July 2014 - scap-security-guide - Fedora mailing-lists

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

Baseline configs & DevOps code-a-thon
by Greg Elin 27 Aug '14

27 Aug '14

Double posting to Scap-Security-Guide and OpenSCAP mailing list... Can I get a show of hands a late September or early October, one or two day code-a-thon around baseline configurations and integrating compliance tools with DevOps? The space of SCAP, baselines, and general integration of security with DevOps seems to be getting frothy lately with activity. Examples: http://bit.ly/DevOpsAudit, OpenSCAP on Github, https://github.com/fisma-ready/ubuntu-lts. We also have some work, like http://martin.preisler.me/2014/07/openscap-html-report-redesign/ that could benefit from some shared face time and coding. I think there would be a nice turn out in DC for such an event. Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

5 8

Anyone using rhel6 ssg for centos6?
by Pettorino, Jeffrey D CTR USAF USAFA USAFA/DFAN 22 Aug '14

22 Aug '14

I have been trying to get oscap working on my CentOS6.5 network core, without luck. Everything comes back with "Result notapplicable". I am pretty new to SCAP and XCCDF, but am a long-time user of Nessus and Security Center (prior to ACAS program by DISA). Does anyone have suggestions where I can find some in depth guidance to adjust the rhel6 configs to CentOS? -- Jeff v/r, Jeffrey D. Pettorino, GCIH, CISSP Systems Engineer High Performance Computing Research Center United States Air Force Academy Jeffrey.Pettorino.ctr(a)USAFA.edu 719/333-9391 ---- The use of the Unix philosophy just for UNIX was a great waste. Fortunately, Linux came along. - Bellevue Linux User Group member, 2005

17 39

[PATCH 0/3][bugfix] - sshd OVAL false positives
by Gabe Alford 08 Aug '14

08 Aug '14

These patches fix some OVAL false positives for SSH configuration checks that were showing that they had passed even when they were not configured in sshd_config. Thanks, Gabe Gabe (3): [bugfix] - disable_host_auth OVAL false positive [bugfix] - sshd_disable_rhosts OVAL false positive [bugfix] - sshd_disable_root_login OVAL false positive shared/oval/disable_host_auth.xml | 4 ++-- shared/oval/sshd_disable_rhosts.xml | 4 ++-- shared/oval/sshd_disable_root_login.xml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) -- 2.0.0

2 16

[PATCH] add oval for aide cron job
by Gabe Alford 29 Jul '14

29 Jul '14

Add oval for aide to check that it is running in a cron job. Thanks, Gabe Alford Gabe (1): add aide cron oval check RHEL/6/input/checks/aide_cron_checking.xml | 39 +++++++++++++++++++++++++++ RHEL/6/input/fixes/bash/aide_cron_checking.sh | 1 + RHEL/6/input/system/software/integrity.xml | 1 + 3 files changed, 41 insertions(+) create mode 100644 RHEL/6/input/checks/aide_cron_checking.xml create mode 100644 RHEL/6/input/fixes/bash/aide_cron_checking.sh -- 2.0.0

2 3

[PATCH 0/1] (Resubmit) add oval for aide cron job
by Gabe Alford 29 Jul '14

29 Jul '14

Add oval for aide to check that it is running in a cron job. This is a resubmit. Thanks, Gabe Alford Gabe (1): add aide cron oval check .../6/input/checks/aide_periodic_cron_checking.xml | 39 ++++++++++++++++++++++ .../fixes/bash/aide_periodic_cron_checking.sh | 1 + RHEL/6/input/system/software/integrity.xml | 1 + 3 files changed, 41 insertions(+) create mode 100644 RHEL/6/input/checks/aide_periodic_cron_checking.xml create mode 100644 RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh -- 2.0.0

1 1

Fixed typo in common profile
by Kordell, Luke T 29 Jul '14

29 Jul '14

2 2

modified CSCF profile
by Kordell, Luke T 28 Jul '14

28 Jul '14

2 3

[PATCH 0/4] Apply David Smith's NIST SP 800-53 reference updates to RHEL7 content
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 27 Jul '14

27 Jul '14

These are David Smith's changes emailed to the scap-security-guide list on Thu Jul 17 18:21:29 UTC 2014, but applied to the RHEL/7 directory. Also I found a typo and fixed it both in RHEL/6 and RHEL/7. I'm attempting to send these patches using Outlook. This may fail. Jared Jennings (4): correct punctuation error in NIST SP800-53 reference updated transforms to reflect 800-53 rev4 updated 800-53 control references (services) updated 800-53 control references (system) RHEL/6/input/system/auditing.xml | 2 +- RHEL/7/input/services/base.xml | 18 ++++---- RHEL/7/input/services/obsolete.xml | 28 +++++++------- RHEL/7/input/services/ssh.xml | 4 +- RHEL/7/input/system/auditing.xml | 58 ++++++++++++++-------------- RHEL/7/input/system/network/ipsec.xml | 2 +- RHEL/7/input/system/network/kernel.xml | 2 +- RHEL/7/input/system/network/wireless.xml | 8 ++-- RHEL/7/input/system/software/integrity.xml | 12 +++--- RHEL/7/transforms/constants.xslt | 2 +- RHEL/7/transforms/xccdf2html.xslt | 4 +- 11 files changed, 70 insertions(+), 70 deletions(-)

