From: Michael Palmiotto mpalmiotto@tresys.com
--- .../input/checks/service_squid_acls_configured.xml | 60 ++++ .../service_squid_authentication_configured.xml | 30 ++ .../service_squid_default_insecure_changed.xml | 60 ++++ .../service_squid_default_secure_verified.xml | 100 ++++++ .../service_squid_listening_port_uncommon.xml | 30 ++ .../input/checks/service_squid_logs_forwarded.xml | 30 ++ .../checks/service_squid_privileges_lowered.xml | 74 +++++ rhel6/src/input/checks/system_icp_configured.xml | 50 +++ .../input/checks/system_proxy_access_allowed.xml | 30 ++ rhel6/src/input/services/squid.xml | 328 +++++++++++++++++++- 10 files changed, 790 insertions(+), 2 deletions(-) create mode 100644 rhel6/src/input/checks/service_squid_acls_configured.xml create mode 100644 rhel6/src/input/checks/service_squid_authentication_configured.xml create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_changed.xml create mode 100644 rhel6/src/input/checks/service_squid_default_secure_verified.xml create mode 100644 rhel6/src/input/checks/service_squid_listening_port_uncommon.xml create mode 100644 rhel6/src/input/checks/service_squid_logs_forwarded.xml create mode 100644 rhel6/src/input/checks/service_squid_privileges_lowered.xml create mode 100644 rhel6/src/input/checks/system_icp_configured.xml create mode 100644 rhel6/src/input/checks/system_proxy_access_allowed.xml
diff --git a/rhel6/src/input/checks/service_squid_acls_configured.xml b/rhel6/src/input/checks/service_squid_acls_configured.xml new file mode 100644 index 0000000..a68be3d --- /dev/null +++ b/rhel6/src/input/checks/service_squid_acls_configured.xml @@ -0,0 +1,60 @@ +<def-group> + <definition class="compliance" id="service_squid_acls_configured" version="1"> + <metadata> + <title>Access Control Lists (ACLs) Tightened</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-511-2, CCE-4529-4, CCE-3610-3, CCE-4466-9, CCE-4607-8, CCE-4255-6, CCE-4127-7, CCE-4519-5, CCE-4413-1, CCE-4373-7" source="CCE" /> + <description>ACL policies tightened.</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" access_list src" test_ref="test_service_squid_acls_configured_access_list" /> + <criterion comment=" http_access allow" test_ref="test_service_squid_acls_configured_access_list_allow" /> + <criterion comment=" deny to_localhost" test_ref="test_service_squid_acls_configured_http_access" /> + <criterion comment=" http_access deny all" test_ref="test_service_squid_acls_configured_deny_access" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" access_list src" id="test_service_squid_acls_configured_access_list" version="1"> + <ind:object object_ref="object_service_squid_acls_configured_access_list" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_acls_configured_access_list" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^acl[\s]+__regex__([\w(_)*]+)[\s]+src[\s]+__regex__(\d{2,3})\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" http_access allow" id="test_service_squid_acls_configured_access_list_allow" version="1"> + <ind:object object_ref="object_service_squid_acls_configured_access_list_allow" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_acls_configured_access_list_allow" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^http_access[\s]+allow\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" deny to_localhost" id="test_service_squid_acls_configured_http_access" version="1"> + <ind:object object_ref="object_service_squid_acls_configured_http_access" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_acls_configured_http_access" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^http_access[\s]+deny[\s]+to_localhost\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" http_access deny all" id="test_service_squid_acls_configured_deny_access" version="1"> + <ind:object object_ref="object_service_squid_acls_configured_deny_access" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_acls_configured_deny_access" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^http_access[\s]+deny[\s]+all\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_authentication_configured.xml b/rhel6/src/input/checks/service_squid_authentication_configured.xml new file mode 100644 index 0000000..c21349c --- /dev/null +++ b/rhel6/src/input/checks/service_squid_authentication_configured.xml @@ -0,0 +1,30 @@ +<def-group> + <definition class="compliance" id="service_squid_authentication_configured" version="1"> + <metadata> + <title>Ensure Squid Authentication Configured (if Applicable)</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Ensure ACL Forced to Require Authentication</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" proxy_auth required" test_ref="test_service_squid_authentication_configured_acl" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" proxy_auth required" id="test_service_squid_authentication_configured_acl" version="1"> + <ind:object object_ref="object_service_squid_authentication_configured_acl" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_authentication_configured_acl" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^acl[\s]+[\w(_)*]+[\s]+proxy_auth[\s]+REQUIRED\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_default_insecure_changed.xml b/rhel6/src/input/checks/service_squid_default_insecure_changed.xml new file mode 100644 index 0000000..f11175c --- /dev/null +++ b/rhel6/src/input/checks/service_squid_default_insecure_changed.xml @@ -0,0 +1,60 @@ +<def-group> + <definition class="compliance" id="service_squid_default_insecure_changed" version="1"> + <metadata> + <title>Verify Default Insecure Settings</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4181-4, CCE-4577-3, CCE-4344-8, CCE-4494-1" source="CCE" /> + <description>Ensure that insecure default settings are changed</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" forwarded_for off" test_ref="test_service_squid_default_insecure_changed_forwarded" /> + <criterion comment=" httpd_suppress_version_string on" test_ref="test_service_squid_default_insecure_changed_suppress_version_string" /> + <criterion comment=" log_mime_hdrs on" test_ref="test_service_squid_default_insecure_changed_log_mime" /> + <criterion comment=" allow_underscore off" test_ref="test_service_squid_default_insecure_changed_underscore" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" forwarded_for off" id="test_service_squid_default_insecure_changed_forwarded" version="1"> + <ind:object object_ref="object_service_squid_default_insecure_changed_forwarded" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_forwarded" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^forwarded_for[\s]+off\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" httpd_suppress_version_string on" id="test_service_squid_default_insecure_changed_suppress_version_string" version="1"> + <ind:object object_ref="object_service_squid_default_insecure_changed_suppress_version_string" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_suppress_version_string" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^httpd_suppress_version_string[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" log_mime_hdrs on" id="test_service_squid_default_insecure_changed_log_mime" version="1"> + <ind:object object_ref="object_service_squid_default_insecure_changed_log_mime" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_log_mime" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^log_mime_hdrs[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" allow_underscore off" id="test_service_squid_default_insecure_changed_underscore" version="1"> + <ind:object