scap-security-guide April 2014

scap-security-guide@lists.fedorahosted.org

29 participants
102 discussions

gconf_gnome_screensaver_idle_delay
by Matos, Carlos M (ES) 28 Apr '14

28 Apr '14

Hello, This is in response to the stig-rhel6-server-upstream xccdf profile. For Security Identifier CCE-26828-4 it states the following: Set GNOME Login Inactivity Timeout Run the following command to set the idle time-out value for inactivity in the GNOME desktop to 15 minutes: # gconftool-2 \ --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type int \ --set /apps/gnome-screensaver/idle_delay 15 Setting the idle delay controls when the screensaver will start, and can be combined with screen locking to prevent access from passersby. CCE-26828-4 To check the current idle time-out value, run the following command: $ gconftool-2 -g /apps/gnome-screensaver/idle_delay If properly configured, the output should be 15. There is two parts of my question: 1. I believe that this is checking the wrong location for this setting. Setting an idle_delay value in /apps/gnome-screensaver/idle_delay has no effect on actually locking this setting down. In fact, the correct location should be: /desktop/gnome/session/idle_delay and the proper way to set this would be: # gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /desktop/gnome/session/idle_delay 15 a. This has been tested and verified and you can also see: Red Hat bug 867945<https://bugzilla.redhat.com/show_bug.cgi?id=867945> 2. I think it is well known that environments are always different. With that being said, in my instance, we set this value to 10, not 15, so of course this will fail. a. Is there a way to update this to check to ensure that this value is either <= 15 OR maybe between 5 and 15? Carlos Matos NGC - ES Linux Systems Administrator 6120 Longbow Drive 720-622-6226

1 0

Review request for couple of pending patches
by Jan Lieskovsky 28 Apr '14

28 Apr '14

Hello folks, there are couple of patch proposals, I have previously sent to the list and for which I didn't receive feedback (acks / nacks) so far. Thus wanted to kindly ask you if it would be possible someone to have a look / perform the testing of them, so they could be either pushed or should be elaborated (second version made). The list is as follows: 1) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005… 2) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005… 3) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005… 4) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005… 5) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005… 6) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005… 7) https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005… Thank you in advance for your help on this. Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

3 6

[PATCH] [RHEL/6] rsyslog_nolisten + system/logging.xml changes
by Jan Lieskovsky 28 Apr '14

28 Apr '14

* checks/rsyslog_nolisten.xml: When checking /etc/rsyslog.conf that there is none of ($UDPServerRun | $InputTCPServerRun | $InputRELPServerRun) directives present, check also their versions possibly prefixed with starting whitespace characters (otherwise we can report system is safe wrt to this check, when it actually wasn't). * RHEL/6/input/system/logging.xml Use $ModLoad imtcp (as stated in manual page) rather than $ModLoad imtcp.so form when checking for loaded UDP / TCP / RELP modules. Also, fix typo in the UDP directive (there's no such $InputUDPServerRun rsyslogd option). * RHEL/7/input/system/logging.xml Changes same as in RHEL/6's case. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [RHEL/6] Don't allow whitespace around equal sign in /etc/sysconfig/init
by Jan Lieskovsky 28 Apr '14

28 Apr '14

When checking /etc/sysconfig/init file for the PROMPT row, don't allow whitespace characters around the equal sign, since it's invalid configuration [*]. But comments can be present after the setting, so count with them (don't fail when the settings meets the criteria, but there's comment present at the same line yet). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team [*] /etc/sysconfig/init script has format of a Bash script -- is run within e.g. /etc/init.d/functions script by each service status check etc. Whitespace around equal sign result into warning like: /etc/sysconfig/init: line 28: no: command not found when the PROMPT line has had the form of: ^PROMPT=\tno But comments are allowed (no warning in the same situation when PROMPT line has the proper syntax)

3 4

[PATCH] [RHEL/6] accounts_umask_etc_profile - when checking umask check all the occurrences not just the first one (because the last listed one is actually the one applied)
by Jan Lieskovsky 28 Apr '14

