scap-security-guide October 2017

scap-security-guide@lists.fedorahosted.org

9 participants
7 discussions

Re: Reg: Openscap scanning for SSH
by Jan Cerny 25 Nov '17

25 Nov '17

Hello, Great! Thanks for clarification. I have reported this issue upstream. You can track fixing the problem there. https://github.com/OpenSCAP/scap-security-guide/issues/2296 Regards Jan Černý Security Technologies | Red Hat, Inc. ----- Original Message ----- > From: "Jakub Jelen" <jjelen(a)redhat.com> > To: "Jan Cerny" <jcerny(a)redhat.com> > Cc: "Dushyant Uge" <duge(a)redhat.com>, "tech-list" <tech-list(a)redhat.com>, "SCAP Security Guide" > <scap-security-guide(a)lists.fedorahosted.org> > Sent: Tuesday, September 5, 2017 1:26:01 PM > Subject: Re: Reg: Openscap scanning for SSH > > On Tue, 2017-09-05 at 07:22 -0400, Jan Cerny wrote: > > Hi, > > > > Thank you very much for letting us know. > > > > I have looked into this issue. The rule "Allow Only SSH Protocol 2" > > checks if /etc/sshd_config cotains string "Protocol 2". > > See the implementation of this check: > > https://github.com/OpenSCAP/scap-security-guide/blob/master/shared/te > > mplates/static/oval/sshd_allow_only_protocol2.xml > > > > Jakub, do I understand it well, that since RHEL 7.4 this > > configuration > > option doesn't exist anymore? Will the system always satisfy the > > requirement > > that only SSHv2 is allowed? What way do you recommend to check that > > this requirement is satisfied? > > > > I think If SSH v2 is the only option on RHEL 7.4, we should remove > > this rule from SCAP Security Guide for RHEL7 completely. > > I would not remove it. Some people might be running the old openssh > from RHEL7.3. I would say that every OpenSSH RPM package >=7.4 will > satisfy this rule. If we have older version, I would leave the check as > it was. Though not sure how to write it in your language :) > > Jakub > > > Dushyant, FYI, rules for OpenSCAP comes from "SCAP Security Guide" > > project, > > https://github.com/OpenSCAP/scap-security-guide > > which has a special mailing list: > > https://lists.fedorahosted.org/admin/lists/scap-security-guide.lists. > > fedorahosted.org/ > > If you run in similar problem in future, you can ask there directly > > :D > > I'm including the mailing list to this thread so that experts can > > chime in. > > > > > > Regards > > > > Jan Černý > > Security Technologies | Red Hat, Inc. > > > > ----- Original Message ----- > > > From: "Jakub Jelen" <jjelen(a)redhat.com> > > > To: "Dushyant Uge" <duge(a)redhat.com> > > > Cc: "tech-list" <tech-list(a)redhat.com>, jcerny(a)redhat.com > > > Sent: Tuesday, September 5, 2017 10:29:19 AM > > > Subject: Re: Reg: Openscap scanning for SSH > > > > > > On Tue, 2017-09-05 at 08:07 +0530, Dushyant Uge wrote: > > > > Hello Jakub Jelen, > > > > > > > > Thank you for your response. > > > > > > > > > > The rules in OpenSCAP needs to be updated to reflect this > > > > > > > > So, Are we in the process of updating OpenSCAP scanning rules? > > > > or Do we need to file a bugzilla ? > > > > > > I am not sure if the OpenSCAP team or SGG is aware of this issue. I > > > added Jan, who should know better. > > > > > > > > > > > On Mon, Sep 4, 2017 at 5:08 PM, Jakub Jelen <jjelen(a)redhat.com> > > > > wrote: > > > > > > > > > On Mon, 2017-09-04 at 11:02 +0530, Dushyant Uge wrote: > > > > > > Hello, > > > > > > > > > > > > While scanning RHEL7 system with openscap below are results > > > > > > for > > > > > > ssh > > > > > > protocol2 > > > > > > > > > > > > ------------------------------------- > > > > > > oval:ssg-sshd_allow_only_protocol2:def:1 false compliance > > > > > > [20140414], > > > > > > [sshd_allow_only_protocol2] Ensure Only Protocol 2 > > > > > > Connections > > > > > > Allowed > > > > > > ------------------------------------- > > > > > > > > > > > > Customer has below concern -- > > > > > > > > > > > > The description in the openscap-workbench: > > > > > > Only SSH protocol version 2 connections should be permitted. > > > > > > The > > > > > > default > > > > > > setting in /etc/ssh/sshd_config is correct, and can be > > > > > > verified > > > > > > by > > > > > > ensuring > > > > > > that the following line appears: Protocol 2 > > > > > > > > > > > > While doing Since this is the default, the check should NOT > > > > > > be > > > > > > for > > > > > > "2", but > > > > > > to make sure that "1" is NOT present. > > > > > > > > > > > > Is this a valid implementation request ? > > > > > > > > > > > > Please suggest. > > > > > > > > > > > > > > > > The SSH-1 protocol was removed in RHEL7.4 (openssh-7.4p1 and > > > > > newer) > > > > > therefore the configuration files will not contain Protocol > > > > > option > > > > > nor > > > > > sshd -T will output it. The rules in OpenSCAP needs to be > > > > > updated > > > > > to > > > > > reflect this > > > > > > > > > > https://access.redhat.com/articles/3022681 > > > > > > > > > > > -- > > > Jakub Jelen > > > Software Engineer > > > Security Technologies > > > Red Hat, Inc. > > > > -- > Jakub Jelen > Software Engineer > Security Technologies > Red Hat, Inc. >

