August 2013 - scap-security-guide - Fedora mailing-lists

Fishing with Gnome's
by Stuart Green 26 Oct '13

26 Oct '13

Hey All, Has there been any previous discussion on the Gnome checks? We run headless installations here so none of the checks are applicable to us, but the XCCDF raises fails. I'm not sure if its possible to add a check to see if x sessions are enabled perhaps? Cheers Stu

4 5

scap-security-guide v0.1-12 released
by Shawn Wells 24 Oct '13

24 Oct '13

On 2-MAY the SSG v0.1-11 update was released, reflecting the inclusion of DISA FSO feedback on the (then) Draft RHEL6 STIG and several OVAL improvements. It was a huge milestone, driving us over 1,800 unique code commits! We've since had an additional 88 commits, largely around OVAL content cleanup and the rewrite of combinefixes.py to handle parameters for OpenSCAP remediation generation (thanks, Jeff!). User feedback also prompted us to fix the build system when compiling on Fedora 18+ and the upcoming RHEL release. SSG v0.1-12 has been released to the EPEL repository to reflect these recent bugfixes and enhancements. Download instructions available on the wiki: https://fedorahosted.org/scap-security-guide/wiki/downloads CHANGELOG: > $ git log --oneline --after={2013-05-02} --no-merges > fe2a0b6 Some corrections to the PAM cracklib guidance as follows: > corrected pam_cracklib.so line to include all discussed parame > 532aeb8 Modified the DoD banner check to accept either a newline or > space between each word, as the RHEL5 version does. This al > ded2ef4 Created remediation template: create_services_disabled.py - > Based off OVAL services file > a96cdc3 Added sysctl remediation scripts - Updated template to reflect > proper naming of sysctl scripts > c3355eb Added bash templates directory, added sample sysctl script - > Makefile based off OVAL, same usage - CVS files point to > f75ad8d Module is freevxfs, not freevsfs > cd940ef Fix build of OpenStack and RHEVM3 parts on Fedora 18+ > df19413 Fix build on Fedora 18+ and the upcoming RHEL release > 2ddbbb7 Subexpression datatype shall equal to the variable datatype > 4cd7650 Ok, to fix the "error" doing an evaluation for the various > umask checks, changed the following variables referenced in t > 5fa190d changed a typo var_acocunts_umask_bashrc => > var_accounts_umask_bashrc > 7d772db Update from deprecated rpmverify_* to rpmverifyfile_* checks > 2026606 made xccdf-addfixes insert all text and child nodes of a fix > d6703f4 rewrite of combinefixes.py to handle parameters for OpenSCAP > remedation generation > c13fafa incomplete support file for bash remediations * does at least > warn when undefined variable exists > f87d817 example remediation script which takes a parameter > 24f2c2e Removing deprecated recurse="files" behavior > f078b8f Removing deprecated recurse=files behavior. > b12d669 Replacing deprecated <ind:environmentvariable_...> tags with > <ind:environmentvariable58_...> tags > 5ed6dc2 Created OVAL for ensure_gpgcheck_never_disabled XCCDF rule > called nonexisting OVAL, created it. > 0d69487 Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 295184c Adding check for no_netrc_files > e1aede3 Adding check for pam_lastlog.so > 9c21556 additional copy editing > 3fd9f3f copy editing > 9db6e3d Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 4109078 Adding check for no_netrc_files > 6f31c05 Adding check for pam_lastlog.so > 0e15e2d Adding check for disabling GNOME thumbnailers in gconf > d10f08e modified makefile to remove test attestation from prose guide > -- revised > 4f3ea5f corrections for typos in OVAL references > d50c71b removal of references to nonexistent OVAL for some NFS guidance > 980f686 refine verify-references to deal only with OVAL compliance > checks for OVAL > 6051ea6 removal of comments, reference to nonexistent OVAL > 8251580 removal or correction of misnamed or obsolete OVAL checks > 76e93ef removal of packages from check templates > 69f31e0 Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some m > c22ed9c Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some more f > c58ac2b Fixing indenting for external variable line. > 95d5a4b removal of unused OVAL checks > bcc1495 bugfixes for undisciplined renaming jaunt, missing OVAL references > 9a378b9 removal of unused OVAL checks > 3b82cf5 deletion of unused OVAL checks > 6a89088 removal of commented text, some redundant/unnecessary Rules > from Profiles > 9705192 deletion of unused/obsoleted OVAL checks (and commented out XCCDF) > 36a75ec deletion of unused OVAL checks > 48e9900 removal of unnecessary guidance from SSL section > 7682f9c removal of commented/obsolete text from logging section > a1f2d30 removal of commented text, invalid CCE from root logins guidance > 0a3577b update to NFS section (still perhaps incomplete) > 1a3d854 changed Dovecot Rule to Group as it is guidance and not a > compliance check > fb4a29b removal of commented/obsolete items for base services > 9a228d5 updates to the CCE verification script to be more informative > ff25fc9 cleanup of comments, unnecessary Rules in DNS (bind) service > 7a16cda Deleting duplicate check for disabling IPv6 > d9d1741 Minor typo, removing slash at end of description > 330258c added version info for RHEL, URL for project > f36ecf3 removed some now-obsolete advice from samba > 8d5ee52 added some clarifying text to the intro > 6c9f047 removing some unnecessary (for compliance-focus) text from cups > de705e9 Updated service_tftpd_disabled As reflected from update to > template file > 356405f Removed duplicate references to var_samba_private_directory > Updated OVAL to have unique IDs > 034b8b3 Removed duplicate references object_etc_skel_files Updated > OVAL to have unique names > d609d6b Removed duplicate var_ssh_config_directory references Updated > OVAL to have unique names > 8a7a3f3 Removed duplicate state_uid_root Updated OVAL to have unique names > e421d69 Modified template_OVAL_package_installed and > template_package_removed These files were causing build errors > regarding ob > 1ae4c30 Removed duplicate references to var_accounts_user_umask > Assigned unique identifiers > ea10f13 Removed duplicate references to object_lib_modules_files > Assigned unique identifiers > 882e341 Removed duplicate object_usr_lib64_files references Assigned > unique identifiers within OVAL > 9d89e61 Removed duplicate object_usr_lib64_dir references Assigned > unique identifiers in OVAL > 863aa19 Removed duplicate object_usr_lib_files references Assigned > unique identifiers to OVAL checks > 714c3c1 Removed duplicate object_usr_lib_dir Updated OVAL to have > unique names > dffd29b Removed duplicates of object_lib64_files Updated OVAL to have > unique names > bc6fbcd Removed duplicate object_lib64_dir Updated OVAL checks to have > unique names > fe089dc Removed duplicate object_lib_files Updated OVAL checks for > unique names > 7546f2e Removed duplicate object_lib_dir references Created unique > names in the OVAL templates > b376e27 Updated mount_option_* OVAL variable var_removable_partition > These OVAL files were using duplicate 'var_remove_partition > 7fae707 Updated template_permissions to place FILEID into strings > e31dc7b Updated state_gid_0 to reflect per check naming > 07380c0 Updated state_uid_0 names within OVAL Multiple OVAL checks > were using "state_uid_0" causing build errors. Updated so eve > f5b90ce Updated rpm_verify_hashes for OVAL 5.10 compliance The old > rpmverify_* is now depricated, updated check to rpmverifyfile > e3b5697 modified transform to only match test attestation > 02a19e2 transform designed to remove the 'tested by' information > a330ccf deleting files for imprecise and obsolete OVAL checks, manual > remediation > ca71cde simplification of Postfix service configuration > 14397cd Removing a newline to fix XHTML formatting > 7d1ab28 deletion of manual audit profile, OVAL for obsolete ldap > server checks > d7f3ca4 removed obsolete LDAP guidance, checks

