scap-security-guide May 2013

scap-security-guide@lists.fedorahosted.org

12 participants
55 discussions

[PATCH] cleanup of comments, unnecessary Rules in DNS (bind) service
by Jeffrey Blank 13 May '13

13 May '13

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil> --- RHEL6/input/services/dns.xml | 43 ++-------------------------------------- RHEL6/input/services/snmp.xml | 11 ++++----- 2 files changed, 8 insertions(+), 46 deletions(-) diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml index 579520a..0a63e25 100644 --- a/RHEL6/input/services/dns.xml +++ b/RHEL6/input/services/dns.xml @@ -61,12 +61,9 @@ attacks on nameservers more difficult.</description> a high-risk service which must frequently be made available to the entire Internet, it is strongly recommended that no other services be offered by machines which act as organizational DNS servers.</description> - - - </Group> -<Rule id="dns_server_chroot"> +<Group id="dns_server_chroot"> <title>Run DNS Software in a chroot Jail</title> <description>Install the <tt>bind-chroot</tt> package: <pre># yum install bind-chroot</pre> @@ -97,31 +94,10 @@ configuration file. That is, when this guide recommends editing <tt>/etc/named.conf</tt>, you should instead edit <tt>/var/named/chroot/etc/named.conf</tt>. </warning> -<ident cce="26957-1" /> -<ident cce="27127-0" /> -<ident cce="26961-3" /> - -<ref nist="CM-7" /> -</Rule> - -<Group id="dns_server_firewall"> -<title>Configure Firewalls to Protect the DNS Server</title> -<description> -By default, <tt>iptables</tt> blocks access to the ports used by the DNS -server. -<iptables-desc-macro proto="udp" port="53" /> -<iptables-desc-macro proto="tcp" port="53" /> -</description> -<rationale>These lines are necessary in order to allow remote machines to -contact the DNS server. If this server is only available to the local network, -it may be appropriate to insert a -s flag into this rule to allow traffic only -from packets on the local network.</rationale> - - -<ref nist="CM-7" /> </Group> -</Group>  + +</Group> <Group id="dns_server_protection"> <title>Protect DNS Data from Tampering or Attack</title> @@ -179,9 +155,6 @@ to untrusted machines. Separate machines should be used to fill these two functions whenever possible. </rationale> - - - </Group> <Group id="dns_server_partition_with_views"> @@ -226,9 +199,6 @@ required for recursion, such as the root hints file, must be available to any clients which are allowed to make recursive queries. Under typical circumstances, this includes only the internal clients which are allowed to use this server as a general-purpose nameserver.</warning> - - - </Group> <Rule id="dns_server_disable_zone_transfers"> @@ -248,9 +218,6 @@ or if you have only one nameserver, it may be possible to use an external configuration management mechanism to distribute zone updates. In that case, it is not necessary to allow zone transfers within BIND itself, so they should be disabled to avoid the potential for abuse.</rationale> - - -<ref nist="CM-7" /> </Rule> <Rule id="dns_server_authenticate_zone_transfers"> @@ -305,8 +272,6 @@ create the shared secret string base64-key-string. Once this secret has been obtained and inserted into named.conf on the primary and secondary servers, the key files Kdns.example.com .+NNN +MMMMM .key and Kdns.example.com .+NNN +MMMMM .private are no longer needed, and may safely be deleted.</warning> - - <ref nist="CM-7" /> </Rule> @@ -328,8 +293,6 @@ are easily spoofed. Instead, use TSIG keys (see the previous section for an example), and consider using the update-policy directive to restrict changes to only the precise type of change needed.</rationale> <ident cce="27105-6" /> - - </Rule> </Group>  diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml index eff0eb8..ec22a42 100644 --- a/RHEL6/input/services/snmp.xml +++ b/RHEL6/input/services/snmp.xml @@ -9,9 +9,9 @@ choices for the community string.</description> <Group id="disabling_snmp_service"> <title>Disable SNMP Server if Possible</title> -<description>The system includes an SNMP daemon that allows for its -remote monitoring, though it not installed by default. If it was -installed and activated, the software should be disabled and removed. +<description>The system includes an SNMP daemon that allows for its remote +monitoring, though it not installed by default. If it was installed and +activated but is not needed, the software should be disabled and removed. </description> <Rule id="disable_snmpd"> @@ -66,8 +66,6 @@ stations</li> <li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li> <li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul> </description> - - <Rule id="snmpd_use_newer_protocol" severity="medium"> <title>Configure SNMP Service to Use Only SNMPv3 or Newer </title> @@ -100,7 +98,8 @@ To ensure the default password is not set, run the following command: There should be no output. </ocil> <rationale> -Presence of the default SNMP password enables querying of different system aspects and could result in unauthorized knowledge of the system. +Presence of the default SNMP password enables querying of different system +aspects and could result in unauthorized knowledge of the system. </rationale> <tested by="MAN" on="20121214"/> </Rule> -- 1.7.1

