scap-security-guide January 2014

scap-security-guide@lists.fedorahosted.org

24 participants
40 discussions

fix CCE-27032-2 no_files_unowned_by_user.xml
by Mercer, Rodney 22 Jan '14

22 Jan '14

Based on comments and recommendations from the following thread, I've submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0036… This only checks /etc/passwd and not any other authorization databases. 8<==================== >From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001 From: Rodney Mercer <rmercer(a)harris.com> Date: Wed, 18 Dec 2013 15:01:25 +0000 Subject: [PATCH] Modified no_files_unowned_by_user.xml modified completely broken no_files_unowned_by_user.xml to properly check all files on the system to make sure that they are owned by a user that resides in /etc/passwd. --- RHEL6/input/checks/no_files_unowned_by_user.xml | 51 ++++++++++++---------- 1 files changed, 28 insertions(+), 23 deletions(-) diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml b/RHEL6/input/checks/no_files_unowned_by_user.xml index a73183a..f3f1276 100644 --- a/RHEL6/input/checks/no_files_unowned_by_user.xml +++ b/RHEL6/input/checks/no_files_unowned_by_user.xml @@ -1,38 +1,43 @@ <def-group> - <definition class="compliance" - id="no_files_unowned_by_user" version="1"> + <definition class="compliance" id="no_files_unowned_by_user" version="1"> <metadata> <title>Find files unowned by a user</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - user</description> + <description>All files should be owned by a user</description> + <reference source="rmercer" ref_id="20131218" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a user" - negate="true" - test_ref="test_20050" /> + <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no user owner" - id="test_20050" version="1"> - <notes> - <note>This will enumerate all files on local - partitions</note> - </notes> - <unix:object object_ref="obj_20022" /> - <unix:state state_ref="state_20050" /> - </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20050" version="1"> - <unix:user_id datatype="int">0</unix:user_id> + + <unix:file_state id="file_permissions_unowned_userid_list_match" version="1"> + <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" /> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20022" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + + <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1"> + <object_component item_field="subexpression" object_ref="file_permissions_unowned_userid_list_object" /> + </local_variable> + + <ind:textfilecontent54_object id="file_permissions_unowned_userid_list_object" version="1"> + <ind:filepath>/etc/passwd</ind:filepath> + <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern> + <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1"> + <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> + <filter action="exclude">file_permissions_unowned_userid_list_match</filter> </unix:file_object> + + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + check="all" check_existence="none_exist" comment="Check user ids on all files on the system" + id="no_files_unowned_by_user_test" version="1"> + <unix:object object_ref="file_permissions_unowned_object" /> + </unix:file_test> </def-group> + -- 1.7.1

2 1

OSCAP Anaconda Addon 0.4 available
by Vratislav Podzimek 15 Jan '14

15 Jan '14

A new version of the OSCAP Anaconda Addon integrating the OpenSCAP toolkit with the Anaconda installer is now available for testing. Links, checksums and documentation are available at project's main page: https://fedorahosted.org/oscap-anaconda-addon/ [new in version 0.4] * fixing unreported issues revealed during testing * UX improvements (http://vpodzime.fedorapeople.org/oaa-0.4-changes.webm) * bugs rhbz#1050913, rhbz#1049989, rhbz#1032846 * support for XCCDF tailoring * checking session validity also when using XCCDF benchmark [plans for 0.5] * automatic detection of scap-security-guide if it is available in the compose * support for data stream + tailoring in an archive/RPM * content integrity checking (probably sha256sum as something to start with) -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

1 0

XCCDF and OVAL Editor
by joescap＠mm.st 13 Jan '14

13 Jan '14

Can any one recommend a XCCDF/OVAL editor? I'm just looking for a GUI that us relatively easy to get running and can modify a few of the checks in the content to conform to our organizations policy (password failed attempts for example). I've seen a few, but would like some recommendations. Thanks

3 2

Red Hat and the CentOS Project
by Nunez, Luis K 13 Jan '14

13 Jan '14

I noticed the recent news of Red Hat's intent to partner and collaborate with the CentOS Project and was wondering if SSG will branch on CentOS content? From time to time folks have asked about running SCAP content on the CentOS platform. Could CentOS leverage the shared directory? I am just throwing this out to see the interest level. http://www.redhat.com/about/news/press-archive/2014/1/red-hat-and-centos-joi n-forces Luis Nunez J83B - Industry Collaboration The MITRE Corporation www.mitre.org

