January 2014 - scap-security-guide - Fedora mailing-lists

Problem with Setting faillock Account Lock Time
by Spice, Adam M CTR USARMY ARL (US) 14 May '14

14 May '14

All, My systems failed the scans for CCE-26844-1 (Set Deny For Failed Password Attempts), CCE-27110-6 (Set Lockout Time For Failed Password Attempts) and CCE-27215-3 (Set Interval For Counting Failed Password Attempts). I was able to resolve the first and last by following the fix text, but CCE-27110-6 remains a problem. The fix text instructs me to add the following lines: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900 auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900 ... directly beneath the following line in /etc/pam.d/system-auth: auth required pam_env.so However, following these instructions results in a system whose GDM prompts me for a username, but never gets to the password. The logs show "gkr-pam: no password is available for user." I performed many Google searches, not really finding much that helped me other than an old message in this group: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-February/0 02601.html Unfortunately, I didn't see a resolution. The person who started that thread opened a ticket, but it doesn't look like it was addressed: https://fedorahosted.org/scap-security-guide/ticket/255 He also referenced a Red Hat Solution that provides instructions on enabling faillock; following this, I was able to restore my system to functionality. I could login; if I failed my attempt three times, I could no longer login; pam_tally2 no longer reported failed logins, but faillock did. I haven't yet spent the week to determine whether or not the unlock_time parameter is being applied (if you know of a way to report remaining time until an account unlocks, that would help). Is there any guidance available regarding passing this scan without disabling my system? Thank you! -- Adam Spice Contractor, STG Unix support, Army Research Labs

4 6

FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The updates validated with OSCAP, but the verify-references.py script spat it up. It looks good to me, otherwise. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

4 9

Rule ensure_redhat_gpgkey_installed
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The OVAL check for the Red Hat release and auxiliary key packages is passing when the packages are not installed. The check_existence and check attributes on the associated rpminfo_test elements are set to "any_exist" and "only one", respectively. Shouldn't the check_existence attribute be "at_least_one_exists" for these tests instead? Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 1

[PATCH] correct several STIG/SSG mappings
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

These are corrections to several mappings in stig_overlay.xml. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/input/auxiliary/stig_overlay.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 9b613eb..8e89373 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -66,7 +66,7 @@ <overlay owner="disastig" ruleid="no_hashes_outside_shadow" ownerid="RHEL-06-000031" disa="366" severity="medium"> <title>The /etc/passwd file must not contain password hashes.</title> </overlay> - <overlay owner="disastig" ruleid="no_uidzero_except_root" ownerid="RHEL-06-000032" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="RHEL-06-000032" disa="366" severity="medium"> <title>The root account must be the only account having a UID of 0.</title> </overlay> <overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium"> @@ -234,7 +234,7 @@ <overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="RHEL-06-000098" disa="366" severity="medium"> <title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title> </overlay> - <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_default_accept_redirects_value" ownerid="RHEL-06-000099" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="sysctl_ipv6_default_accept_redirects" ownerid="RHEL-06-000099" disa="366" severity="medium"> <title>The system must ignore ICMPv6 redirects by default.</title> </overlay> <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium"> @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -747,16 +747,16 @@ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="RHEL-06-000341" disa="366" severity="high"> <title>The snmpd service must not use a default password.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> <title>The system default umask for the bash shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> <title>The system default umask for the csh shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_etc_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> <title>The system default umask in /etc/profile must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_logindefs" ownerid="RHEL-06-000345" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_login_defs" ownerid="RHEL-06-000345" disa="366" severity="low"> <title>The system default umask in /etc/login.defs must be 077.</title> </overlay> <overlay owner="disastig" ruleid="umask_for_daemons" ownerid="RHEL-06-000346" disa="366" severity="low"> -- 1.7.1

3 6

[PATCH] update disable_user_list check and fix and add OVAL
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

This patch includes OVAL for the disable_user_list Rule. It also updates the check and fix to look at the same thing. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 2

