--- RHEL6/input/services/ftp.xml | 12 ++++++------ RHEL6/input/system/permissions/permissions.xml | 2 +- RHEL6/input/system/selinux.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 27957c8..361f7dc 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -84,7 +84,7 @@ xferlog_std_format=NO log_ftp_protocol=YES</pre> </description> <ocil clause="xferlog_enable is missing, or is not set to yes"> -Find if logging is applied to the ftp daemon. +Find if logging is applied to the FTP daemon. <br/><br/> Procedures: <br/><br/> @@ -96,7 +96,7 @@ If the <i>server_args</i> line is missing or does not include the vsftpd configu <pre># grep xferlog_enable <i>vsftpd config file</i></pre> </ocil> <rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to -the ftp server are logged using the verbose vsftpd log +the FTP server are logged using the verbose vsftpd log format. The default vsftpd log file is <tt>/var/log/vsftpd.log</tt>.</rationale> <warning category="general">If verbose logging to <tt>vsftpd.log</tt> is done, sparse logging of downloads to <tt>/var/log/xferlog</tt> will not also occur. However, the information about what files were downloaded is included in the information logged to <tt>vsftpd.log</tt></warning> <ident cce="27142-9" /> @@ -152,13 +152,13 @@ these logins as much as possible.</description> <pre>userlist_enable=YES userlist_file=/etc/vsftp.ftpusers userlist_deny=NO</pre> -Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via ftp, add a line containing that user's name: +Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name: <pre>USERNAME</pre> If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well. <pre>anonymous ftp</pre> </description> -<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale> +<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</rationale> <!--<oval id="ftp_limit_users" />--> <!--<ref nist="CM-7" /> --> </Group> @@ -183,7 +183,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam
<Rule id="ftp_home_partition"> <title>Place the FTP Home Directory on its Own Partition</title> -<description>By default, the anonymous FTP root is the home directory of the ftp user account. The df command can +<description>By default, the anonymous FTP root is the home directory of the FTP user account. The df command can be used to verify that this directory is on its own partition.</description> <rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent these users from filling a disk used by other services.</rationale> @@ -202,7 +202,7 @@ the FTP connection tracking module: <rationale>These settings configure iptables to allow connections to an FTP server. The first line allows initial connections to the FTP server port. FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client -and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by +and server negotiate an arbitrary port to be used for data transfer. The <tt>ip_conntrack_ftp</tt> module is used by iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an FTP server to operate on a machine which is running a firewall.</rationale> <!--<oval id="ftp_configure_firewall" />--> diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml index 3dfb32e..8e5e148 100644 --- a/RHEL6/input/system/permissions/permissions.xml +++ b/RHEL6/input/system/permissions/permissions.xml @@ -18,6 +18,6 @@ The following command prints a list of ext4 partitions on the local machine, which is the default filesystem for Red Hat Enterprise Linux 6 installations: <pre>$ mount -t ext4 | awk '{print $3}'</pre> -If your site uses a local filesystem type other than ext4 then you +If your site uses a local filesystem type other than ext4, you will need to modify this command.</description> </Group> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 9de5714..dec9054 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -10,7 +10,7 @@ sufficiently developed and debugged that it should be usable on almost any Red Hat machine with minimal configuration and a small amount of system administrator training. This policy prevents system services - including most of the common network-visible -services such as mail servers, ftp servers, and DNS servers - from +services such as mail servers, FTP servers, and DNS servers - from accessing files which those services have no valid reason to access. This action alone prevents a huge amount of possible damage from network attacks against services, from trojaned software, and diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 7d5cc5b..a94943b 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -1,6 +1,6 @@ <Group id="disk_partitioning"> <title>Disk Partitioning</title> -<description>To ensure separation and protection of data there +<description>To ensure separation and protection of data, there are top-level system directories which should be placed on their own physical partition or logical volume. The installer's default partitioning scheme creates separate logical volumes for
Looks fine, please push.
