scap-security-guide May 2013

scap-security-guide@lists.fedorahosted.org

12 participants
55 discussions

note for the USGCB tickets
by Jeffrey Blank 11 Jul '13

11 Jul '13

Shawn (et al), The ticketing system shows me you'd opened up a bunch of tickets to add a "New rule" for items which were in the old RHEL 5 USGCB profile. Okay, great, this helps with ensuring there is continuation of that profile/baseline with some consistency. A few notes: 1) I've been able to close some of the tickets as "fixed", providing explanation as to why. Some of them are being handled through other mechanisms for RHEL 6. 2) If anybody starts executing on the other tickets, the goal is NOT to add new rules as the ticket says, but rather to conduct investigation to see if the Rule is applicable to RHEL 6 in the same way it was applicable to RHEL 5. 3) In the ticket titles, there is some of the odd CCE language which talks about disabling/enabling things "as appropriate". That's fine as an identifier (and the RHEL 6 USGCB did use some of this language). However, this style of language, which is intended for neither a human nor a machine, should never appear in the project's XCCDF. (Just in case anybody gets any ideas.) Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

5 10

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

[PATCH 0/3] More tidying for make validate
by Maura Dailey 30 May '13

30 May '13

There are a few more coming that need more testing or aren't working correctly, but here's a small batch for now. The behavior recurse="files" was deprecated, so I changed it to the normal "symlinks and directories". Also, the environment variable tests were updated and replaced by the environmentvariable58 tests, objects, and states. One check I can't submit an update to yet that has a similar problem is "accounts_root_path_dirs_no_write". I was cleaning it up and replacing the deprecated check when I noticed that the check is not actually working correctly. Specifying a single path in file_object gets the correct result of true or false, but passing in a variable with multiple values (PATH, split into multiple strings) appears to always fail with "does not exist". - Maura Dailey Maura Dailey (3): Replacing deprecated <ind:environmentvariable_...> tags with <ind:environmentvariable58_...> tags Removing deprecated recurse=files behavior. Removing deprecated recurse="files" behavior .../checks/accounts_dangerous_path_for_root.xml | 53 ++++++++++---------- .../input/checks/file_permissions_ungroupowned.xml | 4 +- RHEL6/input/checks/file_permissions_unowned.xml | 4 +- 3 files changed, 31 insertions(+), 30 deletions(-)

2 4

[PATCH] Created OVAL for ensure_gpgcheck_never_disabled
by Shawn Wells 28 May '13

28 May '13

2 1

[PATCH 0/3] 3 Updates to cleanup make validate
by Maura Dailey 22 May '13

22 May '13

1. Added new check display_login_attempts to check for a pam_lastlog.so session line. 2. Added new check for .netrc files in /home 3. Renamed existing check so that the file name, OVAL id, and rule id all match. - Maura Dailey Maura Dailey (3): Adding check for pam_lastlog.so Adding check for no_netrc_files Renaming oval check no_rsh_trusted_host_files to no_rsh_trust_files to match rule ID RHEL6/input/checks/display_login_attempts.xml | 25 +++++++++++++++++++ RHEL6/input/checks/no_netrc_files.xml | 22 ++++++++++++++++ RHEL6/input/checks/no_rsh_trust_files.xml | 26 ++++++++++---------- RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/system/accounts/pam.xml | 2 +- .../accounts/restrictions/password_storage.xml | 2 +- 6 files changed, 63 insertions(+), 16 deletions(-) create mode 100644 RHEL6/input/checks/display_login_attempts.xml create mode 100644 RHEL6/input/checks/no_netrc_files.xml

2 6

[PATCH 0/3] copy editing
by David Smith 22 May '13

22 May '13

Most of this was just cleanup. Within the services and system directories, "RHEL6" and "RHEL 6" appeared nearly the same number of times -- this patch changes all of them to "RHEL 6" for consistency. David Smith (3): removed extraneous comma copy editing additional copy editing RHEL6/input/intro/intro.xml | 2 +- RHEL6/input/services/dns.xml | 2 +- RHEL6/input/services/ldap.xml | 2 +- RHEL6/input/services/mail.xml | 2 +- RHEL6/input/services/nfs.xml | 2 +- RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/services/services.xml | 8 ++++---- RHEL6/input/system/accounts/accounts.xml | 2 +- RHEL6/input/system/logging.xml | 2 +- RHEL6/input/system/network/iptables.xml | 6 +++--- RHEL6/input/system/network/wireless.xml | 2 +- RHEL6/input/system/selinux.xml | 4 ++-- 12 files changed, 18 insertions(+), 18 deletions(-)

2 6

[PATCH] Adding check for disabling GNOME thumbnailers
by Maura Dailey 20 May '13

20 May '13

I based this on the existing disable GNOME automounting check. I've run the command to disable it manually and checked its output against what my script checks for with testcheck.py and everything seems to work correctly. - Maura Dailey Maura Dailey (1): Adding check for disabling GNOME thumbnailers in gconf .../checks/gconf_gnome_disable_thumbnailers.xml | 28 ++++++++++++++++++++ RHEL6/input/system/permissions/mounting.xml | 2 +- 2 files changed, 29 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml

