner that is not local to the system. * Ensure All Files Are Owned by a Group * This reports PASS for me, but is a false positive. Running 'find / -xdev -nogroup -print' reveals files that have a group that is not local to the system. * Set Daemon Umask * The test states it is looking for a umask of 022 or 027. In my /etc/init.d/functions, the umask is 022, but the test reports FAIL. This is a false positive. * Set GNOME Login Inactivity Timeout * GNOME Desktop Screensaver Mandatory Use * Enable Screen Lock Activation After Idle Period * Implement Blank Screen Saver * Enable GUI Warning Banner Text * Each of these tests assume that the execution is on an X system. My system does not have X installed or running, so the tests report FAIL. The test should first check if it is applicable to the test system and if not report NOT APPLICABLE or something similar versus FAIL. * Modify the System Login Banner * This test appears to check for exactly the DoD banner text. Since the verbage states "a message compliant with the local site policy", suggest modifying the test to check for the presence of content in /etc/issue, but perhaps not an exact match, as not all deployments may be DoD systems. * Ensure Host Logs Sent to Remote Host * For TCP, this checks for the following in the rsyslog file: *.* @@loghost.example.com * Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in general they are? In my configuration, I have *.info versus the *.* and the test reports FAIL. I would like to understand the intent on this one so I can comply. * Additionally, my filter portion excludes some logs marked via other ways (read in from files) with the string "*.info;local0.none @@dest-ip" and I want to make sure that even if my string needs to be modified to "*.*;local0.none @@dest-ip" to comply that the test will pass. i.e. that the test is robust enough to understand the negation in the rsyslog configuration and report the correct assessment value. * Configure auditd space_left Action on Low Disk Space * Configure auditd admin_space_left Action on Low Disk Space * For both of these, the contents of /etc/audit/auditd.conf contain the correct key with a case-insensitive value (all caps value of one of the possible values) and the test reports FAIL. THis is a false negative. Suggest making the test case-insensitive in the value match portion. * Disable Network Console (netconsole) * Disable Network Router Discovery Daemon (rdisc) * For both of these, the service is not active/installed, but the test reports FAIL. This is a false negative. * Disable SSH Support for .rhosts Files * Disable Host-Based Authentication * Disable SSH Root Login * For all of these, the required value is present in its entirety, but is preceeded by the comment character, making it inactive. The test reports PASS, which is a false positive. * Additionally, for the SSH Root Login test, the commented value is incorrect and the test reports PASS. In addition to these bugs, I found that the following items did not have any check content ref specified in the XCCDF, thus reported NOTCHECKED. I realize some of the check cannot be performed automatically, but each of these can be, but is not. * Disable Ctrl-Alt-Del Reboot Activation * Install the screen Package * Set GUI Warning Banner Text * Set Default IPTables Policy for Forwarded Packets * Disable ntpdate Service (ntpdate) * Ensure Insecure File Locking is Not Allowed * Verify No netrc Files Exist * Ensure All Accounts on the System Have Unique Names * Set Password to Maximum of Three Consecutive Repeating Characters * Set Password Hashing Algorithm in /etc/pam.d/system-auth * Set Password Hashing Algorithm in /etc/login.defs * Set Password Hashing Algorithm in /etc/libuser.conf * Verify that Shared Library Files Have Restrictive Permissions * Verify that Shared Library Files Have Root Ownership * Verify that System Executables Have Restrictive Permissions * Verify that System Executables Have Root Ownership * Ensure No World-Writable Files Exist * Each of the 5 above can be tested using one of: * `find $dir -xdev -perm /o=w ! $ -type d -perm /o=t $ ! -type l -print` * `find $dir -xdev ! -user root ! -type d ! -type l -print` * Limit the Number of Concurrent Login Sessions Allowed Per User * For this one, perhaps check that the key is present, as the value is up to the system owner. * Uninstall Sendmail Package * Additionally, suggest naming this "Ensure sendmail not installed" or something of that flavor more indicative of what the test is checking for, versus an action. * Enable Logging of All FTP Transactions * Create Warning Banners for All FTP Users * Configure SNMP Service to Use Only SNMPv3 or Newer * Ensure Default Password Is Not Used * For the previous 4, the test must first check applicability (much like the GNOME tests), as my system does not have/support FTP or SNMP and should not have FAIL reported. And the last item--each of the following reports UNKNOWN as the check-content-ref element in the XCCDF references a non-existent id in the OVAL. * Ensure Log Files Are Owned By Appropriate Group * Ensure System Log Files Have Correct Permissions * Ensure Logrotate Runs Periodically --Logan Rodrian

