August 2014 - scap-security-guide - Fedora mailing-lists

sshd banner warning
by Jeremiah Jahn 21 Jan '15

21 Jan '15

We used to have to keep out banners under /etc/issue for the console, and /etc/issue.net for remote access. Would it be okay to make this rule deal with either one? diff --git a/shared/oval/sshd_enable_warning_banner.xml b/shared/oval/sshd_enable_warning_banner.xml index 0bd8d32..ace8b75 100644 --- a/shared/oval/sshd_enable_warning_banner.xml +++ b/shared/oval/sshd_enable_warning_banner.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="obj_sshd_banner_set" version="2"> <ind:filepath>/etc/ssh/sshd_config</ind:filepath> - <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue(.net){0,1}[\s]*(?:|(?:#.*))?$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>

5 9

RE: New report and guide in openscap 1.1.0
by Chen, Wei (Contractor)(CFPB) 09 Sep '14

09 Sep '14

Couple comments on the report layout. • Rules result breakdown - while the color bar breakdown is nice, it doesn't present precise information at first glance. The user will see 86 passed, 131 failed, and left guessing what that remaining 6 rules are. It'll be nice to see the total number of rules as well. • Failed rules by severity breakdown – similar to rules results, the severity description got cut off even though it’s easy to assume that the two failed rules refer to High severity. • Score – it’ll be nice to have a brief explanation or reference to how the scoring is done for those not familiar with the scoring system. • Section heading – I think the number of “not checked” should also be included in the section heading along with fail and unknown. For example, I could’ve easily missed “Ensure Software Patches Installed” since it was collapsed within Updating Software section. Regards, Wei ----- Original Message ----- > From: "Martin Preisler" <mpreisle(a)redhat.com<mailto:mpreisle@redhat.com>> > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> > Sent: Thursday, August 28, 2014 7:49:23 PM > Subject: New report and guide in openscap 1.1.0 > > Hi, > > as you may know I have been working on a complete rewrite of HTML > report and guide for the upcoming openscap 1.1.0 release. It's a > feature that will touch almost every user of openscap. I would like to > gather feedback from the scap-security-guide community so that we can > make sure there aren't any blocker issues in the release. It is > natural that there will be small issues that we will iron out in minor > releases. Basically we would just like to make sure the new report and > guide aren't missing anything crucial that would prevent adoption. > > See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample > HTML report and guide from SSG for RHEL6. > > Looking forward to feedback. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/

2 3

Best ways to say this system is not compliant
by Greg Elin 04 Sep '14

04 Sep '14

Several participants in the thread "Re: New report and guide in openscap 1.1.0" raised concerned over a language "The system is not compliant!" in the report. I agree. "not compliant" ideally should only be done against a policy established by an organization for that system. The assessment and passing of any set of controls != compliance, it is a step toward compliance. Public profiles are, generally speaking, against *baselines*. It would be great if the use of OpenSCAP and SSG inspired/encouraged Departments and Agencies to develop and manage their own profiles that build on top of the baseline profiles. For example, if a test is run against a default profile, feedback should emphasize the profile is a default profile and encourage organization to maintain their own organizational profiles. Imagine if by default OpenSCAP tried to find to an agency's default repository of profiles. If no agency-defined repository existed, OpenSCAP would communicate it "No agency-specific profiles available. To create agency specific profiles blah, blah...OpenSCAP using default SCAP-Security-Guide baseline profile blah, blah, blah." This would constantly remind users they should be managing their own set of profiles. Of course, managing drift among agency specific profiles vs the baselines becomes another issue -- but that is something further for OpenSCAP and SSG to assist. Greg Elin http://govready.org - Making FISMA compliance easier for innovators email: gregelin(a)gitmachines.com phone: 917-304-3488

4 10

New report and guide in openscap 1.1.0
by Martin Preisler 02 Sep '14

02 Sep '14

Hi, as you may know I have been working on a complete rewrite of HTML report and guide for the upcoming openscap 1.1.0 release. It's a feature that will touch almost every user of openscap. I would like to gather feedback from the scap-security-guide community so that we can make sure there aren't any blocker issues in the release. It is natural that there will be small issues that we will iron out in minor releases. Basically we would just like to make sure the new report and guide aren't missing anything crucial that would prevent adoption. See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample HTML report and guide from SSG for RHEL6. Looking forward to feedback. -- Martin Preisler