1 1

[PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat
by Maura Dailey 10 Sep '13

10 Sep '13

There isn't any way to do this the clever way, following the symlink /etc/grub.conf, so for now at least, I added a second path to check, the path for EFI in a default install. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/file_group_owner_grub_conf.xml | 18 +++++++++++++++--- RHEL6/input/checks/file_user_owner_grub_conf.xml | 18 +++++++++++++++--- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml b/RHEL6/input/checks/file_group_owner_grub_conf.xml index 3fc076a..4856fdf 100644 --- a/RHEL6/input/checks/file_group_owner_grub_conf.xml +++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml @@ -1,14 +1,16 @@ <def-group> <definition class="compliance" id="file_group_owner_grub_conf" version="1"> <metadata> - <title>File /boot/grub/grub.conf Owned By root Group </title> + <title>File grub.conf Owned By root Group </title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /boot/grub/grub.conf file should be owned by the root group.</description> + <description>The grub.conf file should be owned by the root group.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> <criterion test_ref="test_file_group_owner_grub_conf" /> + <criterion test_ref="test_file_group_owner_efi_grub_conf" /> </criteria> </definition> @@ -17,11 +19,21 @@ <unix:state state_ref="state_file_group_owner_grub_conf" /> </unix:file_test> + <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_group_owner_efi_grub_conf" version="1"> + <unix:object object_ref="object_file_group_owner_efi_grub_conf" /> + <unix:state state_ref="state_file_group_owner_grub_conf" /> + </unix:file_test> + <unix:file_object comment="/boot/grub/grub.conf" id="object_file_group_owner_grub_conf" version="1"> <unix:path>/boot/grub</unix:path> <unix:filename>grub.conf</unix:filename> </unix:file_object> + <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_group_owner_efi_grub_conf" version="1"> + <unix:path>/boot/efi/EFI/redhat</unix:path> + <unix:filename>grub.conf</unix:filename> + </unix:file_object> + <unix:file_state id="state_file_group_owner_grub_conf" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml b/RHEL6/input/checks/file_user_owner_grub_conf.xml index 53d5e2f..290d883 100644 --- a/RHEL6/input/checks/file_user_owner_grub_conf.xml +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml @@ -1,14 +1,16 @@ <def-group> <definition class="compliance" id="file_user_owner_grub_conf" version="1"> <metadata> - <title>File /boot/grub/grub.conf Owned By root User</title> + <title>File grub.conf Owned By root User</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /boot/grub/grub.conf file should be owned by the root user.</description> + <description>The grub.conf file should be owned by the root user.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> <criterion test_ref="test_file_user_owner_grub_conf" /> + <criterion test_ref="test_file_user_owner_efi_grub_conf" /> </criteria> </definition> @@ -17,11 +19,21 @@ <unix:state state_ref="state_file_user_owner_grub_conf" /> </unix:file_test> + <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_user_owner_efi_grub_conf" version="1"> + <unix:object object_ref="object_file_user_owner_efi_grub_conf" /> + <unix:state state_ref="state_file_user_owner_grub_conf" /> + </unix:file_test> + <unix:file_object comment="/boot/grub/grub.conf" id="object_file_user_owner_grub_conf" version="1"> <unix:path>/boot/grub</unix:path> <unix:filename>grub.conf</unix:filename> </unix:file_object> + <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_user_owner_efi_grub_conf" version="1"> + <unix:path>/boot/efi/EFI/redhat</unix:path> + <unix:filename>grub.conf</unix:filename> + </unix:file_object> + <unix:file_state id="state_file_user_owner_grub_conf" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> -- 1.7.1

2 7

[PATCH] Tested partition checks, ensured they returned valid partitions.
by Maura Dailey 10 Sep '13

10 Sep '13

Added test checks for set of partition checks. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/partition_for_home.xml | 18 ++++++++++-------- RHEL6/input/checks/partition_for_tmp.xml | 14 ++++++++------ RHEL6/input/checks/partition_for_var.xml | 18 ++++++++++-------- RHEL6/input/checks/partition_for_var_log.xml | 12 +++++++----- RHEL6/input/checks/partition_for_var_log_audit.xml | 18 +++++++++++------- 5 files changed, 46 insertions(+), 34 deletions(-) diff --git a/RHEL6/input/checks/partition_for_home.xml b/RHEL6/input/checks/partition_for_home.xml index b784316..2081d18 100644 --- a/RHEL6/input/checks/partition_for_home.xml +++ b/RHEL6/input/checks/partition_for_home.xml @@ -5,20 +5,22 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>If user home directories will be stored locally, - create a separate partition for /home. If /home will be mounted - from another system such as an NFS server, then creating a separate - partition is not necessary at this time, and the mountpoint can - instead be configured later.</description> + <description>If user home directories will be stored locally, create a + separate partition for /home. If /home will be mounted from another + system such as an NFS server, then creating a separate partition is not + necessary at this time, and the mountpoint can instead be configured + later.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_home_partition" comment="/home on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_home_partition" version="1" comment="/home on own partition"> - <linux:object object_ref="object_mount_home_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_home_partition" version="1" comment="/home on own partition"> + <linux:object object_ref="object_mount_home_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_home_own_partition" version="1"> - <linux:mount_point>/home</linux:mount_point> + <linux:mount_point>/home</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_tmp.xml b/RHEL6/input/checks/partition_for_tmp.xml index de93ee9..9c28c13 100644 --- a/RHEL6/input/checks/partition_for_tmp.xml +++ b/RHEL6/input/checks/partition_for_tmp.xml @@ -5,18 +5,20 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /tmp directory is a world-writable directory - used for temporary file storage. Verify that it has its own - partition or logical volume.</description> + <description>The /tmp directory is a world-writable directory used for + temporary file storage. Verify that it has its own partition or logical + volume.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_tmp_partition" comment="/tmp on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_tmp_partition" version="1" comment="/tmp on own partition"> - <linux:object object_ref="object_own_tmp_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_tmp_partition" version="1" comment="/tmp on own partition"> + <linux:object object_ref="object_own_tmp_partition" /> </linux:partition_test> <linux:partition_object id="object_own_tmp_partition" version="1"> - <linux:mount_point>/tmp</linux:mount_point> + <linux:mount_point>/tmp</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var.xml b/RHEL6/input/checks/partition_for_var.xml index 58089ab..2ed1d38 100644 --- a/RHEL6/input/checks/partition_for_var.xml +++ b/RHEL6/input/checks/partition_for_var.xml @@ -5,20 +5,22 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Ensuring that /var is mounted on its own partition enables the - setting of more restrictive mount options, which is used as temporary - storage by many program, particularly system services such as daemons. - It is not uncommon for the /var directory to contain world-writable directories, - installed by other software packages.</description> + <description>Ensuring that /var is mounted on its own partition enables + the setting of more restrictive mount options, which is used as temporary + storage by many program, particularly system services such as daemons. It + is not uncommon for the /var directory to contain world-writable + directories, installed by other software packages.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_partition" comment="/var on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_partition" version="1" comment="/var on own partition"> - <linux:object object_ref="object_mount_var_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_partition" version="1" comment="/var on own partition"> + <linux:object object_ref="object_mount_var_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_var_own_partition" version="1"> - <linux:mount_point>/var</linux:mount_point> + <linux:mount_point>/var</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var_log.xml b/RHEL6/input/checks/partition_for_var_log.xml index 8a8a6f4..94d235b 100644 --- a/RHEL6/input/checks/partition_for_var_log.xml +++ b/RHEL6/input/checks/partition_for_var_log.xml @@ -5,17 +5,19 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>System logs are stored in the /var/log directory. - Ensure that it has its own partition or logical volume.</description> + <description>System logs are stored in the /var/log directory. Ensure + that it has its own partition or logical volume.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_log_partition" comment="/var/log on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_log_partition" version="1" comment="/var/log on own partition"> - <linux:object object_ref="object_mount_var_log_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_log_partition" version="1" comment="/var/log on own partition"> + <linux:object object_ref="object_mount_var_log_own_partition" /> </linux:partition_test> <linux:partition_object id="object_mount_var_log_own_partition" version="1"> - <linux:mount_point>/var/log</linux:mount_point> + <linux:mount_point>/var/log</linux:mount_point> </linux:partition_object> </def-group> diff --git a/RHEL6/input/checks/partition_for_var_log_audit.xml b/RHEL6/input/checks/partition_for_var_log_audit.xml index e88ceba..b7a7d68 100644 --- a/RHEL6/input/checks/partition_for_var_log_audit.xml +++ b/RHEL6/input/checks/partition_for_var_log_audit.xml @@ -6,18 +6,22 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make - absolutely certain that it is large enough to store all audit logs - that will be created by the auditing daemon.</description> + Ensure that it has its own partition or logical volume. Make absolutely + certain that it is large enough to store all audit logs that will be + created by the auditing daemon.</description> + <reference source="MED" ref_id="20130830" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_var_log_audit_partition" comment="/var/log/audit on own partition" /> </criteria> </definition> - <linux:partition_test check="all" check_existence="all_exist" id="test_var_log_audit_partition" version="1" comment="check for /var/log/audit partition"> - <linux:object object_ref="object_mount_var_log_audit_own_partition" /> + <linux:partition_test check="all" check_existence="all_exist" + id="test_var_log_audit_partition" version="1" + comment="check for /var/log/audit partition"> + <linux:object object_ref="object_mount_var_log_audit_own_partition" /> </linux:partition_test> - <linux:partition_object id="object_mount_var_log_audit_own_partition" version="1"> - <linux:mount_point>/var/log/audit</linux:mount_point> + <linux:partition_object id="object_mount_var_log_audit_own_partition" + version="1"> + <linux:mount_point>/var/log/audit</linux:mount_point> </linux:partition_object> </def-group> -- 1.7.1

