From: Willy Santos wsantos@redhat
The following commits add NIST 800-53 references to all rules that did not already have them (<nist ref= />).
Willy Santos (13): Added 800-53 refs to Avahi rules. Added 800-53 refs for base services. Added 800-53 refs for IPSec. Added 800-53 refs for login banners. Added 800-53 refs for iptables. Added 800-53 refs for IPv6 rules. Added 800-53 refs for networking rules. Added 800-53 refs for SSL. Added 800-53 refs for uncommon rules. Added 800-53 refs for permission execution rules. Added 800-53 refs for mounting rules. Added 800-53 refs for selinux rules. Added 800-53 refs for software integrity rules.
rhel6/src/input/services/avahi.xml | 5 +++ rhel6/src/input/services/base.xml | 42 +++++++++++++++++++++- rhel6/src/input/system/accounts/banners.xml | 1 + rhel6/src/input/system/network/ipsec.xml | 1 + rhel6/src/input/system/network/iptables.xml | 2 +- rhel6/src/input/system/network/ipv6.xml | 1 + rhel6/src/input/system/network/network.xml | 3 ++ rhel6/src/input/system/network/ssl.xml | 7 ++++ rhel6/src/input/system/network/uncommon.xml | 4 ++ rhel6/src/input/system/permissions/execution.xml | 2 +- rhel6/src/input/system/permissions/mounting.xml | 6 ++-- rhel6/src/input/system/selinux.xml | 1 + rhel6/src/input/system/software/integrity.xml | 7 +++- 13 files changed, 74 insertions(+), 8 deletions(-)
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/services/avahi.xml | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/services/avahi.xml b/rhel6/src/input/services/avahi.xml index f6820eb..ea14fc2 100644 --- a/rhel6/src/input/services/avahi.xml +++ b/rhel6/src/input/services/avahi.xml @@ -55,6 +55,7 @@ the following line exists in the <tt>[server]</tt> section: Similarly, if you are using only IPv6, disable IPv4 sockets with the line: <pre>use-ipv4=no</pre> </description> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -74,6 +75,7 @@ properly-configured router or firewall should not allow mDNS packets into the local network at all, this option provides another check to ensure they are not permitted. </rationale> +<ref nist="AC-4, CM-6, CM-7" /> </Rule>
@@ -88,6 +90,7 @@ and ensure the following line appears in the <tt>[server]</tt> section: This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. </rationale> +<ref nist="AC-4, CM-6, CM-7" /> </Rule>
@@ -102,6 +105,7 @@ and ensure the following line appears in the <tt>[server]</tt> section: This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. </rationale> +<ref nist="AC-4, CM-6, CM-7" /> </Rule>
@@ -131,6 +135,7 @@ disable-publishing. Alternatively, these can be used to restrict the types of published information in the event that some information must be published. </rationale> +<ref nist="AC-4, CM-6, CM-7" /> </Rule>
</Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/services/base.xml | 42 ++++++++++++++++++++++++++++++++++++- 1 files changed, 41 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/services/base.xml b/rhel6/src/input/services/base.xml index 28025cc..259037e 100644 --- a/rhel6/src/input/services/base.xml +++ b/rhel6/src/input/services/base.xml @@ -17,6 +17,7 @@ software executing on the local machine. For most deployments this daemon should </description> <ident cce="TODO" /> <oval id="service_abrtd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -29,6 +30,7 @@ on the local system this daemon should be disabled. </description> <ident cce="4298-6" /> <oval id="service_acpid_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -43,6 +45,7 @@ daemon should be disabled. </description> <ident cce="TODO" /> <oval id="service_atd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -57,6 +60,7 @@ be used for system auditing it is recommended that auditd be enabled. </description> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> +<ref nist="AU-3, CM-6" /> </Rule>
<Group id="base_bluetooth"> @@ -72,6 +76,7 @@ Removal of hardware is the only way to ensure that the Bluetooth wireless capabi </description> <ident cce="4355-4" /> <oval id="service_bluetooth_disabled" /> +<ref nist="AC-18, CM-6, CM-7" /> </Rule>
<Rule id="kernel_module_bluetooth_disabled"> @@ -82,6 +87,7 @@ alias bluetooth off</pre> </description> <ident cce="14948-4" /> <oval id="kernel_module_bluetooth_disabled" /> +<ref nist="AC-18, CM-6, CM-7" /> </Rule>
