August 2013 - scap-security-guide - Fedora mailing-lists

Fishing with Gnome's
by Stuart Green 25 Oct '13

25 Oct '13

Hey All, Has there been any previous discussion on the Gnome checks? We run headless installations here so none of the checks are applicable to us, but the XCCDF raises fails. I'm not sure if its possible to add a check to see if x sessions are enabled perhaps? Cheers Stu

4 5

scap-security-guide v0.1-12 released
by Shawn Wells 24 Oct '13

24 Oct '13

On 2-MAY the SSG v0.1-11 update was released, reflecting the inclusion of DISA FSO feedback on the (then) Draft RHEL6 STIG and several OVAL improvements. It was a huge milestone, driving us over 1,800 unique code commits! We've since had an additional 88 commits, largely around OVAL content cleanup and the rewrite of combinefixes.py to handle parameters for OpenSCAP remediation generation (thanks, Jeff!). User feedback also prompted us to fix the build system when compiling on Fedora 18+ and the upcoming RHEL release. SSG v0.1-12 has been released to the EPEL repository to reflect these recent bugfixes and enhancements. Download instructions available on the wiki: https://fedorahosted.org/scap-security-guide/wiki/downloads CHANGELOG: > $ git log --oneline --after={2013-05-02} --no-merges > fe2a0b6 Some corrections to the PAM cracklib guidance as follows: > corrected pam_cracklib.so line to include all discussed parame > 532aeb8 Modified the DoD banner check to accept either a newline or > space between each word, as the RHEL5 version does. This al > ded2ef4 Created remediation template: create_services_disabled.py - > Based off OVAL services file > a96cdc3 Added sysctl remediation scripts - Updated template to reflect > proper naming of sysctl scripts > c3355eb Added bash templates directory, added sample sysctl script - > Makefile based off OVAL, same usage - CVS files point to > f75ad8d Module is freevxfs, not freevsfs > cd940ef Fix build of OpenStack and RHEVM3 parts on Fedora 18+ > df19413 Fix build on Fedora 18+ and the upcoming RHEL release > 2ddbbb7 Subexpression datatype shall equal to the variable datatype > 4cd7650 Ok, to fix the "error" doing an evaluation for the various > umask checks, changed the following variables referenced in t > 5fa190d changed a typo var_acocunts_umask_bashrc => > var_accounts_umask_bashrc > 7d772db Update from deprecated rpmverify_* to rpmverifyfile_* checks > 2026606 made xccdf-addfixes insert all text and child nodes of a fix > d6703f4 rewrite of combinefixes.py to handle parameters for OpenSCAP > remedation generation > c13fafa incomplete support file for bash remediations * does at least > warn when undefined variable exists > f87d817 example remediation script which takes a parameter > 24f2c2e Removing deprecated recurse="files" behavior > f078b8f Removing deprecated recurse=files behavior. > b12d669 Replacing deprecated <ind:environmentvariable_...> tags with > <ind:environmentvariable58_...> tags > 5ed6dc2 Created OVAL for ensure_gpgcheck_never_disabled XCCDF rule > called nonexisting OVAL, created it. > 0d69487 Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 295184c Adding check for no_netrc_files > e1aede3 Adding check for pam_lastlog.so > 9c21556 additional copy editing > 3fd9f3f copy editing > 9db6e3d Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 4109078 Adding check for no_netrc_files > 6f31c05 Adding check for pam_lastlog.so > 0e15e2d Adding check for disabling GNOME thumbnailers in gconf > d10f08e modified makefile to remove test attestation from prose guide > -- revised > 4f3ea5f corrections for typos in OVAL references > d50c71b removal of references to nonexistent OVAL for some NFS guidance > 980f686 refine verify-references to deal only with OVAL compliance > checks for OVAL > 6051ea6 removal of comments, reference to nonexistent OVAL > 8251580 removal or correction of misnamed or obsolete OVAL checks > 76e93ef removal of packages from check templates > 69f31e0 Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some m > c22ed9c Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some more f > c58ac2b Fixing indenting for external variable line. > 95d5a4b removal of unused OVAL checks > bcc1495 bugfixes for undisciplined renaming jaunt, missing OVAL references > 9a378b9 removal of unused OVAL checks > 3b82cf5 deletion of unused OVAL checks > 6a89088 removal of commented text, some redundant/unnecessary Rules > from Profiles > 9705192 deletion of unused/obsoleted OVAL checks (and commented out XCCDF) > 36a75ec deletion of unused OVAL checks > 48e9900 removal of unnecessary guidance from SSL section > 7682f9c removal of commented/obsolete text from logging section > a1f2d30 removal of commented text, invalid CCE from root logins guidance > 0a3577b update to NFS section (still perhaps incomplete) > 1a3d854 changed Dovecot Rule to Group as it is guidance and not a > compliance check > fb4a29b removal of commented/obsolete items for base services > 9a228d5 updates to the CCE verification script to be more informative > ff25fc9 cleanup of comments, unnecessary Rules in DNS (bind) service > 7a16cda Deleting duplicate check for disabling IPv6 > d9d1741 Minor typo, removing slash at end of description > 330258c added version info for RHEL, URL for project > f36ecf3 removed some now-obsolete advice from samba > 8d5ee52 added some clarifying text to the intro > 6c9f047 removing some unnecessary (for compliance-focus) text from cups > de705e9 Updated service_tftpd_disabled As reflected from update to > template file > 356405f Removed duplicate references to var_samba_private_directory > Updated OVAL to have unique IDs > 034b8b3 Removed duplicate references object_etc_skel_files Updated > OVAL to have unique names > d609d6b Removed duplicate var_ssh_config_directory references Updated > OVAL to have unique names > 8a7a3f3 Removed duplicate state_uid_root Updated OVAL to have unique names > e421d69 Modified template_OVAL_package_installed and > template_package_removed These files were causing build errors > regarding ob > 1ae4c30 Removed duplicate references to var_accounts_user_umask > Assigned unique identifiers > ea10f13 Removed duplicate references to object_lib_modules_files > Assigned unique identifiers > 882e341 Removed duplicate object_usr_lib64_files references Assigned > unique identifiers within OVAL > 9d89e61 Removed duplicate object_usr_lib64_dir references Assigned > unique identifiers in OVAL > 863aa19 Removed duplicate object_usr_lib_files references Assigned > unique identifiers to OVAL checks > 714c3c1 Removed duplicate object_usr_lib_dir Updated OVAL to have > unique names > dffd29b Removed duplicates of object_lib64_files Updated OVAL to have > unique names > bc6fbcd Removed duplicate object_lib64_dir Updated OVAL checks to have > unique names > fe089dc Removed duplicate object_lib_files Updated OVAL checks for > unique names > 7546f2e Removed duplicate object_lib_dir references Created unique > names in the OVAL templates > b376e27 Updated mount_option_* OVAL variable var_removable_partition > These OVAL files were using duplicate 'var_remove_partition > 7fae707 Updated template_permissions to place FILEID into strings > e31dc7b Updated state_gid_0 to reflect per check naming > 07380c0 Updated state_uid_0 names within OVAL Multiple OVAL checks > were using "state_uid_0" causing build errors. Updated so eve > f5b90ce Updated rpm_verify_hashes for OVAL 5.10 compliance The old > rpmverify_* is now depricated, updated check to rpmverifyfile > e3b5697 modified transform to only match test attestation > 02a19e2 transform designed to remove the 'tested by' information > a330ccf deleting files for imprecise and obsolete OVAL checks, manual > remediation > ca71cde simplification of Postfix service configuration > 14397cd Removing a newline to fix XHTML formatting > 7d1ab28 deletion of manual audit profile, OVAL for obsolete ldap > server checks > d7f3ca4 removed obsolete LDAP guidance, checks