3 5

Various False Positives?
by leam hall 03 Sep '13

03 Sep '13

Hey all, Just ran oscap with the xml files available on the website (Benchmark version 0.9). Here are the issues that seem to be false positives. Prefix everything with "RHEL-06-000". These are all marked as fail but the server meets the STIG. 9 rhnsd can be on if configured to Satellite server or similar 57 ucredit 58 ocredit 59 lcredit 73 /etc/issue 98 No ipv6 installed 99 " 165 adjtimex 167 settimeofday 169 stime // Also, the STIG is wrong. There is no x86_64 stime syscall 171 clock_settime 184-196, 200 chmod, chown, etc... 206-211 No telnet installed or turned on 240 /etc/ssh/sshd_config Banner 271 If there are no removable partitions this is not a finding. 278 If the file permissions are more restrictive then it is not a finding. 324 No X running 326 " 346 Finding reported on umask 022 348 No vsftp installed, thus no file. 506 "hushlogin" 507 PrintLastLog Am I confused in thinking a system in run level 3 should net need to worry about X/Gnome findings? Leam -- Mind on a Mission <http://leamhall.blogspot.com/>

7 18

[PATCH 0/4] OVAL template testing
by Shawn Wells 03 Sep '13

03 Sep '13

6 8

Results for "make validate" from current git repo
by leam hall 03 Sep '13

03 Sep '13

Pulled the latest from https://git.fedorahosted.org/cgit/scap-security-guide.git/ and did a make and make validate. Received the following: oscap xccdf validate-xml output/ssg-rhel6-xccdf.xml oscap oval validate-xml output/ssg-rhel6-oval.xml oscap oval validate-xml output/ssg-rhel6-cpe-oval.xml cd output; ../utils/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-rhel6-xccdf.xml Invalid OVAL definition referenced by XCCDF Rule: set_gdm_login_banner_text Invalid OVAL definition referenced by XCCDF Rule: disable_logwatch_for_logserver OVAL Check is not referenced by XCCDF: oval:ssg:def:1052 oscap oval validate-xml --schematron output/ssg-rhel6-oval.xml <?xml version="1.0"?> DEPRECATED OBJECT: ind:environmentvariable_object ID: oval:ssg:obj:2112 Invalid OVAL Definition content(5.10) in output/ssg-rhel6-oval.xml. make: *** [validate] Error 2 -- Mind on a Mission <http://leamhall.blogspot.com/>

2 1

Profiles, or I guess I was sleeping during class.
by Brian Millett 03 Sep '13

03 Sep '13

Sorry for asking, but I really had my head somewhere else and I've noticed that the profile transformations is gone and are now done in the guide.xslt. If I have a profile that is customized (a subset of stig, but more than common) called "MyGreatProfile" then all I would have to do is add a line to the input/guide.xslt file as: <xsl:apply-templates select="document('profiles/mygreatprofile.xml')" /> ?? Thanks. -- Brian Millett "Now, Commander, I'm sure there's more to your story than that." 'Yes.' -- [ Cynthia Torqueman and Ivanova, "And Now For A Word"]

2 1

[PATCH 4/4] OVAL testing template_package_removed
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 3/4] OVAL testing for template_kernel_module_disabled
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 2/4] template_OVAL_package_installed testing + bash remediations
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

[PATCH 1/4] Updated NIST profile ID
by Shawn Wells 30 Aug '13

30 Aug '13

1 0

Bouncing messages?
by Robert Sanders 30 Aug '13

30 Aug '13

Just out of curiosity, has anyone else received messages from the mailing list that about too many bounces? I got one a couple of weeks ago and did see a bunch of email on the web archive that I never received via email, but I just got another notice and there is nothing (recent) in the archive that I don't have here. I've asked my IT group here to back track and see if any of our filters are bouncing stuff... -Rob

4 3

current OVAL testing progress
by Jeffrey Blank 30 Aug '13

30 Aug '13

As promised, here is a display of the OVAL testing progress on scap-security-guide, against the Rules for the STIG profile: http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6-testinf… A very fat green bar in the "Check Text" column indicates that both OVAL and XCCDF have been tested; a note with the testers' names/initials are displayed at the bottom of the associated cell. How check attestations are added to the project are covered in previous discussions on the list (and hopefully apparent at a glance in the corresponding input file). The number of tested checks could increase significantly (momentum!), if some of the templated ones are tested (which would then likely involve adding a tag to the template, at least for the OVAL). Relatedly, I seem to recall that one of the templated OVAL checks may not quite be right, such as enabling/disabling a service for all runlevels instead of the usual 2-5.