object_ref="object_service_squid_default_insecure_changed_underscore" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_insecure_changed_underscore" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^allow_underscore[\s]+off\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_default_secure_verified.xml b/rhel6/src/input/checks/service_squid_default_secure_verified.xml new file mode 100644 index 0000000..1d12422 --- /dev/null +++ b/rhel6/src/input/checks/service_squid_default_secure_verified.xml @@ -0,0 +1,100 @@ +<def-group> + <definition class="compliance" id="service_squid_default_secure_verified" version="1"> + <metadata> + <title>Verify Default Secure Settings</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4454-5, CCE-4353-9, CCE-4503-9, CCE-3585-7, CCE-4419-8, CCE-3692-1, CCE-4459-4, CCE-4476-8" source="CCE" /> + <description>Ensure that secure settings are not changed from their default values</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" check_hostnames" test_ref="test_service_squid_default_secure_verified_check_hostnames" /> + <criterion comment=" reply_header_max_size" test_ref="test_service_squid_default_secure_verified_reply_header" /> + <criterion comment=" ftp_sanitycheck" test_ref="test_service_squid_default_secure_verified_sanitycheck" /> + <criterion comment=" ftp_passive" test_ref="test_service_squid_default_secure_verified_passive" /> + <criterion comment=" ignore_unknown_nameservers" test_ref="test_service_squid_default_secure_verified_ignore_unknown_nameservers" /> + <criterion comment=" cache_effective_group" test_ref="test_service_squid_default_secure_verified_cache_group" /> + <criterion comment=" request_header_max_siz" test_ref="test_service_squid_default_secure_verified_request_header" /> + <criterion comment=" cache_effective_user" test_ref="test_service_squid_default_secure_verified_cache_user" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" check_hostnames" id="test_service_squid_default_secure_verified_check_hostnames" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_check_hostnames" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_check_hostnames" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^check_hostnames[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" reply_header_max_size" id="test_service_squid_default_secure_verified_reply_header" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_reply_header" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_reply_header" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^reply_header_max_size[\s]+20[\s]+KB\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" ftp_sanitycheck" id="test_service_squid_default_secure_verified_sanitycheck" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_sanitycheck" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_sanitycheck" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^ftp_sanitycheck[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" ftp_passive" id="test_service_squid_default_secure_verified_passive" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_passive" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_passive" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^ftp_passive[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" ignore_unknown_nameservers" id="test_service_squid_default_secure_verified_ignore_unknown_nameservers" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_ignore_unknown_nameservers" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_ignore_unknown_nameservers" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^ignore_unknown_nameservers[\s]+on\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" cache_effective_group" id="test_service_squid_default_secure_verified_cache_group" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_cache_group" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_cache_group" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^cache_effective_group[\s]+squid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" request_header_max_siz" id="test_service_squid_default_secure_verified_request_header" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_request_header" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_request_header" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^request_header_max_size[\s]+20[\s]+KB\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" cache_effective_user" id="test_service_squid_default_secure_verified_cache_user" version="1"> + <ind:object object_ref="object_service_squid_default_secure_verified_cache_user" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_default_secure_verified_cache_user" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^cache_effective_user[\s]+squid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml b/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml new file mode 100644 index 0000000..3dd12b3 --- /dev/null +++ b/rhel6/src/input/checks/service_squid_listening_port_uncommon.xml @@ -0,0 +1,30 @@ +<def-group> + <definition class="compliance" id="service_squid_listening_port_uncommon" version="1"> + <metadata> + <title>Ensure Listen on Uncommon Port</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Ensure an arbitrary but uncommon high port to use as the Squid listening port.</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" Ensure arbitrary uncommon high port for Squid listening port." test_ref="test_service_squid_listening_port_uncommon_http_port" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" Ensure arbitrary uncommon high port for Squid listening port." id="test_service_squid_listening_port_uncommon_http_port" version="1"> + <ind:object object_ref="object_service_squid_listening_port_uncommon_http_port" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_listening_port_uncommon_http_port" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^http_port[\s]+\d{4}\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_logs_forwarded.xml b/rhel6/src/input/checks/service_squid_logs_forwarded.xml new file mode 100644 index 0000000..074462f --- /dev/null +++ b/rhel6/src/input/checks/service_squid_logs_forwarded.xml @@ -0,0 +1,30 @@ +<def-group> + <definition class="compliance" id="service_squid_logs_forwarded" version="1"> + <metadata> + <title>Forwarded Log Messages to Syslog Daemon</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Check if Squid sends messages to syslog.</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" logs forwarded" test_ref="test_service_squid_logs_forwarded_squid_opts" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" logs forwarded" id="test_service_squid_logs_forwarded_squid_opts" version="1"> + <ind:object object_ref="object_service_squid_logs_forwarded_squid_opts" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_logs_forwarded_squid_opts" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^SQUID_OPTS="${SQUID_OPTS:-"-D"}[\s]+-s"\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/service_squid_privileges_lowered.xml b/rhel6/src/input/checks/service_squid_privileges_lowered.xml new file mode 100644 index 0000000..88b4f2e --- /dev/null +++ b/rhel6/src/input/checks/service_squid_privileges_lowered.xml @@ -0,0 +1,74 @@ +<def-group> + <definition class="compliance" id="service_squid_privileges_lowered" version="1"> + <metadata> + <title>Service Entry Privileges Lowered</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Ensure service entry is modified to lower priveleges</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" squid status" test_ref="test_service_squid_privileges_lowered_status" /> + <criterion comment=" subsys