8 30

Re: New report and guide in openscap 1.1.0
by Gabe Alford 01 Sep '14

01 Sep '14

On Fri, Aug 29, 2014 at 3:37 AM, Martin Preisler <mpreisle(a)redhat.com> wrote: > ----- Original Message ----- > > From: "Andrew Gilmore" <agilmore2(a)gmail.com> > > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org> > > Sent: Thursday, August 28, 2014 8:29:48 PM > > Subject: Re: New report and guide in openscap 1.1.0 > > > > I like the new look and functionality. > > > > Two first blush comments: > > 1) On the report document, I can imagine my security officials freaking > out > > over the in-your-face "*The system is not compliant!*" text. What is the > > recommended course to ensure this text does not appear if you're running > > the scan on a webserver, for example? Is it as simple as creating a > custom > > profile derived from the STIG profile? Does anyone directly use the STIG > > profile, have a completely compliant system, and have a server that > > actually does anything useful? > > Up to now, I've left tests in that I have waivers for, and then pointed > at > > the waivers to justify the test failures. Perhaps I will need to change > > that practice. > > Isn't that a good thing? They should freak out, their system is not > compliant! > The recommended course is to tailor the profile, leaving out rules that > make > no sense on your system. Then you fix the remaining rules using > remediation. > In the end the machine will be compliant. > I would maybe add or modify the message here to be something along the lines: - "The system is not compliant! Please review rule results, site/network security requirements, and consider applying remediation." --- or --- - "The system may not be compliant! Please review rule results, site/network security requirements, and consider applying remediation." I personally would prefer the last one as it says, "Hey. Check your system as well as check your security requirements to see if what you are seeing from the scan matches with those security requirements." The job of openscap is to check your machines for compliance over and over. > When the machines are suddenly not compliant you really want to know that! > > > 2) On the guide document, the text beginning "Providing system > > administrators" occurs twice. > > Looks like an issue with SSG but I will look more into it. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ >

4 5

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

[jFYI / ahead notification] scap-security-guide-0.1.19 coming next week => submit pull requests for any pending patches / changes soon (till next Wed, 2014-09-03)
by Jan Lieskovsky 28 Aug '14

28 Aug '14

Hello folks, jFYI mail that again the time to make a new upstream SSG release has come (116 existing changes since the last 0.1.18 one): $ git describe v0.1.18-116-g27c9ee2 Therefore in accordance with the previously discussed release policy (and actually later than first Friday in the month -- the delay caused due to summer vacation) this time next week I plan to make new upstream 0.1.19 release. Thus would like to kindly ask you that in case you have any pending patches which should go into 0.1.19 release yet, to submit corresponding pull requests soon (till Wed of next week), so they could be reviewed on time. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

Baseline configs & DevOps code-a-thon
by Greg Elin 27 Aug '14

27 Aug '14

Double posting to Scap-Security-Guide and OpenSCAP mailing list... Can I get a show of hands a late September or early October, one or two day code-a-thon around baseline configurations and integrating compliance tools with DevOps? The space of SCAP, baselines, and general integration of security with DevOps seems to be getting frothy lately with activity. Examples: http://bit.ly/DevOpsAudit, OpenSCAP on Github, https://github.com/fisma-ready/ubuntu-lts. We also have some work, like http://martin.preisler.me/2014/07/openscap-html-report-redesign/ that could benefit from some shared face time and coding. I think there would be a nice turn out in DC for such an event. Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

5 8

Onwards, to GitHub
by Shawn Wells 27 Aug '14

27 Aug '14

Migration to GitHub has been discussed for some time. As preparation for this, over the past few months, the OpenSCAP community of projects have slowly established mirrors of their source repositories at https://github.com/OpenSCAP. Off the OpenSCAP project page you'll find: - Tooling: OpenSCAP Toolkit, SCAP Workbench; - Content: SCAP Security Guide, SCE Community Content; - Ecosystem Projects: Anaconda OpenSCAP Add-On, OpenSCAP Puppet extensions, Foreman integration The idea was to provide a single source repository for the various components, and many thanks to Martin Preisler for setting all this up! For the past two weeks, community members with commit access were asked to start using GitHub as SSG's upstream repository. We wanted to test repository access controls (thanks Greg Elin!), GitHub-style workflows (thanks, everyone), and acclimate to any process changes. The migration has been straightforward, and the new Pull Request process is working well. Hopefully, no more dropped patches or bug reports :) *You can find SSG's repository here:* https://github.com/OpenSCAP/scap-security-guide *We've also started a "SSG on GitHub Primer," for which patches would be most welcome:* https://github.com/OpenSCAP/scap-security-guide/wiki/SSG-on-GitHub-Primer For those who are curious, an example of the Pull Request process (how patches are displayed, how feedback can be given) can be found in the 'Add OVAL for CTRL+ALT+DELETE key sequence" patch: https://github.com/OpenSCAP/scap-security-guide/pull/31 The Pull Request process does mean that patches need not be sent to the mailing list anymore. While pull requests will be centrally managed on a dashboard (of sorts), that does mean members of the community may miss out on dialogs relating to code changes. To ensure you don't miss anything you can setup yourself to "Watch" the project on GitHub. When you 'watch' a project, you are presented with three options: - EMailed only upon mentioning of the project in discussion, or if someone mentions you directly; - EMailed upon every action (patch submissions, comments, tickets, comments on tickets...); - EMailed never, ever Note than when you receive an EMail notification (say, a comment on a patch), you can reply directly from EMail. There's no need to login to GitHub to join the conversation. When you login to GitHub, on the top right, you'll see a section that looks like this: When you click on the "Watch" button you're presented with the three options: GitHub does reflect new processes and a new system for community engagement. Feedback as we migrate is most welcome on the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide. See everyone on GitHub! -Shawn

2 1

On the purpose of cpe_generate.py script (& mainly cpe_variables section within it)
by Jan Lieskovsky 27 Aug '14