2 1

[PATCH] added "checks" as a dependency for tables
by Jeffrey Blank 30 Aug '13

30 Aug '13

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil> --- RHEL6/Makefile | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 40aa322..1c3d2a9 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -7,7 +7,7 @@ DIST = dist ID = ssg -all: shorthand2xccdf tables guide checks content dist +all: shorthand2xccdf tables guide content dist shorthand-guide: xsltproc -o $(OUT)/rhel6-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml @@ -59,14 +59,14 @@ table-srgmap: shorthand2xccdf $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml xmllint --xmlout --html --output $(OUT)/table-rhel6-srgmap-flat.xhtml $(OUT)/table-rhel6-srgmap-flat.html -table-stigs: shorthand2xccdf table-srgmap +table-stigs: shorthand2xccdf table-srgmap checks xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml # xsltproc -stringparam notes "../$(IN)/auxiliary/transition_notes.xml" -o $(OUT)/table-rhel5-stig-manual-withnotes.html \ # $(TRANS)/xccdf2table-stig.xslt \ # $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml # temporarily retain an output file showing the short titles as well - xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o $(OUT)/table-stig-rhel6-shorttitles.html \ + xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y" -o $(OUT)/table-stig-rhel6-testinfo.html \ $(TRANS)/xccdf2table-profileccirefs.xslt \ $(OUT)/unlinked-rhel6-xccdf.xml xsltproc -stringparam overlay "../$(IN)/auxiliary/stig_overlay.xml" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \ -- 1.7.1

2 1

[PATCH] Tiny patch to correct typo, it's -S stime, not -S time.
by Maura Dailey 30 Aug '13

30 Aug '13

Just a typo I noticed in passing. Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 4597b6f..cfb1425 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -555,7 +555,7 @@ to the system time should be audited.</rationale> <description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>: <pre># audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rules</pre> -On a 64-bit system, the "-S time" is not necessary. The -k option allows for +On a 64-bit system, the "-S stime" is not necessary. The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. -- 1.7.1

2 1

minutes from 8/28 meeting (5-7pm) at DuClaw
by David Smith 29 Aug '13

29 Aug '13

Hi all, Here are minutes for the scap-security-guide meeting at DuClaw on 8/28. Attendance was less than we'd hoped -- maybe we'll have more next time! We want to prioritize the following activities: 1) Review/act/closeout existing Trac tickets. (Working on it this afternoon!) 2) Comprehensive proofread of the XCCDF guide. 3) Get with DISA FSO to sync on how to link the project's STIG profile in XCCDF, with whatever they can ingest. This is really important to make sure that the OVAL testing corresponds to the right XCCDF. 4) Continued OVAL testing (in parallel), with results captured graphically. Currently the table with testing info should be captured in the file table-stig-rhel6-shorttitles.html. (Oddly this doesn't quite seem to be working, and it should likely be captured in a different file anyway.) Ambition is to use maven and jenkins for testing against openscap, and even other tools such as SCC. 5) Decide how to handle any references to NIST 800-53 controls in some intellectually coherent/consistent way, to the extent possible. 6) Issue the prose guide and automated checking content, following the testing of the OVAL content. This may precede the DISA issuance of automated content. This should occur prior to the Red Hat Government Symposium on Nov 6.

2 1

Definition Criteria ...
by Trey Henefield 29 Aug '13

29 Aug '13

Greetings, So I am still in the learning process and am currently creating my own SSG benchmark for Java. Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types. While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone. However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal. I can't seem to find any good information that breaks down each of these and their intended outcome. Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true. So to achieve my suggested goal, my thoughts were the following for cpe-oval: <AND> Def.UNIX <OR> Def.JRE-SUN <OR> Def.JRE-ORACLE ... That seems to work, but the criteria for the actual checks seem to get a little more grey. My thoughts were: <OR> TST.JRE-SUN-INSTALLED <AND> TST.JRE-SUN-CHECK TST.JRE-ORACLE-INSTALLED <AND> TST.JRE-ORACLE-CHECK But that doesn't seem to pan out the way I expected it to. Any thoughts on how best to accomplish this? Thaks! Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2013-08-29 12:13:20 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

3 6

Self Introduction
by Jan Lieskovsky 29 Aug '13

29 Aug '13

Hello guys, I have recently joined the Red Hat Security Technologies Team, to help with selected packages maintenance and participate on discussions wrt to OVAL content. I have previously worked for Red Hat Security Response Team, so OVAL and XCCDF shouldn't be that strange topics in comparison with those, I have been working in the past with (but of course some time will be needed me to get / become a fully-fledged member of this community). Jeff's previously provided link: [1] https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper was helpful for me too :) (already requested membership to the SCAP Security Guide project). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

SCC 3.1 results with SSG content
by Robert Sanders 29 Aug '13

29 Aug '13

Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item): RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed. I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group. -Rob

3 3

New Member Intro
by Vincenzo Pierorazio 28 Aug '13

28 Aug '13

Hey everyone - I'm new to this project. I'm a complete novice when it comes with SCAP so please be patient haha. I'm currently having issues with my SSH keys I believe so I've been just pulling the latest repo daily. In the mean time, until I can figure out the disconnect, I believe I have some patches someone can hopefully commit. Add a refine-value tag for the variable to accept a timeout of 15 minutes or less in the CS2 profile. File: .\input\profiles\CS2.xml Line: 271 <refine-value idref="sshd_idle_timeout_value" selector="15_minutes" operator="less than or equal" /> In turn, add a value of 15_minutes/900 in the check for the newly defined value above: FIle: .\input\services\ssh.xml Line: 18 <value selector="15_minutes">900</value> Hopefully that makes some sense and is useful. Still trying to wrap my head around this stuff. Thanks! -- Vincenzo Pierorazio, CISSP, GPEN, C|HFI, OSCP, OSWP Secure Innovations, LLC 443-445-8635 (Office) 443-866-9608 (Cell)

3 2

SSG Happy Hour: Weds 8/28, 4:30pm @ DuClaws Arundel Mills
by Shawn Wells 26 Aug '13

26 Aug '13

It's been awhile since many of us in the MD/DC/VA area have gotten together! This Wednesday Jeff Blank, Dave Smith and I are meeting up at DuClaws Arundel Mills [1] for a happy hour, and we wanted to extend an invite for those in the area to join us. Gives us a chance to plan a few things out (e.g. the remaining OVAL testing, integration of bash scripts, needed profiles like FedRAMP) in a very informal setting. Current plan is to meetup at 4:30 at the Arundel Mills location (it's over near the movie theature): 7000 Arundel Mills Circle Suite R4 Hanover, MD 21076 Feel free to join us! Note this isn't a sponsored event by RH or the government, just an opportunity for locals + interested parties to get together. We'll post "meeting minutes" back to the mailing list... if we can remember them after a few pints ;) Hope to see you there! [1] http://www.duclaw.com/locations.aspx