remove" test_ref="test_service_squid_privileges_lowered_rm_subsys" /> + <criterion comment=" bin determined" test_ref="test_service_squid_privileges_lowered_determine_bin" /> + <criterion comment=" pid changed" test_ref="test_service_squid_privileges_lowered_change_pid" /> + <criterion comment=" new pid location" test_ref="test_service_squid_privileges_lowered_new_pid_loc" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" squid status" id="test_service_squid_privileges_lowered_status" version="1"> + <ind:object object_ref="object_service_squid_privileges_lowered_status" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_status" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^status[\s]+squid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment=" subsys remove" id="test_service_squid_privileges_lowered_rm_subsys" version="1"> + <ind:object object_ref="object_service_squid_privileges_lowered_rm_subsys" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_rm_subsys" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^rm[\s]+-f[\s]+/var/lock/subsys/squid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment=" bin determined" id="test_service_squid_privileges_lowered_determine_bin" version="1"> + <ind:object object_ref="object_service_squid_privileges_lowered_determine_bin" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_determine_bin" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^[[\s]+-f[\s]+/usr/sbin/squid[\s]+][\s]+&&[\s]+SQUID="sudo[\s]+-u[\s]+squid[\s]+squid"\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment=" pid changed" id="test_service_squid_privileges_lowered_change_pid" version="1"> + <ind:object object_ref="object_service_squid_privileges_lowered_change_pid" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_change_pid" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^[[\s]+$RETVAL[\s]+-eq[\s]+0[\s]+][\s]+&&[\s]+touch[\s]+/var/lock/subsys/squid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment=" new pid location" id="test_service_squid_privileges_lowered_new_pid_loc" version="1"> + <ind:object object_ref="object_service_squid_privileges_lowered_new_pid_loc" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_new_pid_loc" version="1"> + ind:path /etc/init.d</ind:path> + ind:filename squid</ind:filename> + <ind:pattern operation="pattern match">^[\w(_)*]+[\s]+/var/spool/squid/squid.pid\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/system_icp_configured.xml b/rhel6/src/input/checks/system_icp_configured.xml new file mode 100644 index 0000000..868335c --- /dev/null +++ b/rhel6/src/input/checks/system_icp_configured.xml @@ -0,0 +1,50 @@ +<def-group> + <definition class="compliance" id="system_icp_configured" version="1"> + <metadata> + <title>Ensure Internet Cache Protocol (ICP) Configured if Necessary</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>ICP port should be disabled if Squid server is standalone</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" icp_access allow" test_ref="test_system_icp_configured_neighbor_allow" /> + <criterion comment=" icp_access deny all" test_ref="test_system_icp_configured_deny_rest" /> + <criterion comment=" icp_port 0" test_ref="test_system_icp_configured_icp_port" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" icp_access allow" id="test_system_icp_configured_neighbor_allow" version="1"> + <ind:object object_ref="object_system_icp_configured_neighbor_allow" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_system_icp_configured_neighbor_allow" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^icp_access[\s]+allow[\s]+[\w(_)*]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" icp_access deny all" id="test_system_icp_configured_deny_rest" version="1"> + <ind:object object_ref="object_system_icp_configured_deny_rest" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_system_icp_configured_deny_rest" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^icp_access[\s]+deny[\s]+all\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment=" icp_port 0" id="test_system_icp_configured_icp_port" version="1"> + <ind:object object_ref="object_system_icp_configured_icp_port" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_system_icp_configured_icp_port" version="1"> + ind:path /etc/squid</ind:path> + ind:filename squid.conf</ind:filename> + <ind:pattern operation="pattern match">^icp_port[\s]+0\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/system_proxy_access_allowed.xml b/rhel6/src/input/checks/system_proxy_access_allowed.xml new file mode 100644 index 0000000..496f2d0 --- /dev/null +++ b/rhel6/src/input/checks/system_proxy_access_allowed.xml @@ -0,0 +1,30 @@ +<def-group> + <definition class="compliance" id="system_proxy_access_allowed" version="1"> + <metadata> + <title>Configured iptables to Allow Access to the Proxy Server</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Check inbound access to Squid proxy service.</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment=" inbound access to squid proxy service" test_ref="test_system_proxy_access_allowed_netwk_mask" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment=" inbound access to squid proxy service" id="test_system_proxy_access_allowed_netwk_mask" version="1"> + <ind:object object_ref="object_system_proxy_access_allowed_netwk_mask" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_system_proxy_access_allowed_netwk_mask" version="1"> + ind:path /etc/sysconfig</ind:path> + ind:filename iptables"</ind:filename> + <ind:pattern operation="pattern match">^-A[\s]+RH-Firewall-1-INPUT[\s]+-s[\s]+netwk[\s]+/mask[\s]+-m[\s]+state[\s]+--state[\s]+NEW[\s]+-p[\s]+tcp[\s]+--dport[\s]+\d{4}[\s]+-j[\s]+ACCEPT\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/services/squid.xml b/rhel6/src/input/services/squid.xml index 80dc4a4..1de3a46 100644 --- a/rhel6/src/input/services/squid.xml +++ b/rhel6/src/input/services/squid.xml @@ -43,6 +43,330 @@ removing it provides a safeguard against its activation. <ident cce="4076-6" /> <oval id="package_squid_removed" /> </Rule> -</Group> -</Group> +</Group><!--End <Group id="disabling_squid"> -->
+<Group id="configure_squid"> +<title> Configure Squid if Necessary</title> +<description> +The Squid configuration file is /etc/squid/squid.conf. The following recommendations can be applied to this +file. +Note: If a particular tag is not present in the configuration file, Squid falls back to the default setting (which +is often illustrated by a comment).</description> + +<Rule id="select_squid_listening_port"> +<title> Listen on Uncommon Port</title> +<description> +The default listening port for the Squid service is 3128. As such, it is frequently scanned by adversaries looking +for proxy servers. +Select an arbitrary (but uncommon) high port to use as the Squid listening port and make the corresponding +change to the configuration file: +<pre>http_port port </pre> +Run the following command to add a new SELinux port mapping for the service: +<pre># semanage port -a -t http_cache_port_t -p tcp port</pre></description> +<oval id="squid_listening_port_uncommon" /> +</Rule> + + +<Rule id="verify_default_secure_settings"> +<title> Verify Default Secure Settings</title> +<description> +Several security-enhancing settings in the Squid configuration file are enabled by default, but appear as comments +in the configuration file (as mentioned in Section 3.19.2). In these instances, the explicit directive is not present, +which means it is implicitly enabled. If you are operating with a default configuration file, this section can be +ignored. +Ensure that the following security settings are NOT explicitly changed from their default values: +<pre>ftp_passive on +ftp_sanitycheck on +check_hostnames on +request_header_max_size 20 KB +reply_header_max_size 20 KB +cache_effective_user squid +cache_effective_group squid +ignore_unknown_nameservers on +</pre> +<tt>ftp passive</tt> forces FTP passive connections. +<tt>ftp sanitycheck</tt> performs additional sanity checks on FTP data connections. +<tt>check hostnames</tt> ensures that hostnames meet RFC compliance. +<tt>request header max size</tt> and <tt>reply header max size</tt> place an upper limit on HTTP header length, precau- +tions against denial-of-service and buffer overflow vulnerabilities. +<tt>cache effective user</tt> and <tt>cache effective group</tt> designate the EUID and EGID of Squid following initial- +ization (it is essential that the EUID/EGID be set to an unprivileged sandbox account). +<tt>ignore unknown nameservers</tt> checks to make sure that DNS responses come from the same IP the request was +sent to.