27 Aug '14

Hello folks, within effort to rewrite umask checks (more about the motivation for this later within its dedicated email thread) encountered the following RHEL/6/transforms/cpe_generate.py script related issue. Use case: Let's consider RHEL/6/input/checks/accounts_umask_etc_profile.xml OVAL check would have the form as attached (it's not the final form of the check. The final one will be slightly more complex yet. In any case the attached form is syntactically correct one & sufficient to demonstrate the issue I would like to speak below about), then running 'make' in scap-security-guide/RHEL/6 subdirectory returns the following error when trying to generate the datastream output: oscap ds sds-compose output/ssg-rhel6-xccdf-1.2.xml output/ssg-rhel6-ds.xml oscap ds sds-add output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-ds.xml File 'output/ssg-rhel6-ds.xml' line 32236: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}object_component': No match found for key-sequence ['oval:ssg:obj:111'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}objectKeyRef'. Invalid SCAP Source Datastream content(1.2) in output/ssg-rhel6-ds.xml. make: *** [content] Error 1 Investigated the problem further, and noticed the problem is content of RHEL/6/output/ssg-rhel6-cpe-oval.xml file. Namely it contains the content as follows: ... </states><variables><local_variable id="oval:ssg:var:110" datatype="int" comment="x" version="1"> <substring substring_start="1" substring_length="1"> <object_component item_field="subexpression" object_ref="oval:ssg:obj:111"/> </substring> </local_variable> </variables></oval_definitions> which after more detailed look explains why 'oval:ssg:obj:111' wouldn't be defined in output/ssg-rhel6-ds.xml file (the oval:ssg:var:110 local variable references oval:ssg:obj:111, but this object isn't defined within that ssg-rhel6-cpe-oval.xml file [only in different part of ssg-rhel6-ds.xml file]). So investigated further to see, which part of the RHEL/6's Makefile generates / includes this variable, when creating ssg-rhel6-cpe-oval.xml file, and noticed the responsible script being RHEL/6/transforms/cpe_generate.py. The questions: 1) Can someone more familiar with the implementation of this script clarify it's purpose? It requires two input files (OVAL file & CPE file), and one identifier (ssg), and generates 'ssg-rhel6-cpe-oval.xml' file. 2) Can someone more familiar with the implementation of this script clarify the need for the following construct within it?: 82 variables = ovaltree.find("./{%s}variables" % oval_ns) 83 cpe_variables = extract_referred_nodes(ovaltree, variables, "var_ref") 84 if cpe_variables: 85 variables.clear() 86 [variables.append(cpe_variable) for cpe_variable in cpe_variables] 87 else: 88 ovaltree.remove(variables) Is it there to (when generating ssg.ini object name to object id file) to incorporate also OVAL local_variables that might reference another variables via the "var_ref" attribute? The reason why I am asking being that have noticed, when I comment out the following part of this file (IOW when the cpe_generate.py script has the following form around the critical lines): 82 variables = ovaltree.find("./{%s}variables" % oval_ns) 83 #cpe_variables = extract_referred_nodes(ovaltree, variables, "var_ref") 84 #if cpe_variables: 85 # variables.clear() 86 # [variables.append(cpe_variable) for cpe_variable in cpe_variables] 87 #else: 88 ovaltree.remove(variables) the aforementioned error message: File 'output/ssg-rhel6-ds.xml' line 32236: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}object_component': No match found for key-sequence ['oval:ssg:obj:111'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}objectKeyRef'. when generating ssg-rhel6-ds.xml isn't reported anymore & the content builds successfully. Since I wouldn't like to break something, the purpose of this email is to ask someone more familiar with the implementation of cpe_generate.py script, why the cpe_variables section (lines from #83 up to #87 need to be present there)? Is there a chance this behaviour is somehow related with the following commit: [1] https://github.com/OpenSCAP/scap-security-guide/commit/59d650ffe140e4ae742d… ? For example in the sense the original meaning of 'cpe_variables' part of cpe_generate.py was to include also variables, that reference other variables via 'var_ref' attribute into final ssg.ini file (and assign IDs in the form of "oval:ssg:var:..." to them too)? But the change [1] is causing variable objects having 'var_ref' attribute is now included within relabelids.py script & therefore the 'cpe_variables' section of the cpe_generate.py script is not needed anymore & can be safely remove as suggested above (or in the also attached RHEL_6_transforms_cpe_generate_py.diff patch)? Any hints you can provide wrt to observed cpe_generate.py behaviour & how to possibly fix it are appreciated. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: If wondering why this problem didn't show earlier, assuming there isn't such construct (local_variable referencing another local_variable referencing textfilecontent54_object) used in the current content yet. Tried also different approach (encapsulate those local_variables into variable_objects & reference those objects instead), but it didn't help (in the sense datastream output would be successfully generated).