1 1

[PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat
by Maura Dailey 10 Sep '13

10 Sep '13

There isn't any way to do this the clever way, following the symlink /etc/grub.conf, so for now at least, I added a second path to check, the path for EFI in a default install. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/file_group_owner_grub_conf.xml | 18 +++++++++++++++--- RHEL6/input/checks/file_user_owner_grub_conf.xml | 18 +++++++++++++++--- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml b/RHEL6/input/checks/file_group_owner_grub_conf.xml index 3fc076a..4856fdf 100644 --- a/RHEL6/input/checks/file_group_owner_grub_conf.xml +++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml @@ -1,14 +1,16 @@ <def-group> <definition class="compliance" id="file_group_owner_grub_conf" version="1"> <metadata> - <title>File /boot/grub/grub.conf Owned By root Group </title> + <title>File grub.conf Owned By root Group </title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /boot/grub/grub.conf file should be owned by the root group.</description> + <description>The grub.conf file should be owned by the root group.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> <criterion test_ref="test_file_group_owner_grub_conf" /> + <criterion test_ref="test_file_group_owner_efi_grub_conf" /> </criteria> </definition> @@ -17,11 +19,21 @@ <unix:state state_ref="state_file_group_owner_grub_conf" /> </unix:file_test> + <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_group_owner_efi_grub_conf" version="1"> + <unix:object object_ref="object_file_group_owner_efi_grub_conf" /> + <unix:state state_ref="state_file_group_owner_grub_conf" /> + </unix:file_test> + <unix:file_object comment="/boot/grub/grub.conf" id="object_file_group_owner_grub_conf" version="1"> <unix:path>/boot/grub</unix:path> <unix:filename>grub.conf</unix:filename> </unix:file_object> + <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_group_owner_efi_grub_conf" version="1"> + <unix:path>/boot/efi/EFI/redhat</unix:path> + <unix:filename>grub.conf</unix:filename> + </unix:file_object> + <unix:file_state id="state_file_group_owner_grub_conf" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml b/RHEL6/input/checks/file_user_owner_grub_conf.xml index 53d5e2f..290d883 100644 --- a/RHEL6/input/checks/file_user_owner_grub_conf.xml +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml @@ -1,14 +1,16 @@ <def-group> <definition class="compliance" id="file_user_owner_grub_conf" version="1"> <metadata> - <title>File /boot/grub/grub.conf Owned By root User</title> + <title>File grub.conf Owned By root User</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /boot/grub/grub.conf file should be owned by the root user.</description> + <description>The grub.conf file should be owned by the root user.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> <criterion test_ref="test_file_user_owner_grub_conf" /> + <criterion test_ref="test_file_user_owner_efi_grub_conf" /> </criteria> </definition> @@ -17,11 +19,21 @@ <unix:state state_ref="state_file_user_owner_grub_conf" /> </unix:file_test> + <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_user_owner_efi_grub_conf" version="1"> + <unix:object object_ref="object_file_user_owner_efi_grub_conf" /> + <unix:state state_ref="state_file_user_owner_grub_conf" /> + </unix:file_test> + <unix:file_object comment="/boot/grub/grub.conf" id="object_file_user_owner_grub_conf" version="1"> <unix:path>/boot/grub</unix:path> <unix:filename>grub.conf</unix:filename> </unix:file_object> + <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_user_owner_efi_grub_conf" version="1"> + <unix:path>/boot/efi/EFI/redhat</unix:path> + <unix:filename>grub.conf</unix:filename> + </unix:file_object> + <unix:file_state id="state_file_user_owner_grub_conf" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> -- 1.7.1

2 7

[PATCH] Tested partition checks, ensured they returned valid partitions.
by Maura Dailey 10 Sep '13