2 3

[Patch] Duplicate Check for Disabling IPv6
by Maura Dailey 13 May '13

13 May '13

The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a duplicate of RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and formatting of all the other sysctl checks, it seems that sysctl_net_ipv6_disabled.xml is the one to delete. - Maura Dailey diff --git a/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml b/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml deleted file mode 100644 index bd2ba67..0000000 --- a/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <definition class="compliance" id="sysctl_net_ipv6_disabled" version="1"> - <metadata> - <title>Disable IPv6 In /etc/sysctl.conf</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>If IPv6 networking is not required then it should be disabled. One way to disable - IPv6 is to set the kernel runtime parameter "net.ipv6.conf.all.disable_ipv6" to 1 (true). This - check examines /etc/sysctl.conf to see if this runtime parameter has been set to true.</description> - </metadata> - <criteria> - <criterion test_ref="test_20134" comment="net.ipv6.conf.all.disable_ipv6 set to 1 (true) in /etc/sysctl.conf"/> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.disable_ipv6 set to 1 (true) in /etc/sysctl.conf" id="test - <ind:object object_ref="obj_20134" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20134" version="1"> - <ind:path>/etc</ind:path> - <ind:filename>sysctl.conf</ind:filename> - <ind:pattern operation="pattern match">^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group>

3 7

any doc writer types around?
by Shawn Wells 13 May '13

13 May '13

This afternoon/evening some colleagues at RH hosted an internal tech meetup, where we talked through projects and tech issues. I brought up the need to author SSG guides in a cross-platform, multi-author format and Gunnar Hellekson [1] suggested the following (thanks, Gunnar!): > First, you should all be grokking [markdown]. > > Second, take a look at the truly great [AsciiDoc], which is richer than markdown, and designed to make creating DocBook (our chosen source format for documentation) much easier. > > Third, you can make them both super-useful with [pandoc], available in your local yum repo. > > [Markdown]:http://daringfireball.net/projects/markdown/ > [AsciiDoc]:http://asciidoctor.org/ > [pandoc]:http://johnmacfarlane.net/pandoc/ The ability to transform content into multiple final outputs is incredibly interesting. Has anyone played with these techs, either individually or as part of some larger workflow? Perhaps these could lay the foundation for authoring/updating the workbooks, and could prove to be a great way to contribute for those who aren't interested in writing OVAL code. [1] His blog is pretty interesting, http://atechnologyjobisnoexcuse.com/. Note his podcast mention SSG in almost every episode!

1 0

[PATCH 0/2] Small OVAL check push
by Maura Dailey 13 May '13

13 May '13

The first update is to add the necessary regex to support specifying the location of X with an absolute path. Other existing security guidance gives examples of how to disable X Forwarding in which the absolute path of X is specified in the config line. This will catch users that followed such security guidance. The second update is super tiny. There was a slash at the end of the description that obviously shouldn't have been there. - Maura Dailey Maura Dailey (2): Adding ability to check for absolute file paths for X, as seen in some other published security guidance Minor typo, removing slash at end of description RHEL6/input/checks/xwindows_remote_listening.xml | 2 +- .../checks/yum_gpgcheck_global_activation.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

2 7

[PATCH 00/21] Fixed "Duplicate ID, which will not be added" errors"
by Shawn Wells 12 May '13

12 May '13

3 4

[PATCH 0/3] updates for services: smb, printing
by Jeffrey Blank 12 May '13

12 May '13

Trying to proofread/cleanup some very old text from the services sections. Jeffrey Blank (3): removing some unnecessary (for compliance-focus) text from cups added some clarifying text to the intro removed some now-obsolete advice from samba RHEL6/input/guide.xml | 26 +++++--- RHEL6/input/services/printing.xml | 23 ++----- RHEL6/input/services/smb.xml | 134 +++++++------------------------------ 3 files changed, 46 insertions(+), 137 deletions(-)

2 7

[PATCH 21/21] Updated service_tftpd_disabled
by Shawn Wells 12 May '13

12 May '13

1 0

[PATCH 20/21] Removed duplicate references to var_samba_private_directory
by Shawn Wells 12 May '13

12 May '13

1 0

[PATCH 19/21] Removed duplicate references object_etc_skel_files
by Shawn Wells 12 May '13

12 May '13

1 0

[PATCH 18/21] Removed duplicate var_ssh_config_directory references
by Shawn Wells 12 May '13

12 May '13

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2013