scap-security-guide May 2014

scap-security-guide@lists.fedorahosted.org

31 participants
60 discussions

Start a nNew thread

testing mail bounces -- sorry for spam -- 1010 est
by Shawn Wells 19 May '14

19 May '14

-- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells

1 0

testing mail bounces -- sorry for spam -- 10:04 est
by Shawn Wells 19 May '14

19 May '14

-- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells

1 0

[PATCH] [shared] sshd_set_idle_timeout - when doing the check be sure to check also the lower bound of ClientAliveInterval value.
by Jan Lieskovsky 19 May '14

19 May '14

This improvement was originally proposed by Tomas Heinrich for USGCB content. But it is applicable to SSG content too, therefore this post. Rationale: ---------- When checking the system for underlying value of ClientAliveInterval sshd config variable it's not sufficient to check just for upper bound (if the present value is less than required maximum), but it is necessary to check also for lower bound. Because from the sshd_config manual page: ClientAliveInterval Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. This option applies to protocol version 2 only. Conclusion: ----------- The current form worked only for instances, not having ClientAliveInterval at all in the config. But having had that value set to zero, would still pass (which is wrong, since as mentioned above these messages would still not be sent). Thus this patch adds also check if actual value is greater than zero. Besides that it add some blank lines for better readability. Also removes Fedora version of sshd_set_idle_timeout.xml rule and links to shared one. Testing background: ------------------- Has been tested on RHEL-7 & Fedora-20 and seems to be working properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

7 15

Test
by leam hall 19 May '14

19 May '14

Trying to make sure I can send e-mail. Leam -- http://31challenge.net http://31challenge.net/insight

3 3

Test
by leam hall 19 May '14

19 May '14

Tried to respond to Greg but it failed. Trying to just send. Leam -- Mind on a Mission <http://leamhall.blogspot.com/>

1 0

SCC (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 14 May '14

14 May '14

Classification: UNCLASSIFIED Caveats: NONE I remember that there were issues with the SSG content and RHEL6 (due to SCC not supporting a sufficient version of...XCCDF? SCAP?). But previously, I could still use SCC with the SSG content; it would just generate a few more false positives than using OpenSCAP. Admittedly, it has been a while since I tried. Now, when trying SCC 3.1.2, I can't make it run at all. After importing the zip file (generated from git) and selecting the stig-rhel6-server-upstream profile, a scan finishes almost immediately with: The SCAP content stream <ssg-rhel6-> is not applicable to this platform per the CPE definitions I've tried on both RHEL6 Workstation and Server, and I've also tried stripping the <platform> information from the XML files. I'm attempting this for two reasons, as otherwise I'm perfectly happy scanning with OpenSCAP. SCC has the ability to run a check on a single rule at a time, which is useful. Also, I have an inspection soon, and they may want me to use it. -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

3 10

[PATCH 0/5] RHEL6 bugfixes
by Shawn Wells 14 May '14

14 May '14

Various bugfixes relating to STIG profile rules, 50% renaming XCCDF/OVAL issues. Last patch is more of an RFC, was unsure why 'rmdir' was no longer being audited Shawn Wells (5): XCCDF/OVAL mismatch, mountopt_noexec_on_removable_partitions -> mount_option_noexec_removable_partitions [bugfix OVAL] updated mount_option_noexec_removable_partitions to reflect proper XCCDF variable XCCDF/OVAL mismatch, install_openswan --> package_openswan_installed XCCDF/OVAL mismatch, audit_file_deletions --> audit_rules_file_deletion_events [auditd RFC / bugfix] updating DAC to audit for rmdir command RHEL/6/input/auxiliary/stig_overlay.xml | 6 +++--- RHEL/6/input/auxiliary/transition_notes.xml | 2 +- .../checks/audit_rules_file_deletion_events.xml | 2 +- .../mount_option_noexec_removable_partitions.xml | 6 +++--- RHEL/6/input/profiles/C2S.xml | 4 ++-- RHEL/6/input/profiles/CS2.xml | 6 +++--- RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 4 ++-- RHEL/6/input/profiles/common.xml | 4 ++-- RHEL/6/input/profiles/desktop.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 4 ++-- RHEL/6/input/profiles/nist-CL-IL-AL.xml | 4 ++-- .../input/profiles/stig-rhel6-server-upstream.xml | 2 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 4 ++-- RHEL/6/input/system/auditing.xml | 4 ++-- RHEL/6/input/system/network/ipsec.xml | 2 +- RHEL/6/input/system/permissions/partitions.xml | 2 +- 16 files changed, 29 insertions(+), 29 deletions(-)