1 0

rhel6 and ptp
by Grant Street 26 Aug '13

26 Aug '13

Hello We have a requirement to not mount portable storage devices and we have implemented the USB blocking but it appears that gphoto has access to camera's and android phones using PTP. This mounting is done at teh gnome layer as the the device is not visibly mounted from the command line, but can be seen in nautilus under computer:/// I tried the "2.2.2.e. Disable GNOME Automounting" but it still mounts. Any one found a solution to this? Grant

1 1

RHEL-06-000292 - The DHCP client must be disabled if not needed
by Robert Sanders 23 Aug '13

23 Aug '13

Quick question on this one. If I follow the prose directory then any interface on the system that doesn't have a file in /etc/sysconfig/network-scripts is a finding. On my box I've got the virbr0 and virbr0-nic interfaces due to the virtualization stuff installed. Should there be some language in here related to these virtual nics? -Rob

2 2

[PATCH] Some changes to the prose, as well as minor copy editing
by David Smith 23 Aug '13

23 Aug '13

This patchset does the following: 1) files.xml was modified so the titles of the SGID and SUID rules were uniform 2) the introductory text to the DHCP section was heavily modified 3) minor copy editing in the rest of the changed files David Smith (1): Prose changes and copy editing RHEL6/input/services/base.xml | 20 ++++++++++---------- RHEL6/input/services/dhcp.xml | 24 ++++++------------------ RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/services/ssh.xml | 3 +-- RHEL6/input/system/permissions/files.xml | 2 +- 5 files changed, 19 insertions(+), 32 deletions(-)

2 2

[PATCH] OCIL content generation fixup
by Jeffrey Blank 23 Aug '13

23 Aug '13

This patch takes the "conditional clause" attribute from the contrived "ocil-transitional" check system and uses it to create a question for users. This should allow the scap-security-guide content to act as a bridge between the robotic and special "this is a finding" phrasing found in DISA STIGs, and OCIL designed for human interaction. We can generate both. Jeffrey Blank (1): added interrogatory phrase to OCIL questions RHEL6/transforms/xccdf-create-ocil.xslt | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-)

2 2

[PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing
by Maura Dailey 22 Aug '13

22 Aug '13

Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- ...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++--------- 1 files changed, 15 insertions(+), 13 deletions(-) diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml index a5e6334..e0abd50 100644 --- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml +++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml @@ -1,36 +1,38 @@ <def-group> - <definition class="compliance" id="mount_option_nodev_nonroot_local_partitions" version="1"> + <definition class="compliance" + id="mount_option_nodev_nonroot_local_partitions" version="1"> <metadata> <title>Add nodev Option to Non-Root Local Partitions</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The nodev mount option prevents files from being - interpreted as character or block devices. Legitimate character and block - devices should exist in the /dev directory on the root partition or - within chroot jails built for system services. All other locations should not - allow character and block devices.</description> + <description>The nodev mount option prevents files from being interpreted + as character or block devices. Legitimate character and block devices + should exist in the /dev directory on the root partition or within chroot + jails built for system services. All other locations should not allow + character and block devices.</description> + <reference source="MED" ref_id="20130821" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="nodev on local filesystems" test_ref="test_nodev_nonroot_local_partitions" /> + <criterion comment="nodev on local filesystems" + test_ref="test_nodev_nonroot_local_partitions" negate="true" /> </criteria> </definition> - - <linux:partition_test check="all" check_existence="all_exist" id="test_nodev_nonroot_local_partitions" version="1" comment="nodev on local filesystems"> + <linux:partition_test check="all" check_existence="all_exist" + id="test_nodev_nonroot_local_partitions" version="1" + comment="nodev on local filesystems"> <linux:object object_ref="object_non_root_partitions" /> <linux:state state_ref="state_local_nodev" /> </linux:partition_test> - <linux:partition_object id="object_non_root_partitions" version="1">  <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point> <filter action="include">state_local_nodev</filter> </linux:partition_object> - <linux:partition_state id="state_local_nodev" version="1">  <linux:device operation="pattern match">^/dev/.*$</linux:device> - <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options> + <linux:mount_options datatype="string" entity_check="all" + operation="not equal">nodev</linux:mount_options> </linux:partition_state> - </def-group> -- 1.7.1

4 8

SSG line item references
by Robert Sanders 22 Aug '13

22 Aug '13

Quick question - I'm looking at the SSG content files and trying to determine the 'line item' number for a particular check. The DISA STIG content is layed out so that the line item information (i.e., rhel-06-0000001) is inline with a particular check. The SSG content doesn't appear to have this inline, and I suspect that the line items are being generated programmatically via the oscap command but I haven't drilled down to see what oscap is actually doing. Considering that the SSG is the upstream document for the RHEL6 STIG - is DISA responsible for remapping the SSG items to the STIG items, or will DISA adopt the way that the SSG is generating line items? If the latter, could this result in line item x.z.y from version A be a *very* different best than line item x.y.z from version B? -Rob

4 8

[PATCH] Another big batch of updates
by Maura Dailey 22 Aug '13

22 Aug '13

I went through a whole bunch more checks, tested them, tweaked their regex as necessary, and corrected comment fields. I also ran them through tidy and fixed them up a little. A few checks had "dead states" which were never referenced in a test field, so I deleted those. I also added rsyslog to the template file for installed packages, since it was apparently missing, even though the compiled check had been added in a previous commit. - Maura Dailey Maura Dailey (1): Another batch of tested checks. Includes some checks that had their comments expanded or were renamed from random values. RHEL6/input/checks/banner_etc_issue.xml | 1 + .../checks/dovecot_disable_plaintext_auth.xml | 10 ++++--- RHEL6/input/checks/dovecot_enable_ssl.xml | 12 ++++---- .../input/checks/logwatch_configured_hostlimit.xml | 8 ++--- .../checks/logwatch_configured_splithosts.xml | 10 +++---- RHEL6/input/checks/network_sniffer_disabled.xml | 1 + RHEL6/input/checks/ntp_remote_server.xml | 27 +++++++++---------- .../checks/postfix_network_listening_disabled.xml | 26 +++++++++--------- RHEL6/input/checks/postfix_server_banner.xml | 17 ++++-------- RHEL6/input/checks/restrict_serial_port_logins.xml | 7 +++-- .../checks/securetty_root_login_console_only.xml | 5 ++- RHEL6/input/checks/selinux_mode.xml | 9 ++++-- RHEL6/input/checks/selinux_policytype.xml | 18 +++++-------- .../set_password_hashing_algorithm_libuserconf.xml | 3 +- .../set_password_hashing_algorithm_logindefs.xml | 5 ++- RHEL6/input/checks/singleuser_password.xml | 19 ++++++-------- RHEL6/input/checks/smb_client_signing_smb_conf.xml | 23 +++++++++-------- .../sysconfig_networking_bootproto_ifcfg.xml | 20 +++++++------- RHEL6/input/checks/sysconfig_nozeroconf_yes.xml | 22 +++++++--------- .../input/checks/system_info_architecture_x86.xml | 22 ++++++++-------- .../checks/system_info_architecture_x86_64.xml | 22 ++++++++-------- .../input/checks/templates/packages_installed.csv | 3 +- RHEL6/input/checks/tftpd_uses_secure_mode.xml | 3 +- RHEL6/input/checks/xwindows_runlevel_setting.xml | 3 +- 24 files changed, 146 insertions(+), 150 deletions(-)

