note for the USGCB tickets
by Jeffrey Blank
Shawn (et al),
The ticketing system shows me you'd opened up a bunch of tickets to add
a "New rule" for items which were in the old RHEL 5 USGCB profile.
Okay, great, this helps with ensuring there is continuation of that
profile/baseline with some consistency.
A few notes:
1) I've been able to close some of the tickets as "fixed", providing
explanation as to why. Some of them are being handled through other
mechanisms for RHEL 6.
2) If anybody starts executing on the other tickets, the goal is NOT to
add new rules as the ticket says, but rather to conduct investigation to
see if the Rule is applicable to RHEL 6 in the same way it was
applicable to RHEL 5.
3) In the ticket titles, there is some of the odd CCE language which
talks about disabling/enabling things "as appropriate". That's fine as
an identifier (and the RHEL 6 USGCB did use some of this language).
However, this style of language, which is intended for neither a human
nor a machine, should never appear in the project's XCCDF. (Just in case
anybody gets any ideas.)
Thanks,
Jeff
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance
10 years, 11 months
xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett
Hello,
I'm trying to get started with making the latest clone from the git
repository and I get the following error:
[bpm]$ git clone
http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide
Cloning into 'scap-security-guide'...
remote: Counting objects: 14016, done.
remote: Compressing objects: 100% (5257/5257), done.
remote: Total 14016 (delta 10574), reused 10664 (delta 7718)
Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done.
Resolving deltas: 100% (10574/10574), done.
[bpm]$ cd scap-security-guide/RHEL6/
[bpm]$ make all
xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml
xmllint --format --output output/rhel6-shorthand.xml
output/rhel6-shorthand.xml
xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml
transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml
compilation error: file transforms/shorthand2xccdf.xslt line 19 element
attribute
xsl:attribute: The attribute name 'xmlns' is not allowed.
make: *** [shorthand2xccdf] Error 5
I've a fedora 18 , x86_64 installation.
Any ideas?
Thanks.
--
Brian Millett
"Shifts in paradigms
often cause nose bleeds."
Greg Glenn
11 years
scap-security-guide v0.1-10 released -- now with JBossEAP5!
by Shawn Wells
Friends,
A rebase of the scap-security-guide RPM was *long* overdue! Please
see the "Consume" section of the project wiki for download information:
https://fedorahosted.org/scap-security-guide/
Highlights of SSG v0.1-10 include:
- JBossEAP5 content! Utilizing content from the SCAP Security Guide
project, on 29-JAN-2013 Red Hat corporately submitted paperwork to DISA
FSO to begin the JBossEAP5 STIG process. SSG v0.1-10 reflects the OCIL,
OVAL, and XCCDF content of this submission. Please refer to
/usr/share/xml/scap/ssg/guide/JBossEAP5_Guide.html for details. We look
forward to your feedback via the SSG mailing list! [1]
- `man scap-security-guide` now provides sample usage of the content.
- Several bugfixes relating to OVAL content. Many thanks to Brian
Millet, Kenneth Stailey, Logan Rodrian, and all other members of the SSG
community for the reports and patches!
- The RHEL6 STIG profile was renamed "stig-rhel6-server"
- A RHEL6 checklist has been included
(/usr/share/xml/scap/ssg/guidestig-rhel6-server-guide.html). This
outlines what specific rules are currently part of the profile.
- A number of updates against NIST 800-53 mappings has been completed.
Please see files under /usr/share/xml/scap/ssg/policytables/.
[1] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
11 years, 1 month
[PATCH 0/4] new CCEs, removal of duplicate Rules, and minor edits
by David Smith
1) there were two Rules in mounting.xml which didn't belong there, and appeared elsewhere -- those were removed
2) a number of additional CCEs have been assigned
3) some minor cosmetic changes to session.xml
David Smith (4):
added CCE IDs
removed duplicate Rules
minor touchups
added CCE IDs
RHEL6/input/services/http.xml | 4 +-
RHEL6/input/services/imap.xml | 6 ++--
RHEL6/input/services/mail.xml | 1 +
RHEL6/input/system/accounts/session.xml | 4 +-
RHEL6/input/system/network/ipsec.xml | 2 +-
RHEL6/input/system/permissions/mounting.xml | 39 ---------------------------
6 files changed, 9 insertions(+), 47 deletions(-)
11 years, 1 month
[PATCH] minor editing in preparation for prose guide
by David Smith
---
RHEL6/input/services/ftp.xml | 12 ++++++------
RHEL6/input/system/permissions/permissions.xml | 2 +-
RHEL6/input/system/selinux.xml | 2 +-
RHEL6/input/system/software/disk_partitioning.xml | 2 +-
4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 27957c8..361f7dc 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -84,7 +84,7 @@ xferlog_std_format=NO
log_ftp_protocol=YES</pre>
</description>
<ocil clause="xferlog_enable is missing, or is not set to yes">
-Find if logging is applied to the ftp daemon.
+Find if logging is applied to the FTP daemon.