On 04/30/2013 12:58 PM, David Smith wrote:
RHEL6/input/services/ftp.xml | 12 ++++++------ RHEL6/input/system/permissions/permissions.xml | 2 +- RHEL6/input/system/selinux.xml | 2 +- RHEL6/input/system/software/disk_partitioning.xml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 27957c8..361f7dc 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -84,7 +84,7 @@ xferlog_std_format=NO log_ftp_protocol=YES</pre>
</description> <ocil clause="xferlog_enable is missing, or is not set to yes"> -Find if logging is applied to the ftp daemon. +Find if logging is applied to the FTP daemon. <br/><br/> Procedures: <br/><br/> @@ -96,7 +96,7 @@ If the <i>server_args</i> line is missing or does not include the vsftpd configu <pre># grep xferlog_enable <i>vsftpd config file</i></pre> </ocil> <rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to -the ftp server are logged using the verbose vsftpd log +the FTP server are logged using the verbose vsftpd log format. The default vsftpd log file is <tt>/var/log/vsftpd.log</tt>.</rationale> <warning category="general">If verbose logging to <tt>vsftpd.log</tt> is done, sparse logging of downloads to <tt>/var/log/xferlog</tt> will not also occur. However, the information about what files were downloaded is included in the information logged to <tt>vsftpd.log</tt></warning> <ident cce="27142-9" /> @@ -152,13 +152,13 @@ these logins as much as possible.</description> <pre>userlist_enable=YES userlist_file=/etc/vsftp.ftpusers userlist_deny=NO</pre> -Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via ftp, add a line containing that user's name: +Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name: <pre>USERNAME</pre> If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well. <pre>anonymous ftp</pre> </description> -<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale> +<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</rationale> <!--<oval id="ftp_limit_users" />--> <!--<ref nist="CM-7" /> --> </Group> @@ -183,7 +183,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam
<Rule id="ftp_home_partition"> <title>Place the FTP Home Directory on its Own Partition</title> -<description>By default, the anonymous FTP root is the home directory of the ftp user account. The df command can +<description>By default, the anonymous FTP root is the home directory of the FTP user account. The df command can be used to verify that this directory is on its own partition.</description> <rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent these users from filling a disk used by other services.</rationale> @@ -202,7 +202,7 @@ the FTP connection tracking module: <rationale>These settings configure iptables to allow connections to an FTP server. The first line allows initial connections to the FTP server port. FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client -and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by +and server negotiate an arbitrary port to be used for data transfer. The <tt>ip_conntrack_ftp</tt> module is used by iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an FTP server to operate on a machine which is running a firewall.</rationale> <!--<oval id="ftp_configure_firewall" />--> diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml index 3dfb32e..8e5e148 100644 --- a/RHEL6/input/system/permissions/permissions.xml +++ b/RHEL6/input/system/permissions/permissions.xml @@ -18,6 +18,6 @@ The following command prints a list of ext4 partitions on the local machine, which is the default filesystem for Red Hat Enterprise Linux 6 installations: <pre>$ mount -t ext4 | awk '{print $3}'</pre> -If your site uses a local filesystem type other than ext4 then you +If your site uses a local filesystem type other than ext4, you will need to modify this command.</description> </Group> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 9de5714..dec9054 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -10,7 +10,7 @@ sufficiently developed and debugged that it should be usable on almost any Red Hat machine with minimal configuration and a small amount of system administrator training. This policy prevents system services - including most of the common network-visible -services such as mail servers, ftp servers, and DNS servers - from +services such as mail servers, FTP servers, and DNS servers - from accessing files which those services have no valid reason to access. This action alone prevents a huge amount of possible damage from network attacks against services, from trojaned software, and diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 7d5cc5b..a94943b 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -1,6 +1,6 @@ <Group id="disk_partitioning"> <title>Disk Partitioning</title> -<description>To ensure separation and protection of data there +<description>To ensure separation and protection of data, there are top-level system directories which should be placed on their own physical partition or logical volume. The installer's default partitioning scheme creates separate logical volumes for
scap-security-guide@lists.fedorahosted.org
-
David Smith -
Jeffrey Blank