2 1

SCAP Security Guide 0.1.36
by Watson Yuuma Sato 31 Oct '17

31 Oct '17

Hello folks, We have the pleasure to announce that SCAP Security Guide version 0.1.36 has been released. Highlights of this release: * Introduction of SCAP Security Guide Test Suite * Better alignment of RHEL6 and RHEL7 with DISA STIG * Remove JBoss EAP5 content due to being End-of-Life * New STIG Profile for JBOSS EAP 6 * Updates in C2S Profile for RHEL 7 * Variables can be directly tailored in Ansible roles * Content presents less false positives in containers * Major changes in directory layout * oval_5.11 directory removed * oval definitions moved to checks/oval * static checks are not in templates/static anymore For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.36 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.36 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.36/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.36/s… (Zip archive using OVAL-5.10 language version only) Great thanks to everyone who contributed with issues, patches and discussion. Happy hardening! -- Watson Sato Security Technologies | Red Hat, Inc

1 0

Fwd: STIG Update - DISA has released the following updated Security Guidance, Security Readiness Review Scripts and Benchmarks
by Shawn Wells 27 Oct '17

27 Oct '17

ICYMI: New RHEl 6 and 7 STIGs from DISA -------- Forwarded Message -------- Subject: STIG Update - DISA has released the following updated Security Guidance, Security Readiness Review Scripts and Benchmarks Date: Fri, 27 Oct 2017 13:03:43 -0500 From: Defense Information Systems Agency (DISA) <subscriptions(a)disa.mil> Reply-To: subscriptions(a)disa.mil To: shawn.d.wells(a)gmail.com STIG Update - DISA has released the following updated Security Guidance, Security Readiness Review Scripts and Benchmarks STIG Update - DISA has released the following updated Security Guidance, Security Readiness Review Scripts and Benchmarks ------------------------------------------------------------------------ DISA has released the following updated Security Guidance, Security Readiness Review Scripts and Benchmarks: Unclassified SRGs: http://iase.disa.mil/stigs/Pages/a-z.aspx Network Device Management SRG – Ver 2, Rel 12 Voice Video Endpoint SRG - Ver 1, Rel 6 Unclassified Application STIGs: http://iase.disa.mil/stigs/app-security/Pages/index.aspx Apache 2.2 STIG Windows – Ver 1, Rel 12 Apache 2.2 STIG UNIX - Ver 1, Rel 9 Application Security and Development STIG - Ver 4, Rel 4 Google Chrome Browser STIG – Ver 1, Rel 10 IIS 7.0 STIG – Ver 1, Rel 15 McAfee