scap-security-guide April 2014

scap-security-guide@lists.fedorahosted.org

29 participants
102 discussions

[PATCH] update disable_user_list check and fix and add OVAL
by Steinke, Leland J Sr CTR DISA DD (US) 25 Apr '14

25 Apr '14

This patch includes OVAL for the disable_user_list Rule. It also updates the check and fix to look at the same thing. Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l)

2 2

[PATCH] [RHEL/6] Case-insensitively check the presence of audit=1 expression on the kernel command line in /etc/grub.conf within bootloader_audit_argument check
by Jan Lieskovsky 25 Apr '14

25 Apr '14

Patch summary: * Check for presence of audit=1 in /etc/grub.conf case-insensitively * Update comments where appropriate * Add test attestation entry * Replace path+filename ind construct with the filepath one Testing report: Tested on RHEL-6. Works fine. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [RHEL/6] Make the (selinux|enforcing)=0 test within enable_selinux_bootloader check case-insensitive
by Jan Lieskovsky 25 Apr '14

25 Apr '14

Kernel command line options are recognized / honoured also when present in UPPER / MiXeD case => make the (selinux|enforcing)=0 test within enable_selinux_bootloader check to work properly also in case this "non-standard" types of font case would be used in /etc/grub.conf. Patch summary: * Make the (selinux|enforcing)=0 test within enable_selinux_bootloader check case insensitive (update the regex) * Update criteria / object / state comments where appropriate * Update test attestation stamp Testing report: Tested on RHEL-6 and works properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

remediating refined values
by Kordell, Luke T 23 Apr '14

23 Apr '14

Hello, I have been testing SCAP remediation content generated on a base desktop RHEL 6.4 build against the CSCF-RHEL6-MLS profile and have noticed the generated scripts appear to contain the default rule content rather than the refined value. Rather than using the fix option I am manually generating the remediation script so that it can be reviewed before it is run. Has anyone else had an issue with this? I will include a copy of the remediation script I have generated. If you notice the remediation script lists var_accounts_password_minlen_login_defs="14" while in the CSCF profile I have it refined to 12. Luke

2 1

[PATCH ] [RHEL/6] search for libraries would find items outsite /lib /lib64 /usr/lib and /usr/lib64
by Renshaw, Richard /c 22 Apr '14

22 Apr '14

In my particular case, it would fail the ‘file_ownership_library_dirs’ CCE-27424-1, test by finding this file: 528273 12 -rwsr-xr-x 1 abrt abrt 9904 Aug 13 2013 /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache Patched ssg-rhel6-oval.xml to include a / at the end of the directory in the pattern match --- orig.ssg-rhel6-oval.xml 2014-04-22 10:14:05.181639519 -0500 +++ ssg-rhel6-oval.xml 2014-04-22 10:15:26.376636705 -0500 @@ -10573,13 +10573,13 @@ </linux:rpminfo_object> <unix:file_object comment="library directories" id="oval:ssg:obj:1862" version="1">  - <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path> + <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path> <unix:filename xsi:nil="true"/> <filter action="include">oval:ssg:ste:2182</filter> </unix:file_object> <unix:file_object comment="library files" id="oval:ssg:obj:1863" version="1">  - <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path> + <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path> <unix:filename operation="pattern match">^.*$</unix:filename> <filter action="include">oval:ssg:ste:2182</filter> </unix:file_object> Verified it passes on my test system. Thanks, Rick Renshaw

4 8

RE: [PATCH ] [RHEL/6] Ensure that system accounts do not run a shell upon login
by Renshaw, Richard /c 22 Apr '14

22 Apr '14

The check in ssg-rhel6-oval.xml actually checks for GID < 500, not UID < 500: testlowgid:x:50099:100::/home/testlowgid:/bin/bash --- orig.ssg-rhel6-oval.xml 2014-04-22 10:14:05.181639519 -0500 +++ ssg-rhel6-oval.xml 2014-04-22 10:42:40.361579812 -0500 @@ -10315,7 +10315,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_object id="oval:ssg:obj:1799" version="1"> <ind:filepath>/etc/passwd</ind:filepath> - <ind:pattern operation="pattern match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern> + <ind:pattern operation="pattern match">^(?!root).*:x:0*([0-9]{1,2}|[1-4][0-9]{2}):[\d]*:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> <ind:textfilecontent54_object id="oval:ssg:obj:1800" version="1"> Patch verified on my test system, it no longer flags the test account. Rick Renshaw

1 0

AUTO: William Darton is out of the office (returning 04/28/2014)
by Will_Darton＠navyfederal.org 21 Apr '14

21 Apr '14

I am out of the office until 04/28/2014. Note: This is an automated response to your message "Re: oscap & jboss on Fedora" sent on 4/21/2014 10:18:47 AM. This is the only notification you will receive while this person is away.

1 0

Seeking feedback on GovReady - tools for government-ready configurations of software
by Greg Elin 18 Apr '14

18 Apr '14

Greetings all -- I became involved with SCAP and SSG as part of grant from the Knight Foundation to support government innovation by creating tools and servers that meet government regulations, so that developers can easily build and adopt new technology. (More here: http://www.knightfoundation.org/grants/201345714/) Basically, I want leverage SCAP so developers start with accreditation-ready environments and security is baked into the development process. Right now, I am focusing on a "GovReady" toolkit so people can more easily add SCAP and vulnerability scanning into their projects; and a GovReady Clearinghouse of content to help people find ready versions of software. *I'm looking for a few volunteers to provide ongoing feedback on the prototypes we are building. * *Anyone interested in seeing early prototypes and providing feedback?* We want to make the content easier for everyone to work with: Security folks, administrators, developers, even business side. Thanks! Greg Elin personal cell: 917-304-3488 personal email: greg(a)fotonotes.net email: gregelin(a)gitmachines.com

2 2

CSCF-RHEL6-MLS profile
by Kordell, Luke T 18 Apr '14

18 Apr '14

Hi all, Here is a profile I have put together for our HPC MLS environment. This profile is to be considered under-development and will eventually be divided into several profiles for the different types of systems we utilize at the CSCF (HPCs, Utility Servers, and Clusters). In the near future I will be developing MLS remediation capabilities to include in the fixes directory. Luke Kordell

2 2

SSG generate fix banner text
by Gallagher, Michael L 18 Apr '14

18 Apr '14

Hello, I have what's hopefully a simple question. Why does the banner text from the "oscap xccdf generate fix" output contain the string "[\s\n\]+" instead of spaces? It's unreadable on a terminal session. It looks like someone is trying to use regular expression text to match either spaces or newlines between any words which is fine, but the same cannot be used as an input to /etc/issue since terminal programs don't understand it. Mike Gallagher, CISSP, CEH Commercial Cyber Solutions 610-354-4058

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2014