2 2

[PATCH] modified makefile to remove test attestation from prose guide -- revised
by David Smith 20 May '13

20 May '13

--- RHEL6/Makefile | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 3e0ba59..9214ce9 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -37,7 +37,8 @@ guide: shorthand2xccdf # remove auxiliary Groups which are only for use in tables, and not guide output. # specifying a nonexistent profile, "allrules," to make oscap print all Rules xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml - oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html + xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf.xml + oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html # example, if needed: for converting XCCDF into shorthand #xccdf2shorthand: -- 1.7.1

2 1

[PATCH 0/6] getting make-validate closer to OK
by Jeffrey Blank 20 May '13

20 May '13

This is largely about deleting vestigial OVAL checks. Some of the remaining "OVAL Check is not referenced by XCCDF" messages which "make validate" produces call for more investigation. And of course the OVAL schematron still has problems. But this gets us closer. Jeffrey Blank (6): removal of packages from check templates removal or correction of misnamed or obsolete OVAL checks removal of comments, reference to nonexistent OVAL refine verify-references to deal only with OVAL compliance checks for OVAL removal of references to nonexistent OVAL for some NFS guidance corrections for typos in OVAL references .../accounts_no_nis_inclusions_etc_passwd.xml | 23 ------ .../input/checks/audit_rules_dac_modification.xml | 40 ----------- RHEL6/input/checks/cups_limit_web_interface.xml | 30 -------- RHEL6/input/checks/file_mode_etc_crontab.xml | 33 --------- RHEL6/input/checks/file_ownership_etc_skel.xml | 39 ----------- .../file_permissions_boot_grub_grub_conf.xml | 46 ------------- RHEL6/input/checks/file_user_owner_etc_crontab.xml | 25 ------- RHEL6/input/checks/mount_option_nodev_on_tmp.xml | 30 -------- .../input/checks/package_ipsec-tools_installed.xml | 25 ------- RHEL6/input/checks/package_talk-server_removed.xml | 25 ------- RHEL6/input/checks/package_talk_removed.xml | 25 ------- RHEL6/input/checks/service_abrtd_disabled.xml | 3 + RHEL6/input/checks/sysconfig_ipv6_disable.xml | 37 ---------- RHEL6/input/checks/sysconfig_ipv6_networking.xml | 37 ---------- .../checks/sysconfig_networking_ipv6_ifcfg.xml | 37 ---------- ...tl_net_ipv6_conf_default_accept_ra_rtr_pref.xml | 31 --------- RHEL6/input/checks/templates/Makefile | 4 +- .../input/checks/templates/packages_installed.csv | 5 -- RHEL6/input/checks/templates/packages_removed.csv | 3 - RHEL6/input/checks/templates/services_disabled.csv | 2 +- RHEL6/input/checks/xwindows_remote_listening.xml | 30 -------- RHEL6/input/services/http.xml | 72 -------------------- RHEL6/input/services/nfs.xml | 4 - RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/system/permissions/partitions.xml | 2 +- RHEL6/utils/verify-references.py | 5 +- 26 files changed, 11 insertions(+), 604 deletions(-) delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_passwd.xml delete mode 100644 RHEL6/input/checks/audit_rules_dac_modification.xml delete mode 100644 RHEL6/input/checks/cups_limit_web_interface.xml delete mode 100644 RHEL6/input/checks/file_mode_etc_crontab.xml delete mode 100644 RHEL6/input/checks/file_ownership_etc_skel.xml delete mode 100644 RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml delete mode 100644 RHEL6/input/checks/file_user_owner_etc_crontab.xml delete mode 100644 RHEL6/input/checks/mount_option_nodev_on_tmp.xml delete mode 100644 RHEL6/input/checks/package_ipsec-tools_installed.xml delete mode 100644 RHEL6/input/checks/package_talk-server_removed.xml delete mode 100644 RHEL6/input/checks/package_talk_removed.xml delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_disable.xml delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_networking.xml delete mode 100644 RHEL6/input/checks/sysconfig_networking_ipv6_ifcfg.xml delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref.xml delete mode 100644 RHEL6/input/checks/xwindows_remote_listening.xml

2 10

[PATCH] Renamed ensure_gpgcheck_never_disabled.xml
by Maura Dailey 20 May '13

20 May '13

The XCCDF pointed to an OVAL check that did not exist because the contents of the OVAL check file did not match the filename. I renamed the OVAL check file to match its contents and updated the OVAL reference to point to the correct check. - Maura Dailey Maura Dailey (1): Renamed OVAL check file to match contents, then updated OVAL reference to point to said file. .../checks/ensure_gpgcheck_never_disabled.xml | 26 -------------------- RHEL6/input/checks/yum_gpgcheck_never_disabled.xml | 26 ++++++++++++++++++++ RHEL6/input/system/software/updating.xml | 2 +- 3 files changed, 27 insertions(+), 27 deletions(-) delete mode 100644 RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml create mode 100644 RHEL6/input/checks/yum_gpgcheck_never_disabled.xml

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2013