Virus Scan Enterprise for Linux 1.2x/2.0x Managed Client STIG - Ver 1, Rel 3 Microsoft Excel 2016 STIG - Ver 1, Rel 2 Microsoft Outlook 2013 STIG - Ver 1, Rel 11 Oracle HTTP Server 12.1.3 STIG - Ver 1, Rel 2 Oracle JRE 8 UNIX STIG - Ver 1, Rel 3 Oracle WebLogic Server 12c STIG - Ver 1, Rel 3 Unclassified Mobility STIG: http://iase.disa.mil/stigs/mobility/Pages/index.aspx Microsoft Windows 10 Mobile STIG - Ver 1, Rel 3 Unclassified Network STIGs and Overviews: http://iase.disa.mil/stigs/net_perimeter/Pages/index.aspx Cisco IOS XE Release 3 Router Overview - Ver 1, Rel 3 Cisco IOS XE Release 3 NDM STG - Ver 1, Rel 3 DNS Policy STIG - Ver 4, Rel 1.21 IBM DataPower NDM STIG - Ver 1, Rel 2 IPSEC VPN Gateway STIG - Ver 1, Rel 13 Juniper SRX Services Gateway (SG) Virtual Private Network (VPN) STIG - Ver 1, Rel 2 Network Firewall STIG - Ver 8, Rel 24 Network Infrastructure Policy STIG - Ver 9, Rel 4 Network Infrastruture Router L3 Switch STIG - Ver 8, Rel 24 Network L2 Switch STIG - Ver 8, Rel 22 Network Perimeter Router L3 Switch STIG - Ver 8, Rel 27 Removable Storage STIG - Ver 1, Rel 7 Unclassified HBSS STIGs: https://iase.disa.mil/stigs/hbss/Pages/index.aspx McAfee Application Control STIG - Ver 1, Rel 2 Unclassified Operating System STIGs: http://iase.disa.mil/stigs/os/Pages/index.aspx AIX 6.1 STIG - Ver 1, Rel 11 HP-UX 11.31 Manual STIG – Ver 1, Rel 15 IBM Hardware Management Console (HMC) STIG - Ver 1, Rel 5 Microsoft Windows 2008 DC STIG – Ver 6, Rel 38 Microsoft Windows 2008 MS STIG – Ver 6, Rel 38 Microsoft Windows 2008 R2 DC STIG – Ver 1, Rel 24 Microsoft Windows 2008 R2 MS STIG – Ver 1, Rel 24 Microsoft Windows 2012 and 2012 R2 DC STIG – Ver 2, Rel 10 Microsoft Windows 2012 and 2012 R2 MS STIG – Ver 2, Rel 10 Microsoft Windows 7 STIG – Ver 1, Rel 28 Microsoft Windows 8/8.1 STIG – Ver 1, Rel 19 Oracle Linux 6 Manual STIG - Ver 1, Rel 11 Red Hat 6 STIG - Ver 1, Rel 17 Red Hat 7 STIG - Ver 1, Rel 3 Solaris 10 SPARC Manual STIG - Ver 1, Rel 20 Solaris 10 x86 Manual STIG - Ver 1, Rel 20 Solaris 11 SPARC Manual STIG - Ver 1, Rel 13 Solaris 11 x86 Manual STIG - Ver 1, Rel 13 SUSE Linux Enterprise Server (SLES) v11 for System z STIG - Ver 1, Rel 11 zOS ACF2 STIG – Ver 6, Rel 33 zOS RACF STIG – Ver 6, Rel 33 zOS TSS STIG – Ver 6, Rel 33 FOUO Network STIGs: http://iase.disa.mil/stigs/net_perimeter/Pages/index.aspx NOTE: DoD PKI Certificate Required JIE Core Data Center (CDC) STIG – Ver 2, Rel 3 JIE Installation Processing Node (IPN) STIG – Ver 2, Rel 3 Benchmarks: http://iase.disa.mil/stigs/scap/Pages/index.aspx Google