Cron and faillog/lastlog
by Kayse, Josh 16 Feb '14

16 Feb '14

Per the RHEL6 Guide I have configured my system to utilize faillock and lastlog. Now I have found that cron no longer works. I have tracked it down to being an SELinux problem. crond_t is trying to read/write lastlog_t and faillog_t files. Has anyone else run in to this problem or have recommendations? My findings so far have shown that cron requires auth, account, and session from password-auth. Inside password-auth we have the appropriate faillock/lastlog lines in auth/account/session. Previously we have put the faillock/lastlog lines in the individual services that users can use to access the system (gdm, sshd, login, etc) but this was not compliant with the SSG/STIG. Should we go back to placing these lines in the individual services or grant the permission to crond_t? Could this be because we disable the unconfined domain? Thanks, -josh -- 404.407.6630

3 7

System UIDs/GIDs in RHEL7 (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 10 Feb '14

10 Feb '14

Classification: UNCLASSIFIED Caveats: NONE https://lists.fedoraproject.org/pipermail/devel/2011-May/151663.html Will UID_MIN and GID_MIN default to 1000 in RHEL7 as well? I have not had (and do not have, sadly) time to check out the RHEL7 beta, but a quick search of several of the documentation pages didn't mention this. I would imagine so, given things like: https://bugzilla.redhat.com/show_bug.cgi?id=907312 If so, should we expect the STIG for RHEL7 to reflect this, counting everything 1000 and below as a "system" account/group for relevant rules? Just trying to get a head start on potentially necessary UID/GID changes. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

5 6

Re: [PATCH 0/2] Pushing SCAP workbook
by Eric Christensen 30 Jan '14

30 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Mon, Jan 27, 2014 at 11:06:54PM -0500, Shawn Wells wrote: > From 4b23a6a448a97a9edc67da602a298a97857e606d Mon Sep 17 00:00:00 2001 > From: Shawn Wells <shawn(a)redhat.com> > Date: Mon, 27 Jan 2014 23:03:13 -0500 > Subject: [PATCH 0/2] Pushing SCAP workbook > > Pushing the SCAP workbook ODT into the source tree. Long-term goal to convert to DocBook, however want to get the content into the community in support of upcoming trainings. I thought I already had it up there but I might have just seen it there from when you pushed it. I mostly marked up chapter five yesterday and committed that to the repo. Still need to markup chapter four and then go back to all the spots where I was lazy and didn't want to do the annoying markups. Robin made lots of notes on his [physical] copy of the guide and so I'm hoping to create patches from that to start a discussion here on potential changes to the document. - -- Eric - -------------------------------------------------- Eric "Sparks" Christensen Red Hat, Inc - Product Security Team sparks(a)redhat.com - sparks(a)fedoraproject.org 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJS6SlBAAoJEB/kgVGp2CYviwUL/1DxHrA+syC1JnIEg+UT1Wl7 SPFhS62JvWhf6u8KK+a/1LXDyzewmQjnvekjlPT0gK/ftb+bAbsG77WNf78MTLI6 gkVobdOUevTk6RH7K1lDK46aZN+EBBsHN7QF3FNxkrSxgEhW3a9bF1yEIKxVOLzQ e3woTzwGy9CW5B3DagwfNzNH225EMJfaEiLbm2ukBLzw8YeaUqGZtcpxNhUq6rrm HhWxWPfprnGOejLg94qDcyA6fSW4KgwWZrk39PYiP0HYTElIJDpz6LTYvOFLGDZu b/FZmMginvcrYnEGZdgF55jMoTArflpG3GvVdmGO0s6bMYxbg9zQpCqNSSZBd8Ed +jQNa0JLngSKzNSf6H3LniAvSn17aioWljepckB4Uqe1dQmnEiYx0ByzqDYd7Mkn KkJsg31/G54H33tVnaYb/uCwHnEooC3CaYScai8Fj1ffUuu5FdU2n1GY31kY9Zil BCcvpEWffLpp2pgJaslNvWVVT3ylOIkJxrLJbQHstA== =+roG -----END PGP SIGNATURE-----

2 1

git push error: no DAV locking support
by Mercer, Rodney 30 Jan '14

30 Jan '14

List Members: Can anyone give advise on overcoming this "git push" problem? [root@wahoo scap-security-guide]# git push -v Pushing to https://git.fedorahosted.org/git/scap-security-guide.git error: no DAV locking support on https://git.fedorahosted.org/git/scap-security-guide.git/ fatal: git-http-push failed Here is my .git/config [root@wahoo scap-security-guide]# vim .git/config [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] fetch = +refs/heads/*:refs/remotes/origin/* url = https://git.fedorahosted.org/git/scap-security-guide.git [branch "master"] remote = origin merge = refs/heads/master TIA, Rodney.

