Signed-off-by: Mike Palmiotto mpalmiotto@tresys.com --- .../checks/audit_rules_logon_modification.xml | 34 +++++++++ .../checks/audit_rules_session_modification.xml | 47 ++++++++++++ .../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++++++++ .../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++++++++ rhel6/src/input/system/auditing.xml | 77 +++++++++++++++++++- rhel6/src/input/system/logging.xml | 67 +++++++++++++++++ 6 files changed, 365 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/rhel6/src/input/checks/audit_rules_logon_modification.xml new file mode 100644 index 0000000..97d170d --- /dev/null +++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml @@ -0,0 +1,34 @@ +<def-group> + <definition class="compliance" id="audit_rules_logon_modification" version="1"> + <metadata> + <title> Record Attempts to Alter Logon and Logout Events</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id=" CCE-14904-7" source="CCE" /> + <description> Audit attempted manual edits of files involved in storing logon events.</description> + </metadata> + <criteria operator = "AND"> + <criterion comment="watch on lastlog" test_ref="test_audit_rules_logon_modification_lastlog" /> + <criterion comment="watch on faillog" test_ref="test_audit_rules_logon_modification_faillog" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" comment="lastlog watch" id="test_audit_rules_logon_modification_lastlog" version="1"> + <ind:object object_ref="object_audit_rules_logon_modification_lastlog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_logon_modification_lastlog" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment="faillog watch" id="test_audit_rules_logon_modification_faillog" version="1"> + <ind:object object_ref="object_audit_rules_logon_modification_faillog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_logon_modification_faillog" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml b/rhel6/src/input/checks/audit_rules_session_modification.xml new file mode 100644 index 0000000..22b0cb6 --- /dev/null +++ b/rhel6/src/input/checks/audit_rules_session_modification.xml @@ -0,0 +1,47 @@ +<def-group> + <definition class="compliance" id="audit_rules_session_modification" version="1"> + <metadata> + <title></title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-14679-5" source="CCE" /> + <description>Ensure that watches are placed on utmp, btmp, and wtmp, sessions.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="watch on wtmp" test_ref="test_audit_rules_session_modification_wtmp" /> + <criterion comment="watch on utmp" test_ref="test_audit_rules_session_modification_utmp" /> + <criterion comment="watch on btmp" test_ref="test_audit_rules_session_modification_btmp" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" comment="wtmp session watch" id="test_audit_rules_session_modification_wtmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_wtmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_wtmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/wtmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="utmp session watch" id="test_audit_rules_session_modification_utmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_utmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_utmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/utmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="btmp session watch" id="test_audit_rules_session_modification_btmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_btmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_btmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/btmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml new file mode 100644 index 0000000..2a99b92 --- /dev/null +++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml @@ -0,0 +1,71 @@ +<def-group> + <definition class="compliance" id="logwatch_configured_on_logserver" version="1"> + <metadata> + <title>Ensure Logwatch Configured on the Central Log Server</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4323-2" source="CCE" /> + <description>Check if logwatch service is enabled and configured.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="hostlimit" test_ref="test_logwatch_configured_on_logserver_hostlimit" /> + <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" /> + <criterion comment="multiemail" test_ref="test_logwatch_configured_on_logserver_multiemail" /> + <criterion comment="service" test_ref="test_logwatch_configured_on_logserver_service" /> + + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_on_logserver_hostlimit" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_hostlimit" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_hostlimit" version="1"> + <ind:subexpression operation="equals">no</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_hostlimit" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_on_logserver_splithosts" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_splithosts" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_splithosts" version="1"> + <ind:subexpression operation="equals">yes</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_splithosts" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test MultiEmail" id="test_logwatch_configured_on_logserver_multiemail" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_multiemail" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_multiemail" version="1"> + <ind:subexpression operation="equals">no</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_multiemail" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test Service" id="test_logwatch_configured_on_logserver_service" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_service" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_service" version="1"> + <ind:subexpression operation="equals">-zz-disk_space</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_service" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]Service[\s]*=[\s]*-zz-disk_space+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6/src/input/checks/rsyslog_messages_captured.xml new file mode 100644 index 0000000..0639653 --- /dev/null +++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml @@ -0,0 +1,70 @@ +<def-group> + <definition class="compliance" id="rsyslog_messages_captured" + version="1"> + <metadata> + <title>Ensure Important Messages are Captured</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Make sure appropriate lines are in rsyslog.conf. </description> + </metadata> + <criteria operator="AND"> + <criterion comment="messages" test_ref="test_rsyslog_messages_captured_messages" /> + <criterion comment="kern.log" test_ref="test_rsyslog_messages_captured_kern" /> + <criterion comment="daemon.log" test_ref="test_rsyslog_messages_captured_daemon" /> + <criterion comment="syslog" test_ref="test_rsyslog_messages_captured_syslog" /> + <criterion comment="unused.log" test_ref="test_rsyslog_messages_captured_unused" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" comment="messages" id="test_rsyslog_messages_captured_messages" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_messages" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_messages" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^auth.*[\s]*,[\s]*user.*[\s]+/var/log/messages$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="kern.log" id="test_rsyslog_messages_captured_kern" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_kern" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> +<ind:pattern operation="pattern match">^kern.*[\s]+/var/log/kern.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="daemon.log" id="test_rsyslog_messages_captured_daemon" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_daemon" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> +<ind:pattern operation="pattern match">^daemon.*[\s]+/var/log/daemon.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="syslog" id="test_rsyslog_messages_captured_syslog" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_syslog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^syslog.*[\s]+/var/log/syslog$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="unused" id="test_rsyslog_messages_captured_unused" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_unused" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*[\s]+/var/log/unused.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index e75754f..1d18eaf 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -95,6 +95,51 @@ process during boot. <ref nist="AU-2" /> </Rule>