2 2

Anyone using rhel6 ssg for centos6?
by Pettorino, Jeffrey D CTR USAF USAFA USAFA/DFAN 22 Aug '14

22 Aug '14

I have been trying to get oscap working on my CentOS6.5 network core, without luck. Everything comes back with "Result notapplicable". I am pretty new to SCAP and XCCDF, but am a long-time user of Nessus and Security Center (prior to ACAS program by DISA). Does anyone have suggestions where I can find some in depth guidance to adjust the rhel6 configs to CentOS? -- Jeff v/r, Jeffrey D. Pettorino, GCIH, CISSP Systems Engineer High Performance Computing Research Center United States Air Force Academy Jeffrey.Pettorino.ctr(a)USAFA.edu 719/333-9391 ---- The use of the Unix philosophy just for UNIX was a great waste. Fortunately, Linux came along. - Bellevue Linux User Group member, 2005

17 39

git pull request - enabling gconf-tree.xml OAVL support (#22)
by Gabe Alford 18 Aug '14

18 Aug '14

Hello, I have a git pull request waiting for review at https://github.com/OpenSCAP/scap-security-guide/pull/22. If ack'ed, it would need to be merged by project collaborators. Thanks, Gabe

2 2

selinux_all_devicefiles_labeled not working
by Jeremiah Jahn 14 Aug '14

14 Aug '14

this just isn't working at all and returns a false positive

3 2

[PATCH] Update C2S profile <description> per request from CIS
by Shawn Wells 14 Aug '14