Chrome for Windows STIG Benchmark Ver 1, Rel 5 HP-UX 11.31 STIG Benchmark - Ver 1, Rel 15 Microsoft Excel 2016 STIG Benchmark - Ver 1, Rel 2 (SCC tool use only) Microsoft Outlook 2013 STIG Benchmark - Ver 1, Rel 6 (SCC tool use only) Microsoft Outlook 2016 STIG Benchmark - Ver 1, Rel 3 (SCC tool use only) Microsoft Windows 2008 DC STIG Benchmark – Ver 6, Rel 40 Microsoft Windows 2008 MS STIG Benchmark – Ver 6, Rel 40 Microsoft Windows 2008 R2 DC STIG Benchmark – Ver 1, Rel 26 Microsoft Windows 2008 R2 MS STIG Benchmark - Ver 1, Rel 27 Microsoft Windows 2012 and 2012 R2 DC STIG Benchmark – Ver 2, Rel 10 Microsoft Windows 2012 and 2012 R2 MS STIG Benchmark – Ver 2, Rel 10 Microsoft Windows 7 STIG Benchmark – Ver 1, Rel 34 Microsoft Windows 8/8.1 STIG Benchmark – Ver 1, Rel 20 Microsoft Windows Server 2016 STIG Benchmark – Ver 1, Rel 3 Red Hat 5 STIG Benchmark - Ver 1, Rel 19 Red Hat 6 STIG Benchmark – Ver 1, Rel 17 Solaris 10 SPARC STIG Benchmark – Ver 1, Rel 19 Solaris 10 x86 STIG Benchmark – Ver 1, Rel 19 Solaris 11 SPARC STIG Benchmark - Ver 1, Rel 8 Solaris 11 x86 STIG Benchmark - Ver 1, Rel 8 No Longer Supported: http://iase.disa.mil/stigs/sunset/Pages/index.aspx BlackBerry for the OS 7 STIG - Ver 2, Rel 11 Good for Enterprise 8.x STIG - Ver 1, Rel 2 Microsoft Access 2007 STIG - Ver 4, Rel 15 Microsoft Excel 2007 STIG - Ver 4, Rel 13 Microsoft Infopath 2007 STIG - Ver 4, Rel 13 Microsoft Office System 2007 STIG - Ver 4, Rel 16 Microsoft Outlook 2007 STIG - Ver 4, Rel 16 Microsoft PowerPoint 2007 STIG - Ver 4, Rel 16 Microsoft Word 2007 STIG - Ver 4, Rel 15 ------------------------------------------------------------------------ For all STIG related questions, please contact the DISA STIG Customer Support Desk: disa.stig_spt(a)mail.mil ------------------------------------------------------------------------ Update your subscriptions, modify your password or e-mail address, or stop subscriptions at any time on your Subscriber Preferences Page <https://public.govdelivery.com/accounts/USDISA/subscriber/new>. You will need to use your email address to log in. If you have questions or problems with the subscription service, please visit subscriberhelp.govdelivery.com <https://subscriberhelp.govdelivery.com/>. All other inquiries can be directed to subscriptions(a)disa.mil <mailto:subscriptions@disa.mil>. ------------------------------------------------------------------------ GovDelivery, Inc. sending on behalf of the Defense Information Systems Agency (DISA) · 707 17th St, Suite 4000 · Denver, CO 80202 · 1-800-439-1420