3 3

False Pass: PASS_MIN_DAYS /etc/login.defs
by Stuart Green 21 Aug '13

21 Aug '13

Just happened across this while I was modding an incorrect parameter. Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs seems to pass regardless of the number being higher than 1. Mine was set to 7 and was passing, so I set it to 100 for another run through and it still passed. Note: I'm not sure if these login.defs are actually necessary, well not in a PAM environment. When PAM's handling the restrictions login.defs is not involved. Citation: http://www.linuxmanpages.com/man5/login.defs.5.php (bug section) Cheers, Stu

4 4

intermittent failure of oval check, how to debug?
by Brian Millett 21 Aug '13

21 Aug '13

Ok, how do I go about debugging this: [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml Definition oval:scap-security-guide.testing:def:100: false The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is failing, but sometimes it does not. When I run an evaluation with the stig-rhel policy, I get OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:584] No definition with ID: oval:ssg:def:509 in result model. [oval_agent.c:182] -- Brian Millett "We are not through with the Centauri yet." -- [ G'Kar (to Jha'dur), "Deathwalker"]

3 5

Generalising SSG ...
by Trey Henefield 20 Aug '13

20 Aug '13

Just food for thought. Has there been any desire to make changes to SSG to accommodate building other (non-rhel6) SSGs? I am getting up to speed on its processes, and for practice and actual need, was thinking of creating an SSG for Firefox and Java, and potentially webmin and apache. However, I noticed rhel6 is embedded all throughout. I have noticed that most of the processes in place can be repurposed. With some changes to the makefile and a repurposed input folder, should this be possible? I was just hoping to get some further insight before going down this long path. Thanks in advance! Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2013-08-20 11:36:43 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

3 3

Re: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED)
by Beavers, Randall D. CTR (US) 20 Aug '13

20 Aug '13

Classification: UNCLASSIFIED Caveats: NONE Willy Santos & Shawn Wells, I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists. (searching CCI information online). I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs to DISA STIGS for my program. Any help would be appreciated. Seems the DISA IASE website and the VMS site doesn't jive. Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that would help me? In excel format? In xml format? Please advise. Randy Beavers, GSLC, CISSP Information Assurance Engineer Joint Battle Command-Platform 6000-C Technology Drive Huntsville, AL 35805 256-842-5426 (work) 256-289-6054 (cell) 256-876-2576 (fax) randall.d.beavers.ctr(a)mail.mil randall.d.beavers.ctr(a)mail.smil.mil Classification: UNCLASSIFIED Caveats: NONE

3 2

Very basic question..
by Stuart Green 20 Aug '13

20 Aug '13

Hi Folks, I just noticed that in my /usr/share/xml/scap/ssg/content/ folder the files are time stamped Jul 5 19:03 but the files in here are from the 13th of July. http://people.redhat.com/swells/scap-security-guide/RHEL6/dist/content/ There's no updates available in yum, so is it just a matter these files have not been pushed to repo yet? Cheers, Stu

2 2

[PATCH 0/2] updates to transforms to show OVAL testing
by Jeffrey Blank 20 Aug '13

20 Aug '13

This update to the table transform will show (with a thick green line) when an OVAL check has been tested for each Rule. This can probably get far more complete-looking if the templated checks are tested. (Did we ever fix the OVAL check for system services, such that only runlevel 2-5 were disabled?) It also shows the Rule ID for each Rule now, which is the stable identifier for each Rule. Jeffrey Blank (2): made CSS adjustments to make <pre> wrap improved table to indicate when OVAL checks have been tested RHEL6/transforms/table-style.xslt | 5 ++++ RHEL6/transforms/xccdf2table-profileccirefs.xslt | 27 +++++++++++++++++----- 2 files changed, 26 insertions(+), 6 deletions(-)

2 4

[PATCH] Original check assumed that sha512 would always be the first option
by Maura Dailey 20 Aug '13

20 Aug '13

Small edit to ensure that sha512 can be set anywhere in the list of options in the pam_unix.so line. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- .../set_password_hashing_algorithm_systemauth.xml | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml b/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml index e999d0d..ac86592 100644 --- a/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml +++ b/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> <criterion test_ref="test_pam_unix_sha512" /> @@ -18,7 +19,7 @@ <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="object_pam_unix_sha512" version="1"> <ind:filepath>/etc/pam.d/system-auth</ind:filepath> - <ind:pattern operation="pattern match">^\s*password\s+sufficient\s+pam_unix.so\s+sha512.*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*password[\s]+sufficient[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> -- 1.7.1

2 1

[PATCH] Existing check was screwed up (title was wrong, comments were wrong, etc.) and was easily replaced by a templated check
by Maura Dailey 20 Aug '13

20 Aug '13

I noticed that the name of the check didn't make any sense, delved in deeper, and discovered that the correct check more closely met the templated sysctl checks. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- .../checks/core_dump_suid_progs_limits_conf.xml | 30 -------------------- RHEL6/input/checks/sysctl_fs_suid_dumpable.xml | 28 ++++++++++++++++++ RHEL6/input/checks/templates/sysctl_values.csv | 1 + RHEL6/input/system/permissions/execution.xml | 2 +- 4 files changed, 30 insertions(+), 31 deletions(-) delete mode 100644 RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml create mode 100644 RHEL6/input/checks/sysctl_fs_suid_dumpable.xml diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml deleted file mode 100644 index 066957a..0000000 --- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml +++ /dev/null @@ -1,30 +0,0 @@ -<def-group> - <definition class="compliance" id="core_dump_suid_progs_limits_conf" - version="1"> - <metadata> - <title>Disable Core Dumps for setuid programs</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Core dumps for setuid programs should be - disabled</description> - </metadata> - <criteria> - <criterion comment="Are core dumps for setuid programs disabled?" - test_ref="test_core_dump_suid_progs_limits_conf" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" - id="test_core_dump_suid_progs_limits_conf" version="2"> - <ind:object object_ref="object_core_dump_suid_progs_limits_conf" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf" - version="1"> - <ind:path>/etc/security</ind:path> - <ind:filename>limits.conf</ind:filename> - <ind:pattern operation="pattern match"> - ^fs.suid_dumpable\s+=\s+1$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml new file mode 100644 index 0000000..e358366 --- /dev/null +++ b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml @@ -0,0 +1,28 @@ +<def-group> +  + <definition class="compliance" id="sysctl_fs_suid_dumpable" version="1"> + <metadata> + <title>Kernel Runtime Parameter "fs.suid_dumpable" Check</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The kernel runtime parameter "fs.suid_dumpable" should be set to "0".</description> + </metadata> + <criteria> + <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="test_sysctl_fs_suid_dumpable" /> + </criteria> + </definition> + + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="test_sysctl_fs_suid_dumpable" version="1"> + <unix:object object_ref="object_sysctl_fs_suid_dumpable" /> + <unix:state state_ref="state_sysctl_fs_suid_dumpable" /> + </unix:sysctl_test> + + <unix:sysctl_object id="object_sysctl_fs_suid_dumpable" version="1"> + <unix:name>fs.suid_dumpable</unix:name> + </unix:sysctl_object> + + <unix:sysctl_state id="state_sysctl_fs_suid_dumpable" version="1"> + <unix:value datatype="int" operation="equals">0</unix:value> + </unix:sysctl_state> +</def-group> diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv index ae38b46..b318c47 100644 --- a/RHEL6/input/checks/templates/sysctl_values.csv +++ b/RHEL6/input/checks/templates/sysctl_values.csv @@ -17,3 +17,4 @@ net.ipv4.ip_forward,0 net.ipv4.tcp_syncookies,1 net.ipv6.conf.default.accept_redirects,0 net.ipv6.conf.default.accept_ra,0 +fs.suid_dumpable,0 diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml index d742d60..86d2ea7 100644 --- a/RHEL6/input/system/permissions/execution.xml +++ b/RHEL6/input/system/permissions/execution.xml @@ -101,7 +101,7 @@ user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.</rationale> <ident cce="27044-7" /> -<oval id="core_dump_suid_progs_limits_conf" /> +<oval id="sysctl_fs_suid_dumpable" /> <ref nist="SI-11" /> </Rule> </Group> -- 1.7.1