14 Aug '14

The prior wording of the C2S profile contained a statement that the C2S profile, as it is derived from CIS' publicly available RHEL6 Benchmark [1], could measure a system against the CIS RHEL6 baseline. We have been informed that per CIS' terms and conditions, specifically under RESTRICTIONS, item #8, one may not "represent or claim a particular level of compliance or consistency with any SB product." To remain in compliance with CIS' request, this patch updates the C2S profile description to indicate that while the C2S profile may be sourced from the public, freely available CIS benchmark, no representation or claim to a particular level of compliance or consistency is being made. CIS is eager to collaborate more closely with the community (and Red Hat) on guidance development, in particular through the SCAP Security Guide. They have expressed that having automated security guidance and workflows ship with the Operating System is definitely a positive step, and one they encourage. Unfortunately, we were unable to reconcile the CIS Terms and Conditions to provide a freely available SCAP profile against the CIS baseline. When faced with the choice of paying ~$20,000 license fees [2], or rewording references to CIS compliance, the later was chosen. [1] https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux… mark_v1.2.0.pdf [2] http://benchmarks.cisecurity.org/membership/certified/overview/ Signed-off-by: Shawn Wells <shawn(a)redhat.com> --- RHEL/6/input/profiles/C2S.xml | 504 ++++++++++++++++++++--------------------- 1 files changed, 250 insertions(+), 254 deletions(-) diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.xml index 282da6a..ef97fc2 100644 --- a/RHEL/6/input/profiles/C2S.xml +++ b/RHEL/6/input/profiles/C2S.xml @@ -1,19 +1,15 @@ <Profile id="C2S"> <title>C2S for Red Hat Enterprise Linux 6</title> <description>This profile demonstrates compliance against the -U.S. Government C2S baseline. - -This baseline is tied to the Center for Internet Security's -Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013, -and uses the same refine values. One could use C2S interchangably -with CIS v1.2.0. For a copy of the CIS RHEL6 benchmark, refer -to: -https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.2.0.pdf - -This profile is not production ready and should be considered -development preview. As of 13-APR-2014, Out of the 233 -policy-mandated checks, only 169 currently have associated OVAL. -Patches would be most welcome! +U.S. Government Commercial Cloud Services (C2S) baseline. + +This baseline was inspired by the Center for Internet Security +(CIS) Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013. +For the SCAP Security Guide project to remain in compliance with +CIS' terms and conditions, specifically Restrictions(8), note +there is no representation or claim that the C2S profile will +ensure a system is in compliance or consistency with the CIS +baseline. </description>  @@ -26,698 +22,698 @@ Patches would be most welcome!  - - + <select idref="partition_for_tmp" selected="true"/> - + <select idref="mount_option_tmp_nodev" selected="true" /> - + <select idref="mount_option_tmp_nosuid" selected="true" /> - + <select idref="mount_option_tmp_noexec" selected="true" /> - + <select idref="partition_for_var" selected="true"/> - + <select idref="mount_option_var_tmp_bind_var" selected="true" /> - + <select idref="partition_for_var_log" selected="true"/> - + <select idref="partition_for_var_log_audit" selected="true"/> - + <select idref="partition_for_home" selected="true"/> - + <select idref="mountopt_nodev_on_nonroot_partitions" selected="true" /> - + <select idref="mountopt_nodev_on_removable_partitions" selected="true" /> - + <select idref="mount_option_noexec_removable_partitions" selected="true" /> - + <select idref="mountopt_nosuid_on_removable_partitions" selected="true" /> - + <select idref="mount_option_dev_shm_nodev" selected="true" /> - + <select idref="mount_option_dev_shm_nosuid" selected="true" /> - + <select idref="mount_option_dev_shm_noexec" selected="true" /> - + <select idref="sticky_world_writable_dirs" selected="true" /> - + <select idref="kernel_module_cramfs_disabled" selected="true" /> - + <select idref="kernel_module_freevxfs_disabled" selected="true" /> - + <select idref="kernel_module_jffs2_disabled" selected="true" /> - + <select idref="kernel_module_hfs_disabled" selected="true" /> - + <select idref="kernel_module_hfsplus_disabled" selected="true" /> - + <select idref="kernel_module_squashfs_disabled" selected="true" /> - + <select idref="kernel_module_udf_disabled" selected="true" /> - - + +  - + <select idref="ensure_redhat_gpgkey_installed" selected="true"/> - + <select idref="ensure_gpgcheck_globally_activated" selected="true"/> <select idref="ensure_gpgcheck_never_disabled" selected="true"/> - + <select idref="service_rhnsd_disabled" selected="true"/> - +  - + <select idref="rpm_verify_permissions" selected="true" /> <select idref="rpm_verify_hashes" selected="true" /> - - + + <select idref="package_aide_installed" selected="true" /> - + <select idref="disable_prelink" selected="true" /> <select idref="aide_build_database" selected="true" /> <select idref="aide_periodic_cron_checking" selected="true" /> - - + + <select idref="enable_selinux_bootloader" selected="true" /> - + <select idref="selinux_state" selected="true" /> - + <select idref="selinux_policytype" selected="true" /> - + <select idref="package_setroubleshoot_removed" selected="true" /> - + <select idref="package_mcstrans_removed" selected="true" /> - + <select idref="selinux_confinement_of_daemons" selected="true" /> - - + + <select idref="user_owner_grub_conf" selected="true"/> <select idref="group_owner_grub_conf" selected="true"/> - + <select idref="permissions_grub_conf" selected="true"/> - + <select idref="bootloader_password" selected="true"/> - + <select idref="require_singleuser_auth" selected="true"/> - + <select idref="disable_interactive_boot" selected="true"/> - - + + <select idref="disable_users_coredumps" selected="true" /> <select idref="sysctl_fs_suid_dumpable" selected="true" /> - + <select idref="sysctl_kernel_exec_shield" selected="true"/> - + <select idref="sysctl_kernel_randomize_va_space" selected="true"/> - - - - + + + + <select idref="uninstall_telnet_server" selected="true"/> - + <select idref="package_telnet_removed" selected="true" /> - + <select idref="uninstall_rsh-server" selected="true"/> - + <select idref="package_rsh_removed" selected="true" /> - + <select idref="package_ypbind_removed" selected="true" /> - + <select idref="uninstall_ypserv" selected="true" /> - + <select idref="package_tftp_removed" selected="true" /> - + <select idref="uninstall_tftp-server" selected="true"/> - +  - +  - + <select idref="uninstall_xinetd" selected="true"/> - +  - +  - +  - +  - +  - +  - +  - - + + <select idref="umask_for_daemons" selected="true" /> - + <select idref="packagegroup_xwindows_remove" selected="true" /> - + <select idref="disable_avahi" selected="true" /> - + <select idref="service_cups_disabled" selected="true" /> - + <select idref="uninstall_dhcp_server" selected="true" /> - + <select idref="service_ntpd_enabled" selected="true" /> <select idref="ntpd_specify_remote_server" selected="true" /> <select idref="ntpd_specify_multiple_servers" selected="true" /> - + <select idref="package_openldap-servers_removed" selected="true" /> - +  - +  - + <select idref="uninstall_vsftpd" selected="true" /> - + <select