</Group> <!-- <Group id="base_bluetooth"> --> @@ -97,6 +103,7 @@ the LAN this service should be disabled. </description> <ident cce="TODO" /> <oval id="service_certmonger_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_cgconfig_disabled"> @@ -109,6 +116,7 @@ Unless control groups are used to manage system resources this service should be </description> <ident cce="TODO" /> <oval id="service_cgconfig_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_cgred_disabled"> @@ -120,6 +128,7 @@ if control groups are not needed to manage system resources then this service sh </description> <ident cce="TODO" /> <oval id="service_cgred_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_cpuspeed_disabled"> @@ -132,6 +141,7 @@ this service should be disabled. </description> <ident cce="4051-9" /> <oval id="service_cpuspeed_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -144,6 +154,7 @@ tasks. The daemon should be configured defensively. </description> <ident cce="4324-0" /> <oval id="service_crond_enabled" /> +<ref nist="CM-6" /> </Rule>
@@ -156,6 +167,7 @@ as a print server then this service should be disabled. </description> <ident cce="4112-9" /> <oval id="service_cups_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_haldaemon_disabled"> @@ -169,6 +181,7 @@ be disabled. </description> <ident cce="4364-6" /> <oval id="service_haldaemon_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_ip6tables_enabled"> @@ -182,6 +195,7 @@ networking is enabled on the local machine then this service should be enabled. </description> <ident cce="4167-3" /> <oval id="service_ip6tables_enabled" /> +<ref nist="AC-3, CM-6" /> </Rule>
<Rule id="service_iptables_enabled"> @@ -195,6 +209,7 @@ networking is enabled on the local machine then this service should be enabled. </description> <ident cce="4189-7" /> <oval id="service_iptables_enabled" /> +<ref nist="AC-3, CM-6" /> </Rule>
<Rule id="service_irqbalance_enabled"> @@ -207,6 +222,7 @@ a useful service and should be left enabled. </description> <ident cce="4123-6" /> <oval id="service_irqbalance_enabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_kdump_disabled"> @@ -219,6 +235,7 @@ system is used for kernel development or testing, disable the service: </description> <ident cce="3425-6" /> <oval id="service_kdump_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -233,6 +250,7 @@ mirrored or snapshot logical volumes then this service should be configured and </description> <ident cce="TODO" /> <oval id="service_lvm2-monitor_enabled" /> +<ref nist="SI-11, CM-6" /> </Rule>
<Rule id="service_mdmonitor_disabled"> @@ -245,6 +263,7 @@ disable this service: </description> <ident cce="3854-7" /> <oval id="service_mdmonitor_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -261,6 +280,7 @@ are in use, disable this service: </description> <ident cce="3822-4" /> <oval id="service_messagebus_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="service_netconsole_disabled"> @@ -274,6 +294,7 @@ this service should be disabled. </description> <ident cce="TODO" /> <oval id="service_netconsole_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -287,6 +308,7 @@ this service can be left enabled. </description> <ident cce="4369-5" /> <oval id="service_network_enabled" /> +<ref nist="CM-6" /> </Rule>
@@ -301,6 +323,7 @@ to leave this service enabled. </description> <ident cce="4376-0 " /> <oval id="service_ntpd_enabled" /> +<ref nist="AU-8, CM-6" /> </Rule>
<Rule id="service_ntpdate_enabled"> @@ -316,6 +339,7 @@ sufficient. For servers it is generally recommended to enable the ntpd service. </description> <ident cce="TODO" /> <oval id="service_ntpdate_enabled" /> +<ref nist="AU-8, CM-6" /> </Rule>
<Rule id="service_oddjobd_disabled"> @@ -326,6 +350,7 @@ applications which communicate with it through the system message bus. </description> <ident cce="TODO" /> <oval id="service_oddjobd_disabled" /> +<ref nist="AC-6, CM-6, CM-7" /> </Rule>
@@ -336,6 +361,7 @@ applications which communicate with it through the system message bus. </description> <ident cce="TODO" /> <oval id="service_portreserve_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -350,6 +376,7 @@ service enabled for local mail delivery. </description> <ident cce="14068-1" /> <oval id="service_postfix_enabled" /> +<ref nist="CM-6" /> </Rule>
@@ -362,6 +389,7 @@ is recommended that this service be configured and enabled. </description> <ident cce="TODO" /> <oval id="service_psacct_enabled" /> +<ref nist="AU-12, CM-6" /> </Rule>
<Rule id="service_quota_nld_disabled"> @@ -375,6 +403,7 @@ violations are not desired then disable this service. </description> <ident cce="TODO" /> <oval id="service_quota_nld_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -391,11 +420,12 @@ configuration information. </description> <ident cce="TODO" /> <oval id="service_rdisc_disabled" /> +<ref nist="AC-4, CM-6, CM-7" /> </Rule>
<Rule id="service_restorecond_enabled"> -<title>Disable Restore SELinux Context Service (restorecond)</title> +<title>Enable Restore SELinux Context Service (restorecond)</title> <description>The restorecond service utilizes inotify to look for the creation of new files listed in the /etc/selinux/restorecond.conf configuration file. Once the file is created, restorecond ensures that the file receives the proper SELinux security context. It is @@ -404,6 +434,7 @@ recommended that this service be enabled. </description> <ident cce="4129-3" /> <oval id="service_restorecond_enabled" /> +<ref nist="AC-3, CM-6" /> </Rule>