10 Sep '13

Added test checks for set of partition checks. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/partition_for_home.xml | 18 ++++++++++-------- RHEL6/input/checks/partition_for_tmp.xml | 14 ++++++++------ RHEL6/input/checks/partition_for_var.xml | 18 ++++++++++-------- RHEL6/input/checks/partition_for_var_log.xml | 12 +++++++----- RHEL6/input/checks/partition_for_var_log_audit.xml | 18 +++++++++++------- 5 files changed, 46 insertions(+), 34 deletions(-) diff --git a/RHEL6/input/checks/partition_for_home.xml b/RHEL6/input/checks/partition_for_home.xml index b784316..2081d18 100644 --- a/RHEL6/input/checks/partition_for_home.xml +++ b/RHEL6/input/checks/partition_for_home.xml @@ -5,20 +5,22 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>If user home directories will be stored locally, - create a separate partition for /home. If /home will be mounted - from another system such as an NFS server, then creating a separate - partition is not necessary at this time, and the mountpoint can - instead be configured later.</description> + <description>If user home directories will be stored locally, create a + separate partition for /home. If /home will be mounted from another + system such as an NFS server, then creating a separate partition is not + necessary at this time, and the mountpoint can instead be configured + later.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_home_partition" comment="/home on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_home_partition" version="1" comment="/home on own partition"> - <linux:object object_ref="object_mount_home_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_home_partition" version="1" comment="/home on own partition"> + <linux:object object_ref="object_mount_home_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_home_own_partition" version="1"> - <linux:mount_point>/home</linux:mount_point> + <linux:mount_point>/home</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_tmp.xml b/RHEL6/input/checks/partition_for_tmp.xml index de93ee9..9c28c13 100644 --- a/RHEL6/input/checks/partition_for_tmp.xml +++ b/RHEL6/input/checks/partition_for_tmp.xml @@ -5,18 +5,20 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /tmp directory is a world-writable directory - used for temporary file storage. Verify that it has its own - partition or logical volume.</description> + <description>The /tmp directory is a world-writable directory used for + temporary file storage. Verify that it has its own partition or logical + volume.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_tmp_partition" comment="/tmp on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_tmp_partition" version="1" comment="/tmp on own partition"> - <linux:object object_ref="object_own_tmp_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_tmp_partition" version="1" comment="/tmp on own partition"> + <linux:object object_ref="object_own_tmp_partition" /> </linux:partition_test> <linux:partition_object id="object_own_tmp_partition" version="1"> - <linux:mount_point>/tmp</linux:mount_point> + <linux:mount_point>/tmp</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var.xml b/RHEL6/input/checks/partition_for_var.xml index 58089ab..2ed1d38 100644 --- a/RHEL6/input/checks/partition_for_var.xml +++ b/RHEL6/input/checks/partition_for_var.xml @@ -5,20 +5,22 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Ensuring that /var is mounted on its own partition enables the - setting of more restrictive mount options, which is used as temporary - storage by many program, particularly system services such as daemons. - It is not uncommon for the /var directory to contain world-writable directories, - installed by other software packages.</description> + <description>Ensuring that /var is mounted on its own partition enables + the setting of more restrictive mount options, which is used as temporary + storage by many program, particularly system services such as daemons. It + is not uncommon for the /var directory to contain world-writable + directories, installed by other software packages.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_partition" comment="/var on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_partition" version="1" comment="/var on own partition"> - <linux:object object_ref="object_mount_var_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_partition" version="1" comment="/var on own partition"> + <linux:object object_ref="object_mount_var_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_var_own_partition" version="1"> - <linux:mount_point>/var</linux:mount_point> + <linux:mount_point>/var</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var_log.xml b/RHEL6/input/checks/partition_for_var_log.xml index 8a8a6f4..94d235b 100644 --- a/RHEL6/input/checks/partition_for_var_log.xml +++ b/RHEL6/input/checks/partition_for_var_log.xml @@ -5,17 +5,19 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>System logs are stored in the /var/log directory. - Ensure that it has its own partition or logical volume.</description> + <description>System logs are stored in the /var/log directory. Ensure + that it has its own partition or logical volume.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_log_partition" comment="/var/log on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_log_partition" version="1" comment="/var/log on own partition"> - <linux:object object_ref="object_mount_var_log_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_log_partition" version="1" comment="/var/log on own partition"> + <linux:object object_ref="object_mount_var_log_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_var_log_own_partition" version="1"> - <linux:mount_point>/var/log</linux:mount_point> + <linux:mount_point>/var/log</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var_log_audit.xml b/RHEL6/input/checks/partition_for_var_log_audit.xml index e88ceba..b7a7d68 100644 --- a/RHEL6/input/checks/partition_for_var_log_audit.xml +++ b/RHEL6/input/checks/partition_for_var_log_audit.xml @@ -6,18 +6,22 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make - absolutely certain that it is large enough to store all audit logs - that will be created by the auditing daemon.</description> + Ensure that it has its own partition or logical volume. Make absolutely + certain that it is large enough to store all audit logs that will be + created by the auditing daemon.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_log_audit_partition" comment="/var/log/audit on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_log_audit_partition" version="1" comment="check for /var/log/audit partition"> - <linux:object object_ref="object_mount_var_log_audit_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_log_audit_partition" version="1" + comment="check for /var/log/audit partition"> + <linux:object object_ref="object_mount_var_log_audit_own_partition" /> </linux:partition_test> - <linux:partition_object id="object_mount_var_log_audit_own_partition" version="1"> - <linux:mount_point>/var/log/audit</linux:mount_point> + <linux:partition_object id="object_mount_var_log_audit_own_partition" + version="1"> + <linux:mount_point>/var/log/audit</linux:mount_point> </linux:partition_object> </def-group> -- 1.7.1

