scap-security-guide June 2014

scap-security-guide@lists.fedorahosted.org

19 participants
36 discussions

A few SCAP videos
by Shawn Wells 20 Jun '14

20 Jun '14

RHT published a few short SCAP videos for RHEL7 -- pretty cool to see how far we've come! Security Compliance by OpenSCAP - Using workbench https://www.youtube.com/watch?v=fsfr6ZNp9GQ Security Compliance by OpenSCAP - Installer extension https://www.youtube.com/watch?v=FMtASybl16k Security Compliance by OpenSCAP - Integration with Satellite https://www.youtube.com/watch?v=qGYWO2THPXM Ideas for future videos most welcome! If members of the ISV community have tooling which ingests SSG content for scanning, it'd be interesting to collaborate on videos as well.

1 0

[PATCH] [RHEL/6, RHEL/7, shared] Replace rsyslog_files_permissions OVAL unknown test stub with actual check implementation
by Jan Lieskovsky 20 Jun '14

20 Jun '14

The proposed patch replaces rsyslog_files_permissions OVAL unknown test stub with actual check implementation. The check: * first searches /etc/rsyslog.conf for (uncommented) presence of /var/log/* log files paths and stores these paths into list, * then selects just file objects (from all the system ones) having path matching some of the selected ones, * lastly compares (via file object state) if the permissions are 0600 or stronger. The change has been tested on both, RHEL-6 & RHEL-7 & seems to work properly (=> update the test_attestations, created links & moved the test to shared within the patch proposal too). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] Replace constants for profile value in XCCDF descriptions
by Rui Pedro Bernardino 12 Jun '14

12 Jun '14

The proposed patch replaces the constants found in XCCDF descriptions by the profile values. Using this patch, generated guides and reports will reflect the profile specific values, eg, PASS_MIN_LEN description in rule accounts_password_minlen_login_defs will reflect profile's var_accounts_password_minlen_login_defs and not the default '14'. Rui Bernardino (1): Replaced profile dependent constants by references to profile values RHEL/6/input/services/ssh.xml | 4 +- RHEL/6/input/system/accounts/pam.xml | 36 ++++++++++---------- RHEL/6/input/system/accounts/physical.xml | 4 +- .../accounts/restrictions/account_expiration.xml | 8 ++--- .../accounts/restrictions/password_expiration.xml | 15 ++++---- RHEL/6/input/system/accounts/session.xml | 20 +++++----- RHEL/6/input/system/auditing.xml | 23 +++++------- RHEL/6/input/system/permissions/execution.xml | 7 ++-- RHEL/6/input/system/selinux.xml | 12 +++--- 9 files changed, 62 insertions(+), 67 deletions(-) -- Rui Pedro Bernardino CTE2 Aveiro PT Inovação e Sistemas

3 7

[PATCH 1/2] modified remediation text for disabling anacron
by David Smith 09 Jun '14

09 Jun '14

--- RHEL/6/input/services/cron.xml | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/RHEL/6/input/services/cron.xml b/RHEL/6/input/services/cron.xml index 983d9ed..b859dc0 100644 --- a/RHEL/6/input/services/cron.xml +++ b/RHEL/6/input/services/cron.xml @@ -25,16 +25,18 @@ enabling the cron daemon is essential. <Rule id="disable_anacron"> <title>Disable anacron Service</title> -<description>The <tt>cronie-anacron</tt> package which provides anacron -functionality is installed by default. To disable <tt>anacron</tt> support, -run the following commands: -<pre># yum install cronie-noanacron -# yum erase cronie-anacron</pre> +<description>The <tt>cronie-anacron</tt> package, which provides <tt>anacron</tt> +functionality, is installed by default. +<package-remove-macro package="cronie-anacron" /> +</description> +<ocil><package-check-macro package="cronie-anacron" /></ocil> +<rationale> The <tt>anacron</tt> service provides <tt>cron</tt> functionality for systems such as laptops and workstations that may be shut down during the normal times that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this additional functionality, <tt>anacron</tt> could needlessly increase the possible -attack surface for an intruder.</description> +attack surface for an intruder. +</rationale> <ref nist="CM-7" /> <ident cce="27158-5" /> </Rule> -- 1.7.1

3 4

[Patch set #v2] [PATCH 0/2] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation.
by Jan Lieskovsky 09 Jun '14