3 6

[PATCH] Resubmitting Modified no_files_unowned_by_user.xml
by Mercer, Rodney 28 Jan '14

28 Jan '14

Shawn, Due to the change in directory structure, RHEL6 vs. RHEL/{6,7}, I was not able to “git push” this modification into the project, so I performed another "git commit" after a fresh "git clone" I need a "re-ack" please and I will promptly "git push" See https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-January/0… for the original ack. Rodney. ------- Based on comments and recommendations from the following thread, I've submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0036… This only checks /etc/passwd and not any other authorization databases. 8<==================== >From a03058b43bd3aec3c8c02c34911f7d5751b7b796 Mon Sep 17 00:00:00 2001 From: Rodney Mercer <rmercer(a)harris.com> Date: Tue, 28 Jan 2014 15:01:58 +0000 Subject: [PATCH] modified completely broken no_files_unowned_by_user.xml to properly check all files on the system to make sure that they are owned by a user that resides in /etc/passwd. --- RHEL/6/input/checks/no_files_unowned_by_user.xml | 51 ++++++++++++---------- 1 files changed, 28 insertions(+), 23 deletions(-) diff --git a/RHEL/6/input/checks/no_files_unowned_by_user.xml b/RHEL/6/input/checks/no_files_unowned_by_user.xml index a73183a..f3f1276 100644 --- a/RHEL/6/input/checks/no_files_unowned_by_user.xml +++ b/RHEL/6/input/checks/no_files_unowned_by_user.xml @@ -1,38 +1,43 @@ <def-group> - <definition class="compliance" - id="no_files_unowned_by_user" version="1"> + <definition class="compliance" id="no_files_unowned_by_user" version="1"> <metadata> <title>Find files unowned by a user</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - user</description> + <description>All files should be owned by a user</description> + <reference source="rmercer" ref_id="20131218" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a user" - negate="true" - test_ref="test_20050" /> + <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no user owner" - id="test_20050" version="1"> - <notes> - <note>This will enumerate all files on local - partitions</note> - </notes> - <unix:object object_ref="obj_20022" /> - <unix:state state_ref="state_20050" /> - </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20050" version="1"> - <unix:user_id datatype="int">0</unix:user_id> + + <unix:file_state id="file_permissions_unowned_userid_list_match" version="1"> + <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" /> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20022" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + + <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1"> + <object_component item_field="subexpression" object_ref="file_permissions_unowned_userid_list_object" /> + </local_variable> + + <ind:textfilecontent54_object id="file_permissions_unowned_userid_list_object" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern> + <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1"> + <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> + <filter action="exclude">file_permissions_unowned_userid_list_match</filter> </unix:file_object> + + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + check="all" check_existence="none_exist" comment="Check user ids on all files on the system" + id="no_files_unowned_by_user_test" version="1"> + <unix:object object_ref="file_permissions_unowned_object" /> + </unix:file_test> </def-group> + -- 1.7.1

2 1

[PATCH 2/2] Updated SCAP Workshop
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 0/2] Pushing SCAP workbook
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 01/10] Added sshd_set_idle_timeout to shared/ + RHEL7
by Shawn Wells 27 Jan '14

27 Jan '14

1 1

[PATCH 10/10] Moved sshd_allow_only_protocol2 to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 09/10] Moved sshd_use_approved_ciphers to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 08/10] Moved sshd_do_not_permit_user_env to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 07/10] Moved sshd_enable_warning_banner to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 06/10] Moved sshd_disable_empty_passwords to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 05/10] Moved sshd_disable_root_login to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 04/10] Added disable_host_auth to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 03/10] Moved sshd_disable_rhosts to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

[PATCH 02/10] Moved sshd_set_keepalive to shared/
by Shawn Wells 27 Jan '14

27 Jan '14

1 0

Anyone going to Red Hat Summit?
by Shawn Wells 24 Jan '14

24 Jan '14

Red Hat Summit is this coming April [1] and there's a number of security talks planned. One about SSG, "Applied SCAP: Automating security compliance & remediation" was accepted [2] :) Summit passes increased from $995 to $1,495 this week and future increases planned [3]. If anyone from the SSG community would like to attend summit, contact me */_off list_/* and we'll be able to get you registered with the original 'super saver' price. Applies to anyone in the community (note that govvies can register @ $995 at any time by default, so this largely helps out system integrators and commercial guys). No, I don't get secret commissions on this or anything.... we just want to enable as much of the SSG community to attend as possible! Again, contact me /_*off list*_/. [1] http://www.redhat.com/summit/ [2] http://www.redhat.com/summit/sessions/index.html#441 [3] https://redhat.g2planet.com/summit2014/register

