scap-security-guide April 2013

scap-security-guide@lists.fedorahosted.org

24 participants
173 discussions

note for the USGCB tickets
by Jeffrey Blank 11 Jul '13

11 Jul '13

Shawn (et al), The ticketing system shows me you'd opened up a bunch of tickets to add a "New rule" for items which were in the old RHEL 5 USGCB profile. Okay, great, this helps with ensuring there is continuation of that profile/baseline with some consistency. A few notes: 1) I've been able to close some of the tickets as "fixed", providing explanation as to why. Some of them are being handled through other mechanisms for RHEL 6. 2) If anybody starts executing on the other tickets, the goal is NOT to add new rules as the ticket says, but rather to conduct investigation to see if the Rule is applicable to RHEL 6 in the same way it was applicable to RHEL 5. 3) In the ticket titles, there is some of the odd CCE language which talks about disabling/enabling things "as appropriate". That's fine as an identifier (and the RHEL 6 USGCB did use some of this language). However, this style of language, which is intended for neither a human nor a machine, should never appear in the project's XCCDF. (Just in case anybody gets any ideas.) Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

5 10

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

scap-security-guide v0.1-10 released -- now with JBossEAP5!
by Shawn Wells 02 May '13

02 May '13

Friends, A rebase of the scap-security-guide RPM was *long* overdue! Please see the "Consume" section of the project wiki for download information: https://fedorahosted.org/scap-security-guide/ Highlights of SSG v0.1-10 include: - JBossEAP5 content! Utilizing content from the SCAP Security Guide project, on 29-JAN-2013 Red Hat corporately submitted paperwork to DISA FSO to begin the JBossEAP5 STIG process. SSG v0.1-10 reflects the OCIL, OVAL, and XCCDF content of this submission. Please refer to /usr/share/xml/scap/ssg/guide/JBossEAP5_Guide.html for details. We look forward to your feedback via the SSG mailing list! [1] - `man scap-security-guide` now provides sample usage of the content. - Several bugfixes relating to OVAL content. Many thanks to Brian Millet, Kenneth Stailey, Logan Rodrian, and all other members of the SSG community for the reports and patches! - The RHEL6 STIG profile was renamed "stig-rhel6-server" - A RHEL6 checklist has been included (/usr/share/xml/scap/ssg/guidestig-rhel6-server-guide.html). This outlines what specific rules are currently part of the profile. - A number of updates against NIST 800-53 mappings has been completed. Please see files under /usr/share/xml/scap/ssg/policytables/. [1] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

1 1

[PATCH 0/4] new CCEs, removal of duplicate Rules, and minor edits
by David Smith 30 Apr '13

30 Apr '13

1) there were two Rules in mounting.xml which didn't belong there, and appeared elsewhere -- those were removed 2) a number of additional CCEs have been assigned 3) some minor cosmetic changes to session.xml David Smith (4): added CCE IDs removed duplicate Rules minor touchups added CCE IDs RHEL6/input/services/http.xml | 4 +- RHEL6/input/services/imap.xml | 6 ++-- RHEL6/input/services/mail.xml | 1 + RHEL6/input/system/accounts/session.xml | 4 +- RHEL6/input/system/network/ipsec.xml | 2 +- RHEL6/input/system/permissions/mounting.xml | 39 --------------------------- 6 files changed, 9 insertions(+), 47 deletions(-)

