>From 63959eea88d5bae8c212b3bd4c9d5b50ed8180ef Mon Sep 17 00:00:00 2001 From: steinkel Date: Tue, 12 Nov 2013 13:05:54 -0500 Subject: [PATCH] partial remap of STIG to SSG IDs and two typo fixes --- RHEL6/input/auxiliary/stig_overlay.xml | 196 +++++++++++++++-------------- RHEL6/input/system/permissions/files.xml | 2 +- RHEL6/input/system/software/integrity.xml | 2 +- 3 files changed, 103 insertions(+), 97 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index d322169..ec19058 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -12,13 +12,13 @@ The system must use a separate file system for the system audit data path. - + The audit system must alert designated staff members when the audit storage volume approaches capacity. The system must use a separate file system for user home directories. - + Vendor-provided cryptographic certificates must be installed to verify the integrity of system software. @@ -33,7 +33,7 @@ The system package management tool must cryptographically verify the authenticity of all software packages during installation. - + A file integrity tool must be installed. @@ -51,58 +51,58 @@ All device files must be monitored by the system Linux Security Module. - + The system must prevent the root account from logging in from virtual consoles. - + The system must prevent the root account from logging in from serial consoles. Default system accounts, other than root, must be locked. - + The system must not have accounts configured with blank or null passwords. - + The /etc/passwd file must not contain password hashes. - + The root account must be the only account having a UID of 0. - + The /etc/shadow file must be owned by root. - + The /etc/shadow file must be group-owned by root. - + The /etc/shadow file must have mode 0000. - + The /etc/gshadow file must be owned by root. - + The /etc/gshadow file must be group-owned by root. - + The /etc/gshadow file must have mode 0000. - + The /etc/passwd file must be owned by root. - + The /etc/passwd file must be group-owned by root. - + The /etc/passwd file must have mode 0644 or less permissive. - + The /etc/group file must be owned by root. - + The /etc/group file must be group-owned by root. - + The /etc/group file must have mode 0644 or less permissive. @@ -126,7 +126,7 @@ User passwords must be changed at least every 60 days. - + Users must be warned 7 days in advance of password expiration. @@ -156,13 +156,13 @@ The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf). - + The system boot loader configuration file(s) must be owned by root. - + The system boot loader configuration file(s) must be group-owned by root. - + The system boot loader configuration file(s) must have mode 0600 or less permissive. @@ -174,67 +174,67 @@ The system must not permit interactive boot. - + The system must allow locking of the console screen. The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts. - + The system must implement virtual address space randomization. - + The system must limit the ability of processes to have simultaneous write and execute access to memory. - + The system must not send ICMPv4 redirects by default. - + The system must not send ICMPv4 redirects from any interface. - + IP forwarding for IPv4 must not be enabled, unless the system is a router. - + The system must not accept IPv4 source-routed packets on any interface. - + The system must not accept ICMPv4 redirect packets on any interface. - + The system must not accept ICMPv4 secure redirect packets on any interface. - + The system must log Martian packets. - + The system must not accept IPv4 source-routed packets by default. - + The system must not accept ICMPv4 secure redirect packets by default. - + The system must ignore IPv4 ICMP redirect messages. - + The system must not respond to ICMPv4 sent to a broadcast address. - + The system must ignore ICMPv4 bogus error responses. The system must be configured to use TCP syncookies when experiencing a TCP SYN flood. - + The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces. - + The system must use a reverse-path filter for IPv4 network traffic when possible by default. - + The IPv6 protocol handler must not be bound to the network stack unless needed. - + The system must ignore ICMPv6 redirects by default. @@ -306,10 +306,10 @@ The operating system must back up audit records on an organization defined frequency onto a different system or media than the system being audited. - + The operating system must support the requirement to centrally manage the content of audit records generated by organization defined information system components. - + System logs must be rotated daily. @@ -342,13 +342,13 @@ Auditing must be enabled at boot by setting a kernel parameter. - + The system must retain enough rotated audit logs to cover the required log retention period. - + The system must set a maximum audit log file size. - + The system must rotate audit log files that reach the maximum file size. @@ -381,10 +381,10 @@ The operating system must automatically audit account termination. - + The audit system must be configured to audit modifications to the systems network configuration. - + The audit system must be configured to audit modifications to the system's Mandatory Access Control (MAC) configuration (SELinux). @@ -459,7 +459,7 @@ The rsh-server package must not be installed. - + The rshd service must not be running. @@ -522,7 +522,7 @@ The operating system must employ NSA-approved cryptography to protect classified information. - + The avahi service must be disabled. @@ -534,16 +534,16 @@ Mail relaying must be restricted. - + The operating system must uniquely identify and authenticate an organization defined list of specific devices and/or types of devices before establishing a connection. - + If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms. - + The LDAP client must use a TLS connection using trust certificates signed by the site CA. - + The openldap-servers package must not be installed unless required. @@ -564,7 +564,7 @@ The atd service must be disabled. - + Automated file system mounting tools must not