scap-security-guide June 2016

scap-security-guide@lists.fedorahosted.org

12 participants
6 discussions

SCAP Security Guide 0.1.30
by Jan Lieskovsky 12 Sep '16

12 Sep '16

Hello folks, it's my pleasure and honor to announce that SCAP Security Guide release 0.1.30 has been created and is now available for download. Highlights of this release: * CNSS No.1253 (nist-CL-IL-AL) profile has been ported to Red Hat Enterprise Linux 7, * SCAP benchmark for Red Hat Enterprise Linux 7 now passes official NIST SCAP ScapVal-1.2.14.1 content validation tool requirements, * The XCCDF rules for Red Hat Enterprise Linux 7 has been equipped with CCE identifiers, * New CJIS "Criminal Justice Information Services (CJIS) Security Policy" profile has been added to Red Hat Enterprise Linux 7 benchmark, * Profile for each ANSSI hardening level for NP targets has been added to Debian 8 benchmark, * Remediation scripts don't rely on external /usr/share/scap-security-guide/remediation_functions shell library any more (instead starting from this release the remediation scripts are part of the specific benchmark itself). This allows to perform remediation without the need to have scap-security-guide RPM package being installed. For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.30 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.10 language version) Happy hardening! Regards, Jan -- Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream team)

2 2

[Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections?
by Jan Lieskovsky 20 Jul '16

20 Jul '16

Hello folks, so there are these SSG "feature milestones" on GitHub: * Infrastructure Enhancements and Fixes (https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastructure%2…) * RHEL7 NIAP/USGCB Submission (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20NIAP/USG…) * NIST 800-53 identifiers assignment (https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%20800-53%20…) * Unimplemented OVAL checks (https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplemented%20…) * RHEL-6 USGCB Profile Review (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%20USGCB%2…) * Draft RHEL 7 STIG (https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20RHEL%207…) There are two issues with the current approach: * they are updated very seldom -- basically only in moment new release is created, * they don't allow to reference all issues fixed in one particular release -- when some change is made (let's suppose it's related with RHEL 7 STIG effort), the corresponding change is tagged with "Draft RHEL 7 STIG" milestone. But it also belongs to some specific release (suppose 0.1.30 in this case). Trying to obtain all changes finished in 0.1.30 release this change wouldn't be present there, because it has "Draft RHEL7 STIG" milestone instead of "0.1.30" one. Therefore the proposal is to move this SSG feature milestones into GitHub labels instead. This way it will be possible to have just numeric milestones (0.1.31, 0.1.32, ...) and assign labels to pull request (so we won't loose the information some change / PR is relevant to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all changes that have been finished in particular release. I can turn the feature milestones into feature labels. But prior to doing that wanted to know if there are some concerns / objections against doing that? Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

6 6

Roadmap for RHEL 7 SSG
by Wilkinson, Matthew 29 Jun '16

29 Jun '16

Is there a roadmap for a final implementation of the RHEL 7 SSG? I'm curious when I can build a security baseline based off of the SCAP Security Guide for RHEL 7. We happen to be running Oracle Linux if there's any impact based on that particular OS. Thanks so much, Matthew Wilkinson | Lead Server Administrator, Unix ALLIANT ENERGY 200 1st St. SE | Cedar Rapids, IA 52401 Office: (319) 786-7694 alliantenergy.com<http://www.alliantenergy.com/> I MatthewWilkinson(a)alliantenergy.com<mailto:MatthewWilkinson@alliantenergy.com> This e-mail message is intended only for the personal use of the recipient(s) named above. This message may be an attorney-client communication and as such privileged and confidential. If you are not an intended recipient, you may not review, copy or distribute this message. If you have received this communication in error, please notify us immediately by e-mail and delete the original message.

1 0

SSG namespace in rhel7 data steam
by Shawn Wells 29 Jun '16

29 Jun '16

In the rhel7 rpm we use the ssgproject.org namespace in the data stream file. Should we change that to RedHat.com or at least open-scap.org?