@@ -418,6 +449,7 @@ service and perform patching in accordance with local configuration management p </description> <ident cce="TODO" /> <oval id="service_rhnsd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -430,6 +462,7 @@ recommended to also disable this service. </description> <ident cce="TODO" /> <oval id="service_rhsmcertd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -444,6 +477,7 @@ to database formats, and the encryption of log data en route to a central loggin </description> <ident cce="17698-2" /> <oval id="service_rsyslog_enabled" /> +<ref nist="AU-12, CM-6" /> </Rule>
@@ -457,6 +491,7 @@ understand SASL based authentication. Unless this service is absolutely needed i </description> <ident cce="TODO" /> <oval id="service_saslauthd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -470,6 +505,7 @@ system’s hard drives are SMART-capable. Otherwise, disable this service. </description> <ident cce="3455-3" /> <oval id="service_smartd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -483,6 +519,7 @@ administration is needed then this service should be enabled. Otherwise, it shou </description> <ident cce="4268-9" /> <oval id="service_sshd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -496,6 +533,7 @@ to provide client auditing and policy services for projects like FreeIPA. </description> <ident cce="TODO" /> <oval id="service_sssd_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -510,6 +548,7 @@ service should be disabled. </description> <ident cce="TODO" /> <oval id="service_sysstat_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
<!-- @@ -534,6 +573,7 @@ not be enabled on systems which are not using NIS. </description> <ident cce="3705-1" /> <oval id="service_ypbind_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
</Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/ipsec.xml | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/network/ipsec.xml b/rhel6/src/input/system/network/ipsec.xml index 2acd2d2..b1004ed 100644 --- a/rhel6/src/input/system/network/ipsec.xml +++ b/rhel6/src/input/system/network/ipsec.xml @@ -9,6 +9,7 @@ <description>OpenSWAN should be installed.</description> <ident cce="111111111" /> <oval id="package_openswan_installed" /> +<ref nist="AC-17, MA-4, SC-9" /> </Rule> </Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/accounts/banners.xml | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 347f467..488a9ac 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -124,6 +124,7 @@ without logging in. <Rule id="disable_user_list"> <title>Disable the User List</title> <description>GDM's list of previously logged in users should not be displayed.</description> +<ref nist="AC-23, CM-6" /> </Rule> </Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/iptables.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/network/iptables.xml b/rhel6/src/input/system/network/iptables.xml index 8b40123..cdbf89a 100644 --- a/rhel6/src/input/system/network/iptables.xml +++ b/rhel6/src/input/system/network/iptables.xml @@ -222,7 +222,7 @@ The following rule will log all traffic originating from a site-local address, w </description> <!--<ident cce="14264-6" />--> <!--MANUAL<oval id="iptables_log_and_drop_suspicious" />--> -<!--<ref nist="AC-4, CM-6" />--> +<ref nist="AC-4, AC-17, CM-6" />--> </Rule>
</Group><!--<Group id="ruleset_modifications">-->
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/ipv6.xml | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/network/ipv6.xml b/rhel6/src/input/system/network/ipv6.xml index b617269..7b43edd 100644 --- a/rhel6/src/input/system/network/ipv6.xml +++ b/rhel6/src/input/system/network/ipv6.xml @@ -40,6 +40,7 @@ IPV6INIT=no</pre> For each network interface IFACE , add or correct the following lines in <tt>/etc/sysconfig/network-scripts/</tt> ifcfg-IFACE as an additional prevention mechanism: <pre>IPV6INIT=no</pre> </description> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="network_ipv6_disable_rpc">