2 1

Rsyslog Permission Checks
by Maura Dailey 20 Aug '13

20 Aug '13

How do you think we should handle file owner and group permission checks on rsyslog files? Should we look for a predetermined list of files (trying to search for *.log is insufficient, since at the very least, /var/log/messages, /var/log/secure, and /var/log/maillog would get passed over)? Or should we try ninja regex to parse rsyslog.conf? - Maura Dailey

7 12

[PATCH] Guide refers to :omrelp: as a valid remote logging option, so I've updated the check to accept that format as well
by Maura Dailey 19 Aug '13

19 Aug '13

Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/rsyslog_remote_loghost.xml | 20 +++++++------------- 1 files changed, 7 insertions(+), 13 deletions(-) diff --git a/RHEL6/input/checks/rsyslog_remote_loghost.xml b/RHEL6/input/checks/rsyslog_remote_loghost.xml index b3ab6a8..81441eb 100644 --- a/RHEL6/input/checks/rsyslog_remote_loghost.xml +++ b/RHEL6/input/checks/rsyslog_remote_loghost.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="rsyslog_remote_loghost" version="1"> + <definition class="compliance" id="rsyslog_remote_loghost" version="1"> <metadata> <title>Send Logs to a Remote Loghost</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Syslog logs should be sent to a remote - loghost</description> + <description>Syslog logs should be sent to a remote loghost</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Conditions are satisfied" - test_ref="test_rsyslog_remote_loghost" /> + <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_remote_loghost" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file" - id="test_rsyslog_remote_loghost" version="1"> + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file" id="test_rsyslog_remote_loghost" version="1"> <ind:object object_ref="object_rsyslog_remote_loghost" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_rsyslog_remote_loghost" - version="1"> + <ind:textfilecontent54_object id="object_rsyslog_remote_loghost" version="1"> <ind:path>/etc</ind:path> <ind:filename>rsyslog.conf</ind:filename> - <ind:pattern operation="pattern match">^\*\.\*[\s]+@</ind:pattern> + <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> -- 1.7.1

2 1

[PATCH] Adding reference tags to show test_attestation for various checks
by Maura Dailey 19 Aug '13

19 Aug '13

I intend to continue to test checks and commit tested results to checks. Here's the current batch I've completed from today and last week. - Maura Dailey Maura Dailey (1): Adding reference tags to show which checks I've tested. Some very slight whitespace corrections were made as well. .../checks/accounts_disable_post_pw_expiration.xml | 1 + .../checks/accounts_maximum_age_login_defs.xml | 1 + .../checks/accounts_minimum_age_login_defs.xml | 3 ++- RHEL6/input/checks/accounts_no_uid_except_zero.xml | 1 + RHEL6/input/checks/accounts_umask_bashrc.xml | 1 + RHEL6/input/checks/accounts_umask_cshrc.xml | 1 + RHEL6/input/checks/accounts_umask_etc_profile.xml | 1 + RHEL6/input/checks/accounts_umask_login_defs.xml | 1 + RHEL6/input/checks/core_dumps_limitsconf.xml | 4 ++-- .../checks/ensure_gpgcheck_never_disabled.xml | 9 ++++----- RHEL6/input/checks/file_owner_etc_group.xml | 1 + RHEL6/input/checks/file_owner_etc_gshadow.xml | 1 + RHEL6/input/checks/file_owner_etc_passwd.xml | 1 + RHEL6/input/checks/file_owner_etc_shadow.xml | 1 + RHEL6/input/checks/no_netrc_files.xml | 1 + RHEL6/input/checks/no_rsh_trust_files.xml | 3 ++- .../checks/yum_gpgcheck_global_activation.xml | 7 ++++--- 17 files changed, 26 insertions(+), 12 deletions(-)

3 3

[PATCH] Making SSH checks uniform and hopefully adding case insensitive matches properly
by Maura Dailey 19 Aug '13

19 Aug '13

There are a few things I did here. The first was to rewrite the regex to use (?i) for case insensitive matching. The second was to make the checks and the language in the comments uniform and run everything through tidy. The third was to test all the checks and add the test_attestation reference to each. - Maura Dailey Maura Dailey (1): Making SSH checks uniform and hopefully adding case insensitive matches properly RHEL6/input/checks/sshd_banner_set.xml | 24 +++++++-------- RHEL6/input/checks/sshd_clientalivecountmax.xml | 32 ++++++++----------- .../input/checks/sshd_hostbasedauthentication.xml | 19 ++++++++---- RHEL6/input/checks/sshd_idle_timeout.xml | 30 ++++++++++-------- RHEL6/input/checks/sshd_no_user_envset.xml | 24 ++++++-------- .../input/checks/sshd_permitemptypasswords_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_permitrootlogin_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_protocol_2.xml | 17 +++++++--- RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 24 +++++++-------- RHEL6/input/checks/sshd_use_approved_ciphers.xml | 28 ++++++++++------- 10 files changed, 126 insertions(+), 120 deletions(-)

2 2

[PATCH] Improbably, the input line for UDP is $UDPServerRun, not $InputUDPServerRun. Also, the check forgot to include the port number, so it always gave a false positive.
by Maura Dailey 19 Aug '13

19 Aug '13

This regex will match on $InputTCPServerRun, $InputRELPServerRun, and $UDPServerRun. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/rsyslog_nolisten.xml | 21 +++++++++------------ 1 files changed, 9 insertions(+), 12 deletions(-) diff --git a/RHEL6/input/checks/rsyslog_nolisten.xml b/RHEL6/input/checks/rsyslog_nolisten.xml index 46cc285..d9376b6 100644 --- a/RHEL6/input/checks/rsyslog_nolisten.xml +++ b/RHEL6/input/checks/rsyslog_nolisten.xml @@ -1,31 +1,28 @@ <def-group> - <definition class="compliance" - id="rsyslog_nolisten" version="1"> + <definition class="compliance" id="rsyslog_nolisten" version="1"> <metadata> - <title>Disable Rsyslogd from Accepting Remote Messages on - Loghosts Only</title> + <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts + Only</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>RSyslogd should reject remote - messages</description> + <description>rsyslogd should reject remote messages</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_nolisten" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" - comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $InputUDPServerRun | $InputRELPServerRun" + <ind:textfilecontent54_test check="all" check_existence="none_exist" + comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun" id="test_rsyslog_nolisten" version="1"> <ind:object object_ref="object_rsyslog_nolisten" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_rsyslog_nolisten" - version="1"> + <ind:textfilecontent54_object id="object_rsyslog_nolisten" version="1"> <ind:path>/etc</ind:path> <ind:filename>rsyslog.conf</ind:filename> - <ind:pattern operation="pattern match">^\$Input(?:(TCP)|(UDP)|(RELP))ServerRun\s*$</ind:pattern> + <ind:pattern operation="pattern match">^\$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> -- 1.7.1