2 7

Problem with Setting faillock Account Lock Time
by Spice, Adam M CTR USARMY ARL (US) 14 May '14

14 May '14

All, My systems failed the scans for CCE-26844-1 (Set Deny For Failed Password Attempts), CCE-27110-6 (Set Lockout Time For Failed Password Attempts) and CCE-27215-3 (Set Interval For Counting Failed Password Attempts). I was able to resolve the first and last by following the fix text, but CCE-27110-6 remains a problem. The fix text instructs me to add the following lines: auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900 auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900 ... directly beneath the following line in /etc/pam.d/system-auth: auth required pam_env.so However, following these instructions results in a system whose GDM prompts me for a username, but never gets to the password. The logs show "gkr-pam: no password is available for user." I performed many Google searches, not really finding much that helped me other than an old message in this group: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-February/0 02601.html Unfortunately, I didn't see a resolution. The person who started that thread opened a ticket, but it doesn't look like it was addressed: https://fedorahosted.org/scap-security-guide/ticket/255 He also referenced a Red Hat Solution that provides instructions on enabling faillock; following this, I was able to restore my system to functionality. I could login; if I failed my attempt three times, I could no longer login; pam_tally2 no longer reported failed logins, but faillock did. I haven't yet spent the week to determine whether or not the unlock_time parameter is being applied (if you know of a way to report remaining time until an account unlocks, that would help). Is there any guidance available regarding passing this scan without disabling my system? Thank you! -- Adam Spice Contractor, STG Unix support, Army Research Labs

4 6

[PATCH 0/6] Updating developer documentation
by Shawn Wells 13 May '14

13 May '14

A number of updates to the Developer Guide documentation. Namely: - Incorporated Jan's RPM build instructions into DocBook and the Developer guide. It's a first cut, and marked as draft. Gives us something to edit from; - To prepare for, and ease, the transition to GitHub, I generated some basic user guides on cloning and patching/"pull requests" Things staged @ http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-sin… (note: don't bookmark that URL. it's just scratch space. real docs will be @ docs.ssgproject.org once ack'd) Shawn Wells (6): Updated docs Makefile to embed TOC Updated docs TOC Updated Developer Guide - Accounts Updated Developer Guide - Patching Updated Developer guide - RPM build Updating master documentation TOC docs/Developer_Guide/en-US/Developer_Guide.xml | 3 + docs/Developer_Guide/en-US/ch001-Accounts.xml | 37 +++ docs/Developer_Guide/en-US/ch002-Patching.xml | 110 +++++++++ docs/Developer_Guide/en-US/ch003-RPM_Build.xml | 236 ++++++++++++++++++++ .../en-US/images/._ch002-Patching-Base_Fork.png | Bin 0 -> 4096 bytes .../._ch002-Patching-Compare_Against_Forks.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-Create_Pull.png | Bin 0 -> 4096 bytes .../._ch002-Patching-GUI_naming_scheme_sample.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-Head_Fork.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-New_Pull.png | Bin 0 -> 4096 bytes .../images/._ch002-Patching-Pull_Requests.png | Bin 0 -> 4096 bytes .../images/._ch002-Patching-Send_Pull_Request.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-fork.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-forklocation.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-githubURL.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Patching-inline_edits.png | Bin 0 -> 4096 bytes .../en-US/images/._ch002-Pull_Request.png | Bin 0 -> 4096 bytes .../en-US/images/ch002-Patching-Base_Fork.png | Bin 0 -> 24742 bytes .../ch002-Patching-Compare_Against_Forks.png | Bin 0 -> 13398 bytes .../en-US/images/ch002-Patching-Create_Pull.png | Bin 0 -> 27090 bytes .../ch002-Patching-GUI_naming_scheme_sample.png | Bin 0 -> 16138 bytes .../en-US/images/ch002-Patching-Head_Fork.png | Bin 0 -> 26322 bytes .../en-US/images/ch002-Patching-New_Pull.png | Bin 0 -> 9916 bytes .../en-US/images/ch002-Patching-Pull_Requests.png | Bin 0 -> 35141 bytes .../images/ch002-Patching-Send_Pull_Request.png | Bin 0 -> 23685 bytes .../en-US/images/ch002-Patching-fork.png | Bin 0 -> 9044 bytes .../en-US/images/ch002-Patching-forklocation.png | Bin 0 -> 52539 bytes .../en-US/images/ch002-Patching-githubURL.png | Bin 0 -> 10156 bytes .../en-US/images/ch002-Patching-inline_edits.png | Bin 0 -> 19339 bytes .../en-US/images/ch002-Pull_Request.png | Bin 0 -> 22963 bytes docs/Makefile | 6 +- docs/html/Sitemap | 36 ++-- docs/html/en-US/toc.html | 1 + docs/ssg-docs.db | Bin 5120 -> 5120 bytes 34 files changed, 408 insertions(+), 21 deletions(-) create mode 100644 docs/Developer_Guide/en-US/ch001-Accounts.xml create mode 100644 docs/Developer_Guide/en-US/ch002-Patching.xml create mode 100644 docs/Developer_Guide/en-US/ch003-RPM_Build.xml create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Base_Fork.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Compare_Against_Forks.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Create_Pull.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-GUI_naming_scheme_sample.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Head_Fork.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-New_Pull.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Pull_Requests.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-Send_Pull_Request.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-fork.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-forklocation.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-githubURL.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Patching-inline_edits.png create mode 100644 docs/Developer_Guide/en-US/images/._ch002-Pull_Request.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Base_Fork.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Compare_Against_Forks.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Create_Pull.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-GUI_naming_scheme_sample.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Head_Fork.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-New_Pull.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Pull_Requests.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-Send_Pull_Request.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-fork.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-forklocation.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-githubURL.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Patching-inline_edits.png create mode 100644 docs/Developer_Guide/en-US/images/ch002-Pull_Request.png