4 3

PATCH] [RHEL-7] Silence three 'Double hyphen within comment' RHEL-7 make shorthand2xccdf parser errors
by Jan Lieskovsky 12 Jan '14

12 Jan '14

Running 'make' / 'make shorthand2xccdf' on current RHEL-7 content returns: # make shorthand2xccdf xsltproc -o output/rhel7-shorthand.xml input/guide.xslt input/guide.xml input/services/ssh.xml:389: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:157: parser error : Double hyphen within comment:  ^ input/services/dhcp.xml:279: parser error : Double hyphen within comment:  ^ Fix the issues by adding missing enclosing comments (after the change 'make shorthand2xccdf' on RHEL-7 content doesn't issue errors anymore). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

RE: Disable DHCP client (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 09 Jan '14

09 Jan '14

Classification: UNCLASSIFIED Caveats: NONE Anyone want to weigh in on this? At the very least, it would be nice if the check also accepted the value of "none", and possibly the guidance should recommend this setting. -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support -----Original Message----- From: Shaw, Ray V CTR USARMY ARL (US) Sent: Thursday, December 26, 2013 1:27 PM To: 'scap-security-guide(a)lists.fedorahosted.org' Subject: Disable DHCP client (UNCLASSIFIED) Classification: UNCLASSIFIED Caveats: NONE The Disable DHCP client check specifies that the value of BOOTPROTO should be "static". However, this doesn't list "static" as an option: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… Should the check be for "none" instead? [Aside: I thought this might be a carryover from RHEL5, but the RHEL5 deployment guide lists the same options: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… However, all the RHEL5 clients I've checked have had it set to "static", whereas the RHEL6 clients I've checked have it set to "none". Is setting it to anything other than "bootp" or "dhcp" the equivalent of setting it to "none"? Not that I'm arguing the check should go in that direction...just wondering how we got here.] -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE Classification: UNCLASSIFIED Caveats: NONE

2 1

SSG 0.1-14-14 - Apparent content error. Unable to find referenced state
by ssg fthfth 08 Jan '14

08 Jan '14

While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with the usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be another variable referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared. SCC errorlog: [ERROR] Apparent content error. Unable to find referenced state: 'oval:ssg:ste:1545.' OVAL snippits: /bin/grep "oval:ssg:ste:1545" /opt/scc/Resources/Content/ssg-rhel6-oval.xml <linux:state state_ref="oval:ssg:ste:1545"/> <filter action="include">oval:ssg:ste:1545</filter> <linux:partition_state id="oval:ssg:ste:1545" version="1"> $ /bin/grep "1545" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $<null> perhaps related is this integer comparison error "[ERROR] Collected item to be compared is not type 'int': hard for item" when run with the stig-rhel6-server profile selected from the SCAP stream.

1 0

RHEL 6 Benchmark and STIG errors
by Shuhart, Jordan P CIV DISA FSO (US) 06 Jan '14

06 Jan '14

I have been doing a full pass/fail test of the RHEL 6 Benchmark and listed below are some of the issues I have come across. - V-38465 / SV-50265 - The benchmark check returns a passing result, but upon a manual check you can see that /lib/modules/2.6.32-358.el6.x86_64/source and /lib/modules/2.6.32-358.el6.x86_64/build both have group and write permissions. - V-38476 / SV-50276 - Benchmark returns that this check is closed. Manually checking for gpg-pubkey shows that the package is not installed - V-38477 / SV-50277 - This check has been returning a open finding even after the settings have been configured to pass. - V-38499 / SV-50300 - Same as above - V-38501 / SV-50302 - Unable to make this check pass. It appears that the STIG is missing some Fix text that the Benchmark is checking for. - V-38512 / SV-50313 - This check passes but the STIG may need updating as the status does not return what the STIG suggests it should. - V-38519 / SV-50320 - I am unable to get this check to run for some reason. - V-38540 / SV-50341 - STIG may need updated. Benchmark is looking for "-a always,exit... " but the STIG is instructing me to configure it as "-a exit,always..." Check runs properly when I change the order but I am unsure which is the correct way. Jordan Shuhart DISA Field Security Operations IA Standards & Analysis Division (717)267-9078 jordan.p.shuhart.civ(a)mail.mil