1 0

Why is xml-common required for SSG RPMs, and where do I find it?
by Shawn Wells 26 Oct '17

26 Oct '17

Attempting to install RPM, receive error about needing xml-common RPM for dependencies. When/why was this introduced? $ sudo yum localinstall _CPack_Packages/Linux/RPM/scap-security-guide-0.1.36.rpm Checksum type 'md5' disabled Loaded plugins: product-id, search-disabled-repos, subscription- : manager This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions. Examining _CPack_Packages/Linux/RPM/scap-security-guide-0.1.36.rpm: scap-security-guide-0.1.36-1.el7.noarch Marking _CPack_Packages/Linux/RPM/scap-security-guide-0.1.36.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package scap-security-guide.noarch 0:0.1.36-1.el7 will be installed --> Processing Dependency: xml-common for package: scap-security-guide-0.1.36-1.el7.noarch --> Finished Dependency Resolution --> Finding unneeded leftover dependencies Found and removing 0 unneeded dependencies Error: Package: scap-security-guide-0.1.36-1.el7.noarch (/scap-security-guide-0.1.36) Requires: xml-common You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest

2 3

Fwd: STIG Update - DISA STIG Viewer 2.6
by Shawn Wells 24 Oct '17

24 Oct '17

Looks like scap 1.2 is now supported! Will be testing with latest SSG later tonight. Begin forwarded message: > From: "Defense Information Systems Agency (DISA)" <subscriptions(a)disa.mil> > Date: October 24, 2017 at 12:07:19 PM EDT > To: shawn.d.wells(a)gmail.com > Subject: STIG Update - DISA STIG Viewer 2.6 > Reply-To: subscriptions(a)disa.mil > > STIG Update - DISA STIG Viewer 2.6 > > DISA has released STIG Viewer 2.6. The STIG Viewer can be found at https://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx. > > Included in this release: full support for SCAP 1.2 content, allows for import checklist data from old STIGs into new Checklists created with the new STIG version, allows for multiple Checklist tabs to be opened at the same time, improved keyboard shortcuts, and optional logging to output file has been implemented to aid in error debugging. Please refer to the Change Log for a list of all changes/features provided in this release of the tool. > > For all STIG related questions, please contact the DISA STIG Customer Support Desk: disa.stig_spt(a)mail.mil > > Update your subscriptions, modify your password or e-mail address, or stop subscriptions at any time on your Subscriber Preferences Page. You will need to use your email address to log in. If you have questions or problems with the subscription service, please visit subscriberhelp.govdelivery.com. All other inquiries can be directed to subscriptions(a)disa.mil. > > > > > > GovDelivery, Inc. sending on behalf of the Defense Information Systems Agency (DISA) · 707 17th St, Suite 4000 · Denver, CO 80202 · 1-800-439-1420

1 0

feedback on attempted first-time contribution
by Matěj Týč 12 Oct '17

12 Oct '17

Hello, I am a scap newbie, trying to learn how things work and I, as a person from the outside, have noticed some patterns that make contributions less fun. I would also like to propose remediations (that could make it into the contribution guide if you agree): Here is what was not ideal: A GitHub issue was created, development of the fix was underway, but nobody had the issue assigned. Proposed resolution: - When one is implementing functionality that is requested in a GitHub issue and he/she is aware that the issue exists, one should mention the issue in the PR and one should also request to have the issue assigned to him/her. --- Git magic was involved in the pull request, so there were outdated comments from the reviewer, but at the same time, there was a single (and therefore huge and difficult to analyze) commit. Proposed resolution: - When doing pull requests, don't alter past commits when the pull request is underway. This makes it easier for others to follow and understand the evolution of the pull request. (One can use GitHub squash merge at the end, right?). --- I am referring to issue #2322 and PR #2381; although those two things that I have pointed out are not heavy stuff, they make contributions to SSG less accessible, because they obscure what's going on to a certain degree. On the other hand, I appreciate that the PR that I have created got its attention and I could learn from the feedback quite quickly. Best regards, Matej Tyc

1 0

STIG Rule Id vs Version
by Wesley Ceraso Prudencio 10 Oct '17

10 Oct '17

Hi all, I noticed something strange in the information we have about the STIG Profiles. The problem is that what we internally refer as "Stig ID" is actually the STIG Rule "Version", it seems like "RHEL-7-01010101", meanwhile, we just ignore the real id of the STIG Rule that seems like "SV-86473r2_rule". When SSG is built, this id (version actually) is output as a Rule reference, for example: "<reference href="http://iase.disa.mil/stigs/os/unix-linux/Pages/index.aspx">RHEL-07-010010</reference>" Although this "Version" is different for each Rule, it does not change when there is new revision, meaning that we are not able to tell which revision of a rule we are evaluating based on this field, on the other hand, the real id gets incremented when there is a new revision for that rule, for example "SV-86473r2_rule" becomes "SV-86473r3_rule". I'm currently trying to enable OpenSCAP to output the result of a scanning in a way the STIG Viewer is able to read it and populate a checklist, but it only understands the real id. Unfortunatelly, there is no place, except for comments, where I can get this id. A workaround for my development is to create another tag (probably a reference) in the Rule with the actual STIG id, but I'd like to hear from you if someone know the story behind this before I move on. Thanks Wesley

6 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide October 2017