scap-security-guide June 2014

scap-security-guide@lists.fedorahosted.org

19 participants
36 discussions

[PATCH] Added SNMP related OVAL checks
by Rui Pedro Bernardino 27 Jun '14

27 Jun '14

This patch add two new checks for SNMP related rules. Minor rule description changes regarding how to disable v1 and v2c. Signed-off-by: Rui Bernardino <rui-p-bernardino(a)telecom.pt> --- RHEL/6/input/checks/snmpd_not_default_password.xml | 25 ++++++++++++++++++++ RHEL/6/input/checks/snmpd_use_newer_protocol.xml | 25 ++++++++++++++++++++ RHEL/6/input/services/snmp.xml | 6 +++- 3 files changed, 54 insertions(+), 2 deletions(-) create mode 100644 RHEL/6/input/checks/snmpd_not_default_password.xml create mode 100644 RHEL/6/input/checks/snmpd_use_newer_protocol.xml diff --git a/RHEL/6/input/checks/snmpd_not_default_password.xml b/RHEL/6/input/checks/snmpd_not_default_password.xml new file mode 100644 index 0000000..2e2f0c6 --- /dev/null +++ b/RHEL/6/input/checks/snmpd_not_default_password.xml @@ -0,0 +1,25 @@ +<def-group> + <definition class="compliance" id="snmpd_not_default_password" version="1"> + <metadata> + <title>SNMP default communities disabled</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>SNMP default communities must be removed</description> + </metadata> + <criteria operator="AND"> + <criterion comment="snmp communities" test_ref="snmp_default_communities_test" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="snmp_default_communities_test" version="1"> + <ind:object object_ref="snmp_default_communities" /> + </ind:textfilecontent54_test> <ind:textfilecontent54_object + comment="Check SNMP communities" id="snmp_default_communities" version="1"> + <ind:path>/etc/snmp/</ind:path> + <ind:filename>snmpd.conf</ind:filename> + <ind:pattern operation="pattern match">^\s*(com2sec|rocommunity|rwcommunity|createUser).*(public|private)</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/RHEL/6/input/checks/snmpd_use_newer_protocol.xml b/RHEL/6/input/checks/snmpd_use_newer_protocol.xml new file mode 100644 index 0000000..7cd2d8f --- /dev/null +++ b/RHEL/6/input/checks/snmpd_use_newer_protocol.xml @@ -0,0 +1,25 @@ +<def-group> + <definition class="compliance" id="snmpd_use_newer_protocol" version="1"> + <metadata> + <title>SNMP version 1 and 2c disabled</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>SNMP version 1 and 2c must not be unabled</description> + </metadata> + <criteria> + <criterion comment="snmp version check" test_ref="snmp_versions_test" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="snmp_versions_test" version="1"> + <ind:object object_ref="snmp_versions_validate" /> + </ind:textfilecontent54_test> <ind:textfilecontent54_object + comment="Check SNMP versions" id="snmp_versions_validate" version="1"> + <ind:path>/etc/snmp/</ind:path> + <ind:filename>snmpd.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]*(com2sec|rocommunity|rwcommunity)</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/RHEL/6/input/services/snmp.xml b/RHEL/6/input/services/snmp.xml index 0e4f8b3..edc584f 100644 --- a/RHEL/6/input/services/snmp.xml +++ b/RHEL/6/input/services/snmp.xml @@ -70,13 +70,13 @@ stations</li> <Rule id="snmpd_use_newer_protocol" severity="medium"> <title>Configure SNMP Service to Use Only SNMPv3 or Newer </title> <description> -Edit <tt>/etc/snmp/snmpd.conf</tt>, removing any references to <tt>v1</tt>, <tt>v2c</tt>, or <tt>com2sec</tt>. +Edit <tt>/etc/snmp/snmpd.conf</tt>, removing any references to <tt>rocommunity</tt>, <tt>rwcommunity</tt>, or <tt>com2sec</tt>. Upon doing that, restart the SNMP service: <pre># service snmpd restart</pre> </description> <ocil clause="there is output"> To ensure only SNMPv3 or newer is used, run the following command: -<pre># grep 'v1\|v2c\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"</pre> +<pre># grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | +grep -v "^#"</pre> There should be no output. </ocil> <rationale> @@ -84,6 +84,7 @@ Earlier versions of SNMP are considered insecure, as they potentially allow unauthorized access to detailed system management information. </rationale> <ident cce="27365-6"/> +<oval id="snmpd_use_newer_protocol" /> </Rule> <Rule id="snmpd_not_default_password" severity="medium"> @@ -103,6 +104,7 @@ Presence of the default SNMP password enables querying of different system aspects and could result in unauthorized knowledge of the system. </rationale> <ident cce="27593-3"/> +<oval id="snmpd_not_default_password" /> <tested by="MAN" on="20121214"/> </Rule> -- 1.7.1

