scap-security-guide May 2014

scap-security-guide@lists.fedorahosted.org

31 participants
60 discussions

kickstart file for correct partitioning?
by Greg Elin 27 May '14

27 May '14

Shawn, You mentioned there was a kickstart file to set up the correct partitions for compliance? Do you have that link? thanks Greg Elin personal cell: 917-304-3488 personal email: greg(a)fotonotes.net email: gregelin(a)gitmachines.com

1 0

[PATCH] modified CS2 profile to exclude Rule for disabling user list
by David Smith 27 May '14

27 May '14

Signed-off-by: David Smith <dsmith(a)secure-innovations.net> --- RHEL/6/input/profiles/CS2.xml | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml index 3615fa2..929cdef 100644 --- a/RHEL/6/input/profiles/CS2.xml +++ b/RHEL/6/input/profiles/CS2.xml @@ -189,7 +189,6 @@ <select idref="enable_gdm_login_banner" selected="true" /> <select idref="set_gdm_login_banner_text" selected="true" /> <refine-value idref="login_banner_text" selector="dod_default"/> -<select idref="disable_user_list" selected="true" /> <select idref="disable_gnome_thumbnailers" selected="true" /> <select idref="gconf_gnome_disable_automount" selected="true"/> -- 1.7.1

3 3

Running a scan for a single rule in opens cap?
by Greg Elin 26 May '14

26 May '14

Is it possible from command line to run a single rule test with opens cap...and even better pipe the output? The only way I can figure to run a single test is to create a profile with a single rule.

2 9

[PATCH 0/2] [RHEL/6] Include STIG disclaimer in two more places. [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils
by Jan Lieskovsky 26 May '14

26 May '14

From 3c42c661b4f12d57fda35c3506bde1140a09a02f Mon Sep 17 00:00:00 2001 From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Mon, 26 May 2014 16:30:22 +0200 Subject: [PATCH 0/2] [RHEL/6] Include STIG disclaimer in two more places. [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils This patchset does the following: 1) [RHEL/6] Includes STIG profile disclaimer into RHEL-6 manual page and also into dedicated file (located in /doc subdirectory of the RPM package once installed) 2) [RHEL/6, RHEL/7, Fedora] Drops Requires on openscap-utils (since we shouldn't enforce use of the OpenSCAP scanner for system evaluation) Patchset has been tested on all of RHEL/6, RHEL/7 & Fedora, builds & works fine. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team Jan Lieskovsky (2): [RHEL/6] Add upstream STIG for RHEL 6 Server profile disclaimer into the scap-security-guide manual page and also into dedicated file under the package's /doc directory. [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils. Add a note into manual pages regarding that. Fedora/input/auxiliary/scap-security-guide.8 | 7 ++++ Fedora/scap-security-guide.spec | 2 +- ...STREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER | 16 +++++++++ RHEL/6/input/auxiliary/scap-security-guide.8 | 41 +++++++++++++++------- RHEL/7/input/auxiliary/scap-security-guide.8 | 7 ++++ scap-security-guide.spec | 4 +-- 6 files changed, 62 insertions(+), 15 deletions(-) create mode 100644 RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER -- 1.8.3.1

1 0

[PATCH] [RHEL] Make new 0.1.17 release
by Jan Lieskovsky 26 May '14

26 May '14

Hello folks, it has been three months again from the last SCAP Security Guide 0.1-16 release (last was Fri, 21-th Feb of 2014). In between 76 changes / patches were applied: $ git log --format=%h --since="21-Feb-2014" | wc -l 76 So I think it's time to make a new official release (for those people relying on RPM packages instead of building directly from Git). Besides that the count of patches (diff 0.1-16 vs current git) makes the maintenance cost of 0.1-16 tarball + set of patches to be applied above it (for example due to package source tarball hash check) very high. Therefore proposing to make a new 0.1.17 release. The attached patch updates the spec & if approved new upstream source tarball & new EPEL package release would follow. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

5 12

Debugging error results
by Greg Elin 25 May '14

25 May '14

Are there docs or best practices for debugging scap scan producing error results? Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