1 0

Remaining false positives
by Andrew Gilmore 22 Jan '14

22 Jan '14

I did a fresh git pull on Monday, and ran the stig-rhel6-server-upstream scan. The set of false positives has shrunk, but is still not zero. 1) mountopt_noexec_on_removable_partitions exits with error, when there are no removable partitions configured in fstab 2) file_ownership_library_dirs complains about an /usr/libexec suid abrt file 3) no_files_unowned_by_* are still broken and looking for any files in / 4) enable_execshield and sysctl_kernel_randomize_va_space are failing, although sysctl shows correct results 5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev directories 6) enable_gdm_login_banner didn't get the gconf mandatory check fixed, although all the rest did (YAY!) 7) sysctl_ipv6_default_accept_redirects and service_ip6tables_enabled fail when ipv6 has been disabled via modprobe.d entries 8) install_openswan is obsoleted by libreswan 9) audit_file_access does not check for open_by_handle_at, and fails when the audit rules lines do not contain exactly the content specified. I was very glad to see almost all of the sysctl and gconf false positives fixed! Andrew Gilmore

3 5

Self Introduction
by Graham Williamson 22 Jan '14

22 Jan '14

Hi everyone, My name is Graham (Willo) Williamson and I'm an employee of Northrop Grumman Australia. I'm currently being sub contracted back to very familiar ground, the Australian DoD. I'm one of those lucky people who are working in this latest cyber craze (like that'll last). :) I was in the Royal Australian Air Force for about 14 years and got out to start "earning the big bucks" back in Mar 2011. For basically, the last 6 and a bit years of my time in the Air Force, I was doing CND and some IA on various systems. I originally self taught myself Linux on Fedora Core 2 and one of those big yellow Wiley 'Bible' series books and haven't looked back. Been a fan ever since. I'm looking forward to getting involved and I am willing and able to contribute. Like a couple of the others on this list, git is definitely not my strong suit, but I'm using it daily at the moment and becoming more at one with the force with every passing day. Anyway, I've already joined the git group and Shawn's already hooked me up and approved my membership, so I'm very keen to crack on and get amongst it. Cheers, Willo -- Graham Williamson

6 8

fix CCE-27032-2 no_files_unowned_by_user.xml
by Mercer, Rodney 22 Jan '14

22 Jan '14

Based on comments and recommendations from the following thread, I've submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0036… This only checks /etc/passwd and not any other authorization databases. 8<==================== >From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001 From: Rodney Mercer <rmercer(a)harris.com> Date: Wed, 18 Dec 2013 15:01:25 +0000 Subject: [PATCH] Modified no_files_unowned_by_user.xml modified completely broken no_files_unowned_by_user.xml to properly check all files on the system to make sure that they are owned by a user that resides in /etc/passwd. --- RHEL6/input/checks/no_files_unowned_by_user.xml | 51 ++++++++++++---------- 1 files changed, 28 insertions(+), 23 deletions(-) diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml b/RHEL6/input/checks/no_files_unowned_by_user.xml index a73183a..f3f1276 100644 --- a/RHEL6/input/checks/no_files_unowned_by_user.xml +++ b/RHEL6/input/checks/no_files_unowned_by_user.xml @@ -1,38 +1,43 @@ <def-group> - <definition class="compliance" - id="no_files_unowned_by_user" version="1"> + <definition class="compliance" id="no_files_unowned_by_user" version="1"> <metadata> <title>Find files unowned by a user</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - user</description> + <description>All files should be owned by a user</description> + <reference source="rmercer" ref_id="20131218" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a user" - negate="true" - test_ref="test_20050" /> + <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no user owner" - id="test_20050" version="1"> - <notes> - <note>This will enumerate all files on local - partitions</note> - </notes> - <unix:object object_ref="obj_20022" /> - <unix:state state_ref="state_20050" /> - </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20050" version="1"> - <unix:user_id datatype="int">0</unix:user_id> + + <unix:file_state id="file_permissions_unowned_userid_list_match" version="1"> + <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" /> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20022" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + + <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1"> + <object_component item_field="subexpression" object_ref="file_permissions_unowned_userid_list_object" /> + </local_variable> + + <ind:textfilecontent54_object id="file_permissions_unowned_userid_list_object" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern> + <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1"> + <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> + <filter action="exclude">file_permissions_unowned_userid_list_match</filter> </unix:file_object> + + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + check="all" check_existence="none_exist" comment="Check user ids on all files on the system" + id="no_files_unowned_by_user_test" version="1"> + <unix:object object_ref="file_permissions_unowned_object" /> + </unix:file_test> </def-group> + -- 1.7.1

