More CCI mappings to SSG content.
Willy Santos (14): Mapped CCI-000056 to gui_screen_locking group and install_vlock_package Mapped CCI-000057 to gui_screen_locking group Mapped CCI-000058 to install_vlock_package Mapped CCI-000060 to gui_screen_locking Mapped CCI-000068 to ssh_server group Mapped CCI-000087 to mountopt_noexec_on_removable_partitions Mapped CCI-000192 to password_require_uppercases Mapped CCI-000193 to password_require_lowercases Mapped CCI-001384 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001385 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001386 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001387 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001388 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001069 to aide group
rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/accounts/banners.xml | 4 ++-- rhel6/src/input/system/accounts/pam.xml | 4 ++-- rhel6/src/input/system/accounts/physical.xml | 3 ++- rhel6/src/input/system/permissions/partitions.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-)
CCI-000056 requires the use of session locks until user reauthenticates, the gui_screen_locking group meets this requirement for graphical environments and install_vlock_package meets the requirements for text console sessions.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/physical.xml | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 45ad144..96bbe69 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,6 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. +<ref disa="56" />
<br /><br /> Because users should be trained to lock the screen when they @@ -288,7 +289,7 @@ for users who may need to suspend console logins. </rationale> <ident cce="3910-7" /> <oval id="package_vlock_installed" /> -<ref nist="CM-6, CM-7" /> +<ref nist="CM-6, CM-7" disa="56" /> </Rule> </Group> </Group>
CCI-000057 requires initiating a session lock after an organization-defined period of inactivity, the gui_screen_locking group meets this requirement.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 96bbe69..e1a3e69 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. -<ref disa="56" /> +<ref disa="56,57" />
<br /><br /> Because users should be trained to lock the screen when they
CCI-000058 requires the OS to provide the user with the capability of directly initiating a session lock, install_vlock_package meets this requirement for the CLI.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index e1a3e69..afd2cfc 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -289,7 +289,7 @@ for users who may need to suspend console logins. </rationale> <ident cce="3910-7" /> <oval id="package_vlock_installed" /> -<ref nist="CM-6, CM-7" disa="56" /> +<ref nist="CM-6, CM-7" disa="56,58" /> </Rule> </Group> </Group>
CCI-000060 requires the session lock mechanism to hide what was previously on the screen, gui_screen_locking meets this requirement for a graphical environment.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index afd2cfc..99d7e2b 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. -<ref disa="56,57" /> +<ref disa="56,57,60" />
<br /><br /> Because users should be trained to lock the screen when they
CCI-000068 requires the use of encryption to protect remote access sessions, ssh_server meets this requirement.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/services/ssh.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/services/ssh.xml b/rhel6/src/input/services/ssh.xml index 0fd4585..9df23f0 100644 --- a/rhel6/src/input/services/ssh.xml +++ b/rhel6/src/input/services/ssh.xml @@ -38,7 +38,7 @@ certain changes should be made to the OpenSSH daemon configuration file <tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied to this file. See the <tt>sshd_config(5)</tt> man page for more detailed information.</description> -<ref disa="197,888" /> +<ref disa="68,197,888" />
<Rule id="sshd_allow_only_protocol2" severity="high"> <title>Allow Only SSH Protocol 2</title>
CCI-000087 requires disabling execution of code on mobile devices, mountopt_noexec_on_removable_partitions meets this requirement.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/permissions/partitions.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/permissions/partitions.xml b/rhel6/src/input/system/permissions/partitions.xml index 5fdd7ad..87e78df 100644 --- a/rhel6/src/input/system/permissions/partitions.xml +++ b/rhel6/src/input/system/permissions/partitions.xml @@ -59,7 +59,7 @@ certain types of worms or malicious code.</description> the system to potential compromise.</rationale> <ident cce="4275-4" /> <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" /> -<ref nist="CM-7, MP-2"/> +<ref nist="CM-7, MP-2" disa="87" /> </Rule>
<Rule id="mountopt_nosuid_on_removable_partitions">
CCI-000192 requires enfocing password complexity by the number of upper case character used, this is met by password_require_uppercases.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index 78b6d7b..9e77717 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -195,7 +195,7 @@ more difficult by ensuring a larger search space. </rationale> <ident cce="14672-0" /> <oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/> -<ref nist="IA-5" /> +<ref nist="IA-5" disa="192" /> </Rule>
<Rule id="password_require_specials">
CCI-000193 requires enforcing password complexity by the number of lower case charachters used, password_require_lowercases meets this requirement.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index 9e77717..5fa2d32 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -227,7 +227,7 @@ more difficult by ensuring a larger search space. </rationale> <ident cce="14712-4" /> <oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/> -<ref nist="IA-5" /> +<ref nist="IA-5" disa="193" /> </Rule>
<Rule id="password_require_diffchars">
CCI-001384 requires the display fo system use information before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 85b511e..8aff9a5 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> </Rule>
<Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> </Rule>
</Group>
CCI-001385 requires the display of reference to monitoring, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 8aff9a5..e8c4fbb 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> </Rule>
<Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> </Rule>
</Group>
CCI-001386 requires the display of references to recording, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index e8c4fbb..9d60d2d 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> </Rule>
<Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> </Rule>
</Group>
CCI-001387 requires the display of references to auditing, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 9d60d2d..b2865b7 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> </Rule>
<Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> </Rule>
</Group>
CCI-001388 requires the display of a description of the authorized uses of the system before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index b2865b7..443fbed 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> </Rule>
<Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> </Rule>
</Group>
CCI-001069 requires the automated detection of the presence of unauthorized software, this is met by the aide group.
Signed-off-by: Willy Santos wsantos@redhat.com --- rhel6/src/input/system/software/integrity.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml index e11b1c6..c203d01 100644 --- a/rhel6/src/input/system/software/integrity.xml +++ b/rhel6/src/input/system/software/integrity.xml @@ -27,7 +27,7 @@ impractical due to registration and software updates. AIDE is highly configurable. This advice is based on information provided in its documentation available in <tt>/usr/share/doc/aide-VERSION</tt></description> -<ref disa="1297"/> +<ref disa="1069,1297"/>
<Rule id="install_aide"> <title>Install AIDE</title>
I hereby deem this ACK-tastic.
On 05/04/2012 09:50 AM, Willy Santos wrote:
More CCI mappings to SSG content.
Willy Santos (14): Mapped CCI-000056 to gui_screen_locking group and install_vlock_package Mapped CCI-000057 to gui_screen_locking group Mapped CCI-000058 to install_vlock_package Mapped CCI-000060 to gui_screen_locking Mapped CCI-000068 to ssh_server group Mapped CCI-000087 to mountopt_noexec_on_removable_partitions Mapped CCI-000192 to password_require_uppercases Mapped CCI-000193 to password_require_lowercases Mapped CCI-001384 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001385 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001386 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001387 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001388 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001069 to aide group
rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/accounts/banners.xml | 4 ++-- rhel6/src/input/system/accounts/pam.xml | 4 ++-- rhel6/src/input/system/accounts/physical.xml | 3 ++- rhel6/src/input/system/permissions/partitions.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-)
scap-security-guide@lists.fedorahosted.org
-
Jeffrey Blank -
Willy Santos