2 2

Scap for Centos
by Derek Warner 24 May '14

24 May '14

Any chance anyone is working on getting SCAP to work on CENTOS? I would love to use the scap security guide and secstate to validate CENTOS 6.5. Right now its a manual process going line by line in the RHEL 5 STIG. I would really love to find out if anyone has anything automated that works on CENTOS. V/R Derek Warner – CISSP-ISSEP Information System Security Engineer Riptide Software w- 321-296-0068 x 136 c- 407-716-9223 derek.warner(a)riptidesoftware.com derek.a.warner(a)us.army.mil

7 11

[PATCH] Updated no_files_unowned_by_user
by Shawn Wells 24 May '14

24 May '14

Shawn Wells (1): [bugfix] no_files_unowned_by_user, 'symlinks and directories' -> 'directories' RHEL/6/input/checks/no_files_unowned_by_user.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

2 3

[PATCH 0/7] bugfixes from DISA FSO
by Shawn Wells 23 May '14

23 May '14

A few bugfixes for issues raised by DISA FSO Shawn Wells (7): [bugfix RHEL6] Updates to gconf_gnome_screensaver_idle_delay Added vim swap files to checks/.gitignore [bugfix RHEL6] OCIL fix for accounts_passwords_pam_fail_interval XCCDF rule name audit_file_access --> audit_rules_unsuccessful_file_modification [bugfix RHEL6] Disabling OVAL for audit_privileged_commands (audit_rules_privileged_commands) Naming mismatch, deny_password_attempts_unlock_time --> accounts_passwords_pam_faillock_unlock_time Updated OVAL name, logrotate_rotate_all_files -> ensure_logrotate_activated RHEL/6/input/auxiliary/stig_overlay.xml | 4 ++-- RHEL/6/input/auxiliary/transition_notes.xml | 8 ++++---- RHEL/6/input/checks/.gitignore | 1 + RHEL/6/input/checks/ensure_logrotate_activated.xml | 20 ++++++++++++++++++++ .../checks/gconf_gnome_screensaver_idle_delay.xml | 6 +++--- RHEL/6/input/checks/logrotate_rotate_all_files.xml | 20 -------------------- RHEL/6/input/profiles/C2S.xml | 2 +- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 4 ++-- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 4 ++-- RHEL/6/input/profiles/nist-CL-IL-AL.xml | 4 ++-- .../input/profiles/stig-rhel6-server-upstream.xml | 2 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL/6/input/system/accounts/pam.xml | 6 +++--- RHEL/6/input/system/accounts/physical.xml | 4 ++-- RHEL/6/input/system/auditing.xml | 4 ++-- RHEL/6/input/system/logging.xml | 2 +- 18 files changed, 49 insertions(+), 48 deletions(-) create mode 100644 RHEL/6/input/checks/ensure_logrotate_activated.xml delete mode 100644 RHEL/6/input/checks/logrotate_rotate_all_files.xml

2 9

Current scan issues
by Andrew Gilmore 23 May '14

23 May '14

Periodically, I do a git merge with upstream and test the result against my system. Most of the time, things get better, but occasionally, something breaks. Here's my list of broken stuff: Rule world_writeable_files: Now scans /proc and shows thousands of files from /proc/#/attr/<file> with permissions 777. Rule package_openswan_installed: Yum tells me that I have libreswan installed, which obsoletes openswan. Is downgrading to openswan really required, and why? Rule world_writable_files_system_ownership: Now finding /tmp/.X11-unix and /tmp/.ICE-unix where it did not before. What's the right way to address this? Why are these 777 anyway? Rule accounts_max_concurrent_login_sessions: Broken regular expressions, I may get to a patch for this one, something like (if I can ever figure out gmail's formatting!) diff --git a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml index b08faa5..b0f0920 100644 --- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml +++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml @@ -21,7 +21,7 @@ <ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1"> <ind:filepath>/etc/security/limits.conf</ind:filepath> - <ind:pattern operation="pattern match">^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*\*[\s]+hard|-[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2014