3 2

[PATCH 00/21] DISA FSO Patch Sync
by Shawn Wells 27 Jul '14

27 Jul '14

DISA FSO has provided the following patches based on end-user feedback and updates done amongst the DISA FSO staff. Submitting to list on their behalf. -shawn Leland Steinke (21): Update aide_build_database Add VMS/DPMS mappings in stig_overlay Update VRelease attributes for DISA FSO VMS tags Add set_ip6tables_default_rule to common, map to STIG RHEL-06-000523 Update VRelease attribute for RHEL-06-000008 (ensure_redhat_gpgkey_installed) Add reload to set_ip6tables_default_rule [bugfix] modify file_permissions_library_dirs to follow symlinks [bugfix] Modify file_permissions_binary_dirs to follow symlinks Increment VRelease for sysctl_ipv6_default_accept_redirects/RHEL-06-000099 Check syscall audits explicitly to avoid partial matches Add applicability statement to audit_rules_time_stime/RHEL-06-000169 Give SELinux precedence over HBSS in install_hids/RHEL-06-000285 Update install_antivirus/RHEL-06-000284 from uvscan to VSEL/nails Remove display_login_attempts/RHEL-06-000506 from RHEL 6 STIG Add display_login_attempts/RHEL-06-000372 to STIG [bugfix] Update selinux_all_devicefiles to "any_exist" Increment OVAL version for selinux_all_devicefiles_labeled Update OVAL version for sysctl_net_ipv6_conf_default_accept_redirects Fix lowercase in system/auditing.xml Update severity of aide_build_database in stig_overlay.xml [bugfix] Correct static sysctl.conf check regex and increment versions RHEL/6/input/auxiliary/stig_overlay.xml | 87 +++++++++++--------- .../checks/selinux_all_devicefiles_labeled.xml | 2 +- RHEL/6/input/checks/sysctl_fs_suid_dumpable.xml | 2 +- .../input/checks/sysctl_kernel_dmesg_restrict.xml | 2 +- RHEL/6/input/checks/sysctl_kernel_exec_shield.xml | 2 +- .../checks/sysctl_kernel_randomize_va_space.xml | 2 +- .../sysctl_net_ipv4_conf_all_accept_redirects.xml | 2 +- ...ysctl_net_ipv4_conf_all_accept_source_route.xml | 2 +- .../sysctl_net_ipv4_conf_all_log_martians.xml | 2 +- .../checks/sysctl_net_ipv4_conf_all_rp_filter.xml | 2 +- .../sysctl_net_ipv4_conf_all_secure_redirects.xml | 2 +- .../sysctl_net_ipv4_conf_all_send_redirects.xml | 2 +- ...sctl_net_ipv4_conf_default_accept_redirects.xml | 2 +- ...l_net_ipv4_conf_default_accept_source_route.xml | 2 +- .../sysctl_net_ipv4_conf_default_rp_filter.xml | 2 +- ...sctl_net_ipv4_conf_default_secure_redirects.xml | 2 +- ...sysctl_net_ipv4_conf_default_send_redirects.xml | 2 +- ...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml | 2 +- ..._net_ipv4_icmp_ignore_bogus_error_responses.xml | 2 +- RHEL/6/input/checks/sysctl_net_ipv4_ip_forward.xml | 2 +- .../checks/sysctl_net_ipv4_tcp_syncookies.xml | 2 +- .../sysctl_net_ipv6_conf_default_accept_ra.xml | 2 +- ...sctl_net_ipv6_conf_default_accept_redirects.xml | 2 +- RHEL/6/input/checks/templates/template_sysctl | 2 +- RHEL/6/input/profiles/common.xml | 1 + RHEL/6/input/system/accounts/pam.xml | 2 +- RHEL/6/input/system/auditing.xml | 3 + RHEL/6/input/system/network/iptables.xml | 2 + RHEL/6/input/system/permissions/files.xml | 4 +- RHEL/6/input/system/software/integrity.xml | 27 ++++-- 30 files changed, 97 insertions(+), 75 deletions(-)

1 44

first post
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

Hi, I'm Jared Jennings. I work under contract as an admin at the US Air Force SEEK EAGLE Office (AFSEO). Engineers here deal with the problem of aircraft-store compatibility, where "store" means "something you put on the aircraft," like a missile, bomb or fuel tank. There's lots of modelling and simulation going on here, on Windows, Linux and Mac workstations, and Linux HPC clusters. I make the Linux and Mac stuff compliant with STIGs, and document the compliance. So I've built CMITS (Configuration Management for IT Systems), out of Puppet, LaTeX and Python. Folks with DoD certificates can check it out from <https://software.forge.mil/svn/repos/dodpuppet/cmits-release>. Besides configuring RHEL5, RHEL6 and Snow Leopard hosts, it builds documentation that answers the questions, "Do we have everything covered? How are we complying with requirement X? Why are we not complying with requirement Y? Requirement Z says something should be written down; where is it?" Now, RHEL7 is out. Dave and Gunnar have been going on about it for months <http://dgshow.org/>. I want to run it. But I need a STIG to comply with. And here is a community where I can help build such a thing. Hello, community! -- Jared Jennings, RHCE, Network Administrator, SURVICE Engineering Co.