2 2

[RHEL/6, RHEL/7, shared] Start using package_talk-server_removed.xml OVAL check by adding appropriate XCCDF entry
by Jan Lieskovsky 27 Jun '14

27 Jun '14

This patch adds particular XCCDF entry (to appropriate places) to start using existing package_talk-server_removed.xml OVAL check in RHEL-6 & RHEL-7. Update also test attestations for both systems & moved the check to shared. The corresponding OVAL check & XCCDF definition for 'package talk removed' case will follow in separate patch. Rationale: While none of talk-server / talk packages are installed nowadays by default on RHEL-6 / RHEL-7, there still might be instances, where these will get installed later, and during the scan of such a system the administrator should be notified talk services are considered outdated & insecure. Testing status: Change has been tested on both (RHEL-6, RHEL-7) returning expected results. Also checked particular entry is created in *-guide.html version of both (RHEL-6, RHEL-7) benchmarks. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [RHEL/6] Delete unused file_permissions_boot_grub_grub_conf.xml OVAL check [RHEL/6] Small changes in file_permissions_grub_conf.xml
by Jan Lieskovsky 27 Jun '14

27 Jun '14

1) This patch deletes the unused file_permissions_boot_grub_grub_conf.xml OVAL check (since file_permissions_grub_conf.xml one is used instead of it). 2) Also updates file_permissions_grub_conf.xml - replace path+filename with filepath element & add test_attestation. Tested on RHEL-6, and seems to be working properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] RHEL/6: Fix for 'installed_OS_is_rhel6' check
by Rui Pedro Bernardino 26 Jun '14

26 Jun '14

As is, the check doesn't evaluate properly because linux:version is '6' and not '6.\d+'. This CPE works because it uses OpenSCAP's OVAL. Signed-off-by: Rui Bernardino <rui-p-bernardino(a)telecom.pt> --- RHEL/6/input/checks/installed_OS_is_rhel6.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL/6/input/checks/installed_OS_is_rhel6.xml b/RHEL/6/input/checks/installed_OS_is_rhel6.xml index 0c61df5..60a8ac7 100644 --- a/RHEL/6/input/checks/installed_OS_is_rhel6.xml +++ b/RHEL/6/input/checks/installed_OS_is_rhel6.xml @@ -37,7 +37,7 @@ <linux:state state_ref="state_rhel_workstation" /> </linux:rpminfo_test> <linux:rpminfo_state id="state_rhel_workstation" version="1"> - <linux:version operation="pattern match">^6\.\d+$</linux:version> + <linux:version operation="pattern match">^6</linux:version> </linux:rpminfo_state> <linux:rpminfo_object id="obj_rhel_workstation" version="1"> <linux:name>redhat-release-workstation</linux:name> @@ -48,7 +48,7 @@ <linux:state state_ref="state_rhel_server" /> </linux:rpminfo_test> <linux:rpminfo_state id="state_rhel_server" version="1"> - <linux:version operation="pattern match">^6\.\d+$</linux:version> + <linux:version operation="pattern match">^6</linux:version> </linux:rpminfo_state> <linux:rpminfo_object id="obj_rhel_server" version="1"> <linux:name>redhat-release-server</linux:name> -- 1.7.1 -- Rui Pedro Bernardino CTE2 Aveiro PT Inovação e Sistemas

