scap-security-guide April 2014

scap-security-guide@lists.fedorahosted.org

29 participants
102 discussions

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

[PATCH] [shared] sshd_set_idle_timeout - when doing the check be sure to check also the lower bound of ClientAliveInterval value.
by Jan Lieskovsky 20 May '14

20 May '14

This improvement was originally proposed by Tomas Heinrich for USGCB content. But it is applicable to SSG content too, therefore this post. Rationale: ---------- When checking the system for underlying value of ClientAliveInterval sshd config variable it's not sufficient to check just for upper bound (if the present value is less than required maximum), but it is necessary to check also for lower bound. Because from the sshd_config manual page: ClientAliveInterval Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. This option applies to protocol version 2 only. Conclusion: ----------- The current form worked only for instances, not having ClientAliveInterval at all in the config. But having had that value set to zero, would still pass (which is wrong, since as mentioned above these messages would still not be sent). Thus this patch adds also check if actual value is greater than zero. Besides that it add some blank lines for better readability. Also removes Fedora version of sshd_set_idle_timeout.xml rule and links to shared one. Testing background: ------------------- Has been tested on RHEL-7 & Fedora-20 and seems to be working properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

7 15

Problem with Setting faillock Account Lock Time
by Spice, Adam M CTR USARMY ARL (US) 14 May '14

14 May '14

All, My systems failed the scans for CCE-26844-1 (Set Deny For Failed Password Attempts), CCE-27110-6 (Set Lockout Time For Failed Password Attempts) and CCE-27215-3 (Set Interval For Counting Failed Password Attempts). I was able to resolve the first and last by following the fix text, but CCE-27110-6 remains a problem. The fix text instructs me to add the following lines: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900 auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900 ... directly beneath the following line in /etc/pam.d/system-auth: auth required pam_env.so However, following these instructions results in a system whose GDM prompts me for a username, but never gets to the password. The logs show "gkr-pam: no password is available for user." I performed many Google searches, not really finding much that helped me other than an old message in this group: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-February/0 02601.html Unfortunately, I didn't see a resolution. The person who started that thread opened a ticket, but it doesn't look like it was addressed: https://fedorahosted.org/scap-security-guide/ticket/255 He also referenced a Red Hat Solution that provides instructions on enabling faillock; following this, I was able to restore my system to functionality. I could login; if I failed my attempt three times, I could no longer login; pam_tally2 no longer reported failed logins, but faillock did. I haven't yet spent the week to determine whether or not the unlock_time parameter is being applied (if you know of a way to report remaining time until an account unlocks, that would help). Is there any guidance available regarding passing this scan without disabling my system? Thank you! -- Adam Spice Contractor, STG Unix support, Army Research Labs

4 6

[PATCH] Service cgred (service name for binary cgrulesengd) is gone in RHEL 7.
by Maura Dailey 12 May '14

12 May '14

I noticed that cgred.service was not present in libcgroup-tools in the RHEL 7 beta. cgred.service is the service file that controls the daemon cgrulesengd. # rpm -q --changelog libcgroup-tools * Mon Nov 04 2013 Peter Schiffer <pschiffe(a)redhat.com> 0.40-0.rc1.3 - related: #819568 fixed some coverity findings * Fri Nov 01 2013 Peter Schiffer <pschiffe(a)redhat.com> 0.40-0.rc1.2 - related: #1016810 returned creation of cgred group, which was removed in previous commit by mistage * Fri Nov 01 2013 Peter Schiffer <pschiffe(a)redhat.com> 0.40-0.rc1.1 - resolves: #819568, #740113 rebased to 0.40.rc1 - resolves: #983264 rebuilt with full relro and PIE - resolves: #1016810 removed cgrulesengd daemon ... Please note that in the last line displayed here, cgrulesengd is listed as having been removed. RHEL Bugzilla reference here (I can't read the actual bug from the changelog, but there's a link to it on this page): https://bugzilla.redhat.com/show_bug.cgi?id=1034248 - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL/7/input/fixes/bash/service_cgred_disabled.sh | 9 --------- RHEL/7/input/services/base.xml | 15 --------------- 2 files changed, 0 insertions(+), 24 deletions(-) delete mode 100644 RHEL/7/input/fixes/bash/service_cgred_disabled.sh diff --git a/RHEL/7/input/fixes/bash/service_cgred_disabled.sh b/RHEL/7/input/fixes/bash/service_cgred_disabled.sh deleted file mode 100644 index e4d7301..0000000 --- a/RHEL/7/input/fixes/bash/service_cgred_disabled.sh +++ /dev/null @@ -1,9 +0,0 @@ -# -# Disable cgred for all run levels -# -chkconfig --level 0123456 cgred off - -# -# Stop cgred if currently running -# -service cgred stop diff --git a/RHEL/7/input/services/base.xml b/RHEL/7/input/services/base.xml index 4f2c05a..5c0941c 100644 --- a/RHEL/7/input/services/base.xml +++ b/RHEL/7/input/services/base.xml @@ -75,21 +75,6 @@ service is not necessary. <ref nist="CM-7" /> </Rule> -<Rule id="service_cgred_disabled"> -<title>Disable Control Group Rules Engine (cgred)</title> -<description>The <tt>cgred</tt> service moves tasks into control groups according to -parameters set in the <tt>/etc/cgrules.conf</tt> configuration file. -<service-disable-macro service="cgred" /> -</description> -<ocil><service-disable-check-macro service="cgred" /></ocil> -<rationale>Unless control groups are used to manage system resources, running the cgred service -service is not necessary. -</rationale> -<ident cce="RHEL7-CCE-TBD" /> -<oval id="service_cgred_disabled" /> -<ref nist="CM-7" /> -</Rule> - <Rule id="service_cpuspeed_disabled"> <title>Disable CPU Speed (cpuspeed)</title> <description>The <tt>cpuspeed</tt> service can adjust the clock speed of supported CPUs based upon -- 1.7.1