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/network.xml | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/network/network.xml b/rhel6/src/input/system/network/network.xml index 8c5763b..ad07930 100644 --- a/rhel6/src/input/system/network/network.xml +++ b/rhel6/src/input/system/network/network.xml @@ -24,6 +24,7 @@ If the system is a standalone machine with no need for network access or even co <rationale>The network interfaces expand the attack surface of a system. If they are not needed they should be disabled.</rationale> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_disable_unused_interfaces" />--> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="network_disable_zeroconf"> @@ -34,6 +35,7 @@ If the system is a standalone machine with no need for network access or even co <rationale>Zeroconf addresses are in the network 169.254.0.0. The networking scripts add entries to the system’s routing table for these addresses. Zeroconf address assignment commonly occurs when the system is configured to use DHCP but fails to receive an address assignment from the DHCP server.</rationale> <ident cce="CCE-14054-1" /> <oval id="sysconfig_nozeroconf_yes" /> +<ref nist="CM-6, CM-7" /> </Rule>
<Rule id="network_sniffer_disabled"> @@ -45,6 +47,7 @@ If the system is a standalone machine with no need for network access or even co </rationale> <ident cce="CCE-15013-6" /> <oval id="network_sniffer_disabled" /> +<ref nist="CM-6, CM-7, MA-3" /> </Rule>
</Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/ssl.xml | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/network/ssl.xml b/rhel6/src/input/system/network/ssl.xml index e0e56f6..c439ed4 100644 --- a/rhel6/src/input/system/network/ssl.xml +++ b/rhel6/src/input/system/network/ssl.xml @@ -79,6 +79,7 @@ of the server certificate. </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_create_ca" />--> +<ref nist="SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_create_ssl_certs"> @@ -100,6 +101,7 @@ Instructions on how to generate and sign SSL certificates are provided for the f </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_create_ssl_certs" />--> +<ref nist="CM-6, SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_enable_client_support"> @@ -112,6 +114,7 @@ To avoid this warning, and properly authenticate the servers, your CA certificat application on every client system that will be connecting to an SSL-enabled server.</description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_enable_client_support" />--> +<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_add_ca_firefox"> @@ -130,6 +133,7 @@ web sites, e-mail users, and software developers and trust it for each according </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_add_ca_firefox" />--> +<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_add_ca_thunderbird"> @@ -148,6 +152,7 @@ web sites, e-mail users, and software developers and trust it for each according </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_add_ca_thunderbird" />--> +<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_add_ca_evolution"> @@ -166,6 +171,7 @@ web sites, e-mail users, and software developers and trust it for each according </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_add_ca_evolution" />--> +<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" /> </Rule>
<Rule id="network_ssl_remove_certs"> @@ -177,6 +183,7 @@ Internet-connected system. </description> <!--<ident cce="TODO" />--> <!--TODO:MANUAL<oval id="network_ssl_remove_certs" />--> +<ref nist="AC-3, AC-17, CM-6, SC-12, SC-13" /> </Rule>
</Group><!--<Group id="network_ssl">-->
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/network/uncommon.xml | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/network/uncommon.xml b/rhel6/src/input/system/network/uncommon.xml index 41e31da..1911b2e 100644 --- a/rhel6/src/input/system/network/uncommon.xml +++ b/rhel6/src/input/system/network/uncommon.xml @@ -27,6 +27,7 @@ the system against exploitation of any flaws in its implementation. </rationale> <ident cce="14268-7" /> <oval id="kernel_module_dccp_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -46,6 +47,7 @@ the system against exploitation of any flaws in its implementation. </rationale> <ident cce="14132-5" /> <oval id="kernel_module_sctp_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -64,6 +66,7 @@ the system against exploitation of any flaws in its implementation. </rationale> <ident cce="14027-7" /> <oval id="kernel_module_rds_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
@@ -82,6 +85,7 @@ the system against exploitation of any flaws in its implementation. </rationale> <ident cce="14911-2" /> <oval id="kernel_module_tipc_disabled" /> +<ref nist="CM-6, CM-7" /> </Rule>
</Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/permissions/execution.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/permissions/execution.xml b/rhel6/src/input/system/permissions/execution.xml index d83fef4..1c1a58b 100644 --- a/rhel6/src/input/system/permissions/execution.xml +++ b/rhel6/src/input/system/permissions/execution.xml @@ -184,7 +184,7 @@ on AMD-based systems.</description> <rationale>Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will allow users to turn the feature on or off at will.</rationale> <ident cce="4177-2" /> -<!--<ref nist="CM-7" />--> +<ref nist="CM-6" /> </Rule>