28 Apr '14

Patch summary: The current implementation of accounts_umask_etc_profile check is checking just the first occurrence of umask keyword in /etc/profile file. But the last occurrence is the one that's actually applied. This can be checked via having: umask 077 umask 022 in /etc/profile, login to a new log-in session for particular user (su - $USER), and running "umask" command without arguments (the last setting, e.g. 0022 is reported as the actual umask value used for file creation. Can be verified by checking mode of newly created file in that session). So instead of checking just first value (and possibly reporting false-negative test result), check all occurrences (and report proper result). Testing report: The patch has been tested on RHEL-6 & works properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[Heads up] OVAL 5.11 systemd test currently ongoing proposal - feel free to vote / express comments
by Jan Lieskovsky 28 Apr '14

28 Apr '14

Hello folks, just FYI mail that there's OVAL 5.11 systemd test proposal / inclusion discussion happening at OVAL Developer's list currently: [1] http://making-security-measurable.1364806.n2.nabble.com/Proposal-for-OVAL-5… Wanted to kindly ask you to vote for existing proposals and / or to express comments on the topic as general from the OVAL (SCAP) content creator's PoV. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [RHEL/6] Search for nousb kernel command line argument in /etc/grub.conf within bootloader_nousb_argument check case-insensitively
by Jan Lieskovsky 25 Apr '14

25 Apr '14

Patch summary: * check for 'nousb' argument on kernel command line in /etc/grub.conf within the bootloader_nousb_argument check in a case-insensitive way * update comments where appropriate * add test attestation timestamp * replace path + filename ind construct with filepath one Testing report: * Tested on RHEL-6. Works fine. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

6 21

FW: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The updates validated with OSCAP, but the verify-references.py script spat it up. It looks good to me, otherwise. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

4 9

Rule ensure_redhat_gpgkey_installed
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

The OVAL check for the Red Hat release and auxiliary key packages is passing when the packages are not installed. The check_existence and check attributes on the associated rpminfo_test elements are set to "any_exist" and "only one", respectively. Shouldn't the check_existence attribute be "at_least_one_exists" for these tests instead? Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 1

[PATCH] correct several STIG/SSG mappings
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

These are corrections to several mappings in stig_overlay.xml. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- RHEL6/input/auxiliary/stig_overlay.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 9b613eb..8e89373 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -66,7 +66,7 @@ <overlay owner="disastig" ruleid="no_hashes_outside_shadow" ownerid="RHEL-06-000031" disa="366" severity="medium"> <title>The /etc/passwd file must not contain password hashes.</title> </overlay> - <overlay owner="disastig" ruleid="no_uidzero_except_root" ownerid="RHEL-06-000032" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="RHEL-06-000032" disa="366" severity="medium"> <title>The root account must be the only account having a UID of 0.</title> </overlay> <overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium"> @@ -234,7 +234,7 @@ <overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="RHEL-06-000098" disa="366" severity="medium"> <title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title> </overlay> - <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_default_accept_redirects_value" ownerid="RHEL-06-000099" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="sysctl_ipv6_default_accept_redirects" ownerid="RHEL-06-000099" disa="366" severity="medium"> <title>The system must ignore ICMPv6 redirects by default.</title> </overlay> <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium"> @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -747,16 +747,16 @@ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="RHEL-06-000341" disa="366" severity="high"> <title>The snmpd service must not use a default password.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> <title>The system default umask for the bash shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> <title>The system default umask for the csh shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_etc_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> <title>The system default umask in /etc/profile must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_logindefs" ownerid="RHEL-06-000345" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_login_defs" ownerid="RHEL-06-000345" disa="366" severity="low"> <title>The system default umask in /etc/login.defs must be 077.</title> </overlay> <overlay owner="disastig" ruleid="umask_for_daemons" ownerid="RHEL-06-000346" disa="366" severity="low"> -- 1.7.1

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2014