1 0

[PATCH] Initial GConf2 fixups
by Maura Dailey 06 Jan '14

06 Jan '14

Several of the GConf checks were using xmlfilecontent, which I liked, so I changed the ones that weren't to use it. However, the checks that had been using xmlfilecontent were improperly pointing to /etc/gconf/gconf.xml.defaults, when we wanted to be peering into gconf.xml.mandatory instead (this is where the gconf2-tool instructions were writing their values). To add support to ensure these checks will no longer report a failure on machines that aren't using X, I added an extended definition check and the appropriate package checks to point to the lowest level package that installs GConf settings, namely the GConf2 package. On servers that don't have this package installed, the check will pass. - Maura Dailey Maura Dailey (1): Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). .../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh

6 19

[PATCH] [Fedora] Drop -compat package, provide openscap-content directly (RH BZ#1040335#c14)
by Jan Lieskovsky 06 Jan '14

06 Jan '14

Happy New Year folks, an issue has been found: https://bugzilla.redhat.com/show_bug.cgi?id=1040335#c14 with scap-security-guide-0.1.4-1.* packages on Fedora. This patch should fix it (tested via local yum repo, pushed to master and have built new packages for all versions of Fedora-18 up to [upcoming] Fedora-21). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] add disable_user_list to STIG/RHEL-06-000527
by Steinke, Leland J Sr CTR DISA DD (US) 03 Jan '14

03 Jan '14

This has been overlooked for a long time. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 2

SSG 0.1-14-14 - [WARN] Value X was not found
by ssg testing 03 Jan '14

03 Jan '14

2 1

[PATCH] [bugfix] Updated USGCB XCCDF variable umask_user_value
by Shawn Wells 03 Jan '14

03 Jan '14

1 0

SSG 0.1-14-14 - [ERROR] Could not find external variable with id X
by ssg testing 03 Jan '14

03 Jan '14

While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with either the stig-rhel6-server or usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be variables referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared. SCC errorlog snippets: [ERROR] Could not find external variable with id 'oval:ssg:var:2224'. [ERROR] Could not find external variable with id 'oval:ssg:var:2234'. [ERROR] Could not find external variable with id 'oval:ssg:var:2237'. OVAL/XCCDF snippets: ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1436" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2224"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:1440" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:name>vsftpd</linux:name> ./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1439" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2224"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1437" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <value>/usr/sbin/usernetctl</value> ./Content/ssg-rhel6-oval.xml- </constant_variable> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2224" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2244" version="1"/> ./Content/ssg-rhel6-oval.xml- L25:L29 $ /bin/grep "2224" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $<null> 　 ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1713" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2234"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <unix:file_object comment="/etc/passwd" id="oval:ssg:obj:1717" version="1"> ./Content/ssg-rhel6-oval.xml- <unix:path>/etc</unix:path> ./Content/ssg-rhel6-oval.xml- <unix:filename>passwd</unix:filename> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1716" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2234"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1714" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg:var:2257" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg:var:2258" version="1"/> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2234" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib dcredit" datatype="int" id="oval:ssg:var:2259" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2260" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="umask for user shell" datatype="string" id="oval:ssg:var:2261" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib minclass" datatype="int" id="oval:ssg:var:2262" version="1"/> /bin/grep "2234" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $ <null> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object> ./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:2095" version="1"> ./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2237"/> ./Content/ssg-rhel6-oval.xml- </linux:partition_object> ./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:2099" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:name>nfs-utils</linux:name> ./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object> ./Content/ssg-rhel6-oval.xml- </unix:runlevel_state> ./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:2098" version="1"> ./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2237"/> ./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state> ./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:2096" version="1"> ./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options> ./Content/ssg-rhel6-oval.xml- </linux:partition_state> ./Content/ssg-rhel6-oval.xml- <external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg:var:2267" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg:var:2268" version="1"/> ./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2237" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib ucredit" datatype="int" id="oval:ssg:var:2269" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg:var:2270" version="1"/> ./Content/ssg-rhel6-oval.xml- <external_variable comment="external variable for daemon umask" datatype="string" id="oval:ssg:var:2271" version="1"/> ./Content/ssg-rhel6-oval.xml- </variables> $ /bin/grep "2237" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml $ <null>

2 1

scan-result question
by Kordell, Luke T 02 Jan '14

02 Jan '14

Hello, I have two questions regarding scan results. 1) When reviewing the .xml and .html output how can I determine the cause of an error if the setting described in the rule is configured properly? Does the scan output human-readable or even OVAL errors? 2) What is the difference between not checked, not applicable, unknown and not selected? I know not selected is when an inherited rule is specifically eliminated from an extended profile. Otherwise I would think it would either pass,fail or error. Luke K

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2014