</Group> <!--<Group id="enable_nx"> -->
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/permissions/mounting.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/rhel6/src/input/system/permissions/mounting.xml b/rhel6/src/input/system/permissions/mounting.xml index 87b83d6..1899858 100644 --- a/rhel6/src/input/system/permissions/mounting.xml +++ b/rhel6/src/input/system/permissions/mounting.xml @@ -27,7 +27,7 @@ solve the same problem with less risk.</description> <rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale> <ident cce="3685-5" /> <oval id="console_device_restrict_access_desktop" /> -<!--<ref nist="CM-6, CM-7" />--> +<ref nist="AC-6, CM-6, CM-7" /> </Rule>
<Rule id="console_device_restrict_access_server"> @@ -37,7 +37,7 @@ solve the same problem with less risk.</description> <rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale> <ident cce="3685-5" /> <oval id="console_device_restrict_access_server" /> -<!--<ref nist="CM-6, CM-7" />--> +<ref nist="AC-6, CM-6, CM-7" /> </Rule>
<Rule id="kernel_module_usb-storage_disabled"> @@ -283,7 +283,7 @@ malicious file would exploit the thumbnailer with the potential for malicious co is best to disable these thumbnailer applications unless they are explicitly required.</rationale> <ident cce="TODO" /> <oval id="disable_gnome_thumbnailers" /> -<ref nist="TODO" /> +<ref nist="CM-6, CM-7" /> </Rule>
</Group>
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/selinux.xml | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/selinux.xml b/rhel6/src/input/system/selinux.xml index 23f1c78..76449d1 100644 --- a/rhel6/src/input/system/selinux.xml +++ b/rhel6/src/input/system/selinux.xml @@ -191,6 +191,7 @@ It should produce no output in a well-configured system. Daemons which run with the <tt>initrc_t</tt> context may cause AVC denials, or allow privileges that the daemon does not require. </rationale> +<ref nist="AC-6, CM-6, CM-7" /> </Rule>
<Rule id="selinux_unlabeled_device_files">
From: Willy Santos wsantos@redhat
Signed-off-by: Willy Santos wsantos@redhat --- rhel6/src/input/system/software/integrity.xml | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml index 5fedd85..dea8b37 100644 --- a/rhel6/src/input/system/software/integrity.xml +++ b/rhel6/src/input/system/software/integrity.xml @@ -39,7 +39,7 @@ The AIDE package must be installed if it is to be available for integrity checki </rationale> <ident cce="4209-3" /> <oval id="package_aide_installed" /> -<ref nist="CM-6, CM-7"/> +<ref nist="CM-6, CM-7, SC-28, SI-7" /> </Rule>
<Rule id="disable_prelink"> @@ -57,6 +57,7 @@ to restore binaries to a normal, non-prelinked state. The prelinking feature can interfere with the operation of AIDE, because it changes binaries. </rationale> +<ref nist="CM-6, SC-28, SI-7" /> </Rule>
<Rule id="aide_build_database"> @@ -76,6 +77,7 @@ If this check produces any unexpected output, investigate. For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files. </rationale> +<ref nist="SC-28, SI-7" /> </Rule>
<Rule id="aide_periodic_cron_checking"> @@ -90,6 +92,7 @@ AIDE can be executed periodically through other means; this is merely one exampl By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files. </rationale> +<ref nist="CM-6, SC-28, SI-7" /> </Rule>
<Rule id="aide_verify_integrity_manually"> @@ -117,7 +120,7 @@ earlier for this purpose. </rationale> <!--<ident cce="4209-3" />--> <!--<oval id="aide_verify_integrity_manually" />--> -<!--<ref nist="CM-6, CM-7"/>--> +<ref nist="SC-28, SI-7" /> </Rule>
</Group>
On 4/25/12 9:11 AM, Willy Santos wrote:
From: Willy Santoswsantos@redhat
The following commits add NIST 800-53 references to all rules that did not already have them (<nist ref= />).
Willy Santos (13): Added 800-53 refs to Avahi rules. Added 800-53 refs for base services. Added 800-53 refs for IPSec. Added 800-53 refs for login banners. Added 800-53 refs for iptables. Added 800-53 refs for IPv6 rules. Added 800-53 refs for networking rules. Added 800-53 refs for SSL. Added 800-53 refs for uncommon rules. Added 800-53 refs for permission execution rules. Added 800-53 refs for mounting rules. Added 800-53 refs for selinux rules. Added 800-53 refs for software integrity rules.
Given that we're converting the mappings from NIST over to the CCIs (which get us things like NIST 800-53 and OS SRG for free) these patches will have a short lifespan, however they do provide us with a foundation for identifying what potential CCIs the rules apply to. Ack for the patchset, so that these can provide a base for mapping to appropriate CCIs.
scap-security-guide@lists.fedorahosted.org
-
Shawn Wells -
Willy Santos