2 1

Any projects similar to OpenSCAP/SSG but for the Oracle RDBMS tier?
by Hayden,Robert 25 Jun '14

25 Jun '14

I am looking to determine if there is a community project similar to OpenSCAP/SSG that applies to Oracle RDBMS STIG compliance? I have done some R&D on SSG for the Linux OS and have presented it internally at our Developer's conference with some positive feedback. Outside of the Linux OS, the next big tier is Oracle RDBMS. Thanks Robert Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden(a)cerner.com<mailto:rhayden@cerner.com> | www.cerner.com CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.

2 1

RHEL7 scanning (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 24 Jun '14

24 Jun '14

Classification: UNCLASSIFIED Caveats: NONE By default, it looks like only the partition checks are enabled when scanning with the stig-rhel7-server-upstream profile (on RHEL7). If I edit the profile to enable all of the ones that RHEL6 has enabled (and then remove the few that don't exist for RHEL7), I get a total of 56 checks. [If anyone is curious, out of the box it passes 35 and fails 21, assuming it's partitioned correctly.] We're starting on RHEL7 to prepare our configuration management system, etc. for when 7 is blessed and we can deploy it, and of course STIGs are a big part of that. Is it reasonable to expect that they will closely parallel the RHEL6 STIG? Permissions/ownership, audit rules, sysctl, GDM, etc. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

1 0

RHEL 7 as guest in VMware Fusion 6 and Workstation 10 Environments
by Kachigian, Christopher R 24 Jun '14

24 Jun '14

Hi everyone, Just a heads up that RHEL 7 crashes during installation into a VMware Fusion 6 and Workstation 10 environment. I haven¹t tried it on Vmware ESXi 5+ as I don¹t have anything to test on. I found this as I was building my RHEL 7 testing environment. That said to get RHEL 7 to install correctly as a guest I had to to use the SATA drivers for the HDD. Everything else works stock. Chris

5 5

[RFC] SCAP Security Guide icon to be included into HTML guides generated by SSG?
by Jan Lieskovsky 24 Jun '14

24 Jun '14

Hello folks, since (for now [if we ever will]) we didn't change the name of the project, and will keep the SCAP Security Guide one, and since we have received icons for both of the alternatives (renaming to OpenSCAP SG, or staying with current name) of the project name, would like to check with you the following: Would the community want the SCAP Security Guide icon to be included in the HTML version of the guide (for particular products), the SSG product creates within the build process? Also, would we want this icon to be included on the project wiki pages? Or would we rather want to stay with current position, having wiki page & corresponding HTML guides vendor neutral, so they can be modified (according to the subsequent needs) afterwards? Opinions for SVG icon inclusion / against it appreciated. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

5 11

SSG / SCAP collateral links
by Shawn Wells 23 Jun '14

23 Jun '14

I occasionally get asked for links re: SSG, SCAP, and related topics. Thought it may be helpful to centralize things, so I've began a listing here: https://github.com/OpenSCAP/scap-security-guide/wiki/Collateral Feel free to add links to your favorite articles, presentations, etc!

2 2

github mirror fixed
by Martin Preisler 20 Jun '14

20 Jun '14

Hi, I have stripped the pull requests and related commits and push forced to a state that is merge-able with a fast-forward type merge. I have synced the repos. Trying out pull requests is fine but will create a mess, especially if we strip them like this. The github repo now has a pull request that says it was merged but isn't actually in the repo. https://github.com/OpenSCAP/scap-security-guide Any news related to moving to a better development model than sending patches around on mailing lists like cavemen? ;-D -- Martin Preisler

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2014