4 5

[PATCH 4/4] updated 800-53 control references (system)
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like c20e0403 from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/input/system/auditing.xml | 58 ++++++++++++++-------------- RHEL/7/input/system/network/ipsec.xml | 2 +- RHEL/7/input/system/network/kernel.xml | 2 +- RHEL/7/input/system/network/wireless.xml | 8 ++-- RHEL/7/input/system/software/integrity.xml | 12 +++--- 5 files changed, 41 insertions(+), 41 deletions(-) diff --git a/RHEL/7/input/system/auditing.xml b/RHEL/7/input/system/auditing.xml index 9711628..aedab59 100644 --- a/RHEL/7/input/system/auditing.xml +++ b/RHEL/7/input/system/auditing.xml @@ -510,7 +510,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_adjtimex" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -538,7 +538,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_settimeofday" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -564,7 +564,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_stime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -592,7 +592,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_clock_settime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> @@ -617,7 +617,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_time_watch_localtime" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> <ref disa="1487,169" /> </Rule> </Group> @@ -646,7 +646,7 @@ unexpected users, groups, or modifications should be investigated for legitimacy.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_usergroup_modification" /> -<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/> +<ref nist="AC-2(4),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/> </Rule> <Rule id="audit_network_modifications"> @@ -672,7 +672,7 @@ than administrator action. Any change to network parameters should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_networkconfig_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Rule id="file_permissions_var_log_audit"> @@ -729,7 +729,7 @@ arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_mac_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Group id="audit_dac_actions"> @@ -779,7 +779,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_chmod" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_chown"> @@ -805,7 +805,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_chown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchmod"> @@ -831,7 +831,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchmod" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchmodat"> @@ -857,7 +857,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchmodat" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchown"> @@ -883,7 +883,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fchownat"> @@ -909,7 +909,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fchownat" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fremovexattr"> @@ -935,7 +935,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fremovexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_fsetxattr"> @@ -961,7 +961,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_fsetxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lchown"> @@ -987,7 +987,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lchown" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lremovexattr"> @@ -1013,7 +1013,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lremovexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_lsetxattr"> @@ -1039,7 +1039,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_lsetxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_removexattr"> @@ -1065,7 +1065,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_removexattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_rules_dac_modification_setxattr"> @@ -1091,7 +1091,7 @@ calls with others as identifying earlier in this guide is more efficient. </warning> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_dac_modification_setxattr" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> </Group>  @@ -1108,7 +1108,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi as an attacker attempting to remove evidence of an intrusion.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_login_events" /> -<ref nist="AC-17(7),AU-1(b),IR-5" /> +<ref nist="AC-3(10),AU-1(b),IR-5" /> </Rule> <Rule id="audit_manual_session_edits"> @@ -1125,7 +1125,7 @@ storing such process information, add the following to as an attacker attempting to remove evidence of an intrusion.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_session_events" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" /> </Rule> <Rule id="audit_file_access"> @@ -1146,7 +1146,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol these events could serve as evidence of potential system compromise.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_unsuccessful_file_modification" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" /> </Rule> <Rule id="audit_privileged_commands"> @@ -1174,7 +1174,7 @@ unusual activity. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_privileged_commands" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),IR-5" disa="40" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> <tested by="DS" on="20121024"/> </Rule> @@ -1196,7 +1196,7 @@ trail should be created each time a filesystem is mounted to help identify and g loss.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_media_export" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> <tested by="DS" on="20121024"/> </Rule> @@ -1217,7 +1217,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as malicious processes that attempt to delete log files to conceal their presence.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_file_deletion_events" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_sysadmin_actions"> @@ -1235,7 +1235,7 @@ To verify that auditing is configured for system administrator actions, run the of what was executed on the system, as well as, for accountability purposes.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_sysadmin_actions" /> -<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-2(7)(b),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> <tested by="DS" on="20121024"/> </Rule> @@ -1257,7 +1257,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp to have an audit trail of modules that have been introduced into the kernel.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="audit_rules_kernel_module_loading" /> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/> </Rule> <Rule id="audit_config_immutable"> diff --git a/RHEL/7/input/system/network/ipsec.xml b/RHEL/7/input/system/network/ipsec.xml index b05ed1a..4e8186d 100644 --- a/RHEL/7/input/system/network/ipsec.xml +++ b/RHEL/7/input/system/network/ipsec.xml @@ -19,7 +19,7 @@ transmitted over a wide area network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_openswan_installed" /> -<ref nist="AC-17, MA-4, SC-9" disa="1130,1131" /> +<ref nist="AC-17, MA-4, SC-8" disa="1130,1131" /> </Rule> </Group> diff --git a/RHEL/7/input/system/network/kernel.xml b/RHEL/7/input/system/network/kernel.xml index 3c8b75f..fe7505f 100644 --- a/RHEL/7/input/system/network/kernel.xml +++ b/RHEL/7/input/system/network/kernel.xml @@ -262,7 +262,7 @@ sign of nefarious network activity. Logging these packets enables this activity to be detected.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" /> -<ref nist="AC-17(7),CM-7" disa="126"/> +<ref nist="AC-3(10),CM-7" disa="126"/> <tested by="DS" on="20121024"/> </Rule> diff --git a/RHEL/7/input/system/network/wireless.xml b/RHEL/7/input/system/network/wireless.xml index 19b84be..869dc55 100644 --- a/RHEL/7/input/system/network/wireless.xml +++ b/RHEL/7/input/system/network/wireless.xml @@ -35,7 +35,7 @@ to reboot the system first. </rationale> <ident cce="RHEL7-CCE-TBD" />  -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> </Rule> <Rule id="deactivate_wireless_interfaces"> @@ -65,7 +65,7 @@ protocols which were not designed with security in mind. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="wireless_disable_interfaces" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" /> <tested by="DS" on="20121025"/> </Rule> @@ -84,7 +84,7 @@ Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_bluetooth_disabled" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> </Rule> @@ -106,7 +106,7 @@ from loading the kernel module provides an additional safeguard against its activation.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="kernel_module_bluetooth_disabled" /> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" /> <tested by="DS" on="20121025"/> </Rule> diff --git a/RHEL/7/input/system/software/integrity.xml b/RHEL/7/input/system/software/integrity.xml index a2a6921..b250460 100644 --- a/RHEL/7/input/system/software/integrity.xml +++ b/RHEL/7/input/system/software/integrity.xml @@ -41,7 +41,7 @@ The AIDE package must be installed if it is to be available for integrity checki </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_aide_installed" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28, SI-7" disa="1069"/> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28, SI-7" disa="1069"/> <tested by="DS" on="20121024"/> </Rule> @@ -61,7 +61,7 @@ of AIDE, because it changes binaries. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="disable_prelink" /> -<ref nist="CM-6(d),CM-6(3),SC-28, SI-7" /> +<ref nist="CM-6(d),SC-28, SI-7" /> </Rule> <Rule id="aide_build_database"> @@ -82,7 +82,7 @@ For AIDE to be effective, an initial database of "known-good" information about must be captured and it should be able to be verified against the installed files. </rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" /> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" /> </Rule> <Rule id="aide_periodic_cron_checking" severity="medium"> @@ -101,7 +101,7 @@ By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. </rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> </Group> @@ -142,7 +142,7 @@ The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="rpm_verify_permissions" /> -<ref nist="AC-6,CM-6(d),CM-6(3)" disa="1493,1494,1495" /> +<ref nist="AC-6,CM-6(d),SI-7" disa="1493,1494,1495" /> </Rule> <Rule id="rpm_verify_hashes"> @@ -173,7 +173,7 @@ information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="rpm_verify_hashes" /> -<ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" /> +<ref nist="CM-6(d),SI-7" disa="1496" /> </Rule> </Group> -- 1.7.1

