scap-security-guide June 2017

scap-security-guide@lists.fedorahosted.org

20 participants
13 discussions

VMs, containers vs. bare-metal machines in SSG
by Martin Preisler 15 Aug '17

15 Aug '17

We have had increasing requests to scan containers and VM storage images for compliance. In those use-cases a lot of our rules don't make sense. For example separate partition for /tmp isn't really applicable to containers. I thought about how we can deal with this in SSG. We have several options: 1) Separate benchmark and datastreams for containers and VM storage images: ssg-rhel7-ds.xml and ssg-rhel7-container-ds.xml 2) Separate profile for containers and VM storage images: pci-dss and pci-dss-container 3) Use applicability and CPE platforms to distinguish between what is being scanned. That allows us to use the same pci-dss profile for bare-metal, VM, VM storage image and container image. Right now I am leaning towards 3) because it "unlocks" the feature transparently to our users. There is nothing extra they have to study to start scanning containers. The downside is that we will have to add "fake" CPE IDs for platforms like "vm-storage" and "container". Rules that apply to everything will have no <platform> element in them. Rules that apply to just containers will have something like: <platform idref="cpe:/a:*:container-image"/> or <platform idref="cpe:/a:*:vm-storage"/> Official NIST CPE ID dictionary has these related CPE IDs cpe:/a:redhat:docker:1.5.0-27 cpe:/a:linuxcontainers:lxc:0.5.0 cpe:/a:redhat:libvirt:1.2.7 Not sure we want to go with any of those though. I would like to keep it container and VM tech agnostic. Before I start hacking this I would like to hear your thoughts. -- Martin Preisler Identity Management and Platform Security | Red Hat, Inc.

7 12

PCI-DSS Baseline Queries
by Colin Madigan 29 Jun '17

29 Jun '17

Hi Team, I have applied the PCI-DSS profile to my Centos 7 system and there seems to be a false positive with the check "Disable Prelinking". I have checked the Remediation steps and they have been applied but check still marks as a fail. Secondly with this PCI profile how come Rules like enabling or checking SELinux are marked as notselected. Are these notselected rules not part of PCI-DSS requirements or is this due to some other reason. Benchmark URL ssg-centos7-ds.xml Benchmark ID xccdf_org.ssgproject.content_benchmark_RHEL-7 Profile ID xccdf_org.ssgproject.content_profile_pci-dss [cid:image002.png@01D2F011.BA7425D0] Colin Madigan|UNIX Engineer T02 9344 2705 30 Ross St, Glebe NSW 2037 Colin.Madigan(a)tpgtelecom.com.au<mailto:Colin.Madigan@tpgtelecom.com.au> TPG Telecom (ASX: TPM) [Description: http://res.tpgi.com.au/img/signature/tpglogo.jpg] This email and any attachments are confidential and may be subject to copyright, legal or some other professional privilege. They are intended solely for the attention and use of the named addressee(s). They may only be copied, distributed or disclosed with the consent of the copyright owner. If you have received this email by mistake or by breach of the confidentiality clause, please notify the sender immediately by return email and delete or destroy all copies of the email. Any confidentiality, privilege or copyright is not waived or lost because this email has been sent to you by mistake. Confidentiality: This email and any attachments are confidential and may be subject to copyright, legal or some other professional privilege. They are intended solely for the attention and use of the named addressee(s). They may only be copied, distributed or disclosed with the consent of the copyright owner. If you have received this email by mistake or by breach of the confidentiality clause, please notify the sender immediately by return email and delete or destroy all copies of the email. Any confidentiality, privilege or copyright is not waived or lost because this email has been sent to you by mistake.

4 7

SCAP Security Guide 0.1.34
by Watson Yuuma Sato 29 Jun '17

29 Jun '17

Hello folks, We have the pleasure to announce that SCAP Security Guide version 0.1.33 has been released. Highlights of this release: * Unification of where templates and csv reside * Optimization and clean up of build system * Lots of Ansible remediations added * Bash remediation functions file is now generated by build system For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.34 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.34 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.34/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.34/s… (Zip archive using OVAL-5.10 language version only) Thank you to everyone who contributed with issues, patches and discussion. Happy hardening! -- Watson Sato Security Technologies | Red Hat, Inc

1 0

RHEL7 SSG v0.1.33: RHEL-07-010270
by Trey Henefield 21 Jun '17

21 Jun '17

According to STIG ID RHEL-07-010270, the pam_unix.so entry in system-auth should apply the remember= value to limit password reuse. However, upon applying the SSG scap checks and remediations, I noticed that I was unable to change my password when forcing all account passwords to be changed at the next login. So upon doing some searching, I discovered this: https://bugzilla.redhat.com/show_bug.cgi?id=1412838 Tomaz included a statement at the end as follows: "Please use pam_pwhistory instead of adding remember option to pam_unix. There is no way to make that remember option of pam_unix properly supported with SELinux." Can we please report this issue up to DISA and recommend changing the requirement to require pam_pwhistory versus pam_unix? Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com<mailto:Trey.Henefield@ultra-ats.com> Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com<http://www.ultra-ats.com> Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2017-06-21 15:02:03 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

1 0

Help with Compiling SSG
by Bertilla Theodore 21 Jun '17

21 Jun '17

Hi I am new to SCAP technology and trying to learn adding new XCCDF and OVAL content to SCAP security guide. I am following the workshop content at http://people.redhat.com/jamisonm/scap/SCAP-Workshop-Coursebook-v2.pdf & https://jlieskov.files.wordpress.com/2013/11/scap_security_guide_questions_… But they seem to be outdated and I am lost since the directory structure of the latest SSG is different than the one at the time of the workshop. Although I could locate and add a new XCCDF rule, I'm not sure how to compile and validate after that. 'make' returns errors as there is no Makefile. The ssg macros in CMakeLists.txt are missing their definition, so cmake is also not working. I am also not able to locate the HTML guide where I can see the newly added rule (I am guessing that's because I couldn't compile in the first place). I've got the SSG source from https://github.com/OpenSCAP/scap-security-guide. Please help me on how I should proceed. If there is an updated documentation, please point it out to me. Your advise would be of great help. Thanks in advance. Best regards Bertilla Theodore