idref="uninstall_httpd" selected="true" /> - +  - +  - +  - + <select idref="uninstall_net-snmp" selected="true"/> - + <select idref="postfix_network_listening" selected="true" /> - - - + + + <select idref="sysctl_ipv4_ip_forward" selected="true"/> - + <select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/> <select idref="sysctl_ipv4_all_send_redirects" selected="true"/> - - + + <select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/> <select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/> - + <select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/> <select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/> - + <select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/> <select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/> - + <select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true"/> - + <select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/> - + <select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/> - + <select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true"/> <select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true"/> - + <select idref="sysctl_net_ipv4_tcp_syncookies" selected="true"/> - - + + <select idref="wireless_disable_in_bios" selected="true" /> <select idref="deactivate_wireless_interfaces" selected="true" /> - - - + + + <select idref="sysctl_net_ipv6_conf_default_accept_ra" selected="true" />  - + <select idref="sysctl_ipv6_default_accept_redirects" selected="true" />  - + <select idref="network_ipv6_disable_interfaces" selected="true" /> - - + +  - +  - +  - +  - +  -  - - + + + <select idref="kernel_module_dccp_disabled" selected="true"/> - + <select idref="kernel_module_sctp_disabled" selected="true"/> - + <select idref="kernel_module_rds_disabled" selected="true"/> - + <select idref="kernel_module_tipc_disabled" selected="true"/> - + <select idref="service_iptables_enabled" selected="true"/> - + <select idref="service_ip6tables_enabled" selected="true"/> - - - + + + <select idref="package_rsyslog_installed" selected="true"/> - + <select idref="service_rsyslog_enabled" selected="true"/> - +  - + <select idref="rsyslog_file_permissions" selected="true"/> - + <select idref="rsyslog_send_messages_to_logserver" selected="true"/> - + <select idref="rsyslog_accept_remote_messages_none" selected="true" /> - - - + + + <select idref="configure_auditd_max_log_file" selected="true"/> - + <select idref="auditd_data_retention_space_left_action" selected="true" /> <select idref="auditd_data_retention_action_mail_acct" selected="true" /> <select idref="auditd_data_retention_admin_space_left_action" selected="true" /> - + <select idref="configure_auditd_max_log_file_action" selected="true" /> - + <select idref="service_auditd_enabled" selected="true"/> - + <select idref="enable_auditd_bootloader" selected="true"/> - + <select idref="audit_rules_time_adjtimex" selected="true" /> <select idref="audit_rules_time_settimeofday" selected="true" /> <select idref="audit_rules_time_stime" selected="true" /> <select idref="audit_rules_time_watch_localtime" selected="true" /> - + <select idref="audit_account_changes" selected="true" /> - + <select idref="audit_network_modifications" selected="true" /> - + <select idref="audit_mac_changes" selected="true" /> - + <select idref="audit_manual_logon_edits" selected="true" /> - + <select idref="audit_manual_session_edits" selected="true" /> - + <select idref="audit_dac_actions" selected="true" /> - + <select idref="audit_rules_unsuccessful_file_modification" selected="true" /> - + <select idref="audit_privileged_commands" selected="true" /> - + <select idref="audit_media_exports" selected="true" /> - + <select idref="audit_rules_file_deletion_events" selected="true" /> - + <select idref="audit_sysadmin_actions" selected="true" /> - +   - + <select idref="audit_kernel_module_loading" selected="true" /> - + <select idref="audit_config_immutable" selected="true" /> - + <select idref="ensure_logrotate_activated" selected="true" /> - - - + + +    - + <select idref="service_crond_enabled" selected="true" /> - +  - +  - +  - +  - +  - +  - +  - + <select idref="service_atd_disabled" selected="true" /> - +  - - + + <select idref="sshd_allow_only_protocol2" selected="true" /> - +  - +  - +  - +  - + <select idref="sshd_disable_rhosts" selected="true" /> - + <select idref="disable_host_auth" selected="true" /> - + <select idref="sshd_disable_root_login" selected="true" /> - + <select idref="sshd_disable_empty_passwords" selected="true" /> - - + + <select idref="sshd_use_approved_ciphers" selected="true" /> - + <select idref="sshd_set_idle_timeout" selected="true" /> - + <select idref="sshd_limit_user_access" selected="true" /> - + <select idref="sshd_enable_warning_banner" selected="true" /> - - + + <select idref="set_password_hashing_algorithm" selected="true" /> - + <select idref="password_quality_pamcracklib" selected="true" /> - + <select idref="accounts_passwords_pam_faillock_deny" selected="true" /> - + <select idref="accounts_password_reuse_limit" selected="true" /> - + <select idref="no_direct_root_logins" selected="true" /> - +  - - - + + + <select idref="accounts_maximum_age_login_defs" selected="true" /> - + <select idref="accounts_minimum_age_login_defs" selected="true" /> - + <select idref="accounts_password_warn_age_login_defs" selected="true" /> - + <select idref="no_shelllogin_for_systemaccounts" selected="true" /> - +  - + <select idref="accounts_umask_bashrc" selected="true" /> <select idref="accounts_umask_etc_profile" selected="true" /> - + <select idref="account_disable_post_pw_expiration" selected="true" /> - + - + <select idref="set_system_login_banner" selected="true" /> - +  - + <select idref="enable_gdm_login_banner" selected="true" /> <select idref="set_gdm_login_banner_text" selected="true" /> - - - + + +  - + <select idref="file_permissions_etc_passwd" selected="true" /> - + <select idref="file_permissions_etc_shadow" selected="true" /> - + <select idref="file_permissions_etc_gshadow" selected="true" /> - + <select idref="file_permissions_etc_group" selected="true" /> - + <select idref="file_owner_etc_passwd" selected="true" /> <select idref="file_groupowner_etc_passwd" selected="true" /> - + <select idref="userowner_shadow_file" selected="true" /> <select idref="groupowner_shadow_file" selected="true" /> - + <select idref="file_owner_etc_gshadow" selected="true" /> <select idref="file_groupowner_etc_gshadow" selected="true" /> - + <select idref="file_owner_etc_group" selected="true" /> <select idref="file_groupowner_etc_group" selected="true" /> - + <select idref="file_permissions_binary_dirs" selected="true" /> <select idref="world_writeable_files" selected="true" /> - + <select idref="no_files_unowned_by_user" selected="true" /> - + <select idref="no_files_unowned_by_group" selected="true" /> - + <select idref="no_unpackaged_suid_files" selected="true" /> - + <select idref="no_unpackaged_sgid_files" selected="true" /> - - + + <select idref="no_empty_passwords" selected="true" /> - +  - +  - +  - + <select idref="accounts_no_uid_except_zero" selected="true" /> - + <select idref="root_path_default" selected="true" /> - + <select idref="homedir_perms_no_groupwrite_worldread" selected="true" /> - +  - +  - + <select idref="no_rsh_trust_files" selected="true" /> - + <select idref="gid_passwd_group_same" selected="true" /> - +  - +  - + <select idref="account_unique_name" selected="true" /> - +  - +  - +  - - + + - + <select idref="no_netrc_files" selected="true" /> - +  -- 1.7.1