2 1

[PATCH 3/4] updated 800-53 control references (services)
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like 62466610 from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/input/services/base.xml | 18 +++++++++--------- RHEL/7/input/services/obsolete.xml | 28 ++++++++++++++-------------- RHEL/7/input/services/ssh.xml | 4 ++-- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/RHEL/7/input/services/base.xml b/RHEL/7/input/services/base.xml index 4f2c05a..61c4ac0 100644 --- a/RHEL/7/input/services/base.xml +++ b/RHEL/7/input/services/base.xml @@ -22,7 +22,7 @@ vulnerabilities in software executing on the local machine, as well as sensitive information from within a process's address space or registers.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_abrtd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="381" /> +<ref nist="CM-7" disa="381" /> </Rule> <Rule id="service_acpid_disabled"> @@ -153,7 +153,7 @@ crash, which can load information from the crashed kernel for analysis. is little need to run the kdump service.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_kdump_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> </Rule> @@ -205,7 +205,7 @@ kernel panics, which is not common. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_netconsole_disabled" /> -<ref nist="AC-17(8),CM-7" disa="381" /> +<ref nist="CM-7" disa="381" /> </Rule> <Rule id="service_ntpdate_disabled"> @@ -224,7 +224,7 @@ reboots. In any event, the functionality of the ntpdate service is now available in the ntpd program and should be considered deprecated.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_ntpdate_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -260,7 +260,7 @@ preventing conflicting usage of ports in the reserved port range, but it can be disabled if not needed.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_portreserve_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> <tested by="DS" on="20121024"/> </Rule> @@ -298,7 +298,7 @@ the system is not intended to receive AMQP traffic, then the <tt>qpidd</tt> service is not needed and should be disabled or removed.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_qpidd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> </Rule> <Rule id="service_quota_nld_disabled"> @@ -337,7 +337,7 @@ some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rdisc_disabled" /> -<ref nist="AC-17(8),AC-4,CM-7" disa="382" /> +<ref nist="AC-4,CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -356,7 +356,7 @@ desirable for some environments. However, if the system is being managed by RHN RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rhnsd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="382" /> +<ref nist="CM-7" disa="382" /> <tested by="DS" on="20121024"/> </Rule> @@ -395,7 +395,7 @@ use Kerberos and LDAP. For others, however, in which only local files may be consulted, it is not necessary and should be disabled.</rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_saslauthd_disabled" /> -<ref nist="AC-17(8),CM-7" /> +<ref nist="CM-7" /> <tested by="DS" on="20121024"/> </Rule> diff --git a/RHEL/7/input/services/obsolete.xml b/RHEL/7/input/services/obsolete.xml index c1f594f..5c88422 100644 --- a/RHEL/7/input/services/obsolete.xml +++ b/RHEL/7/input/services/obsolete.xml @@ -41,7 +41,7 @@ attacks against xinetd itself. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_xinetd_disabled" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -60,7 +60,7 @@ xinetd service's accidental (or intentional) activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_xinetd_removed" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -87,7 +87,7 @@ subject to man-in-the-middle attacks. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_telnetd_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" /> +<ref nist="CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" /> <tested by="DS" on="20121026"/> </Rule> @@ -103,7 +103,7 @@ telnet service's accidental (or intentional) activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_telnet-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> </Group> @@ -128,7 +128,7 @@ activation. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_rsh-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> @@ -147,7 +147,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rexec_disabled" /> -<ref nist="AC-17(8),CM-7" disa="68,1436"/> +<ref nist="CM-7" disa="68,1436"/> <tested by="DS" on="20121026"/> </Rule> @@ -166,7 +166,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rsh_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436" /> +<ref nist="CM-7,IA-5(1)(c)" disa="68,1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -202,7 +202,7 @@ stolen by eavesdroppers on the network. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_rlogin_disabled" /> -<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="1436" /> +<ref nist="CM-7,IA-5(1)(c)" disa="1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -225,7 +225,7 @@ of an Rsh trust relationship. used in conjunction with the R-services, they can allow unauthenticated access to a system.</rationale> <ident cce="RHEL7-CCE-TBD" /> -<ref nist="AC-17(8),CM-7" disa="1436" /> +<ref nist="CM-7" disa="1436" /> <oval id="no_rsh_trust_files" /> <tested by="DS" on="20121026"/> </Rule> @@ -252,7 +252,7 @@ accidental (or intentional) activation of NIS or NIS+ services. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_ypserv_removed" /> -<ref nist="AC-17(8),CM-7" disa="305,381"/> +<ref nist="CM-7" disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> @@ -269,7 +269,7 @@ as a client in a NIS or NIS+ domain. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_ypbind_disabled" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> </Group> @@ -297,7 +297,7 @@ as a TFTP server, which does not provide encryption or authentication. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="service_tftp_disabled" /> -<ref nist="AC-17(8),CM-7" disa="1436" /> +<ref nist="CM-7" disa="1436" /> <tested by="DS" on="20121026"/> </Rule> @@ -315,7 +315,7 @@ accidental (or intentional) activation of tftp services. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="package_tftp-server_removed" /> -<ref nist="AC-17(8),CM-7" disa="305"/> +<ref nist="CM-7" disa="305"/> <tested by="DS" on="20121026"/> </Rule> @@ -346,7 +346,7 @@ server_args = -s /var/lib/tftpboot</pre> </ocil> <ident cce="RHEL7-CCE-TBD" /> <oval id="tftpd_uses_secure_mode" /> -<ref nist="AC-17(8),CM-7" disa="366"/> +<ref nist="CM-7" disa="366"/> </Rule> </Group> diff --git a/RHEL/7/input/services/ssh.xml b/RHEL/7/input/services/ssh.xml index cf41bc1..9461da5 100644 --- a/RHEL/7/input/services/ssh.xml +++ b/RHEL/7/input/services/ssh.xml @@ -81,7 +81,7 @@ should not be used. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sshd_allow_only_protocol2" /> -<ref nist="AC-17(7),IA-5(1)(c)" disa="776,774,1436" /> +<ref nist="AC-3(10),IA-5(1)(c)" disa="776,774,1436" /> <tested by="DS" on="20121024"/> </Rule> @@ -363,7 +363,7 @@ implementation. These are also required for compliance. </rationale> <ident cce="RHEL7-CCE-TBD" /> <oval id="sshd_use_approved_ciphers" /> -<ref nist="AC-3,AC-17(2),AU-10(5),IA-5(1)(c),IA-7" disa="803,1144,1145,1146" /> +<ref nist="AC-3,AC-17(2),SI-7,IA-5(1)(c),IA-7" disa="803,1144,1145,1146" /> <tested by="DS" on="20121024"/> </Rule> -- 1.7.1

2 1

[PATCH 2/4] updated transforms to reflect 800-53 rev4
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