2 1

OSCAP Anaconda Addon 0.4 available
by Vratislav Podzimek 15 Jan '14

15 Jan '14

A new version of the OSCAP Anaconda Addon integrating the OpenSCAP toolkit with the Anaconda installer is now available for testing. Links, checksums and documentation are available at project's main page: https://fedorahosted.org/oscap-anaconda-addon/ [new in version 0.4] * fixing unreported issues revealed during testing * UX improvements (http://vpodzime.fedorapeople.org/oaa-0.4-changes.webm) * bugs rhbz#1050913, rhbz#1049989, rhbz#1032846 * support for XCCDF tailoring * checking session validity also when using XCCDF benchmark [plans for 0.5] * automatic detection of scap-security-guide if it is available in the compose * support for data stream + tailoring in an archive/RPM * content integrity checking (probably sha256sum as something to start with) -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

1 0

XCCDF and OVAL Editor
by joescap＠mm.st 13 Jan '14

13 Jan '14

Can any one recommend a XCCDF/OVAL editor? I'm just looking for a GUI that us relatively easy to get running and can modify a few of the checks in the content to conform to our organizations policy (password failed attempts for example). I've seen a few, but would like some recommendations. Thanks

3 2

Red Hat and the CentOS Project
by Nunez, Luis K 13 Jan '14

13 Jan '14

I noticed the recent news of Red Hat's intent to partner and collaborate with the CentOS Project and was wondering if SSG will branch on CentOS content? From time to time folks have asked about running SCAP content on the CentOS platform. Could CentOS leverage the shared directory? I am just throwing this out to see the interest level. http://www.redhat.com/about/news/press-archive/2014/1/red-hat-and-centos-joi n-forces Luis Nunez J83B - Industry Collaboration The MITRE Corporation www.mitre.org

4 3

PATCH] [RHEL-7] Silence three 'Double hyphen within comment' RHEL-7 make shorthand2xccdf parser errors
by Jan Lieskovsky 12 Jan '14

12 Jan '14

Running 'make' / 'make shorthand2xccdf' on current RHEL-7 content returns: # make shorthand2xccdf xsltproc -o output/rhel7-shorthand.xml input/guide.xslt input/guide.xml input/services/ssh.xml:389: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:157: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:279: parser error : Double hyphen within comment:  ^ Fix the issues by adding missing enclosing comments (after the change 'make shorthand2xccdf' on RHEL-7 content doesn't issue errors anymore). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

RE: Disable DHCP client (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 09 Jan '14

09 Jan '14

Classification: UNCLASSIFIED Caveats: NONE Anyone want to weigh in on this? At the very least, it would be nice if the check also accepted the value of "none", and possibly the guidance should recommend this setting. -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support -----Original Message----- From: Shaw, Ray V CTR USARMY ARL (US) Sent: Thursday, December 26, 2013 1:27 PM To: 'scap-security-guide(a)lists.fedorahosted.org' Subject: Disable DHCP client (UNCLASSIFIED) Classification: UNCLASSIFIED Caveats: NONE The Disable DHCP client check specifies that the value of BOOTPROTO should be "static". However, this doesn't list "static" as an option: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… Should the check be for "none" instead? [Aside: I thought this might be a carryover from RHEL5, but the RHEL5 deployment guide lists the same options: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… However, all the RHEL5 clients I've checked have had it set to "static", whereas the RHEL6 clients I've checked have it set to "none". Is setting it to anything other than "bootp" or "dhcp" the equivalent of setting it to "none"? Not that I'm arguing the check should go in that direction...just wondering how we got here.] -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE Classification: UNCLASSIFIED Caveats: NONE