</description> +<ident cce="4454-5, 4353-9, 4503-9, 3585-7, 4419-8, 3692-1, 4459-4, 4476-8" /> +<oval id="service_squid_default_secure_verified" /> +</Rule> + + +<Rule id="change_default_insecure_settings"> +<title> Change Default Insecure Settings</title> +<description> +The default configuration settings for the following tags are considered to be weak security and NOT recom- +mended. +Add or modify the configuration file to include the following lines: +<pre>allow_underscore off +httpd_suppress_version_string on +forwarded_for off +log_mime_hdrs on +</pre> +<tt>allow_underscore</tt> enforces RFC 1034 compliance on hostnames by disallowing the use of underscores. +<tt>httpd</tt> suppress version string prevents Squid from revealing version information in web headers and error +pages. +<tt>forwarded_for</tt> reveals proxy client IP addresses in HTTP headers and should be disabled to prevent the leakage +of internal network configuration details. +<tt>log_mime_hdrs</tt> enables logging of HTTP response/request headers.</description> +<ident cce="4181-4, 4577-3, 4344-8, 4494-1" /> +<oval id="service_squid_default_insecure_changed" /> +</Rule> + +<Rule id="configure_authentication"> +<title> Configure Authentication if Applicable</title> +<description> +Note: Authentication cannot be used in the case of transparent proxies due to limitations of the TCP/IP +protocol. +Similar to web servers, two of the available options are Basic and Digest authentication. The other options are +NTLM and Negotiate authentication. As noted in Section 3.16.3.5, Basic authentication transmits passwords in +plain-text and is susceptible to passive monitoring. If network sniffing is a concern, basic authentication should +not be used. Negotiate is the newest and most secure protocol. It attempts to use Kerberos authentication and +falls back to NTLM if it cannot. It should be noted that Kerberos requires a third-party Key Distribution Center +(KDC) to function properly, whereas the other methods of authentication are two-party schemes. + +Squid also offers the ability to choose a custom external authenticator. Designating an external authenticator +(also known as a "helper" module) allows Squid to offer pluggable third-party authentication schemes. LDAP is +one example of a helper module that exists and is in use today. +There are comments under the <tt>auth_param</tt> tag inside <tt>/etc/squid/squid.conf</tt> that provide extensive detail on how to configure each of these methods. If authentication is necessary, choose a method of authentication and +configure appropriately. The recommended minimum configurations illustrated for each method are acceptable. +To force an ACL (as discussed in Section 3.19.2.5) to require authentication, use the following directive: +<pre>acl <i>name-of-ACL</i> proxy_auth REQUIRED</pre> +Note: The keyword <tt>REQUIRED</tt> can be replaced with a user or list of users to further restrict access to a smaller +subset of users.</description> +<oval id="service_squid_authentication_configured" /> +</Rule> + + +<Rule id="access_control_lists"> +<title> Access Control Lists (ACL)</title> +<description> +Be very careful with the order of access control tags. Access control is handled top-down. The first +rule that matches is the only rule adhered to. The last rule on the list defines the default behavior +in the case of no rule match. +The acl and http_access tags are used in combination to allow filtering based on a series of access control lists. +Squid has a list of default ACLs for localhost, SSL ports, and "safe" ports. Following the definition of these +ACLs, a series of http access directives establish the following default filtering policy: +<ul> +<li> Allow <tt>cachemgr</tt> access only from localhost </li> +<li> Allow access to only ports in the "safe" access control list </li> +<li> Limit <tt>CONNECT</tt> method to SSL ports only </li> +<li> Allow access from localhost </li> +<li> Deny all other requests </li> +</ul> +The default ACL policies are reasonable from a security standpoint. However, the number of ports listed as +"safe" could be significantly trimmed depending on the needs of your network. Out of the box, ports 21, 70, 80, 210, 280, 443, 488, 591, 777, and 1025 through 65535 are all considered safe. Some of these ports are associated +with deprecated or rarely used protocols. As such, this list could be trimmed to further tighten filtering. +The following actions should be taken to tighten the ACL policies: +1.There is a filter line in the configuration file that is recommended but commented out. This line should +be uncommented or added to prevent access to localhost from the proxy: +<pre>http access deny to_localhost</pre> +2.An access list should be setup for the specific network or networks that the proxy is intended to serve. +Only this subset of IP addresses should be allowed access. +Add these lines where the following comment appears: +<pre> +# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS +acl your-network-acl-name src ip-range +http_access allow your-network-acl-name +</pre> +Note: <tt>ip-range</tt> is of the format xxx.xxx.xxx.xxx/xx +3.Ensure that the final http access line to appear in the document is the following: +<pre>http_access deny all</pre> +This guarantees that all traffic not meeting an explicit filtering rule is denied. +Further filters should be established to meet the specific needs of a network, explicitly allowing access +only where necessary. +4.Consult the chart below. Corresponding <tt>acl</tt> entries for unused protocols should be commented out and thus denied. +<ul> +<li> +Port: 21<br /> +Service: <tt>ftp</tt> <br /> +File Transfer Protocol(FTP) is a widely used file transfer protocol. <br /> +ALLOW <br /> +</li> + +<li> +Port: 70 <br /> +Service: <tt>gopher</tt> <br /> +The gopher protocol is a deprecated search and retrieval protocol +that is almost extinct, with as few as 100 gopher servers present worldwide. +Support for gopher is disabled in most modern browsers.<br /> +DENY<br /> +</li> + +<li> +Port: 80<br /> +Service: <tt>http</tt><br /> +A web proxy needs to allow access to HTTP traffic. <br /> +ALLOW<br /> +</li> + +<li> +Port: 210<br /> +Service: <tt>wais</tt><br /> +The Wide Area Information Server port is similar +to gopher, serving as a text searching system +to scour indexes on remote machines. Today, it is +deprecated and nearly non-existent on the Inter- +net.<br /> +DENY<br /> +</li> + +<li> +Port: 280<br /> +Service: <tt>http-mgmt</tt><br /> +No documentation of any kind could be found on the +obscure service that resides on this port.