scap-security-guide July 2013

scap-security-guide@lists.fedorahosted.org

23 participants
61 discussions

[PATCH 0/5] Additional profile, two new rules, one modified rule, and a modified transform
by David Smith 26 Jul '13

26 Jul '13

I needed to build an example custom profile, which led to the following: 1) a new profile 2) two new rules added specifically for the new profile 3) an additional option for selecting the number of max concurrent logins 4) modifications to the xccdf-addprofiles transform, to include the new profile in the build process David Smith (5): added example of a custom profile modified transform to include new profile Added rule regarding anonymous NFS connections Additional option for number of max concurrent logins Added rule for disabling interface use of IPv6 RHEL6/input/profiles/CS2.xml | 380 +++++++++++++++++++++++++++++++ RHEL6/input/services/nfs.xml | 11 + RHEL6/input/system/accounts/session.xml | 1 + RHEL6/input/system/network/ipv6.xml | 9 +- RHEL6/transforms/xccdf-addprofiles.xslt | 1 + 5 files changed, 401 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/profiles/CS2.xml

2 6

[PATCH] Updated rationale for SSH Idle Timeout
by Andrew Gilmore 23 Jul '13

23 Jul '13

The text of this rationale overstates the issue, as well as being difficult to understand. I had to fix this for my own use, so why not share? Signed-off-by: Andrew Gilmore <agilmore2(a)gmail.com> --- RHEL6/input/services/ssh.xml | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 59330ab..c3b97cc 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -163,9 +163,8 @@ If properly configured, the output should be: <pre>ClientAliveInterval 900</pre> </ocil> <rationale> -Causing idle users to be automatically logged out -guards against compromises one system leading trivially -to compromises on another. +Automatically logging out idle users guards against one +compromised system leading to access on another. </rationale> <ident cce="26919-1" /> <oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/> -- 1.7.1

2 1

[PATCH] DHCP section referred to the wrong file location for dhcpd.conf
by Maura Dailey 23 Jul '13

23 Jul '13

Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/services/dhcp.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml index 4190c07..a611adc 100644 --- a/RHEL6/input/services/dhcp.xml +++ b/RHEL6/input/services/dhcp.xml @@ -75,7 +75,7 @@ accidentally reactivated and disrupt network operation. <description>If the system must act as a DHCP server, the configuration information it serves should be minimized. Also, support for other protocols and DNS-updating schemes should be explicitly disabled unless needed. The -configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file +configuration file for dhcpd is called <tt>/etc/dhcp/dhcpd.conf</tt>. The file begins with a number of global configuration options. The remainder of the file is divided into sections, one for each block of addresses offered by dhcpd, each of which contains configuration options specific to that address @@ -84,7 +84,7 @@ block.</description> <Rule id="dhcp_server_disable_ddns"> <title>Do Not Use Dynamic DNS</title> <description>To prevent the DHCP server from receiving DNS information from -clients, edit <tt>/etc/dhcpd.conf</tt>, and add or correct the following global +clients, edit <tt>/etc/dhcp/dhcpd.conf</tt>, and add or correct the following global option: <pre>ddns-update-style none;</pre> </description> <rationale>The Dynamic DNS protocol is used to remotely update the data served @@ -107,7 +107,7 @@ best practice).</warning> <Rule id="dhcp_server_deny_decline"> <title>Deny Decline Messages</title> -<description>Edit <tt>/etc/dhcpd.conf</tt> and add or correct the following +<description>Edit <tt>/etc/dhcp/dhcpd.conf</tt> and add or correct the following global option to prevent the DHCP server from responding the DHCPDECLINE messages, if possible: <pre>deny declines;</pre> </description> <rationale>The DHCPDECLINE message can be sent by a DHCP client to indicate @@ -137,7 +137,7 @@ vectors against the DHCP server. <Group id="dhcp_server_minimize_served_info"> <title>Minimize Served Information</title> -<description>Edit /etc/dhcpd.conf. Examine each address range section within +<description>Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is an operational need to provide this information via DHCP: <pre>option domain-name @@ -173,7 +173,7 @@ usually static across machines at a given site.</warning> <Rule id="dhcp_server_configure_logging"> <title>Configure Logging</title> <description>Ensure that the following line exists in -<tt>/etc/syslog.conf</tt>: +<tt>/etc/rsyslog.conf</tt>: <pre>daemon.* /var/log/daemon.log</pre> Configure logwatch or other log monitoring tools to summarize error conditions reported by the dhcpd process.</description> @@ -246,7 +246,7 @@ successfully distribute. For more information on configuring dhclient, see the <Group id="dhcp_client_restrict_options"> <title>Minimize the DHCP-Configured Options</title> -<description>Create the file <tt>/etc/dhclient.conf</tt>, and add an +<description>Create the file <tt>/etc/dhcp/dhclient.conf</tt>, and add an appropriate setting for each of the ten configuration settings which can be obtained via DHCP. For each setting, do one of the following: <br/> @@ -277,7 +277,7 @@ system on a network. It is recommended that almost all configuration options be assigned statically, and only options which must vary on a host-by-host basis be assigned via DHCP. This limits the damage which can be done by a rogue DHCP server. If appropriate for your site, it is also possible to supersede the -host-name directive in <tt>/etc/dhclient.conf</tt>, establishing a static +host-name directive in <tt>/etc/dhcp/dhclient.conf</tt>, establishing a static hostname for the machine. However, dhclient does not use the host name option provided by the DHCP server (instead using the value provided by a reverse DNS lookup).</rationale> -- 1.7.1