3 2

Issue with file_permissions_ungroupowned in CentOS 5
by Rodolfo Martínez 17 Jun '16

17 Jun '16

Hi, I am having an issue with OVAL test file_permissions_ungroupowned in CentOS 5. I believe it is a bug in the oscap version that it is available in CentOS 5 (kind of old, v1.0.8). Here is the procedure I am doing: 1. Download and build scap-security-guide for RHEL5 in my Fedora 23 machine; then copy the output to my CentOS 5 testing server: wget https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.29.tar.gz -O scap-security-guide-0.1.29.tar.gz tar -zxf scap-security-guide-0.1.29.tar.gz make -C scap-security-guide-0.1.29/RHEL/5 dist scp -r scap-security-guide-0.1.29/RHEL/5/dist/content centos5-test: Now in the CentOS 5 testing server, create a tailoring file to run file_permissions_ungroupowned test alone: cat >ssg-centos5-xccdf-tailoring.xml <<"EOF" <?xml version="1.0" encoding="UTF-8"?> <Tailoring xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_ssg-centos5_tailoring_xccdf"> <version time="2016-06-14T19:50:57">1</version> <Profile id="xccdf_my_profile_stig-centos5-upstream_tailored"> <title>CentOS 5 [TAILORED]</title> <select idref="file_permissions_ungroupowned" selected="true"/> </Profile> </Tailoring> EOF Create a file without corresponding group in /etc/group: touch /an_unowned_group_file chgrp 4567 /an_unowned_group_file find / -nogroup 2>/dev/null /an_unowned_group_file <-- Check that it is found Finally run oscap: oscap xccdf eval \ --tailoring-file ssg-centos5-xccdf-tailoring.xml \ --profile xccdf_my_profile_stig-centos5-upstream_tailored \ --cpe content/ssg-rhel5-cpe-dictionary.xml \ content/ssg-centos5-xccdf.xml ... and output is: Title Ensure All Files Are Owned by a Group Rule file_permissions_ungroupowned Ident GEN001170 Result pass I would expect that the test fails since there is at least one file without existing group. I took a look at the OVAL definition scap-security-guide-0.1.29/RHEL/5/input/oval/file_permissions_ungroupowned.xml but I do not see anything wrong. Do you have any idea why this test is passing when it should fail? Regards -- Rodolfo Martínez

2 3

Use /etc/passwd directly instead of sources in NSS
by Rodolfo Martínez 08 Jun '16

08 Jun '16

Hi List, After many hours playing with SSG and OpenSCAP and not able to do what I want I need some help. Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to SSG and I am still getting familiar. The following OVAL test searches for system accounts (UID < 500) in /etc/at.allow (I am showing just the relevant parts of RHEL/5/input/oval/at_system_accounts.xml to explain my problem): <criteria> <criterion test_ref="test_at_system_accounts_at_allow" /> </criteria> <unix:password_test check="all" check_existence="none_exist" comment="Testing system accounts in /etc/at.allow" id="test_at_system_accounts_at_allow" version="1"> <unix:object object_ref="object_at_system_accounts_at_allow" /> </unix:password_test> <unix:password_object id="object_at_system_accounts_at_allow" version="1"> <unix:username operation="equals" var_ref="var_at_system_accounts_allow_list" var_check="at least one" datatype="string" /> <filter action="include">state_at_system_accounts_at_allow_uid</filter> </unix:password_object> <local_variable id="var_at_system_accounts_allow_list" comment="Accounts Allowed" datatype="string" version="1"> <object_component item_field="subexpression" object_ref="object_at_system_accounts_allow_list" /> </local_variable> <ind:textfilecontent54_object comment="/etc/at.allow" id="object_at_system_accounts_allow_list" version="1"> <ind:filepath>/etc/at.allow</ind:filepath> <ind:pattern operation="pattern match">^(.*)$</ind:pattern> <ind:instance operation="greater than or equal" datatype="int">0</ind:instance> </ind:textfilecontent54_object> <unix:password_state id="state_at_system_accounts_at_allow_uid" version="1"> <unix:user_id datatype="int" operation="less than">500</unix:user_id> </unix:password_state> The test above gets the users information from the sources specified in NSS (/etc/nsswitch.conf) which is correct, however I want to create a version that uses /etc/passwd directly. Why? We have many (thousands?) of RHEL 5 based servers with LDAP integration, and many (thousands?) of accounts in the LDAP servers. Simple tests like RHEL/5/input/oval/at_system_accounts.xml and RHEL/5/input/oval/cron_system_accounts.xml can take hours to run because they retrieve *all* users information from the LDAP servers and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. Also, if we run OpenSCAP (oscap) at the same time in a few servers they hit the LDAP servers really bad. I have been trying to replace password_test and password_object by textfilecontent54_test and textfilecontent54_object without any luck. If you want, I can share my at_system_accounts.xml file that I thought it was going to work. I would really appreciate any help or hint? Regards -- Rodolfo Martínez

6 13

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2016