<br /> +DENY<br /> +</li> + +<li> +Port: 443<br /> +Service: <tt>https</tt><br /> +SSL traffic is likely (and recommended) for any +proxy and should be allowed.<br /> +ALLOW<br /> +</li> + +<li> +Port: 488<br /> +Service: <tt>gss-http</tt><br /> +No documentation of any kind could be found on +the obscure service that resides on this port.<br /> +DENY<br /> +</li> + +<li> +Port: 591<br /> +Service: <tt>filemaker</tt><br /> +Filemaker is a database application originally offered +by Apple in the 1980s. Although development continues + and it remains in use today, it should be disabled +if your network does not require such traffic.<br /> +DENY<br /> +</li> + +<li> +Port: 777<br /> +Service: <tt>multiling http</tt><br /> +No documentation of any kind could be found on +the obscure service that resides on this port.<br /> +DENY<br /> +</li> + +<li> +Port: 1025-65535<br /> +Service: unregistered ports<br /> +Random high ports are used by a variety of applications + and should be allowed.<br /> +ALLOW<br /> +</li> +</ul> +</description> +<ident cce="4511-2, 4529-4, 3610-3, 4466-9, 4607-8, 4255-6, 4127-7, 4519-5, 4413-1, 4373-7" /> +<oval id="service_squid_acls_configured" /> +</Rule> + + +<Rule id="configure_icp"> +<title> Configure Internet Cache Protocol (ICP) if Necessary</title> +<description> +The ICP protocol is a cache communication protocol that allows multiple Squid servers to communicate. The +ICP protocol was designed with no security in mind, relying on user-defined access control lists alone to determine +which ICP messages to allow. +If a Squid server is standalone, the ICP port should be disabled by adding or correcting the following line in +the configuration file: +<pre>icp_port 0 </pre> +If the Squid server is meant to speak with peers, strict ACLs should be established to only allow ICP traffic +from trusted neighbors. To accomplish this, add or correct the following lines: +<pre>icp_access allow <i>acl-defining-trusted-neighbors</i> +icp_access deny all</pre></description> +<oval id="system_icp_configured" /> +</Rule> + + +<Rule id="allow_proxy_server_access"> +<title> Configure iptables to Allow Access to the Proxy Server</title> +<description> +Determine an appropriate network block, <i>netwk</i>, and network mask, <i>mask</i>, representing the machines on +your network which should operate as clients of the proxy server. +Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring that it appears <i>before</i> the final <tt>LOG</tt> and +<tt>DROP</tt> lines for the <tt>RH-Firewall-1-INPUT</tt> chain: +<pre>-A RH-Firewall-1-INPUT -s <i>netwk/mask</i> -m state --state NEW -p tcp --dport <i>port</i> -j ACCEPT </pre> +For port , use either the default 3128 or the alternate port was selected in Section 3.19.2.1. +The default Iptables configuration does not allow inbound access to the Squid proxy service. This modification +allows that access, while keeping other ports on the server in their default protected state. See Section 2.5.5 for +more information about Iptables.</description> +<oval id="system_proxy_access_allowed" /> +</Rule> + + +<Rule id="forward_logs_to_syslogd"> +<title> Forward Log Messages to Syslog Daemon</title> +<description> +The default behavior of Squid is to record its log messages in <tt>/var/log/squid.log</tt>. This behavior can be +supplemented so that Squid also sends messages to syslog as well. This is useful for centralizing log data, +particularly in instances where multiple Squid servers are present. +Squid provides a command line argument to enable syslog forwarding. Modify the <tt>SQUID_OPTS</tt> line in +<tt>/etc/init.d/squid</tt> to include the <tt>-s</tt> option: +<pre>SQUID_OPTS="${SQUID_OPTS:-"-D"} -s"</pre></description> +<oval id="service_squid_logs_forwarded" /> +</Rule> + + +<Group id="disallow_squid_root"> +<title> Do Not Run as Root</title> +<description> +Since Squid is loaded by the system's <tt>service</tt> utility, it starts as root and then changes its effective UID to the +UID specified by the <tt>cache_effective_user</tt> directive. However, since it was still executed by root, the program +maintains a saved UID of root even after changing its effective UID. +To prevent this undesired behavior, Squid must either be configured to run in a chroot environment or it must +be executed by a non-privileged user in non-daemon mode (the <tt>service</tt> utility must not be used).</description> + +<Rule id="run_squid_in_chroot_jail"> +<title> Run Squid in a <tt>chroot</tt> Jail</title> +<description> +Chrooting Squid can be a very complicated task. Documentation for the process is vague and a great deal +of trial and error may be required to determine all the files that need to be transitioned over to the chroot +environment. Therefore, this guide recommends instead the method detailed in Section 3.19.2.9.2 to lower +privileges. If chrooting Squid is still desired, it can be enabled with the following directive in the configuration +file: +<pre>chroot <i>chroot-path</i></pre> +Then, all the necessary files used by Squid must be copied into the <i>chroot-path</i> directory. The specifics of this +step cannot be covered in this guide because they are highly dependent on the external programs used in the +Squid configuration. +Note: The <tt>strace</tt> utility is a valuable resource for discovering the files needed for the chroot environment.</description> +<oval id="service_squid_chroot_jailed" /> +</Rule> + + +<Rule id="lower_privileges"> +<title> Modify Service Entry to Lower Privileges</title> +<description> +The following modification to <tt>/etc/init.d/squid</tt> forces the <tt>service</tt> utility to execute Squid as the squid +user instead of the root user: +<pre># determine the name of the squid binary +[ -f /usr/sbin/squid ] && SQUID="sudo -u squid squid" </pre> +Making this change prevents Squid from writing its pid to <tt>/var/run</tt>. This pid file is used by <tt>service</tt> to +check to see if the program started successfully. Therefore, a new location must be chosen for this pid file +that the squid user has access to, and the corresponding references in <tt>/etc/init.d/squid</tt> must be altered +to point to it. +Make the following modification to the Squid configuration file: +<pre>pid_filename /var/spool/squid/squid.pid</pre> +Edit the file <tt>/etc/init.d/squid</tt> by changing all occurrences of <tt>/var/run/squid.pid</tt> to <tt>/var/spool/squid/squid.pid</tt> +Also modify the following line in <tt>/etc/init.d/squid</tt>: +<pre>[ $RETVAL -eq 0 ] && touch /var/lock/subsys/squid</pre> +and add the following lines immediately after it: +<pre>rm -f /var/lock/subsys/squid +status squid +</pre></description> +<oval id="service_squid_privileges_lowered" /> +</Rule> +</Group> <!-- End <Group id="disallow_squid_root"> --> +</Group> <!-- End <Group id="configure_squid"> --> +</Group> <!-- End <Group id="proxy"> -->
Before we could be ACK'ed (for commit), it needs some changes, primarily relating to granularity as noted in https://fedorahosted.org/scap-security-guide/wiki/newxccdf . The overall goal is to include the relevant information from the RHEL 5 prose document, but translate it into XCCDF in a way that facilitates its re-use by different parties (and straightforward automation).
There was also some discussion in https://fedorahosted.org/pipermail/scap-security-guide/2012-April/000185.htm... suggesting one CCE per Rule (as the preferred level of granularity).
There are some benefits to this:
1) This will position us (and Mitre) to easily verify the correspondence/agreement between CCE description and XCCDF description.