1 1

Updates to JBoss EAP5 STIG
by Jess Sightler 08 Mar '13

08 Mar '13

I have updated many of the entries within the JBossEAP5/eap5-xccdf.xml file to contain reference elements referring to the SRG. While this covers well over half of the elements, I found a number of elements that did not appear to correlate directly to the SRG. I have attached the sample patch with most of the elements mapped. Feedback is welcome. Thanks, -- Jess Sightler

2 1

enable_randomize_va_space question
by Aaron Lamb 08 Mar '13

08 Mar '13

I am running through this now and have a question in regards to enable_randomize_va_space rule (CCE-4146-7), also refers to RHEL-06-000078 in the DRAFT. This check is calling for kernel.randomize_va_space=1 I decided to research this a little deeper and this is what I am coming up with. All systems I have checked , RHEL6, CentOS6, and Fedora default to kernel.randomize_va_space=2 Per the kernel documentation (If I am reading this right) says that 2 basically is fully randomization. https://www.kernel.org/doc/Documentation/sysctl/kernel.txt ============================================================== randomize-va-space: This option can be used to select the type of process address space randomization that is used in the system, for architectures that support this feature. 0 - Turn the process address space randomization off. This is the default for architectures that do not support this feature anyways, and kernels that are booted with the "norandmaps" parameter. 1 - Make the addresses of mmap base, stack and VDSO page randomized. This, among other things, implies that shared libraries will be loaded to random addresses. Also for PIE-linked binaries, the location of code start is randomized. This is the default if the CONFIG_COMPAT_BRK option is enabled. 2 - Additionally enable heap randomization. This is the default if CONFIG_COMPAT_BRK is disabled. There are a few legacy applications out there (such as some ancient versions of libc.so.5 from 1996) that assume that brk area starts just after the end of the code+bss. These applications break when start of the brk area is randomized. There are however no known non-legacy applications that would be broken this way, so for most systems it is safe to choose full randomization. Systems with ancient and/or broken binaries should be configured with CONFIG_COMPAT_BRK enabled, which excludes the heap from process address space randomization. ============================================================== Now reading the STIG draft... "The output of the command should indicate a value of "1". If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in "/etc/sysctl.conf". If the correct value is not returned, this is a finding." If I understand this right, we have to downgrade the randomization to pass this check? Not sure if this should be changed reflect "2" as the default setting instead of "1" or if the checks should be looking -ge 1 instead of -eq 1. Aaron Lamb

4 7

STIG feedback -- resolution underway
by Jeffrey Blank 08 Mar '13

08 Mar '13

Project participants may want to note that STIG feedback resolution is underway: https://fedorahosted.org/scap-security-guide/query?milestone=RHEL6+Draft+ST… At this point unique tickets have been created for much of the feedback, and will be resolved in the coming days. (16/103 tickets are already resolved). This way, the project can remain the upstream source for final STIG issuance, as well as improve in quality for all users. The project welcomes feedback at any time, but for feedback specific to STIG issuance it's quite important to send to DISA FSO for their tracking, as indicated on the official comment form. Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

1 0

RE: scap-security-guide 0.1-10 help
by Rodrian, Logan P (IS) 07 Mar '13

07 Mar '13

That is the URL where I found the command. I just happened to try the common profile in addition to the stig-rhel6-server profile. Both yield the same result showing "notapplicable". Logan Rodrian ________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)redhat.com] Sent: Wednesday, March 06, 2013 19:53 To: scap-security-guide(a)lists.fedorahosted.org Subject: EXT :Re: scap-security-guide 0.1-10 help On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote: * I am attempting a secstate audit and would like to use the newly released scap-security-guide v0.1-10. I have tried simply applying the v0.1-10 rpm and importing that content into secstate. When running a profile (no matter which is selected), the report shows that none of the rules have been selected. Backing up a layer, I simply tried the instructions on the scap-security-guide webpage of running: oscap xccdf eval --profile common /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml ...and then all output shows "Result notapplicable". I haven't used the secstate tool much recently, so I can't address that... but as for the oscap command above, where on the webpage did you find it? That's an outdated invocation and needs to be updated. Here's the current usage guide: https://fedorahosted.org/scap-security-guide/wiki/usageguide