2 1

SSG 0.1-14-14 - Apparent content error. Unable to find referenced state
by ssg fthfth 08 Jan '14

08 Jan '14

While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with the usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be another variable referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared. SCC errorlog: [ERROR] Apparent content error. Unable to find referenced state: 'oval:ssg:ste:1545.' OVAL snippits: /bin/grep "oval:ssg:ste:1545" /opt/scc/Resources/Content/ssg-rhel6-oval.xml <linux:state state_ref="oval:ssg:ste:1545"/> <filter action="include">oval:ssg:ste:1545</filter> <linux:partition_state id="oval:ssg:ste:1545" version="1"> $ /bin/grep "1545" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $<null> perhaps related is this integer comparison error "[ERROR] Collected item to be compared is not type 'int': hard for item" when run with the stig-rhel6-server profile selected from the SCAP stream.

1 0

RHEL 6 Benchmark and STIG errors
by Shuhart, Jordan P CIV DISA FSO (US) 06 Jan '14

06 Jan '14

I have been doing a full pass/fail test of the RHEL 6 Benchmark and listed below are some of the issues I have come across. - V-38465 / SV-50265 - The benchmark check returns a passing result, but upon a manual check you can see that /lib/modules/2.6.32-358.el6.x86_64/source and /lib/modules/2.6.32-358.el6.x86_64/build both have group and write permissions. - V-38476 / SV-50276 - Benchmark returns that this check is closed. Manually checking for gpg-pubkey shows that the package is not installed - V-38477 / SV-50277 - This check has been returning a open finding even after the settings have been configured to pass. - V-38499 / SV-50300 - Same as above - V-38501 / SV-50302 - Unable to make this check pass. It appears that the STIG is missing some Fix text that the Benchmark is checking for. - V-38512 / SV-50313 - This check passes but the STIG may need updating as the status does not return what the STIG suggests it should. - V-38519 / SV-50320 - I am unable to get this check to run for some reason. - V-38540 / SV-50341 - STIG may need updated. Benchmark is looking for "-a always,exit... " but the STIG is instructing me to configure it as "-a exit,always..." Check runs properly when I change the order but I am unsure which is the correct way. Jordan Shuhart DISA Field Security Operations IA Standards & Analysis Division (717)267-9078 jordan.p.shuhart.civ(a)mail.mil

1 0

[PATCH] Initial GConf2 fixups
by Maura Dailey 06 Jan '14

06 Jan '14

Several of the GConf checks were using xmlfilecontent, which I liked, so I changed the ones that weren't to use it. However, the checks that had been using xmlfilecontent were improperly pointing to /etc/gconf/gconf.xml.defaults, when we wanted to be peering into gconf.xml.mandatory instead (this is where the gconf2-tool instructions were writing their values). To add support to ensure these checks will no longer report a failure on machines that aren't using X, I added an extended definition check and the appropriate package checks to point to the lowest level package that installs GConf settings, namely the GConf2 package. On servers that don't have this package installed, the check will pass. - Maura Dailey Maura Dailey (1): Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). .../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh

6 19

[PATCH] [Fedora] Drop -compat package, provide openscap-content directly (RH BZ#1040335#c14)
by Jan Lieskovsky 06 Jan '14

06 Jan '14

Happy New Year folks, an issue has been found: https://bugzilla.redhat.com/show_bug.cgi?id=1040335#c14 with scap-security-guide-0.1.4-1.* packages on Fedora. This patch should fix it (tested via local yum repo, pushed to master and have built new packages for all versions of Fedora-18 up to [upcoming] Fedora-21). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] add disable_user_list to STIG/RHEL-06-000527
by Steinke, Leland J Sr CTR DISA DD (US) 03 Jan '14

03 Jan '14

This has been overlooked for a long time. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 2