3 5

Various False Positives?
by leam hall 03 Sep '13

03 Sep '13

Hey all, Just ran oscap with the xml files available on the website (Benchmark version 0.9). Here are the issues that seem to be false positives. Prefix everything with "RHEL-06-000". These are all marked as fail but the server meets the STIG. 9 rhnsd can be on if configured to Satellite server or similar 57 ucredit 58 ocredit 59 lcredit 73 /etc/issue 98 No ipv6 installed 99 " 165 adjtimex 167 settimeofday 169 stime // Also, the STIG is wrong. There is no x86_64 stime syscall 171 clock_settime 184-196, 200 chmod, chown, etc... 206-211 No telnet installed or turned on 240 /etc/ssh/sshd_config Banner 271 If there are no removable partitions this is not a finding. 278 If the file permissions are more restrictive then it is not a finding. 324 No X running 326 " 346 Finding reported on umask 022 348 No vsftp installed, thus no file. 506 "hushlogin" 507 PrintLastLog Am I confused in thinking a system in run level 3 should net need to worry about X/Gnome findings? Leam -- Mind on a Mission <http://leamhall.blogspot.com/>

7 18

[PATCH 0/4] OVAL template testing
by Shawn Wells 03 Sep '13

03 Sep '13

6 8

Results for "make validate" from current git repo
by leam hall 02 Sep '13

02 Sep '13

Pulled the latest from https://git.fedorahosted.org/cgit/scap-security-guide.git/ and did a make and make validate. Received the following: oscap xccdf validate-xml output/ssg-rhel6-xccdf.xml oscap oval validate-xml output/ssg-rhel6-oval.xml oscap oval validate-xml output/ssg-rhel6-cpe-oval.xml cd output; ../utils/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-rhel6-xccdf.xml Invalid OVAL definition referenced by XCCDF Rule: set_gdm_login_banner_text Invalid OVAL definition referenced by XCCDF Rule: disable_logwatch_for_logserver OVAL Check is not referenced by XCCDF: oval:ssg:def:1052 oscap oval validate-xml --schematron output/ssg-rhel6-oval.xml <?xml version="1.0"?> DEPRECATED OBJECT: ind:environmentvariable_object ID: oval:ssg:obj:2112 Invalid OVAL Definition content(5.10) in output/ssg-rhel6-oval.xml. make: *** [validate] Error 2 -- Mind on a Mission <http://leamhall.blogspot.com/>

2 1

Profiles, or I guess I was sleeping during class.
by Brian Millett 02 Sep '13

02 Sep '13

Sorry for asking, but I really had my head somewhere else and I've noticed that the profile transformations is gone and are now done in the guide.xslt. If I have a profile that is customized (a subset of stig, but more than common) called "MyGreatProfile" then all I would have to do is add a line to the input/guide.xslt file as: <xsl:apply-templates select="document('profiles/mygreatprofile.xml')" /> ?? Thanks. -- Brian Millett "Now, Commander, I'm sure there's more to your story than that." 'Yes.' -- [ Cynthia Torqueman and Ivanova, "And Now For A Word"]

2 1

[PATCH 4/4] OVAL testing template_package_removed
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 3/4] OVAL testing for template_kernel_module_disabled
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 2/4] template_OVAL_package_installed testing + bash remediations
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 1/4] Updated NIST profile ID
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

Bouncing messages?
by Robert Sanders 29 Aug '13

29 Aug '13

Just out of curiosity, has anyone else received messages from the mailing list that about too many bounces? I got one a couple of weeks ago and did see a bunch of email on the web archive that I never received via email, but I just got another notice and there is nothing (recent) in the archive that I don't have here. I've asked my IT group here to back track and see if any of our filters are bouncing stuff... -Rob

4 3

current OVAL testing progress
by Jeffrey Blank 29 Aug '13

29 Aug '13

As promised, here is a display of the OVAL testing progress on scap-security-guide, against the Rules for the STIG profile: http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6-testinf… A very fat green bar in the "Check Text" column indicates that both OVAL and XCCDF have been tested; a note with the testers' names/initials are displayed at the bottom of the associated cell. How check attestations are added to the project are covered in previous discussions on the list (and hopefully apparent at a glance in the corresponding input file). The number of tested checks could increase significantly (momentum!), if some of the templated ones are tested (which would then likely involve adding a tag to the template, at least for the OVAL). Relatedly, I seem to recall that one of the templated OVAL checks may not quite be right, such as enabling/disabling a service for all runlevels instead of the usual 2-5.