3 4

scap-security-guide 0.1-10 help
by Rodrian, Logan P (IS) 06 Mar '13

06 Mar '13

I am attempting something here, and I don't know if I am even doing it correctly, but it isn't working, so I wanted to give a shout to see if anyone could shed some light on it. I have a system installed from the CLIP 6.3 baseline, which has the following installed versions: * openscap* => 0.9.1-1 * secstate => 0.6.0-1 * scap-security-guide => 1.0-git.4d28ff3 I am attempting a secstate audit and would like to use the newly released scap-security-guide v0.1-10. I have tried simply applying the v0.1-10 rpm and importing that content into secstate. When running a profile (no matter which is selected), the report shows that none of the rules have been selected. Backing up a layer, I simply tried the instructions on the scap-security-guide webpage of running: oscap xccdf eval --profile common /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml ...and then all output shows "Result notapplicable". So, my questions are as follows: * Can I simply use the v0.1-10 content without any other upgrades? * If not, what versions of the other components/dependencies are needed to execute this version? * If so, what am I missing to allow the selection of the rules within a given profile? Thanks in advance. Logan Rodrian

2 2

[PATCH] [bugfix] ticket 289 - add sshd_config filename to check instructions
by Shawn Wells 06 Mar '13

06 Mar '13

2 1

Configuration of password-auth-ac should mirror that of system-auth-ac
by Roach, Brian 05 Mar '13

05 Mar '13

Hello all. I'm new to this list/project, and to development teams in general (usually fly solo) so please forgive and explain any faux pas. Now, on to the point... Depending on where a user is being authenticated, the configuration for that authentication is set in either /etc/pam.d/system-auth-ac or /etc/pam.d/password-auth-ac. For example, when logging into Gnome, the initial login authentication is configured in password-auth-ac. However, the screensaver password for that session is configured in system-auth-ac. After reading and searching through specs, STIGs, forums, mailing lists, etc... I have yet to find any awareness of this configuration distinction. To my experience thus far, the content of the two files should be the same, though I'm sure there is some rationale in having them separate. In any event, the STIG (and derived works) should carry instructions for password-auth-ac in addition to system-auth-ac. The PAM configuration is actually more complicated than just those two files, but most of the other files in the /etc/pam.d directory point to either password-auth-ac or system-auth-ac for the majority of their instructions. It would be prudent to specify and programmatically verify the configuration of these ancillary files as well. Comments and questions are always welcome. Brian Roach

4 4

[PATCH] [bugfix] ticket 274 - check content for umask in login.defs
by Shawn Wells 01 Mar '13

01 Mar '13

1 0

[PATCH] [bugfix] ticket 290 - add smb.conf to fix text instructions
by Shawn Wells 01 Mar '13

01 Mar '13

1 0

[PATCH] [bugfix] Ticket 258 - permissions test on grub.conf
by Shawn Wells 01 Mar '13

01 Mar '13

1 0

[PATCH] Ticket #277: ctrl-alt-delete fix text
by Shawn Wells 01 Mar '13

01 Mar '13

Pushing as bugfix

1 0

(no subject)
by Kenneth Stailey 01 Mar '13

01 Mar '13

Makefile:67: *** unterminated variable reference. Stop. Even in comments you must terminate variable references. Fix: ]$ git diff diff --git a/Makefile b/Makefile index d2e5e59..3a0f190 100644 --- a/Makefile +++ b/Makefile @@ -71,7 +71,7 @@ zipfile: # to cd into $(RPM_TMPDIR) cp RHEL6/output/ssg-* $(RPM_TOPDIR)/ZIP/ cp JBossEAP5/eap5-* $(RPM_TOPDIR)/ZIP/ - # Originally attempted to `cd $(RPM_TOPDIR/ZIP` and + # Originally attempted to `cd $(RPM_TOPDIR)/ZIP` and # make the zip from there, however it still placed it # at working directory. Should look into this sometime #

3 3

RHEL6 Draft STIG to DIACAP 8500 controls mapping?
by Philip Shuman 01 Mar '13

01 Mar '13

We are currently trying to map 8500 controls to the RHEL6 draft content (either the version from git or DISA's website would work). The RHEL5 STIG benchmark contains references to the IA controls, which allows the auditors to tie each check back to 8500. Here is an example from RedHat_5-V1R1_STIG_Benchmark-xccdf: Rule Title: The operating system must be a supported release. STIG ID: GEN000100 Rule ID: SV-27049r1_rule Vuln ID: V-11940 IA Controls:VIVM-1 Is there any mapping either between RHEL6 and 8500 or even between RHEL6 and RHEL5 that we could use to map these? It seems none of the RHEL6 identifiers in either the build from git or the DISA website are common with the past STIG content. Thanks, Philip

2 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2013