(like fee5b77c from David Smith <dsmith(a)secure-innovations.net>, but applied to RHEL7 content) Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/7/transforms/constants.xslt | 2 +- RHEL/7/transforms/xccdf2html.xslt | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL/7/transforms/constants.xslt b/RHEL/7/transforms/constants.xslt index afe719b..c252c3e 100644 --- a/RHEL/7/transforms/constants.xslt +++ b/RHEL/7/transforms/constants.xslt @@ -7,7 +7,7 @@ <xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>  -<xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…</xsl:variable> +<xsl:variable name="nist800-53uri">http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf</xsl:variable> <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable> <xsl:variable name="dcid63uri">not_officially_available</xsl:variable> <xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable> diff --git a/RHEL/7/transforms/xccdf2html.xslt b/RHEL/7/transforms/xccdf2html.xslt index bdf04f7..92d6e6a 100644 --- a/RHEL/7/transforms/xccdf2html.xslt +++ b/RHEL/7/transforms/xccdf2html.xslt @@ -556,7 +556,7 @@ <xsl:when test='./@href = "http://iase.disa.mil/cci/index.html"'> <a href="{@href}">DISA CCI-<xsl:value-of select="text()"/></a> </xsl:when> - <xsl:when test='./@href = "http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…"'> + <xsl:when test='./@href = "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"'> <a href="{@href}">NIST <xsl:value-of select="text()"/></a> </xsl:when> <xsl:otherwise> @@ -664,7 +664,7 @@ <xsl:when test='./@href = "http://iase.disa.mil/cci/index.html"'> <a href="{@href}">DISA CCI-<xsl:value-of select="text()"/></a> </xsl:when> - <xsl:when test='./@href = "http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.…"'> + <xsl:when test='./@href = "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"'> <a href="{@href}">NIST <xsl:value-of select="text()"/></a> </xsl:when> <xsl:otherwise> -- 1.7.1

2 1

[PATCH 1/4] correct punctuation error in NIST SP800-53 reference
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 25 Jul '14

25 Jul '14

Signed-off-by: Jared Jennings <jared.jennings.ctr(a)us.af.mil> --- RHEL/6/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml index e25f890..a7efc37 100644 --- a/RHEL/6/input/system/auditing.xml +++ b/RHEL/6/input/system/auditing.xml @@ -1174,7 +1174,7 @@ unusual activity. </rationale> <ident cce="26457-2" /> <oval id="audit_rules_privileged_commands" /> -<ref nist="AC-3(10)),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" /> <tested by="JL" on="20140703"/> </Rule> -- 1.7.1

2 1

[PATCH] [RHEL/7] Include SCAP Security Guide logo into generated HTML guide
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, this change adds support to display SSG logo in the generated HTML guide for RHEL-7 product (depends on the two transformations to be placed in the shared/ directory, IOW my previous patch). Testing status: --------------- Tested via: oscap xccdf generate guide --profile allrules --output /tmp/el7.html ssg-rhel7-xccdf.xml where 'ssg-rhel7-xccdf.xml' was benchmark built within the RPM build process on both Fedora (with openscap 1.0.9) & RHEL-6 (with openscap 1.0.8) versions. The change works as expected (in both cases). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH] [shared] Create shared/transforms directory [shared] Move includelogo.xslt & oscapsupportssvg.py transforms into shared/ directory
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, shortly after submitting the "Fedora logo" change for review: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-July/0058… I have realized the includelogo.xslt & oscapsupportssvg.py transformations are identical for both products, thus created shared/transforms directory, and moved them into shared/ (to save place in the repository) by updating the appropriate entries in RHEL/6 & Fedora directories. Testing status: --------------- Retested both scenarios: * building RHEL-6 content on both of RHEL-6 & Fedora, and * building Fedora content on both of RHEL-6 & Fedora and the proposed changes still work OK. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: This way more of the transformations could be joined (to save the space). Would just need to go trough various of them in */transforms subdirectories to see which of them are identical & could be merged into one place.

2 1

[PATCH] [Fedora] Include SCAP Security Guide logo into generated HTML guide
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, similar change like in: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-July/0058… but this time for the Fedora product. Testing status: ---------------- Tested & confirmed logo is included when content built on Fedora (with openscap 1.0.9), and current state is kept when building Fedora content on RHEL-6 (with openscap 1.0.8). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH] [RHEL/6] Include SCAP Security Guide logo into generated HTML guide (if underlying openscap version supports <svg> XHTML element to be present within <front-matter> element)
by Jan Lieskovsky 25 Jul '14

25 Jul '14

Hello folks, the attached change adds support for displaying of SCAP Security Guide (horizontal) logo in the HTML form of the guide (within it's <front-matter> element). Since the <svg> inclusion requires openscap of version v1.0.9 (at least) to be able to handle SVG images within benchmark's description / front-matter / rear-matter elements properly, the display of the logo has been made conditional: * the version of openscap package on the system is < 1.0.9, there will be no change wrt to current <front-matter> content, * the version of openscap package on the system is >= 1.0.9 (currently on Fedora only), the SCAP Security Guide logo will be displayed (for now just as plain image, without a href to Fedorahosted instance - this is another feature that needs to be implemented in openscap first). You can see the new output after applying the patch & building the RPM on Fedora (with openscap = 1.0.9). On RHEL-6 there won't be any difference (for now). Testing report: Tested the change on all of RHEL-6, RHEL-7 & Fedora-20, and seems to be working properly (no change on RHEL-6, RHEL-7 & equipped with logo on Fedora). Similar changes for RHEL-7 & Fedora transforms will follow shortly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

openscap HTML report redesign
by Martin Preisler 18 Jul '14

18 Jul '14

Hi, I wrote a blog post about the ongoing HTML report redesign. http://martin.preisler.me/2014/07/openscap-html-report-redesign/ Please give it a look and consider providing feedback. -- Martin Preisler