+<!-- +<Group id="configure_auditd_data_retention"> +<title> Configure <tt>auditd</tt> Data Retention</title> +<description> +<ul> + +<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log +file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:</li> +<pre>max_log_file = <i>STOREMB</i></tt> + +<li>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition +or logical volume during system installation time. The partition should be larger than the maximum +space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied +by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</li> + +<li>If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt> +to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or +correct the following lines:</li> +<pre>space_left_action = email +action_mail_acct = root +admin_space_left_action = halt</pre> +</ul> +The default action to take when the logs reach their maximum size is to rotate the log files, discarding the +oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility +of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line: +<pre>max_log_file_action = keep_logs</pre> +By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly +auditing system activity, this is likely to be insuffcient. +The log file size needed will depend heavily on what types of events are being audited. First configure auditing +to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will +allow you to keep the required data for the correct time period. +Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if +they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit +trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.) +Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then +<tt>auditd</tt> can be configured to halt the machine if it runs out of space. +<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated +away before they can be viewed. +<i>If your system is configured to halt when logging cannot be performed, make sure this can never +happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and +that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description> +<oval id="service_auditd_data_retention_configured" /> +</Group> +--> + <Group id="auditd_configure_rules"> <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title> <description>The <tt>auditd</tt> program can perform comprehensive @@ -171,7 +216,6 @@ to capture events that modify account changes: <ref nist="AU-2(a)" /> </Rule>
- <Rule id="audit_network_modifications"> <title>Record Events that Modify the System’s Network Environment</title> <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting @@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy should be au <ref nist="AU-2" /> </Rule>
+<Rule id="audit_manual_logon_edits"> +<title> Record Attempts to Alter Logon and Logout Events</title> +<description> +The audit system already collects login info for all users and root. To watch for attempted manual edits of +files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/log/faillog -p wa -k logins +-w /var/log/lastlog -p wa -k logins +</pre> +</description> +<ident cce="14904-7" /> +<oval id="audit_rules_logon_modification" /> +<ref nist="TODO" /> +</Rule> + + +<Rule id="audit_manual_session_edits"> +<title> Record Attempts to Alter Process and Session Initiation Information</title> +<description> +The audit system already collects process information for all users and root. To watch for attempted manual +edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/run/utmp -p wa -k session +-w /var/log/btmp -p wa -k session +-w /var/log/wtmp -p wa -k session +</pre> +</description> +<ident cce="14679-5" /> +<oval id="audit_rules_session_modification" /> +<ref nist="TODO" /> +</Rule>
<Rule id="audit_dac_actions"> <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml index 839484e..fc6b311 100644 --- a/rhel6/src/input/system/logging.xml +++ b/rhel6/src/input/system/logging.xml @@ -54,6 +54,25 @@ logging services. <ref nist="AU-2" /> </Rule>
+<Rule id="ensure_rsyslog_messages_captured"> +<title> Ensure Important Messages are Captured</title> +<description> +Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your +environment: +<pre> +auth.*,user.* /var/log/messages +kern.* /var/log/kern.log +daemon.* /var/log/daemon.log +syslog.* /var/log/syslog +lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.* /var/log/unused.log +</pre> +See the man page <tt>rsyslog.conf(5)</tt> for more information. +<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en- +vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i> +<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description> +<oval id="rsyslog_messages_captured" /> +</Rule> + <Group id="log_file_permissions"> <title>Confirm Existence and Permissions of System Log Files</title> <description>For each log file LOGFILE referenced in @@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale> <ref nist="AU-2, AU-9, CM-6" /> </Rule> </Group> + +<Rule id="configure_logwatch_on_logserver"> +<title> Configure Logwatch on the Central Log Server</title> +<description> +Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or +correct the following lines: +<pre> +HostLimit = no +SplitHosts = yes +MultiEmail = no +Service = -zz-disk_space +</pre> +Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): +<pre># cd /etc/cron.daily +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch +</pre> +On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate +on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it +is running. +If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly +more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that +information is almost always necessary. If <tt>MultiEmail</tt> is set, then each host's information will be sent in a +separate e-mail message. This is a matter of preference. +The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to +the logserver.</description> +<ident cce="4323-2" /> +<oval id="logwatch_configured_on_logserver" /> +</Rule> + + +<Rule id="disable_logwatch_for_logserver"> +<title> Disable Logwatch on Clients if a Logserver Exists</title> +<description> +Does your site have a central logserver which has been configured to report on logs received from all systems? +If so: +<pre> +# rm /etc/cron.daily/0logwatch +</pre> +If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central +logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier +and less time-intensive for administrators.</description> +<oval id="logwatch_disabled_for_logserver" /> +</Rule> </Group> +