2 3

root_path_no_groupother_writable false positive
by Jeremiah Jahn 14 Aug '14

14 Aug '14

this is currently returning a false positive

1 0

no_files_unowned_by_user needs to be tightened down
by Jeremiah Jahn 14 Aug '14

14 Aug '14

It currently includes /proc in which nothing seems to be owned by anyone. path type UID GID size permissions /proc/16815/ns/pid symbolic link 0 0 0 rwxrwxrwx /proc/16815/net/ip_tables_targets regular 0 0 0 r--r-----

1 0

faillock related descriptions are wrong and dangerous
by Jeremiah Jahn 12 Aug '14

12 Aug '14

accounts_passwords_pam_fail_interval and accounts_passwords_pam_faillock_unlock_time have bad description The description needs to be changed in these from currently telling the user to put them under pam_env.so to under pam_unix.so. Also there are a number of things you have to do. And I'll walk though this example so you can see. normal pam system-auth file, same allied for password file auth required pam_env.so auth [success=1 default=bad] pam_unix.so auth [default=die] pam_faillock.so authfail deny=3 even_deny_root unlock_time=604800 fail_interval=900 auth sufficient pam_faillock.so authsucc deny=3 even_deny_root unlock_time=604800 fail_interval=900 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so fist things first. you must skip the authfail on a successful login, and set default equal to bad. the faillock authfail will ALWAYS lock the user out if run. Which is why if you follow the guidance, you'll brick your machine. so pam_unix.so must be set to [success=1 default=bad]. second pam_faillock.so authsucc must be set to sufficient, and always placed before pam_deny. your description currently says required, but you've got to alter unix.so to fall through on success instead of simply being sufficient, so now pam_faillock.so authsucc has to be sufficient to pick up the slack. The test for this is also going to have to be rewritten as well. -jj-

3 4

RHEL 6.6 beta released, includes SCAP Security Guide!
by Shawn Wells 12 Aug '14

12 Aug '14

RHEL 6.6 beta was released this morning: http://www.redhat.com/about/news/archive/2014/8/red-hat-enterprise-linux-6.… And as mentioned, includes SSG!: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6-Be… Testing and bugfixes most welcome. URL for RHEL 6.6 beta download: https://access.redhat.com/downloads/content/69/ver=/rhel---6/6.6%20Beta/x86…

2 1

[PATCH] SSH + CAC Card Guidance
by Shawn Wells 11 Aug '14

11 Aug '14

Include SSH+CAC doc reference Shawn Wells (1): Updated Smart Card XCCDF to reflect SSH+CAC docs RHEL/6/input/system/accounts/physical.xml | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)

3 5

[PATCH 0/3][bugfix] - sshd OVAL false positives
by Gabe Alford 08 Aug '14

08 Aug '14

These patches fix some OVAL false positives for SSH configuration checks that were showing that they had passed even when they were not configured in sshd_config. Thanks, Gabe Gabe (3): [bugfix] - disable_host_auth OVAL false positive [bugfix] - sshd_disable_rhosts OVAL false positive [bugfix] - sshd_disable_root_login OVAL false positive shared/oval/disable_host_auth.xml | 4 ++-- shared/oval/sshd_disable_rhosts.xml | 4 ++-- shared/oval/sshd_disable_root_login.xml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) -- 2.0.0

2 16

[PATCH 0/1] (Resubmit) add oval for aide cron job
by Gabe Alford 08 Aug '14

08 Aug '14

Add oval for aide to check that it is running in a cron job. This is a resubmit. Thanks, Gabe Alford Gabe (1): add aide cron oval check .../6/input/checks/aide_periodic_cron_checking.xml | 39 ++++++++++++++++++++++ .../fixes/bash/aide_periodic_cron_checking.sh | 1 + RHEL/6/input/system/software/integrity.xml | 1 + 3 files changed, 41 insertions(+) create mode 100644 RHEL/6/input/checks/aide_periodic_cron_checking.xml create mode 100644 RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh -- 2.0.0

1 2

[PATCH] resubmit -- adding CAC links
by Shawn Wells 07 Aug '14

07 Aug '14

Shawn Wells (1): resubmit - Updated Smart Card XCCDF to reflect SSH+CAC docs RHEL/6/input/system/accounts/physical.xml | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-)

2 3

system auth password hashing algorithm can also be required right?
by Jeremiah Jahn 06 Aug '14

06 Aug '14

not just sufficient? diff --git a/shared/oval/set_password_hashing_algorithm_systemauth.xml b/shared/oval/set_password_hashing_algorithm_systemauth.xml index 8a5525e..2d71e8b 100644 --- a/shared/oval/set_password_hashing_algorithm_systemauth.xml +++ b/shared/oval/set_password_hashing_algorithm_systemauth.xml @@ -20,7 +20,7 @@ <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="object_pam_unix_sha512" version="1"> <ind:filepath>/etc/pam.d/system-auth</ind:filepath> - <ind:pattern operation="pattern match">^[\s]*password[\s]+sufficient[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>

3 6

my kernels all live in /boot/vmlinuz by default
by Jeremiah Jahn 05 Aug '14

05 Aug '14

diff --git a/RHEL/6/input/checks/bootloader_audit_argument.xml b/RHEL/6/input/checks/bootloader_audit_argument.xml index e22bb17..fdbca28 100644 --- a/RHEL/6/input/checks/bootloader_audit_argument.xml +++ b/RHEL/6/input/checks/bootloader_audit_argument.xml @@ -17,7 +17,7 @@ <ind:textfilecontent54_object id="object_bootloader_audit_argument" version="1"> <ind:path>/etc</ind:path> <ind:filename>grub.conf</ind:filename> - <ind:pattern operation="pattern match">^\s*kernel\s/vmlinuz.*audit=1.*$</ind:pattern> + <ind:pattern operation="pattern match">^\s*kernel\s(/boot){0,1}/vmlinuz.*audit=1.*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>