4 6

[PATCH] [RHEL/6] Allow /boot/grub/grub.conf permissions to be stronger than 0600
by Jan Lieskovsky 11 May '14

11 May '14

When checking "Verify /boot/grub/grub.conf Permissions" rule, allow the check to succeed also in case the underlying system has stronger file permissions on /boot/grub/grub.conf file than exactly 0600 (IOW instead of exact requirement of / for 0600 permissions, make the 0600 mode the upper bound of the allowed value / range). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[RFC] SCAP security guide to become member of larger community - OpenSCAP ecosystem by changing it's name to OpenSCAP security guide?
by Jan Lieskovsky 06 May '14

06 May '14

Hello folks, in effort to increase discoverability of security compliance solutions, Simon created github's entry for OpenSCAP ecosystem yesterday: [1] https://github.com/OpenSCAP collecting all the relevant tools / products, necessary to perform security compliance checks in automated way. The intention of this ecosystem is to have all the parts available at one place, so people interested in automated SCAP scans wouldn't need to search for: * the scanner, * tailoring / remediation tool, * the content itself at three different locations. For now those repositories are just mirrors of their parental ones (copies which will get updated on regular basis - Simon can clarify how often). Together with this change, we have received proposal of icon / logo for the SCAP security guide project. Though yet before you download & inspect the attached tarballs, I need to mention, there are two versions of the icons attached: * one is for current "SCAP Security Guide" project name (SCAP_logos_SCAP_security_guide.tar.gz), * the second to see the proposal if the name of the project would change to "OpenSCAP Security Guide" (OpenSCAP_logos_SCAP_security_guide.tar.gz) Since there's effort to create OpenSCAP ecosystem, of which SCAP security guide project is its indisputable part, besides cloning the repository, the other natural subsequent step, coming to mind is to have the project renamed from SCAP security guide to OpenSCAP security guide. In our opinion, look at OpenSCAP ecosystem [1] might induce the potential user's impression, the whole project being organized properly (all parts being available at one place and all parts named by same prefix, differing just by component's name). The pros / cons of the name change as I was able to collect are as follows: Pros: * whole (security compliance) solution can be viewed / looked at like having organized & unified form (distinguished just by component's name / colour of the icon), * all the necessary bits are reachable at one place (=> lowering the potential user's "start barrier" in effort to get familiar with the concept) Cons: * user's accustomed to old name might get confused. It might need to take some time till they get accustomed to start using new name, * the content being named "OpenSCAP Security Guide" (IOW with OpenSCAP brand) might induce the impression, it's not usable in other tools / scanners than just by OpenSCAP one. This could be overcome by us providing tutorial articles / images pinpointing the use of SCAP Security Guide content with tools (scanners) other than OpenSCAP to disperse the potential confusion (clearly state it's possible to use it in other scanners too). To express my subjective opinion I like the idea of the project to be renamed to "OpenSCAP Security Guide". But wanted to know wider opinions from the community on the potential translation. Please express you preference(s). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: Attached are icons / logos for both alternatives.