2 8

[PATCH 1/5] Fix check for Red Hat Enterprise Linux 6 installed
by Shawn Wells 12 May '14

12 May '14

Updating RHEL6 check to match RHEL7 style, as submitted by Simon Lukasik on 17-MAR-2014. Signed-off-by: Shawn Wells <shawn(a)redhat.com> --- RHEL/6/input/checks/installed_OS_is_rhel6.xml | 37 ++++++++++++++++--------- 1 files changed, 24 insertions(+), 13 deletions(-) diff --git a/RHEL/6/input/checks/installed_OS_is_rhel6.xml b/RHEL/6/input/checks/installed_OS_is_rhel6.xml index 7f77491..0c61df5 100644 --- a/RHEL/6/input/checks/installed_OS_is_rhel6.xml +++ b/RHEL/6/input/checks/installed_OS_is_rhel6.xml @@ -14,8 +14,12 @@ <criteria> <criterion comment="Installed operating system is part of the unix family" test_ref="test_unix_family" /> - <criterion comment="Red Hat Enterprise Linux 6 is installed" - test_ref="test_rhel_6" /> + <criteria operator="OR"> + <criterion comment="Red Hat Enterprise Linux 6 Workstation is installed" + test_ref="test_rhel_workstation" /> + <criterion comment="Red Hat Enterprise Linux 6 Server is installed" + test_ref="test_rhel_server" /> + </criteria> </criteria> </definition> @@ -28,18 +32,25 @@ </ind:family_state> <ind:family_object id="obj_unix_family" version="1" /> - <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-* is version 6" id="test_rhel_6" version="1"> - <linux:object object_ref="obj_rhel_release" /> - <linux:state state_ref="state_rhel_6" /> + <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="test_rhel_workstation" version="1"> + <linux:object object_ref="obj_rhel_workstation" /> + <linux:state state_ref="state_rhel_workstation" /> </linux:rpminfo_test> - <linux:rpminfo_state id="state_rhel_6" version="1"> - <linux:name operation="pattern match">^redhat-release</linux:name> - <linux:version operation="pattern match">^6[^\d]</linux:version> + <linux:rpminfo_state id="state_rhel_workstation" version="1"> + <linux:version operation="pattern match">^6\.\d+$</linux:version> </linux:rpminfo_state> - <linux:rpmverifyfile_object id="obj_rhel_release" version="1"> -  - <linux:filepath>/etc/redhat-release</linux:filepath> - </linux:rpmverifyfile_object> + <linux:rpminfo_object id="obj_rhel_workstation" version="1"> + <linux:name>redhat-release-workstation</linux:name> + </linux:rpminfo_object> + <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="test_rhel_server" version="1"> + <linux:object object_ref="obj_rhel_server" /> + <linux:state state_ref="state_rhel_server" /> + </linux:rpminfo_test> + <linux:rpminfo_state id="state_rhel_server" version="1"> + <linux:version operation="pattern match">^6\.\d+$</linux:version> + </linux:rpminfo_state> + <linux:rpminfo_object id="obj_rhel_server" version="1"> + <linux:name>redhat-release-server</linux:name> + </linux:rpminfo_object> </def-group> -- 1.7.1

2 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2014