2 8

[PATCH] minor editing in preparation for prose guide
by David Smith 30 Apr '13

30 Apr '13

--- RHEL6/input/services/ftp.xml | 12 ++++++------ RHEL6/input/system/permissions/permissions.xml | 2 +- RHEL6/input/system/selinux.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 27957c8..361f7dc 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -84,7 +84,7 @@ xferlog_std_format=NO log_ftp_protocol=YES</pre> </description> <ocil clause="xferlog_enable is missing, or is not set to yes"> -Find if logging is applied to the ftp daemon. +Find if logging is applied to the FTP daemon. Procedures: @@ -96,7 +96,7 @@ If the server_args line is missing or does not include the vsftpd configu <pre># grep xferlog_enable vsftpd config file</pre> </ocil> <rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to -the ftp server are logged using the verbose vsftpd log +the FTP server are logged using the verbose vsftpd log format. The default vsftpd log file is <tt>/var/log/vsftpd.log</tt>.</rationale> <warning category="general">If verbose logging to <tt>vsftpd.log</tt> is done, sparse logging of downloads to <tt>/var/log/xferlog</tt> will not also occur. However, the information about what files were downloaded is included in the information logged to <tt>vsftpd.log</tt></warning> <ident cce="27142-9" /> @@ -152,13 +152,13 @@ these logins as much as possible.</description> <pre>userlist_enable=YES userlist_file=/etc/vsftp.ftpusers userlist_deny=NO</pre> -Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via ftp, add a line containing that user's name: +Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name: <pre>USERNAME</pre> If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well. <pre>anonymous ftp</pre> </description> -<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale> +<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</rationale>   </Group> @@ -183,7 +183,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam <Rule id="ftp_home_partition"> <title>Place the FTP Home Directory on its Own Partition</title> -<description>By default, the anonymous FTP root is the home directory of the ftp user account. The df command can +<description>By default, the anonymous FTP root is the home directory of the FTP user account. The df command can be used to verify that this directory is on its own partition.</description> <rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent these users from filling a disk used by other services.</rationale> @@ -202,7 +202,7 @@ the FTP connection tracking module: <rationale>These settings configure iptables to allow connections to an FTP server. The first line allows initial connections to the FTP server port. FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client -and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by +and server negotiate an arbitrary port to be used for data transfer. The <tt>ip_conntrack_ftp</tt> module is used by iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an FTP server to operate on a machine which is running a firewall.</rationale>  diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml index 3dfb32e..8e5e148 100644 --- a/RHEL6/input/system/permissions/permissions.xml +++ b/RHEL6/input/system/permissions/permissions.xml @@ -18,6 +18,6 @@ The following command prints a list of ext4 partitions on the local machine, which is the default filesystem for Red Hat Enterprise Linux 6 installations: <pre>$ mount -t ext4 | awk '{print $3}'</pre> -If your site uses a local filesystem type other than ext4 then you +If your site uses a local filesystem type other than ext4, you will need to modify this command.</description> </Group> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 9de5714..dec9054 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -10,7 +10,7 @@ sufficiently developed and debugged that it should be usable on almost any Red Hat machine with minimal configuration and a small amount of system administrator training. This policy prevents system services - including most of the common network-visible -services such as mail servers, ftp servers, and DNS servers - from +services such as mail servers, FTP servers, and DNS servers - from accessing files which those services have no valid reason to access. This action alone prevents a huge amount of possible damage from network attacks against services, from trojaned software, and diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 7d5cc5b..a94943b 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -1,6 +1,6 @@ <Group id="disk_partitioning"> <title>Disk Partitioning</title> -<description>To ensure separation and protection of data there +<description>To ensure separation and protection of data, there are top-level system directories which should be placed on their own physical partition or logical volume. The installer's default partitioning scheme creates separate logical volumes for -- 1.7.1

2 1

[PATCH 0/3] more edits in preparation for prose guide issuance
by Jeffrey Blank 30 Apr '13

30 Apr '13

Jeffrey Blank (3): minor changes to introduction text deletion of introductory text with obsolete tone minor edits to AIDE description RHEL6/input/guide.xml | 41 ++++++++++++++++++------ RHEL6/input/intro/intro.xml | 10 +----- RHEL6/input/system/permissions/permissions.xml | 2 +- RHEL6/input/system/software/integrity.xml | 24 +++++++------- 4 files changed, 46 insertions(+), 31 deletions(-)

2 6

domain name ideas?
by Shawn Wells 29 Apr '13

29 Apr '13

The time has come where we need a domain name. In part for branding/marketing of the project, but also to provide us with blogs, large document storage, potential shell access for committers, etc. We can get hosting for free from openshift.com, but what should we call the domain name? Some ideas have been: ssgproject scapsecurityguides scapsecurityguide scapguides scap-security-guide scapcontent Or should we make up a name ala Aqueduct and Accumulo style?

3 4

SCAP 1.2 DataStream File Format
by Šimon Lukašík 29 Apr '13

29 Apr '13

Hello list, If someone wants to play with DataStream file format which comes with SCAP 1.2 specification. He (or she) can use the latest OpenSCAP to convert SSG to DataStream. I have written step-by-step instructions how to convert USGCB to DataStream: http://isimluk.livejournal.com/3660.html Best regards, -- Simon Lukasik Security Technologies

2 3

[PATCH 0/2] minor description fixups in Groups
by Jeffrey Blank 29 Apr '13

29 Apr '13

These fixups are to update some descriptive text in Groups, and do not affect any Rule text used by any Profiles. This is part of a comprehensive proofreading underway in preparation for guide publication. Jeffrey Blank (2): updating text to describe AIDE removed references to pirut and pup which are not in RHEL 6 RHEL6/input/system/software/integrity.xml | 9 ++++++--- RHEL6/input/system/software/updating.xml | 21 ++++++++------------- 2 files changed, 14 insertions(+), 16 deletions(-)

2 3

[PATCH 00/64] patchbomb: NIST mappings and FISMA profile expansion
by Shawn Wells 29 Apr '13

29 Apr '13

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2013