2 1

[PATCH v#2] [RHEL/7, Fedora] Include SSG logo into generated HTML guide if underlying system oscap version supports it
by Jan Lieskovsky 05 Aug '14

05 Aug '14

Hello folks, this is the second version of the logo inclusion patches for RHEL-7 & Fedora products. Testing report: --------------- Tested on both platforms for both scenarios oscap (not) / supporting <svg> elements presence. The change returns expected results. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH v#2] [RHEL/6] Include SSG logo into generated HTML guide if underlying oscap version on the system supports <svg> element to be present within <front-matter> element of the <xccdf:benchmark>
by Jan Lieskovsky 05 Aug '14

05 Aug '14

Hello folks, based on the feedback (not good to hardcode arbitrary versions / dependencies in transform scripts) from: [1] https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-July/0058… attached below is the version #2 of the patch, that should ensure inclusion of the SSG logo into HTML guide as generated from RHEL-6 content. The logo will be included only in case underlying oscap package version supports presence of <svg> XHTML element to be present within the <front-matter> element of the <xccdf:benchmark>. The difference between the first version being that instead of hardcoding / requiring certain (1.0.9) version of the openscap RPM package to be present on the system, in this version we before generating the guide first check (via simplified benchmark) if <svg> presence is supported, and in case it is, we include the logo. In case it isn't (HTML guide from simplified benchmark doesn't contain corresponding form of <svg> content), we leave <front-matter> intact (as is). Testing report: --------------- The proposed change has been tested on both: * openscap versions supporting <svg> elements (X >= 1.0.9), and * openscap versions not supporting <svg> inclusion yet and works properly in both cases. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

accounts_root_path_dirs_no_write not working correctly?
by Jeremiah Jahn 01 Aug '14

01 Aug '14

The split result in this class don't seem to be treated as separate paths in the var_ref of the path element. I can't quite wrap my head around how to fix this. Is there any info I can send to the list to help resolve this? thanks, -jj-

1 0

isn't /dev/null also a valid nologin option for system accounts
by Jeremiah Jahn 01 Aug '14

01 Aug '14

There seems to be some debate on this, but I think /dev/null should be a valid setting for system accounts diff --git a/shared/oval/no_shelllogin_for_systemaccounts.xml b/shared/oval/no_shelllogin_for_systemaccounts.xml index d38e4bb..aeda9d5 100644 --- a/shared/oval/no_shelllogin_for_systemaccounts.xml +++ b/shared/oval/no_shelllogin_for_systemaccounts.xml @@ -18,7 +18,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_no_shelllogin_for_systemaccounts" version="1"> <ind:filepath>/etc/passwd</ind:filepath> - <ind:pattern operation="pattern match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern> + <ind:pattern operation="pattern match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/dev\/null).*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>

1 0

fix for including /home in /home dir permissions
by Jeremiah Jahn 01 Aug '14

01 Aug '14

the actual /home dir should be world readable I think, there for should be included in the permission checks. diff --git a/RHEL/6/input/checks/file_permissions_home_dirs.xml b/RHEL/6/input/checks/file_permissions_home_dirs.xml index e0d671f..e9757a8 100644 --- a/RHEL/6/input/checks/file_permissions_home_dirs.xml +++ b/RHEL/6/input/checks/file_permissions_home_dirs.xml @@ -16,8 +16,8 @@ <unix:state state_ref="state_home_dirs_wrong_perm" /> </unix:file_test> <unix:file_object comment="home directories" id="object_file_permissions_home_dirs" version="1"> - <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" /> - <unix:path operation="equals">/home</unix:path> + <unix:behaviors recurse="directories" recurse_direction="down" max_depth="0" recurse_file_system="all" /> + <unix:path operation="pattern match">^/home/[^/]*$</unix:path> <unix:filename xsi:nil="true" /> <filter action="include">state_home_dirs_wrong_perm</filter> </unix:file_object>

1 0

[PATCH] [bugfix] Updating verify-references.py
by David Smith 01 Aug '14

01 Aug '14

Discovered during a RHT presentation this morning that there was still a reference to 800-53 rev3 in the content. Rechecked after modifying the verify-references.py file: [dave@localhost 6]$ ls output/ bash-remediations.xml ssg.ini ssg-rhel6-ocil.xml unlinked-notest-rhel6-xccdf-guide.xml unlinked-rhel6-xccdf.xml images ssg-ocilrefs-rhel6-xccdf.xml ssg-rhel6-oval.xml unlinked-ocilrefs-rhel6-xccdf.xml unlinked-unresolved-rhel6-xccdf.xml rhel6-guide-custom.html ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf-1.2.xml unlinked-rhel6-ocil.xml rhel6-guide.html ssg-rhel6-cpe-oval.xml ssg-rhel6-xccdf-nodangles.xml unlinked-rhel6-oval.xml rhel6-shorthand.xml ssg-rhel6-ds.xml ssg-rhel6-xccdf.xml unlinked-rhel6-xccdf-guide.xml [dave@localhost 6]$ grep -ri rev3 output/ [dave@localhost 6]$ David Smith (1): [bugfix] Modified verify-references.py to reflect 800-53 rev4 RHEL/6/utils/verify-references.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2014