<br/><br/>
Procedures:
<br/><br/>
@@ -96,7 +96,7 @@ If the <i>server_args</i> line is missing or does not include the vsftpd configu
<pre># grep xferlog_enable <i>vsftpd config file</i></pre>
</ocil>
<rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to
-the ftp server are logged using the verbose vsftpd log
+the FTP server are logged using the verbose vsftpd log
format. The default vsftpd log file is <tt>/var/log/vsftpd.log</tt>.</rationale>
<warning category="general">If verbose logging to <tt>vsftpd.log</tt> is done, sparse logging of downloads to <tt>/var/log/xferlog</tt> will not also occur. However, the information about what files were downloaded is included in the information logged to <tt>vsftpd.log</tt></warning>
<ident cce="27142-9" />
@@ -152,13 +152,13 @@ these logins as much as possible.</description>
<pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</pre>
-Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via ftp, add a line containing that user's name:
+Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
<pre>USERNAME</pre>
If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well.
<pre>anonymous
ftp</pre>
</description>
-<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale>
+<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</rationale>
<!--<oval id="ftp_limit_users" />-->
<!--<ref nist="CM-7" /> -->
</Group>
@@ -183,7 +183,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam
<Rule id="ftp_home_partition">
<title>Place the FTP Home Directory on its Own Partition</title>
-<description>By default, the anonymous FTP root is the home directory of the ftp user account. The df command can
+<description>By default, the anonymous FTP root is the home directory of the FTP user account. The df command can
be used to verify that this directory is on its own partition.</description>
<rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent
these users from filling a disk used by other services.</rationale>
@@ -202,7 +202,7 @@ the FTP connection tracking module:
<rationale>These settings configure iptables to allow connections to an FTP server. The first line allows initial connections
to the FTP server port.
FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client
-and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by
+and server negotiate an arbitrary port to be used for data transfer. The <tt>ip_conntrack_ftp</tt> module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
FTP server to operate on a machine which is running a firewall.</rationale>
<!--<oval id="ftp_configure_firewall" />-->
diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml
index 3dfb32e..8e5e148 100644
--- a/RHEL6/input/system/permissions/permissions.xml
+++ b/RHEL6/input/system/permissions/permissions.xml
@@ -18,6 +18,6 @@ The following command prints a list of ext4 partitions on the local
machine, which is the default filesystem for Red Hat Enterprise Linux
6 installations:
<pre>$ mount -t ext4 | awk '{print $3}'</pre>
-If your site uses a local filesystem type other than ext4 then you
+If your site uses a local filesystem type other than ext4, you
will need to modify this command.</description>
</Group>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 9de5714..dec9054 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -10,7 +10,7 @@ sufficiently developed and debugged that it should be usable on
almost any Red Hat machine with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
-services such as mail servers, ftp servers, and DNS servers - from
+services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index 7d5cc5b..a94943b 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -1,6 +1,6 @@
<Group id="disk_partitioning">
<title>Disk Partitioning</title>
-<description>To ensure separation and protection of data there
+<description>To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
--
1.7.1
11 years, 1 month
[PATCH 0/3] more edits in preparation for prose guide issuance
by Jeffrey Blank
Jeffrey Blank (3):
minor changes to introduction text
deletion of introductory text with obsolete tone
minor edits to AIDE description
RHEL6/input/guide.xml | 41 ++++++++++++++++++------
RHEL6/input/intro/intro.xml | 10 +-----
RHEL6/input/system/permissions/permissions.xml | 2 +-
RHEL6/input/system/software/integrity.xml | 24 +++++++-------
4 files changed, 46 insertions(+), 31 deletions(-)
11 years, 1 month
domain name ideas?
by Shawn Wells
The time has come where we need a domain name. In part for
branding/marketing of the project, but also to provide us with blogs,
large document storage, potential shell access for committers, etc. We
can get hosting for free from openshift.com, but what should we call the
domain name?
Some ideas have been:
ssgproject
scapsecurityguides
scapsecurityguide
scapguides
scap-security-guide
scapcontent
Or should we make up a name ala Aqueduct and Accumulo style?
11 years, 1 month
SCAP 1.2 DataStream File Format
by Šimon Lukašík
Hello list,
If someone wants to play with DataStream file format which comes with
SCAP 1.2 specification. He (or she) can use the latest OpenSCAP to
convert SSG to DataStream.
I have written step-by-step instructions how to convert USGCB to
DataStream: http://isimluk.livejournal.com/3660.html
Best regards,
--
Simon Lukasik
Security Technologies
11 years, 1 month
[PATCH 0/2] minor description fixups in Groups
by Jeffrey Blank
These fixups are to update some descriptive text in Groups,
and do not affect any Rule text used by any Profiles.
This is part of a comprehensive proofreading underway
in preparation for guide publication.
Jeffrey Blank (2):
updating text to describe AIDE
removed references to pirut and pup which are not in RHEL 6
RHEL6/input/system/software/integrity.xml | 9 ++++++---
RHEL6/input/system/software/updating.xml | 21 ++++++++-------------
2 files changed, 14 insertions(+), 16 deletions(-)
11 years, 1 month