7 10

[PATCH 0/3] Updating NIST SP 800-53 References
by David Smith 17 Jul '14

17 Jul '14

This patchset updates the NIST control references throughout the XCCDF. A number of controls from Rev3 didn't make it into Rev4, and items that previously fell under those controls were incorporated into other controls. David Smith (3): updated transforms to reflect 800-53 rev4 updated 800-53 control references (services) updated 800-53 control references (system) RHEL/6/input/services/base.xml | 18 ++++---- RHEL/6/input/services/obsolete.xml | 28 +++++++------- RHEL/6/input/services/ssh.xml | 4 +- RHEL/6/input/system/auditing.xml | 58 ++++++++++++++-------------- RHEL/6/input/system/network/ipsec.xml | 2 +- RHEL/6/input/system/network/kernel.xml | 2 +- RHEL/6/input/system/network/wireless.xml | 8 ++-- RHEL/6/input/system/software/integrity.xml | 12 +++--- RHEL/6/transforms/constants.xslt | 2 +- RHEL/6/transforms/xccdf2html.xslt | 4 +- 10 files changed, 69 insertions(+), 69 deletions(-)

2 7

bug in html report
by Kordell, Luke T 17 Jul '14

17 Jul '14

Hello, I think there may be a bug in the way the pass/fail percentage is computed in the html results from an open-scap scan. Currently I am showing 192 passes, 0 fails and 0 errors, but am at 96.79%. Is this actually a bug or am I missing something else? I am going to attach my scan-results to this email, please let me know if you require any further information. Regards, Luke Kordell

3 3

[PATCH 1/2] [*/transforms/idtranslate.py] Allow shorthand format to contain <ind:variable_object> definition
by Jan Lieskovsky 16 Jul '14

16 Jul '14

Currently it's not possible the shorthand form of OVAL definition to contain <ind:variable_object> definition (based on previously defined <local_variable>). The reason behind this limitation being that idtranslate.py script (which is internally called by relabelids.py script, which is subsequently called during the benchmark build process) is not currently able to properly handle <ind:var_ref> element. When translating the OVAL ids idtranslate.py is able to correctly replace value of 'var_ref' attribute, but not able to translate the id when 'var_ref' isn't an attribute, but rather an tag / element directly. The <variable_object> definition expects the form of: <ind:variable_object id="object_id" version="1"> <ind:var_ref>reference_to_previously_defined_variable_used_in_the_check</ind:var_ref> </ind:variable_object> Since (currently) value of <ind:var_ref> element isn't properly translated into real ID, during the benchmark build process the error like the following is raised: ... [pattern] id 'variable_name' does not meet the expected pattern [oval:a-z...] This results in unability to successfully build the benchmark, when variable_object (containing by xsd required reference to var_ref) is used. Since I need the capability to define variable_objects (see the patch [2/2]), update idtranslate.py script (in RHEL/6 and also across the content) to be able to properly handle variable_objects (properly translate var_ref ids even in case it's listed as tag / element). The function / proper work of proposed change is confirmed by successful work of subsequent patch (see patch [2/2] for further details). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 6

SSG Git repository content now tagged (for versions from 0.1-6 through to v0.1.18)
by Jan Lieskovsky 15 Jul '14

15 Jul '14

Hello folks, jFYI mail that the content of SCAP Security Guide Git repository has been equipped with RHEL release tags today (for versions from v0.1-6 up to the most recent v0.1.18 one) [*] The tags are visible at (tarballs are now available for download via version id): https://git.fedorahosted.org/cgit/scap-security-guide.git and now it's also possible to use e.g. git describe: $ git describe v0.1.18-11-g3a4ed7b to find out: * which version is repository at (v0.1.18) * how many (committed) changes there have been from v0.1.18 release (11) * that this is a git managed version (g) * and most recent commit identifier. Starting from the next release (v0.1.19) I am considering to start using GPG signed tags -- let me know if these would be preferred / welcome? Enjoy. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: [*] Older versions (X < 0.1-6) were intentionally kept untagged due the following two reasons: * they are using different versioning scheme (from v1.0-1 up to v1.0-5) * not that easy to identify particular commits making releases in these early SSG repository days

2 1

[PATCH 0/2] copy-editing
by David Smith 11 Jul '14

11 Jul '14

This patchset does two primary things: 1) modifies two of the XSLT transforms to refer to NIST SP 800-53 rev4, instead of the current rev3 2) corrects a number of things and addresses inconsistences within the prose I haven't attempted a remapping of 800-53 controls for rev4, so that will likely still need to take place where applicable. David Smith (2): modified constants.xslt and xccdf2html.xslt to reflect 800-53 rev4 copy-editing for prose publication RHEL/6/input/intro/intro.xml | 2 +- RHEL/6/input/system/accounts/physical.xml | 18 +++++++------- RHEL/6/input/system/network/iptables.xml | 24 ++++++++++---------- RHEL/6/input/system/network/ipv6.xml | 10 ++++---- RHEL/6/input/system/network/wireless.xml | 8 +++--- RHEL/6/input/system/permissions/partitions.xml | 22 +++++++++--------- RHEL/6/input/system/software/disk_partitioning.xml | 2 +- RHEL/6/transforms/constants.xslt | 2 +- RHEL/6/transforms/xccdf2html.xslt | 4 +- 9 files changed, 46 insertions(+), 46 deletions(-)

2 4

[PATCH] [*/utils/verify-input-sanity.py] Enhance 7031613 change -- show also what kind of error happened & line number it happened at
by Jan Lieskovsky 08 Jul '14

08 Jul '14

This patch enhances the change introduced in: [1] https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=7031613 it to be yet more verbose. Instead of reporting just file name, the error happened in, report also what kind of error happened & particular line number of that processed file, causing / leading to this error. Current verify-input-sanity.py output: utils]$ ./verify-input-sanity.py XML syntax error in file: src/input/checks/platform/rhel6-cpe-dictionary.xml XML syntax error in file: src/input/auxiliary/stig_overlay.xml Output once the change is applied: utils]$ ./verify-input-sanity.py XML syntax error in file src/input/checks/platform/rhel6-cpe-dictionary.xml: XML declaration allowed only at the start of the document, line 1, column 49 XML syntax error in file src/input/auxiliary/stig_overlay.xml: XML declaration allowed only at the start of the document, line 1, column 49 The patch changes the behaviour all across the content (i.e. for verify-input-sanity.py foreach of RHEL/6, RHEL/7, Fedora, Openstack & RHEVM3 -- tested for all cases, works fine). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH 0001-0003] - various ssh and gconf fixes
by Gabe Alford 07 Jul '14