2) After a set of OVAL checks is run, an admin (or a C&A person) may only see a list of pass/fail results. When possible, we want to keep these precise to enable well-informed decisions. This is also relevant to the eventual addition of <fix> tags, which may attempt to tie a remediation action to a particular check's result.
The software also could have changed since RHEL 5, and we should not assume that there are no errors in the RHEL 5 document to begin with. I noticed that there is a squid user as the owner (of presumably a sub-task) of the squid service. In your testing, does the product now do (out of the box) what the lower_privileges Rule suggests configuring for RHEL 5 (for the most part)? If so, we can drop that. I'm also generally a bit more reluctant now to suggest things like altering system startup scripts; this affects our ability to verify their integrity.
Thanks, Jeff
On 4/11/12 11:33 AM, "Jeffrey Blank" blank@eclipse.ncsc.mil wrote:
Before we could be ACK'ed (for commit), it needs some changes, primarily relating to granularity as noted in https://fedorahosted.org/scap-security-guide/wiki/newxccdf . The overall goal is to include the relevant information from the RHEL 5 prose document, but translate it into XCCDF in a way that facilitates its re-use by different parties (and straightforward automation).
There was also some discussion in https://fedorahosted.org/pipermail/scap-security-guide/2012-April/000185.h tml suggesting one CCE per Rule (as the preferred level of granularity).
There are some benefits to this:
This will position us (and Mitre) to easily verify the correspondence/agreement between CCE description and XCCDF description.
After a set of OVAL checks is run, an admin (or a C&A person) may only see a list of pass/fail results. When possible, we want to keep these precise to enable well-informed decisions. This is also relevant to the eventual addition of <fix> tags, which may attempt to tie a remediation action to a particular check's result.
The software also could have changed since RHEL 5, and we should not assume that there are no errors in the RHEL 5 document to begin with. I noticed that there is a squid user as the owner (of presumably a sub-task) of the squid service. In your testing, does the product now do (out of the box) what the lower_privileges Rule suggests configuring for RHEL 5 (for the most part)? If so, we can drop that. I'm also generally a bit more reluctant now to suggest things like altering system startup scripts; this affects our ability to verify their integrity.
I'll let Michael respond to most points you make above. I'm just concerned with the last point. You need to perform integrity checks on tons of things that will definitely be modified as part of implementing the req guidance. The hashes must be generated after any of those modifications take place. The startup scripts themselves do some crazy things we patch out for our solutions. Often these modifications go above and beyond these reqs, such as label-based mounting or the devmapper operations which requires raw block device access. Of course reducing those modifications to things that provide serious benefit is desirable. But I don't think "verify their integrity" should prevent someone from enhancing the security of the solution. If a req is best addressed by modifying an init script so be it. After all, they're just text files ;)
Thanks, --Spencer
Thanks, Jeff _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/scap-security-guide
On 04/11/2012 11:52 AM, Spencer R. Shimko wrote:
On 4/11/12 11:33 AM, "Jeffrey Blank"blank@eclipse.ncsc.mil wrote:
Before we could be ACK'ed (for commit), it needs some changes, primarily relating to granularity as noted in https://fedorahosted.org/scap-security-guide/wiki/newxccdf . The overall goal is to include the relevant information from the RHEL 5 prose document, but translate it into XCCDF in a way that facilitates its re-use by different parties (and straightforward automation).
There was also some discussion in https://fedorahosted.org/pipermail/scap-security-guide/2012-April/000185.h tml suggesting one CCE per Rule (as the preferred level of granularity).
There are some benefits to this:
This will position us (and Mitre) to easily verify the correspondence/agreement between CCE description and XCCDF description.
After a set of OVAL checks is run, an admin (or a C&A person) may only see a list of pass/fail results. When possible, we want to keep these precise to enable well-informed decisions. This is also relevant to the eventual addition of<fix> tags, which may attempt to tie a remediation action to a particular check's result.
The software also could have changed since RHEL 5, and we should not assume that there are no errors in the RHEL 5 document to begin with. I noticed that there is a squid user as the owner (of presumably a sub-task) of the squid service. In your testing, does the product now do (out of the box) what the lower_privileges Rule suggests configuring for RHEL 5 (for the most part)? If so, we can drop that. I'm also generally a bit more reluctant now to suggest things like altering system startup scripts; this affects our ability to verify their integrity.
I'll let Michael respond to most points you make above. I'm just concerned with the last point. You need to perform integrity checks on tons of things that will definitely be modified as part of implementing the req guidance. The hashes must be generated after any of those modifications take place. The startup scripts themselves do some crazy things we patch out for our solutions. Often these modifications go above and beyond these reqs, such as label-based mounting or the devmapper operations which requires raw block device access. Of course reducing those modifications to things that provide serious benefit is desirable. But I don't think "verify their integrity" should prevent someone from enhancing the security of the solution. If a req is best addressed by modifying an init script so be it. After all, they're just text files ;)
I think the question is more one of how much does this really enhance the security. In some cases such as where permissions were changed from the default, they provided little to no real value and merely hampered things like rpm -V. If the security provided is significant I think we can all agree its worth the pain.
Thanks,
Kevin
Thanks, --Spencer
Thanks, Jeff _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/scap-security-guide
I think the question is more one of how much does this really enhance the security. In some cases such as where permissions were changed from the default, they provided little to no real value and merely hampered things like rpm -V. If the security provided is significant I think we can all agree its worth the pain.
Well, yes. This is largely about use-case / role of the system. There may even be difference between whether we expect hashes to agree or simply for permissions to agree (comprehensively via rpm).
Here is some of my perspective on the matter. There are very few files on RHEL where tighter-than-default permissions provide value, and Red Hat has historically been receptive to tightening such permissions (when we've asked and also had a sane case for doing so). Every once in a blue moon something might get packaged with goofy permissions, but that's what bugzilla is for, and not something you'd ask every admin to check for all the time. (In fact, the checks against certain directories or the whole filesystem are what tends to reveal any such oddities, so I strongly support these.)
This is a good topic for a future discussion or documentation on the wiki as a matter of establishing a common perspective. As I mentioned, I believe there is good value in global or directory-wide permissions checks (especially when they are linked to a requirements for files of a certain class). However, the only files that I believe should be called out for inspection on an individual basis are those which contain account or credential information (or are otherwise singularly important, such as those which control boot parameters). If any other files are to be called out for individual inspection from the 200,000 or so files on the system (which are all important, and arguably equally so), there must be some kind of criteria similar to those I've just mentioned. I do not want a body of guidance that is 30% a random selection of file permissions checks based on no particular criteria.