09 Jun '14

From 32bbdecc7dda86f71f16cc8f0a47a02e959c717e Mon Sep 17 00:00:00 2001 From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Fri, 6 Jun 2014 14:09:33 +0200 Subject: [PATCH 0/2] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation. Based on promise in: [1] https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-June/0056… the following patchset finishes the logrotate_rotate_all_files to ensure_logrotate_activated transition. The first patch [1/2] is identical with the original one from: [2] https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-May/00564… But in addition to that one, the ensure_logrotate_activated.xml OVAL check in [shared] has been modified via patch [2/2] to properly honour the syntax / behaviour of /etc/ logrotate.conf file (last rotate log setting uncommented option present is actually the honoured one). Implement the test it was pretty challenging (considering the possibilities OVAL language brings to check complex configuration files). Needed to try couple of alternatives, but the one following seems to be working properly. Note: When testing the change, be sure to comment out the 'test_cron_daily_logrotate_existence' sub-test (or move /etc/cron.daily/logrotate file under temporary backup with different name) to actually see, how behaviour of 'test_logrotate_conf_daily_setting' OVAL check changed (to actually see when making changes to /etc/logrotate.conf they to have impact on the final result of XCCDF rule scan). Testing status: Proposed change has been tested on both (RHEL-6, RHEL-7) products, and works properly in all various cases of /etc/logrotate.conf config file format, that might occur (as far as I have tested & can tell). The underlying regular expressions are pretty complex, but hopefully the comments before / around them will clarify the idea behind the test's work. Should there be a need to clarify some part of them, feel free to ask. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team Jan Lieskovsky (2): [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation. [shared] Fix ensure_logrotate_activated OVAL check to properly handle /etc/logrotate.conf format (last occurred rotate log directive to be the by the check honoured one) RHEL/6/input/checks/ensure_logrotate_activated.xml | 21 +------ RHEL/6/input/system/logging.xml | 2 +- RHEL/7/input/checks/ensure_logrotate_activated.xml | 1 + RHEL/7/input/system/logging.xml | 2 +- shared/oval/ensure_logrotate_activated.xml | 72 ++++++++++++++++++++++ 5 files changed, 76 insertions(+), 22 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/ensure_logrotate_activated.xml create mode 120000 RHEL/7/input/checks/ensure_logrotate_activated.xml create mode 100644 shared/oval/ensure_logrotate_activated.xml -- 1.8.3.1

2 2

[PATCH] [*/utils/verify-references.py] Return non-zero status (to indicate failure) if some warning message was printed (some of the internal checks didn't pass)
by Jan Lieskovsky 09 Jun '14

09 Jun '14

Currently */utils/verify-references.py script(s) (thus make validate for that product) always return zero (success) status regardless if some of the underlying internal checks failed or not. This is not good for subsequent automated processing e.g. via shell scripts. Therefore if some of the verify-references.py check caused a warning to be printed, return non-zero / 1 exit status to indicate failure (not to actually need to parse the warning). This is just cosmetic change which doesn't have impact if the RPM package will be built successfully or not (make validate isn't part of the RPM package build), but will simplify the testing / life for those actually running 'make validate' after each commit for that product. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[Patch set #v2] [PATCH 2/2] [shared] Fix ensure_logrotate_activated OVAL check to properly handle /etc/logrotate.conf format (last occurred rotate log directive to be the by the check honoured one)
by Jan Lieskovsky 06 Jun '14

06 Jun '14

This patch modifies the behaviour of the original ensure_logrotate_activated's test_logrotate_conf_daily_setting sub-test it to: * not just check if there's 'daily' setting present in /etc/logrotate.conf (at least one uncommented occurrence of it), * but also if it isn't followed by (uncommented) occurrence of some of weekly / monthly / yearly rotate log directives, which have global meaning (IOW aren't present in some of {} block sections). Various possibilities / combinations of /etc/logrotate.conf file, that can occur (wrt to multiple directives present) has been tested, and the check seems to be working properly on both, RHEL-6 & RHEL-7 (more testing appreciated of course). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[Patch set #v2] [PATCH 1/2] [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation.
by Jan Lieskovsky 06 Jun '14

06 Jun '14

This is the unmodified / same version of the patch as provided in: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-May/00564… Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] Adapted 'no_files_unowned_by_user' to implement 'no_files_unowned_by_group' rules/checks
by Rui Pedro Bernardino 03 Jun '14

03 Jun '14

The proposed patch implements 'no_files_unowned_by_group' rule and check, based on 'no_files_unowned_by_user'. Rui Bernardino (1): Adapted 'no_files_unowned_by_user' to implement 'no_files_unowned_by_group' rules/checks .../input/checks/file_permissions_ungroupowned.xml | 36 -------------------- RHEL/6/input/checks/no_files_unowned_by_user.xml | 4 +- RHEL/6/input/system/permissions/files.xml | 2 +- 3 files changed, 3 insertions(+), 39 deletions(-) delete mode 100644 RHEL/6/input/checks/file_permissions_ungroupowned.xml -- Rui Pedro Bernardino CTE2 Aveiro PT Inovação e Sistemas

2 2

[PATCH] modified remediation text for disabling anacron
by David Smith 03 Jun '14

03 Jun '14

Signed-off-by: David Smith <dsmith(a)secure-innovations.net> --- RHEL/6/input/services/cron.xml | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/RHEL/6/input/services/cron.xml b/RHEL/6/input/services/cron.xml index 983d9ed..b859dc0 100644 --- a/RHEL/6/input/services/cron.xml +++ b/RHEL/6/input/services/cron.xml @@ -25,16 +25,18 @@ enabling the cron daemon is essential. <Rule id="disable_anacron"> <title>Disable anacron Service</title> -<description>The <tt>cronie-anacron</tt> package which provides anacron -functionality is installed by default. To disable <tt>anacron</tt> support, -run the following commands: -<pre># yum install cronie-noanacron -# yum erase cronie-anacron</pre> +<description>The <tt>cronie-anacron</tt> package, which provides <tt>anacron</tt> +functionality, is installed by default. +<package-remove-macro package="cronie-anacron" /> +</description> +<ocil><package-check-macro package="cronie-anacron" /></ocil> +<rationale> The <tt>anacron</tt> service provides <tt>cron</tt> functionality for systems such as laptops and workstations that may be shut down during the normal times that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this additional functionality, <tt>anacron</tt> could needlessly increase the possible -attack surface for an intruder.</description> +attack surface for an intruder. +</rationale> <ref nist="CM-7" /> <ident cce="27158-5" /> </Rule> -- 1.7.1

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2014