2 1

[PATCH] Last item in Avahi file feels like it's supposed to be a Rule, not a Group
by Maura Dailey 23 Jul '13

23 Jul '13

The rendered Avahi section looked off. I think the last Avahi section should be a rule, not its own group. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/services/avahi.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml index debc26b..acdc23a 100644 --- a/RHEL6/input/services/avahi.xml +++ b/RHEL6/input/services/avahi.xml @@ -102,7 +102,7 @@ that port on the system. <ref nist="CM-7" /> </Rule> -<Group id="avahi_restrict_published_information"> +<Rule id="avahi_restrict_published_information"> <title>Restrict Information Published by Avahi</title> <description> If it is necessary to publish some information to the network, it should not be joined @@ -129,6 +129,6 @@ the types of published information in the event that some information must be published. </rationale> <ref nist="CM-7" /> -</Group> +</Rule> </Group> </Group> -- 1.7.1

2 1

Revised audit false positive fix
by Andrew Gilmore 22 Jul '13

22 Jul '13

Now with more feeling!

4 15

[PATCH] Correct telnet service disabled checks
by Andrew Gilmore 19 Jul '13

19 Jul '13

I altered the pattern match to use the same one as the other xinetd based services, then retested. This is both fixes, the rpm present fix, and the pattern match. Since I've not had telnet installed, never tested the pattern match. Andrew

1 2

Call for last minute patches -- doing another build tonight/tomorrow
by Shawn Wells 19 Jul '13

19 Jul '13

Over the past few weeks there's been a marked improvement in the OVAL code, and a number of bash remediations added. Time for a new release! Are there any outstanding patches that need acking, or anyone working on these they'd like to see in the next RPM release? Ideally we could cut a new RPM around COB today.

3 2

Remediation: XCCDF BCP draft
by Nunez, Luis K 19 Jul '13

19 Jul '13

In anticipation of Developer Days 2013, a draft whitepaper "Using XCCDF for Remediation: Best Current Practice", is attached for your review. The paper provides a perspective on remediation and explores current XCCDF elements related to remediation. The paper also highlights Red Hat's effort to introduce scripting content into XCCDF. All comments and suggestions are welcome. Luis Nunez G022 - IA Industry Collaboration The MITRE Corporation 703-983-4428 www.mitre.org

1 0

Remediation: XCCDF BCP draft
by Nunez, Luis K 19 Jul '13

19 Jul '13

1 0

Quick False Positive fixes\
by Andrew Gilmore 19 Jul '13

19 Jul '13

These two false positives were easy to fix. There's about 4 others that aren't so easy. Do I open trac issues for these, or just email the group? Andrew

2 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2013