To Spencer's point (with which I also agree), we are trying to satisfy two use cases. For general-purpose systems I think it's a reasonable expectation that rpm -V complete successfully. For specialized systems that are fulfilling roles with particular security requirements, integrity checking may depend more strongly on aide or strong change controls, and it's probably not reasonable to expect rpm verification (of hashes) to succeed.
Always in my mind is concern about creation of baselines that draws from configurations designed for a specialized system and tries to apply them to a general purpose system and creates senseless misery. However, careful consideration of a system's role when creating Profiles should help address this.
Before we could be ACK'ed (for commit), it needs some changes, primarily relating to granularity as noted in https://fedorahosted.org/scap-security-guide/wiki/newxccdf . The overall goal is to include the relevant information from the RHEL 5 prose document, but translate it into XCCDF in a way that facilitates its re-use by different parties (and straightforward automation).
There was also some discussion in https://fedorahosted.org/pipermail/scap-security-guide/2012-April/000185.htm... suggesting one CCE per Rule (as the preferred level of granularity).
For some content, such as verify_default_secure_settings, the CCE's are each tied to an individual line in the same file. This level of granularity would require creating a rule for each line: ftp_passive on ftp_sanitycheck on check_hostnames on request_header_max_size 20 KB reply_header_max_size 20 KB cache_effective_user squid cache_effective_group squid ignore_unknown_nameservers on
The software also could have changed since RHEL 5, and we should not assume that there are no errors in the RHEL 5 document to begin with. I noticed that there is a squid user as the owner (of presumably a sub-task) of the squid service. In your testing, does the product now do (out of the box) what the lower_privileges Rule suggests configuring for RHEL 5 (for the most part)? If so, we can drop that. I'm also generally a bit more reluctant now to suggest things like altering system startup scripts; this affects our ability to verify their integrity.
I don't believe it does, or at least the lines in /etc/init.d/squid and /etc/squid/squid.conf are not the way that the prose recommends them to be.
--Mike
Thanks, Jeff
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/scap-security-guide
For some content, such as verify_default_secure_settings, the CCE's are each tied to an individual line in the same file. This level of granularity would require creating a rule for each line: ftp_passive on ftp_sanitycheck on check_hostnames on request_header_max_size 20 KB reply_header_max_size 20 KB cache_effective_user squid cache_effective_group squid ignore_unknown_nameservers on
Correct. But if there are any of these for which there is not a solid case for including it in a compliance-checking regime, then don't include it.
I think this should be a wake-up call to would-be contributors: we are not seeking a hurried copy-paste from the RHEL 5 prose guide. This project is designed to produce SCAP content that is modular, granular, and flexible.
Related: Regarding OVAL content, I might create a Rule for cache_effective_user, but I might make the OVAL check succeed if the line is not found at all, since the default is sane. Interestingly, based on http://www.squid-cache.org, the default for the squid project is "nobody," but Red Hat uses "squid" (likely for better accountability and to grant some privilege when needed).
I don't believe it does, or at least the lines in /etc/init.d/squid and /etc/squid/squid.conf are not the way that the prose recommends them to be.
I meant only /etc/init.d/squid, and for rpm-based verification. As Spencer pointed out, this quickly turns into a question about use-case. It might be reasonable to expect that init scripts have not been altered for systems in a general-purpose use-case. But not for a more specialized system.
Config files are always expected to change (and rpm flags them as such).
From: Michael Palmiotto mpalmiotto@tresys.com
--- .../checks/accounts_disabled_after_expiration.xml | 24 +++++ .../accounts_login_shell_timeout_implemented.xml | 55 +++++++++++ .../input/checks/accounts_netrc_files_checked.xml | 25 +++++ .../checks/accounts_root_auditing_improved.xml | 30 ++++++ .../accounts_user_dot_files_not_world_writable.xml | 33 +++++++ .../checks/libuser_login_defs_userdefaults.xml | 50 ++++++++++ rhel6/src/input/system/accounts/accounts.xml | 27 ++++++ rhel6/src/input/system/accounts/pam.xml | 38 +++++++- rhel6/src/input/system/accounts/physical.xml | 41 ++++++++ .../system/accounts/restrictions/restrictions.xml | 99 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 24 +++++ 11 files changed, 445 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml create mode 100644 rhel6/src/input/checks/accounts_root_auditing_improved.xml create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml new file mode 100644 index 0000000..334c1dd --- /dev/null +++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml @@ -0,0 +1,24 @@ +<def-group> + <definition class="compliance" id="accounts_disabled_after_expiration" version="1"> + <metadata> + <title> Ensure Accounts Set to Disable After Password Expiration</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description> Check for INACTIVE line in useradd.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="inactive set" test_ref="test_accounts_disabled_after_expiration_inactive" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" comment="inactive set in useradd" id="test_accounts_disabled_after_expiration_inactive" version="1"> + <ind:object object_ref="object_accounts_disabled_after_expiration_inactive" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_disabled_after_expiration_inactive" version="1"> + ind:path/etc/default</ind:path> + ind:filenameuseradd</ind:filename> + <ind:pattern operation="pattern match">^INACTIVE=[\d{1,3}]\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml new file mode 100644 index 0000000..aa330c8 --- /dev/null +++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml @@ -0,0 +1,55 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_file_entries.py. --> + <definition class="compliance" id="accounts_login_shell_timeout_implemented" version="1"> + <metadata> + <title> Implement Inactivity Time-out for Login Shells</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-3689-7, CCE-3707-7" source="CCE" /> + <description> Check if login shells set to automatically log users out after a certain period of inactivity.