07 Jul '14

Hello, These patches should address a few sshd false positives [Patch 0001] and add support for %gconf-tree.xml [Patch 0002] as well as a recommendation to change remediation for the GDM login banner from a gdm user default to a gconf mandatory setting [Patch 0003]. [Patch 0001]: When initially running the scan, some sshd settings such as PermitRootLogin were showing that they were set correcly. This patch should fix those as well as hopefully address https://fedorahosted.org/scap-security-guide/ticket/434 [Patch 0002]: Adds support to check %gconf-tree.xml. If %gconf-tree.xml exists (such as being deployed through Satellite), it takes precedence over any directory containing a %gconf.xml file under /etc/gconf/gconf.xml.mandatory. Plus having a single configuration file to create/change/modify is always a plus. Could potentially help address https://fedorahosted.org/scap-security-guide/ticket/282 [Patch 0003]: This is a recommendation to move setting the gdm banner and login settings from /var/lib/gdm to /etc/gconf/gconf.xml.mandatory. Reason for this is that the /etc/gconf directory is the location for administrators to set mandatory system policies over user set policies. Plus due to the gconf order of processing/precedance, it would be recommended to set under /etc rather than /var as anything set as a mandatory policy would be the default no matter what was in /var/lib/gdm. If approved, would potentially address https://fedorahosted.org/scap-security-guide/ticket/319 Thanks, Gabe

1 1

Formalizing the release process / schedule
by Jan Lieskovsky 07 Jul '14

07 Jul '14

Hello folks, since the request to give more formalized shape to SSG release process / schedule appeared couple of times in the past already (to mention some example: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-May/00541…) and since we are hitting the doubt if already make / not to make yet a new release each time (each couple of weeks), we have decided to share the idea about SSG release process proposal. The proposal is to have release of new tarballs to happen at regular time (each 4 up to 6 weeks), and have a dedicated wiki page listing when the couple of upcoming releases will happen [1]. Something like Mozilla is doing for their products: https://wiki.mozilla.org/Releases https://wiki.mozilla.org/Releases#Upcoming_Releases https://wiki.mozilla.org/RapidRelease/Calendar From the observation period of 6 weeks is enough to have "sufficient count of new bug fixes / features requests" (aka the evolution step) these changes by themselves to form a need of a new release. But since it's difficult to decide if some patchset deserves new release (what's very valuable for someone, might not be that exciting / urgent for someone else etc.) to be fair we decided regular release period might be the best option how to balance out the various requests that might come out. Therefore starting from the next release we would like the release to happen regularly (each 4 up to 6 weeks - this to be decided yet. Feel free to vote for your preferences) at a date listed on the wiki page [2]. This could allow us establish automated functionality which could in sufficiently ahead period of time (for example week ago) notify the list the new release is coming and if someone is planning from their point of view critical patches to be included yet, those should be proposed / reviewed as soon as possible. To express personal opinion I would prefer the releases to happen on per 4 week scenario (while 6 weeks window might produce more changes in the tarball & less releases during the year at the end it also introduces some related inconsistency - one time the release would happen at start of the month, next time in the middle etc.) since it has the advantage the release will happen each time at regular (same) period, so users can update their functionality to better align upgrades with the schedule. Yet, since majority of us works on various / multiple projects, it might happen start of the week might not be the right time for new release (urgent action required somewhere else resulting into delay of a release etc.). Therefore I would propose the release to happen each first Friday in the month (the users could use the upcoming weekend to install the updates if / where appropriate). Feedback, comments, votes, proposals welcome. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team (on behalf of SSG upstream) [1] For now the wiki would contain just dates of past releases & dates of the upcoming ones (possibly also describing the release scheme). In the future it could provide further information what functionality each of the releases introduced (and taking it to the very advanced level hopefully too which functionality the new releases will contain in the future). [2] Once the scheme is clear (the proposal is approved), I will create that wiki page.

6 6

[PATCH 2/2] [RHEL/6] (Re-)Implement audit_rules_privileged_commands OVAL check & start using it
by Jan Lieskovsky 07 Jul '14

07 Jul '14

Re-implement (the currently incorrect & unreferenced / unused) audit_rules_privileged_commands RHEL-6 check. The idea behind the check is roughly as follows -- the check works on comparing of two sets: * set A originally contains list of all privileged (setuid or setgid bit set) files found on the system (intentionally speaking about files, not executables above. Since former setuid / setgid can have the executable bit temporarily removed due some reason, we check - it's enough the file to have one of setuid / setgid set [IOW not checking if the file is executable]) * for each item from set A we prefix it with: --a always, exit ... -F path= prefix, and suffix it with -F ... -k privileged suffix. In other words for each setuid / setgid file found on the system we generate the full / expanded form of audit rule, we expect to be found. * second set B contains list of instances, following / matching the expected audit rule pattern, we have retrieved by looking into /etc/audit/audit.rules file * for each instance found (item from set B) we compare it for match with each item (pregenerated full audit rule form) from set A * besides the above, we need to ensure the dimensions / cardinality of both sets matches (e.g. what could happen being /etc/audit/audit.rules would contain all expected audit rules for setuid files, but none rule for setgid files. Checking just that each audit.rules rule is present in pregenerated list would succeed in this case too, even when it should fail. Therefore we add second, variable_test which compares if the cardinality of set A matches the cardinality of set B. If so, the test succeeds [the count of found audit.rules matches and has expected form than count of various setuid / setgid files, present on the system], otherwise failure is returned). Regardless of the OVAL check being such complex already currently, there are three limitations I am aware of wrt to it: * it will return success only in case the audit.rules have exactly the form (meaning order of various arguments) as expected / defined in the comment. Will have a look at possible permutations of -F ... arguments in the future yet (so it would pass also in case the rules are present there, but have one of the permutated forms), * it doesn't check if there isn't "Delete all rules" statement present somewhere in between / behind the audit rules definition (resulting not all of the rules to be actually taking into account by auditd). This is again space for future enhancement (will have a look), * for now the check has been tested & implemented just for RHEL-6. It's enhancement to cover RHEL-7 too will require more time & more testing. Again to come in subsequent version. Testing status: ------------------- The proposed check has been tested on RHEL-6 considering the following sub-cases that can happen & returns expected / appropriate result in each of them: 1) blank audit.rules file on the system -> returns FAIL V 2) audit.rules present, but no suid, no sgid rules defined -> returns FAIL V 3) audit.rules present, just suid audit rules defined -> returns FAIL V 4) audit.rules present, just sgid audit rules defined -> returns FAIL V 5) audit.rules present, both suid, sgid rules defined -> returns PASS v 6) audit.rules present, both suid / sgid, heading / trailing whitespace -> returns PASS v auditd doesn't allow comments in its config file (fails to restart if inline comment present) => this case isn't necessary to consider / cover. Please review. Thank you && Regards, Jan. --- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: Should you need to share testing scripts / scenario let me know.