SSG 0.1-14-14 - [WARN] Value X was not found
by ssg testing 03 Jan '14

03 Jan '14

While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with either the stig-rhel6-server or usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be variables referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared. usgcb-rhel6-server profile: SCC Warning: "[WARN] Value 'umask_user_value' was not found" declaration in XCCDF: # /bin/grep -ir "<value id.* 'umask_user_value" /opt/scc/Resources/ <null> reference in XCCDF: # /bin/grep -ir "value idref.*umask_user_value" /opt/scc/Resources/ /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml: <refine-value idref="umask_user_value" selector="077"/> # /bin/grep "umask_user_value" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml -A13|/bin/grep "oval:ssg:var"|/usr/bin/uniq <check-export export-name="oval:ssg:var:2261" value-id="var_accounts_user_umask"/> reference in OVAL: /bin/grep -i "2261" /opt/scc/Resources/Content/ssg-rhel6-oval.xml <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg:var:2261"/> <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg:var:2261"/> <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg:var:2261"/> <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg:var:2261"/> <external_variable comment="umask for user shell" datatype="string" id="oval:ssg:var:2261" version="1"/> 　 stig-rhel6-server profile: SCC Warning: "[WARN] Value 'sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value' was not found." declaration in XCCDF: # /bin/grep -ir "<value id.*sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" /opt/scc/Resources/ <null> reference in XCCDF: # /bin/grep -ir "value idref.*sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" /opt/scc/Resources/ /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml: <refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/> /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml: <refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/> /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml: <refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/> reference in OVAL: <null> SCC Warning: [WARN] Value 'var_password_min_len' was not found. [WARN] Value 'var_password_max_age' was not found. [WARN] Value 'var_password_min_age' was not found. [WARN] Value 'var_password_warn_age' was not found. $ /bin/grep -E "var_password_[m|w]" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml <refine-value idref="var_password_min_len" selector="6"/> <refine-value idref="var_password_max_age" selector="90"/> <refine-value idref="var_password_min_age" selector="7"/> <refine-value idref="var_password_warn_age" selector="7"/> $ /bin/grep -E "var_password_[m|w]" /opt/scc/Resources/Content/ssg-rhel6-oval.xml $ <null>

2 1

[PATCH] [bugfix] Updated USGCB XCCDF variable umask_user_value
by Shawn Wells 03 Jan '14

03 Jan '14

1 0

SSG 0.1-14-14 - [ERROR] Could not find external variable with id X
by ssg testing 03 Jan '14

03 Jan '14

While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with either the stig-rhel6-server or usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be variables referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared. SCC errorlog snippets: [ERROR] Could not find external variable with id 'oval:ssg:var:2224'. [ERROR] Could not find external variable with id 'oval:ssg:var:2234'. [ERROR] Could not find external variable with id 'oval:ssg:var:2237'. OVAL/XCCDF snippets: ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1436" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2224"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:1440" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:name>vsftpd</linux:name> ./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1439" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2224"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1437" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <value>/usr/sbin/usernetctl</value> ./Content/ssg-rhel6-oval.xml- </constant_variable> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2224" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2244" version="1"/> ./Content/ssg-rhel6-oval.xml- L25:L29 $ /bin/grep "2224" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $<null> 　 ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1713" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2234"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <unix:file_object comment="/etc/passwd" id="oval:ssg:obj:1717" version="1"> ./Content/ssg-rhel6-oval.xml- <unix:path>/etc</unix:path> ./Content/ssg-rhel6-oval.xml- <unix:filename>passwd</unix:filename> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1716" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2234"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1714" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg:var:2257" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg:var:2258" version="1"/> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2234" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib dcredit" datatype="int" id="oval:ssg:var:2259" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2260" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="umask for user shell" datatype="string" id="oval:ssg:var:2261" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib minclass" datatype="int" id="oval:ssg:var:2262" version="1"/> /bin/grep "2234" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $ <null> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:2095" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2237"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:2099" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:name>nfs-utils</linux:name> ./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:2098" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2237"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:2096" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg:var:2267" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg:var:2268" version="1"/> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2237" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib ucredit" datatype="int" id="oval:ssg:var:2269" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg:var:2270" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="external variable for daemon umask" datatype="string" id="oval:ssg:var:2271" version="1"/> ./Content/ssg-rhel6-oval.xml- </variables> $ /bin/grep "2237" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $ <null>

2 1

scan-result question
by Kordell, Luke T 02 Jan '14

02 Jan '14

Hello, I have two questions regarding scan results. 1) When reviewing the .xml and .html output how can I determine the cause of an error if the setting described in the rule is configured properly? Does the scan output human-readable or even OVAL errors? 2) What is the difference between not checked, not applicable, unknown and not selected? I know not selected is when an inherited rule is specifically eliminated from an extended profile. Otherwise I would think it would either pass,fail or error. Luke K

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2014