1 0

Question on 'Verify File Hashes with RPM', and results in general
by Robert Sanders 15 Aug '13

15 Aug '13

Ok, I'm stumped now. I'm using the latest SSG content (downloaded today) on a RHEL6.4 64bit VM. On this box I loaded the latest SPAWAR release candidate as well as Security Blanket. Ran the scan, and this module passed, but it failed in Security Blanket. Poking through the SSG content I ran the command as indicated in the description manually and it *failed*. So looking in the check-content section for this rule I see 3 entries - one for the CCE reference one for a oval definition one for an ocil-transitional If I drill down through the oval definition it *looks* like there's an pattern match for only looking at things with a 'bin' as part of the path, which would skip the things that appeared to bork. Looked at the ocil-transitional definition I see a command using grep like I've *never* seen before (note the && was escaped in the xccdf file) description command -> rpm -Va | grep '^..5' check-content(ocil-trans) command -> rpm -Va | grep '$1 ~ /..5/ && $2 != "c"' So... question 1 - which command is actually being run? I'm assuming the one from the oval, as the ocil one doesn't make any sense to me unless the command is being mangled before execution, or someone snuck something into grep when I wasn't looking... Question 2 - Is there any way to have oscap spit out a log file of the commands/checks actually being run, so see why things may or may not have triggered a fail? Question 3 - If the command being run is actually from the oval, with the pathname pattern match, why doesn't the description detail the same exception? I've had this complaint with the RHEL5 STIG as well where there have been a few line items where the description says one thing and the actual check is doing some extra stuff. -Rob

2 2

Modifing report design
by Antonio Sebastian Salles M. 12 Aug '13

12 Aug '13

Hi all, Somebody knows how can I modify openscap report design? I need to put a logo in front and add contact information, and I cannot see any info in wiki. All info would be nice. Thanks a lot! -- Antonio Salles

2 1

Does aide_periodic_cron_checking have an incorrect fix documented?
by Hayden,Robert 09 Aug '13

09 Aug '13

I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix: ----start quote---- To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check AIDE can be executed periodically through other means; this is merely one example. ---- end quote------ This fix is also documented in the RHEL STIG version 1 release 2. I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box # mail Heirloom Mail version 12.4 7/29/08. Type ? for help. "/var/spool/mail/root": 1 message 1 new >N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron <root@techval15> root /usr/sbin/aide --check" & 1 Message 1: From root(a)techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013 Return-Path: <root(a)techval15.northamerica.cerner.net> Date: Fri, 9 Aug 2013 04:05:01 -0500 From: root(a)techval15.northamerica.cerner.net (Cron Daemon) To: root(a)techval15.northamerica.cerner.net Subject: Cron <root@techval15> root /usr/sbin/aide --check Content-Type: text/plain; charset=ISO-8859-1 Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Status: R /bin/sh: root: command not found Am I missing something? Thanks Robert Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden(a)cerner.com<mailto:rhayden@cerner.com> | www.cerner.com CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.

3 3

[PATCH] Check needs to be reversed. As is, if you specified 10 as the maximum number of concurrent logins, it would allow 20.
by Maura Dailey 07 Aug '13

07 Aug '13

Self explanatory. I also added a test_attestation reference and corrected the comment for the external value. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- .../accounts_max_concurrent_login_sessions.xml | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml index eda8052..cb2e859 100644 --- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml +++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml @@ -7,6 +7,7 @@ </affected> <description>The maximum number of concurrent login sessions per user should meet minimum requirements.</description> + <reference source="MED" ref_id="20130807" ref_url="test_attestation" /> </metadata> <criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf"> <criterion test_ref="test_maxlogins" /> @@ -25,9 +26,9 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_maxlogins" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" /> + <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" /> </ind:textfilecontent54_state> - <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" /> + <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="max_concurrent_login_sessions_value" version="1" /> </def-group> -- 1.7.1

2 1

Using OR operator for runlevel criteria
by Chen, Wei 07 Aug '13

07 Aug '13

Hello, Can someone explain the logic behind using the OR operator for runlevel test criteria? If runlevel 1 is set to true and runlevel 3 set to false, wouldn't the below criteria still return true? <criteria operator="OR" comment="service iptables is configured to start"> <criterion comment="iptables runlevel 0" test_ref="oval:ssg:tst:427"/> <criterion comment="iptables runlevel 1" test_ref="oval:ssg:tst:428"/> <criterion comment="iptables runlevel 2" test_ref="oval:ssg:tst:429"/> <criterion comment="iptables runlevel 3" test_ref="oval:ssg:tst:430"/> <criterion comment="iptables runlevel 4" test_ref="oval:ssg:tst:431"/> <criterion comment="iptables runlevel 5" test_ref="oval:ssg:tst:432"/> <criterion comment="iptables runlevel 6" test_ref="oval:ssg:tst:433"/> </criteria> Thanks, Wei Chen DS/SI/CS Chenw3(a)state.gov<mailto:Chenw3@state.gov> 571-345-2567

1 0

Suggestion on the 'Ensure All Files Are Owned...' items
by Robert Sanders 06 Aug '13

06 Aug '13

I was wondering why the tests for 'Ensure all Files Are Owned by a User' and 'Ensure all Files are Owned by a Group' kept on failing. Drilling down it looks like the underlying find command being used is along the lines of : find PARTITION -xdev -nouser -print When I run this command manually I've had complaints that find can't read files in /proc. Looking at the man page suggests this can be avoided by adding the '-ignore_readdir_race' option before the -xdev option. This change may need to be added for both SSG items 2.2.3.e and 2.2.3.f -Rob

7 22

[PATCH] Small patch to replace autogenerated ids with human readable ids
by Maura Dailey 06 Aug '13

06 Aug '13

I think some of these ids were leftover from the USGCB for RHEL 5. In any case, I've replaced them with human readable ones, which should make them easier to read for future editors. - Maura Dailey Maura Dailey (1): Small patch to replace autogenerated test, state, and object ids with human readable ones .../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)

2 5

MLS question from a new user
by Kordell, Luke T 06 Aug '13

06 Aug '13

Hello. I am new to SCAP and trying to determine how to modify a rule. I have downloaded the source code and have located an OVAL test I would like to change to suite my purposes. The file is selinux_policytype.xml. I have chosen this file because I am trying to make the SELinux enforcement rule pass for an MLS enforcement rather than targeted. My questions are as follows: The OVAL document references an object, test, state and variable but does not define them (as far as I can tell) within the OVAL file. Rather, it appears to be calling them from somewhere else. In particular I am referring to these lines. 13 test_ref = "test_selinux_policy" 21 object object_ref = obj_selinux_policy 22 state state_ref = state_selinux_policy Finally I think this is the variable I am going to need to change. var_ref = var_selinux_policy_name My question are: 1) where are these objects defined, and if it is possible how can I modify them? 2) Other than the OVAL website are there any other resources anyone can recommend that can help me learn this material? Luke

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2013