2 1

[PATCH] added "checks" as a dependency for tables
by Jeffrey Blank 29 Aug '13

29 Aug '13

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil> --- RHEL6/Makefile | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 40aa322..1c3d2a9 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -7,7 +7,7 @@ DIST = dist ID = ssg -all: shorthand2xccdf tables guide checks content dist +all: shorthand2xccdf tables guide content dist shorthand-guide: xsltproc -o $(OUT)/rhel6-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml @@ -59,14 +59,14 @@ table-srgmap: shorthand2xccdf $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml xmllint --xmlout --html --output $(OUT)/table-rhel6-srgmap-flat.xhtml $(OUT)/table-rhel6-srgmap-flat.html -table-stigs: shorthand2xccdf table-srgmap +table-stigs: shorthand2xccdf table-srgmap checks xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml # xsltproc -stringparam notes "../$(IN)/auxiliary/transition_notes.xml" -o $(OUT)/table-rhel5-stig-manual-withnotes.html \ # $(TRANS)/xccdf2table-stig.xslt \ # $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml # temporarily retain an output file showing the short titles as well - xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o $(OUT)/table-stig-rhel6-shorttitles.html \ + xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o $(OUT)/table-stig-rhel6-testinfo.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-rhel6-xccdf.xml xsltproc -stringparam overlay "../$(IN)/auxiliary/stig_overlay.xml" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \ -- 1.7.1

2 1

[PATCH] Tiny patch to correct typo, it's -S stime, not -S time.
by Maura Dailey 29 Aug '13

29 Aug '13

Just a typo I noticed in passing. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 4597b6f..cfb1425 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -555,7 +555,7 @@ to the system time should be audited.</rationale> <description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>: <pre># audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rules</pre> -On a 64-bit system, the "-S time" is not necessary. The -k option allows for +On a 64-bit system, the "-S stime" is not necessary. The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. -- 1.7.1

2 1

minutes from 8/28 meeting (5-7pm) at DuClaw
by David Smith 29 Aug '13

29 Aug '13

Hi all, Here are minutes for the scap-security-guide meeting at DuClaw on 8/28. Attendance was less than we'd hoped -- maybe we'll have more next time! We want to prioritize the following activities: 1) Review/act/closeout existing Trac tickets. (Working on it this afternoon!) 2) Comprehensive proofread of the XCCDF guide. 3) Get with DISA FSO to sync on how to link the project's STIG profile in XCCDF, with whatever they can ingest. This is really important to make sure that the OVAL testing corresponds to the right XCCDF. 4) Continued OVAL testing (in parallel), with results captured graphically. Currently the table with testing info should be captured in the file table-stig-rhel6-shorttitles.html. (Oddly this doesn't quite seem to be working, and it should likely be captured in a different file anyway.) Ambition is to use maven and jenkins for testing against openscap, and even other tools such as SCC. 5) Decide how to handle any references to NIST 800-53 controls in some intellectually coherent/consistent way, to the extent possible. 6) Issue the prose guide and automated checking content, following the testing of the OVAL content. This may precede the DISA issuance of automated content. This should occur prior to the Red Hat Government Symposium on Nov 6.

2 1

Definition Criteria ...
by Trey Henefield 29 Aug '13

29 Aug '13

Greetings, So I am still in the learning process and am currently creating my own SSG benchmark for Java. Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types. While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone. However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal. I can't seem to find any good information that breaks down each of these and their intended outcome. Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true. So to achieve my suggested goal, my thoughts were the following for cpe-oval: <AND> Def.UNIX <OR> Def.JRE-SUN <OR> Def.JRE-ORACLE ... That seems to work, but the criteria for the actual checks seem to get a little more grey. My thoughts were: <OR> TST.JRE-SUN-INSTALLED <AND> TST.JRE-SUN-CHECK TST.JRE-ORACLE-INSTALLED <AND> TST.JRE-ORACLE-CHECK But that doesn't seem to pan out the way I expected it to. Any thoughts on how best to accomplish this? Thaks! Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2013-08-29 12:13:20 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