7 9

oscap & jboss on Fedora
by Ivan Saez Scheihing 05 May '14

05 May '14

Hi, I'n new to oscap/xccdf and am trying unleash it on a Jboss 5 installation (Jboss EAP 5 (5.1.2)). The original jboss installation runs on a RedHat 6 server but I'm not allowed to install software on that server. I've copied the Jboss installation on a Fedora server and when I try to use xccdf I get the following error: !! The target checklist is not applicable to this platform. aborting.... I'm not sure if it's refering to Fedora or Jboss. Any ideas? The when I try oscap oscap xccdf evel --results bla.xml --report bla.html --profile eap5_full --cpe eap5-cpe-dictionary.xml eap5-xccdf.xml I get lot's of "not applicable" messages and the bla.html contains no meaningfull information. I'm trying to run oscap/xccdf on fedora because it's the only Linux distro where I was able to yum install all necessary rpm's. All other distro's gave me problems when dependent rpm's like xerces where needed. I hope you can give some ideas. regards, Ivan

3 10

[PATCH] allow enable_gdm_login_banner to pass if gdm isn't installed
by Paul Tittle (Contractor) 29 Apr '14

29 Apr '14

--- RHEL/6/input/checks/banner_gui_enabled.xml | 3 +- RHEL/6/input/checks/package_gdm_installed.xml | 26 ++++++++++++++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL/6/input/fixes/bash/package_gdm_installed.sh | 1 + 4 files changed, 30 insertions(+), 1 deletions(-) create mode 100644 RHEL/6/input/checks/package_gdm_installed.xml create mode 100644 RHEL/6/input/fixes/bash/package_gdm_installed.sh diff --git a/RHEL/6/input/checks/banner_gui_enabled.xml b/RHEL/6/input/checks/banner_gui_enabled.xml index a6c147c..4be3183 100644 --- a/RHEL/6/input/checks/banner_gui_enabled.xml +++ b/RHEL/6/input/checks/banner_gui_enabled.xml @@ -8,7 +8,8 @@ <description>Enable the GUI warning banner.</description> <reference source="rmercer" ref_id="20131104" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="gdm installed" definition_ref="package_gdm_installed" negate="true" /> <criterion comment="check settings" test_ref="test_banner_gui_enabled" /> </criteria> </definition> diff --git a/RHEL/6/input/checks/package_gdm_installed.xml b/RHEL/6/input/checks/package_gdm_installed.xml new file mode 100644 index 0000000..b9ea21f --- /dev/null +++ b/RHEL/6/input/checks/package_gdm_installed.xml @@ -0,0 +1,26 @@ +<def-group> +  + <definition class="compliance" id="package_gdm_installed" + version="1"> + <metadata> + <title>Package gdm Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package gdm should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package gdm is installed" + test_ref="test_package_gdm_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_gdm_installed" version="1" + comment="package gdm is installed"> + <linux:object object_ref="obj_package_gdm_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_gdm_installed" version="1"> + <linux:name>gdm</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv b/RHEL/6/input/checks/templates/packages_installed.csv index 6dfc406..ef6e737 100644 --- a/RHEL/6/input/checks/templates/packages_installed.csv +++ b/RHEL/6/input/checks/templates/packages_installed.csv @@ -2,6 +2,7 @@ aide audit cronie GConf2 +gdm iptables iptables-ipv6 irqbalance diff --git a/RHEL/6/input/fixes/bash/package_gdm_installed.sh b/RHEL/6/input/fixes/bash/package_gdm_installed.sh new file mode 100644 index 0000000..b5025fa --- /dev/null +++ b/RHEL/6/input/fixes/bash/package_gdm_installed.sh @@ -0,0 +1 @@ +yum -y install gdm -- 1.7.1

2 4

Fwd: Re: [Open-scap] OpenSCAP Receives NIST Certification
by Šimon Lukašík 29 Apr '14

29 Apr '14

This perhaps is worth a cross post. On 04/29/2014 03:44 PM, Gary Gapinski wrote: > http://www.redhat.com/about/news/press-archive/2014/4/red-hat-continues-to-… > > My congratulations to those responsible. > > OpenSCAP is an admirable achievement. > > Best regards, > > Gary > Hello Gary, Thank you for your kind words. It is great honor for OpenSCAP community to receive NIST's certification [1]. Certified bits will soon be release to Red Hat Enterprise Linux variants. The update will also enable SCE technology which you can opt-in by installing openscap-engine-sce package. OpenSCAP upstream has started 1.0 branch [2] which may be used for maintenance. And for rebuilds by other downstreams. Thanks all! -- Simon Lukasik Security Technologies, Red Hat, Inc. [1]: http://nvd.nist.gov/scapproducts.cfm [2]: https://git.fedorahosted.org/cgit/openscap.git/log/?h=maint-1.0 _______________________________________________ Open-scap-list mailing list Open-scap-list(a)redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list

1 0

Transform usage
by Kachigian, Christopher R 29 Apr '14

29 Apr '14

Is there any documentation about how to use the transforms? A quick google search didn’t find anything. So for example, I have my STIG scan output but I want to utilize the STIG overlay to allow easier importing into the STIG Viewer for less manual inputting. Example scan: oscap xccdf eval --profile stig-rhel6-server-upstream --results ssg-results.xml --report ssg-report.xml --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml The data from the result output doesn’t map to the DISA STIG XCCDF file. I figure there is a way using the transforms. Any help is appreciated. Thanks, Chris

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2014