2 2

no_files_unowned_by_group rule issue
by Kordell, Luke T 07 Jul '14

07 Jul '14

Hello, I have been having an issue with the no_files_unowned_by_group rule. I am running scans on both a local system and a remote vm and both systems are failing. The OVAL output for the local system suggests that five root-owned files are causing the failure. In actuality these files are root:root. When I run a find / -xdev -nogroup -print I receive a slew of files that really do not have group ownership. Initially I wrote this off as a simple oval-output error, however my vm also fails the check and has no group-unowned files. The oval output for that failed-rule indicates that a single root-owned file (/.autofsk) is responsible for the failure. Is there a known-issue with this rule? Failed files on Local System //console.txt //.Xauthority //.autofsk //rootk //ansys_inc Failed Files on VM //.autofsk Luke K

2 2

[PATCH] [RHEL/6] accounts_password_pam_cracklib_minclass XCCDF rule: * rename the remediation script to proper name * start using value of particular variable instead of hardcoded value of '3'
by Jan Lieskovsky 07 Jul '14

07 Jul '14

Rename original remediation script (password_require_minimum_class.sh) from: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=a38ece… to it's proper name (so remediation would actually perform the fix). Besides that replace the hardcoded value of '3' with evaluated value of $var_password_pam_cracklib_minclass variable (which can be actually set up to something different according to custom preferences). Also make the remediation fix implementation to complain / align more with actual requirements for the remediation fixes (include templates/support.sh etc.) Testing report: --------------- Change has been tested on RHEL-6 for both cases: * minclass already present in /etc/pam.d/system-auth, but having different value than expected / required, * minclass not present in /etc/pam.d/system-auth file and works properly. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

noexec and bash
by Stuart Green 03 Jul '14

03 Jul '14

Apologies if this is slightly 'offpiste'. One of the hardening parameters we use to stop execution of programs on certain partitions is noexec in fstab, this is a general C.I.S requirement. I believe the only requirement advising this in the context of this list is to do with Removable Media Partitions. I've noted myself that you can still execute bash scripts in these partitions by utilising /bin/sh (bash), in our environment /bin/sh is set to -rwxr-xr-x which I belive is an OOB setting, should this be refined to something more strict? Furthermore is there any SSG auditing on this? Thanks, Stuart

4 4

[PATCH 0/2] Allow shorthand format to accept variable_object & re-implement the audit_rules_privileged_commands OVAL check for RHEL-6
by Jan Lieskovsky 03 Jul '14

03 Jul '14

From 15f327359d03ee935c6fb7010b1f1c00c9571533 Mon Sep 17 00:00:00 2001 From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Thu, 3 Jul 2014 11:30:20 +0200 Subject: [PATCH 0/2] Allow shorthand format to accept variable_object & re-implement the audit_rules_privileged_commands OVAL check for RHEL-6 See further descriptions in each of the changes Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team Jan Lieskovsky (2): [*/transforms/idtranslate.py] Allow shorthand format to contain <ind:variable_object> definition [RHEL/6] (Re-)Implement audit_rules_privileged_commands OVAL check & start using it Fedora/transforms/idtranslate.py | 3 + OpenStack/transforms/idtranslate.py | 3 + .../checks/audit_rules_privileged_commands.xml | 188 ++++++++++++++++++--- RHEL/6/input/system/auditing.xml | 16 +- RHEL/6/transforms/idtranslate.py | 3 + RHEL/7/transforms/idtranslate.py | 3 + RHEVM3/transforms/idtranslate.py | 3 + 7 files changed, 192 insertions(+), 27 deletions(-) -- 1.8.3.1

1 0

RE: RHEL7 scanning (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 01 Jul '14

01 Jul '14

Classification: UNCLASSIFIED Caveats: NONE Hope I'm not being a bother, but if possible, would someone mind weighing in on this? Scanning on RHEL7 isn't particularly useful right now, and we'd like to lock it down as soon as possible. Thanks, -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support > -----Original Message----- > From: Shaw, Ray V CTR USARMY ARL (US) > Sent: Tuesday, June 24, 2014 10:31 AM > To: 'SCAP Security Guide' > Subject: RHEL7 scanning (UNCLASSIFIED) > > Classification: UNCLASSIFIED > Caveats: NONE > > By default, it looks like only the partition checks are enabled when > scanning with the stig-rhel7-server-upstream profile (on RHEL7). If I > edit > the profile to enable all of the ones that RHEL6 has enabled (and then > remove the few that don't exist for RHEL7), I get a total of 56 checks. > > [If anyone is curious, out of the box it passes 35 and fails 21, > assuming > it's partitioned correctly.] > > We're starting on RHEL7 to prepare our configuration management system, > etc. > for when 7 is blessed and we can deploy it, and of course STIGs are a > big > part of that. Is it reasonable to expect that they will closely > parallel > the RHEL6 STIG? Permissions/ownership, audit rules, sysctl, GDM, etc. > > Thanks, > > -- > Ray Shaw (Contractor, STG) > Army Research Laboratory > CIO, Unix Support > > > > Classification: UNCLASSIFIED > Caveats: NONE > Classification: UNCLASSIFIED Caveats: NONE

5 5

[PATCH] [RHEL] Make new 0.1.18 release
by Jan Lieskovsky 01 Jul '14

01 Jul '14

Hello folks, another 55 changes have been committed in between since the last 0.1.17 release: $ git log --format=%h --since=09-May-2014 | wc -l 56 so made a new 0.1.18 release: [1] http://repos.ssgproject.org/sources/scap-security-guide-0.1.18.tar.gz The attached patch has been (after testing) pushed to master (that's the 56-th change). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

4 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2014