be enabled unless needed. @@ -588,10 +588,10 @@ The noexec option must be added to removable media partitions. - + The system must use SMB client signing for connecting to samba servers using smbclient. - + The system must use SMB client signing for connecting to samba servers using mount.cifs. @@ -618,7 +618,7 @@ The system package management tool must verify contents of all files associated with the audit package. - + There must be no world-writable files on the system. @@ -627,28 +627,28 @@ The system must have a host-based intrusion detection tool installed. - + The x86 Ctrl-Alt-Delete key sequence must be disabled. - + The postfix service must be enabled for mail delivery. - + The sendmail package must be removed. The netconsole service must be disabled unless required. - + X Windows must not be enabled unless required. - + The xorg-x11-server-common (X Windows) package must not be installed, unless required. - + The DHCP client must be disabled if not needed. - + All GIDs referenced in /etc/passwd must be defined in /etc/group @@ -660,7 +660,7 @@ Emergency accounts must be provisioned with an expiration date. - + The system must require passwords to contain no more than three consecutive repeating characters. @@ -687,13 +687,13 @@ The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked. - + Process core dumps must be disabled unless needed. The NFS server must not have the insecure file locking option enabled. - + The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity. @@ -729,37 +729,37 @@ The operating system must manage information system identifiers for users and devices by disabling the user identifier after an organization defined time period of inactivity. - + The sticky bit must be set on all public directories. - + All public directories must be owned by a system account. - + The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system. The FTP daemon must be configured for logging or verbose mode. - + The snmpd service must use only SNMP protocol version 3 or newer. - + The snmpd service must not use a default password. - + The system default umask for the bash shell must be 077. - + The system default umask for the csh shell must be 077. - + The system default umask in /etc/profile must be 077. - + The system default umask in /etc/login.defs must be 077. - + The system default umask for daemons must be 027 or 022. @@ -777,18 +777,18 @@ The system must disable accounts after excessive login failures within a 15-minute interval. - + The operating system must dynamically manage user privileges and associated access authorizations. - + The operating system must support organization defined one-way flows using hardware mechanisms. - + The operating system must provide the capability for a privileged administrator to enable/disable organization defined security policy filters. - + The operating system, upon successful logon, must display to the user the date and time of the last logon (access) via GUI. - + The operating system, upon successful logon/access, must display to the user the number of unsuccessful logon/access attempts since the last successful logon/access. @@ -816,16 +816,16 @@ Operating system must support the capability to centralize the review and analysis of audit records from multiple components within the system. - + The operating system must support an audit reduction capability. The operating system must use internal system clocks to generate time stamps for audit records. - + Audit log files must have mode 0640 or less permissive. - + Audit log files must be owned by root. @@ -990,10 +990,10 @@ The operating system must take organization defined list of least disruptive actions to terminate suspicious events. - + The operating system must respond to security function anomalies in accordance with organization defined responses and alternative action(s). - + The system must have USB Mass Storage disabled unless needed. @@ -1011,7 +1011,7 @@ The system must allow locking of graphical desktop sessions. - + The system must forward audit records to the syslog service. @@ -1038,10 +1038,10 @@ The system package management tool must verify group-ownership on all files and directories associated with packages. - + The system package management tool must verify permissions on all files and directories associated with packages. - + The system package management tool must verify contents of all files associated with packages. @@ -1053,8 +1053,14 @@ The system's local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets. - - The operating system must provide automated support for account management functions. + + The system must provide automated support for account management functions. + + + Auditing must be enabled at boot by setting a kernel parameter. + + + Automated file system mounting tools must not be enabled unless needed. The operating system must enforce dual authorization, based on organizational policies and procedures for organization defined privileged commands. diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index a35bf0b..7574f5a 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -503,7 +503,7 @@ appropriate group. The following command will discover and print world-writable directories that are not owned by a system account, given the assumption that only system accounts have a uid lower than 500. Run it once for each local partition PART: -
# find PART -xdev -type d -perm 0002 -uid +500 -print
+
# find PART -xdev -type d -perm -0002 -uid +500 -print
Allowing a user account to own a world-writable directory is diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 4807009..3d28c78 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -165,7 +165,7 @@ Alternatively, the package can be reinstalled from trusted media using the comma The following command will list which files on the system have file hashes different from what is expected by the RPM database. -
# rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
+
# rpm -Va | awk '$1 ~ /..5/ && $2 != "c"'
 The hashes of important files like system executables should match the -- 1.7.1