5 12

Stack Clash Fun Times
by Trevor Vaughan 20 Jun '17

20 Jun '17

Like most everyone, I'm running around trying to prevent Stack Clash types of issues from happening in the future. The most 'general purpose' way of doing this is to set the Address Space and Stack limits in pam_limits. So, two questions: 1) What is a good, general purpose number to set these to? I figured that Red Hat would have a bunch of systems to sample.... 2) Should these be included in the SSG? 3) Should the rest of these have nailed in defaults that make sense for most systems? This really should be something that people understand about their applications and/or can adjust to be larger on an as-needed basis. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

1 1

Disabling passwords in the cloud
by Fen Labalme 19 Jun '17

19 Jun '17

If password access is disabled on a cloud-based server - both from (virtual) console and via SSH - can the set of password checks be disabled somehow? - 10 checks: Set Password Quality Requirements with pam_pwquality - 5 checks: Set Lockouts for Failed Password Attempts - 3 checks: Set Password Hashing Algorithm Thanks, =Fen

7 13

STIGs and SSG Gaps
by Molly Bault 15 Jun '17

15 Jun '17

Greetings Team SSG, Firstly, thank you so much for your work on this project. Helping Linux be more secure helps everyone. I work for an avionics embedded computer company and really appreciate your tool. I know there are gaps right now in the scap-security-guide and the RHEL 7 STIGs. I'm trying to figure out what the game plan is for those. * There are some that is seems you guys are pushing back up to the DISA people with edits. * There are some that are simply missing that need the work done to add. (Follow on question, is this work scheduled?) Is this captured somewhere and I am blind? :) Thank you again for all your work on this very important project. ~Molly Jo

2 1

Re: STIGs and SSG Gaps
by Ted Brunell 15 Jun '17

15 Jun '17

Molly, I am working with DISA to create common content between the STIG and SSG. It is our hope that we will, in the not too distant future, be in sync with one another. Please let me know if there are any follow-up questions. R/ Ted Ted Brunell - RHCA, RHCE, RHCVA Principal Solution Architect Chief Architect, DoD Red Hat, Inc. (c) 760-712-6837 tbrunell(a)redhat.com ** Sent from my mobile device. ** On Jun 15, 2017 6:29 PM, "Molly Bault" <Molly.Jo.Bault(a)ballardtech.com> wrote: Greetings Team SSG, Firstly, thank you so much for your work on this project. Helping Linux be more secure helps everyone. I work for an avionics embedded computer company and really appreciate your tool. I know there are gaps right now in the scap-security-guide and the RHEL 7 STIGs. I'm trying to figure out what the game plan is for those. * There are some that is seems you guys are pushing back up to the DISA people with edits. * There are some that are simply missing that need the work done to add. (Follow on question, is this work scheduled?) Is this captured somewhere and I am blind? :) Thank you again for all your work on this very important project. ~Molly Jo _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists. fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@ lists.fedorahosted.org

1 0

Time based SSG releases
by Watson Yuuma Sato 09 Jun '17

09 Jun '17

Hello folks, I would like to announce that we are changing SCAP Security Guide releases to be time based. From now on, every two months there will be a release coming out. As last release was on April 29th, next release will happen on June 29th. Our aim is to release early and often to increase the feedback loop and also reduce anxiety on when the next release will happen. -- Watson Sato Security Technologies | Red Hat, Inc

1 0

Any new OpenSCAP / SSG presentations?
by Shawn Wells 08 Jun '17

08 Jun '17

Realize the 'Conference Presentations' page on the OpenSCAP/SSG wiki has gotten a bit stale. Anyone present on OpenSCAP or SSG things lately? Would love to see community presentations get added to the wiki! Feel free to edit the wiki directly (just add a change note), or reply on-list with your presentation date/title/link and I'll add it for you :)

2 1

Audit Offloading in the EL7 STIG
by Trevor Vaughan 07 Jun '17

07 Jun '17

So, I was digging through and found the following: RHEL-07-030300 The operating system must off-load audit records onto a different system or media from the system being audited. and RHEL-07-030310 The operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited. This poses a real problem since there are pretty much limitless methods to meet this requirement and, given that actual proof is multi-node, this is going to be *really* difficult to evaluate properly. As much as I like auditd, I don't care for the thought of the network blocking all of my operations, so I've opted to pass it along to syslog. My syslog is then TLS encrypted to the various shipping points. This obviously meets the requirement, and I can automatically test that configuration in my code but I feel like this is yet another place where we're going to have difficulty with the SSG. I also noticed that this one hasn't been implemented in the SSG and I'm guessing that this is why. What are the plans for things like this moving forward? Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

6 12

Thoughts on RHEL-07-020600-690?
by Sean 06 Jun '17

06 Jun '17

Hi SCAP folks... I am curious what anyone working on the RHEL 7 STIG Alignment or remediation thinks about these controls relating to "interactive user" home directories. Is this something you see fit to implement through a remediation script? It's one thing to setup a new system that complies with these rules before new users start using it, but running a script to correct this kind of stuff on an existing system seems like inviting a lot of trouble. Also, clearly there is nothing new in these controls specific to RHEL7, should we expect to see these controls pushed into the RHEL6 STIG too? Thanks for your thoughts! --Sean

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2017