3 6

Self Introduction
by Jan Lieskovsky 29 Aug '13

29 Aug '13

Hello guys, I have recently joined the Red Hat Security Technologies Team, to help with selected packages maintenance and participate on discussions wrt to OVAL content. I have previously worked for Red Hat Security Response Team, so OVAL and XCCDF shouldn't be that strange topics in comparison with those, I have been working in the past with (but of course some time will be needed me to get / become a fully-fledged member of this community). Jeff's previously provided link: [1] https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper was helpful for me too :) (already requested membership to the SCAP Security Guide project). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

SCC 3.1 results with SSG content
by Robert Sanders 29 Aug '13

29 Aug '13

Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item): RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed. I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group. -Rob

3 3

New Member Intro
by Vincenzo Pierorazio 27 Aug '13

27 Aug '13

Hey everyone - I'm new to this project. I'm a complete novice when it comes with SCAP so please be patient haha. I'm currently having issues with my SSH keys I believe so I've been just pulling the latest repo daily. In the mean time, until I can figure out the disconnect, I believe I have some patches someone can hopefully commit. Add a refine-value tag for the variable to accept a timeout of 15 minutes or less in the CS2 profile. File: .\input\profiles\CS2.xml Line: 271 <refine-value idref="sshd_idle_timeout_value" selector="15_minutes" operator="less than or equal" /> In turn, add a value of 15_minutes/900 in the check for the newly defined value above: FIle: .\input\services\ssh.xml Line: 18 <value selector="15_minutes">900</value> Hopefully that makes some sense and is useful. Still trying to wrap my head around this stuff. Thanks! -- Vincenzo Pierorazio, CISSP, GPEN, C|HFI, OSCP, OSWP Secure Innovations, LLC 443-445-8635 (Office) 443-866-9608 (Cell)

3 2

SSG Happy Hour: Weds 8/28, 4:30pm @ DuClaws Arundel Mills
by Shawn Wells 26 Aug '13

26 Aug '13

It's been awhile since many of us in the MD/DC/VA area have gotten together! This Wednesday Jeff Blank, Dave Smith and I are meeting up at DuClaws Arundel Mills [1] for a happy hour, and we wanted to extend an invite for those in the area to join us. Gives us a chance to plan a few things out (e.g. the remaining OVAL testing, integration of bash scripts, needed profiles like FedRAMP) in a very informal setting. Current plan is to meetup at 4:30 at the Arundel Mills location (it's over near the movie theature): 7000 Arundel Mills Circle Suite R4 Hanover, MD 21076 Feel free to join us! Note this isn't a sponsored event by RH or the government, just an opportunity for locals + interested parties to get together. We'll post "meeting minutes" back to the mailing list... if we can remember them after a few pints ;) Hope to see you there! [1] http://www.duclaw.com/locations.aspx

1 0

rhel6 and ptp
by Grant Street 25 Aug '13

25 Aug '13

Hello We have a requirement to not mount portable storage devices and we have implemented the USB blocking but it appears that gphoto has access to camera's and android phones using PTP. This mounting is done at teh gnome layer as the the device is not visibly mounted from the command line, but can be seen in nautilus under computer:/// I tried the "2.2.2.e. Disable GNOME Automounting" but it still mounts. Any one found a solution to this? Grant

1 1

RHEL-06-000292 - The DHCP client must be disabled if not needed
by Robert Sanders 23 Aug '13

23 Aug '13

Quick question on this one. If I follow the prose directory then any interface on the system that doesn't have a file in /etc/sysconfig/network-scripts is a finding. On my box I've got the virbr0 and virbr0-nic interfaces due to the virtualization stuff installed. Should there be some language in here related to these virtual nics? -Rob

2 2

[PATCH] Some changes to the prose, as well as minor copy editing
by David Smith 23 Aug '13

23 Aug '13

This patchset does the following: 1) files.xml was modified so the titles of the SGID and SUID rules were uniform 2) the introductory text to the DHCP section was heavily modified 3) minor copy editing in the rest of the changed files David Smith (1): Prose changes and copy editing RHEL6/input/services/base.xml | 20 ++++++++++---------- RHEL6/input/services/dhcp.xml | 24 ++++++------------------ RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/services/ssh.xml | 3 +-- RHEL6/input/system/permissions/files.xml | 2 +- 5 files changed, 19 insertions(+), 32 deletions(-)

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2013