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="check readonly line" test_ref="test_accounts_login_shell_timeout_implemented_readonly" /> + <criterion comment="check timeout line" test_ref="test_accounts_login_shell_timeout_implemented_idle" /> + <criterion comment="check export line" test_ref="test_accounts_login_shell_timeout_implemented_export" /> + <criterion comment="check autologout line" test_ref="test_accounts_login_shell_timeout_implemented_implement" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" comment="readonly timeout" id="test_accounts_login_shell_timeout_implemented_readonly" version="1"> + <ind:object object_ref="object_accounts_login_shell_timeout_implemented_readonly" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_readonly" version="1"> + ind:path/etc/profile.d</ind:path> + ind:filenametmout.sh</ind:filename> + <ind:pattern operation="pattern match">^readonly[\s]+TMOUT\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment="idle timeout" id="test_accounts_login_shell_timeout_implemented_idle" version="1"> + <ind:object object_ref="object_accounts_login_shell_timeout_implemented_idle" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_idle" version="1"> + ind:path/etc/profile.d</ind:path> + ind:filenametmout.sh</ind:filename> + <ind:pattern operation="pattern match">^TMOUT=\d{3,5}\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment="export timeout" id="test_accounts_login_shell_timeout_implemented_export" version="1"> + <ind:object object_ref="object_accounts_login_shell_timeout_implemented_export" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_export" version="1"> + ind:path/etc/profile.d</ind:path> + ind:filenametmout.sh</ind:filename> + <ind:pattern operation="pattern match">^export[\s]+TMOUT\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment="autologout" id="test_accounts_login_shell_timeout_implemented_implement" version="1"> + <ind:object object_ref="object_accounts_login_shell_timeout_implemented_implement" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_implement" version="1"> + ind:path/etc/profile.d</ind:path> + ind:filenameautologout.csh</ind:filename> + <ind:pattern operation="pattern match">^set[\s]+-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rhel6/src/input/checks/accounts_netrc_files_checked.xml new file mode 100644 index 0000000..2a4a6ca --- /dev/null +++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml @@ -0,0 +1,25 @@ +<def-group> + <definition class="compliance" id="accounts_netrc_files_checked" version="1"> + <metadata> + <title>Ensure No .netrc Files</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-TODO" source="CCE" /> + <description>Check that .netrc files are missing from all user accounts.</description> + </metadata> + <criteria > + <criterion comment=".netrc files" test_ref="test_accounts_netrc_files_checked" negate="true" /> + </criteria> + </definition> + <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_netrc_files_checked" version="1"> + <unix:object object_ref="object_accounts_netrc_files_checked" /> + </unix:file_test> + <unix:file_object comment=".netrc files" id="object_accounts_netrc_files_checked" version="1"> + <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" /> + <unix:path operation="equals">/home</unix:path> + <unix:filename operation="pattern match">.netrc</unix:filename> + </unix:file_object> +</def-group> + + diff --git a/rhel6/src/input/checks/accounts_root_auditing_improved.xml b/rhel6/src/input/checks/accounts_root_auditing_improved.xml new file mode 100644 index 0000000..648bc02 --- /dev/null +++ b/rhel6/src/input/checks/accounts_root_auditing_improved.xml @@ -0,0 +1,30 @@ +<def-group> + <definition class="compliance" id="accounts_root_auditing_improved" version="1"> + <metadata> + <title>Verify Sudo Audit Trail</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4044-4" source="CCE" /> + <description>Check if the following line appears in /etc/sudoers.</description> + </metadata> + + <criteria operator="AND"> + + <criterion comment="check_sudoers" test_ref="test_accounts_root_auditing_improved_sudoers" /> + + </criteria> + + </definition> + + <ind:textfilecontent54_test check="all" comment="check sudoers" id="test_accounts_root_auditing_improved_sudoers" version="1"> + <ind:object object_ref="object_accounts_root_auditing_improved_sudoers" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_root_auditing_improved_sudoers" version="1"> + ind:path /etc</ind:path> + ind:filename sudoers</ind:filename> + <ind:pattern operation="pattern match">^%wheel[\s]+[\s]+ALL=(ALL)[\s]+[\s]+ALL\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml new file mode 100644 index 0000000..82a9e45 --- /dev/null +++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml @@ -0,0 +1,33 @@ +<def-group> + <definition class="compliance" id="accounts_user_dot_files_not_world_writable" version="1"> + <metadata> + <title>Ensure User Dot Files not World Writable</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-TODO" source="CCE" /> + <description>File permissions should be set correctly for dot-files for all user accounts.</description> + </metadata> + <criteria > + <criterion comment="user dot files" test_ref="test_accounts_user_dot_files_not_world_writable" negate="true" /> + </criteria> + </definition> + <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_user_dot_files_not_world_writable" version="1"> + <unix:object object_ref="object_accounts_user_dot_files_not_world_writable" /> + <unix:state state_ref="state_dot_files_wrong_perm" /> + </unix:file_test> + <unix:file_object comment="user dot files" id="object_accounts_user_dot_files_not_world_writable" version="1"> + <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" /> + <unix:path operation="equals">/home</unix:path> + <unix:filename operation="pattern match">.*</unix:filename> + <filter action="include">state_dot_files_wrong_perm</filter> + </unix:file_object> + <unix:file_state id="state_dot_files_wrong_perm" version="1" operator="OR"> + <unix:suid datatype="boolean">true</unix:suid> + <unix:sgid datatype="boolean">true</unix:sgid> + <unix:sticky datatype="boolean">true</unix:sticky> + <unix:gwrite datatype="boolean">true</unix:gwrite> + <unix:owrite datatype="boolean">true</unix:owrite> + </unix:file_state> +</def-group> + diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml new file mode 100644 index 0000000..66345a5 --- /dev/null +++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml @@ -0,0 +1,50 @@ +<def-group> + <definition class="compliance" id="libuser_login_defs_userdefaults" version="1"> + <metadata> + <title>Check if Password Parameters are Removed from libuser.conf</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description> Make sure the password password parameters are removed from libuser.conf.</description> + </metadata> + <criteria operator="AND"> + + <criterion comment="shadowmin removed" test_ref="test_libuser_login_defs_removed_shadowmin" /> + <criterion comment="shadowmax removed" test_ref="test_libuser_login_defs_removed_shadowmax" /> + <criterion comment="shadowwarn removed" test_ref="test_libuser_login_defs_removed_shadowwarn" /> + + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmin removed from login.defs" id="test_libuser_login_defs_removed_shadowmin" version="1"> + <ind:object object_ref="object_libuser_login_defs_removed_shadowmin" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmin" version="1"> + ind:path/etc</ind:path> + ind:filenamelogin.defs</ind:filename> + <ind:pattern operation="pattern match">^LU_SHADOWMIN\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmax removed from login.defs" id="test_libuser_login_defs_removed_shadowmax" version="1"> + <ind:object object_ref="object_libuser_login_defs_removed_shadowmax" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmax" version="1"> + ind:path/etc</ind:path> + ind:filenamelogin.defs</ind:filename> + <ind:pattern operation="pattern match">^LU_SHADOWMAX\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowwarn removed from login.defs" id="test_libuser_login_defs_removed_shadowwarn" version="1"> + <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowwarn" version="1"> + ind:path/etc</ind:path> + ind:filenamelogin.defs</ind:filename> + <ind:pattern operation="pattern match">^LU_SHADOWWARNING\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + +</def-group> diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/input/system/accounts/accounts.xml index fbdeb39..e5b61a6 100644 --- a/rhel6/src/input/system/accounts/accounts.xml +++ b/rhel6/src/input/system/accounts/accounts.xml @@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a necessary part of securing a system. This section introduces mechanisms for restricting access to accounts under RHEL6.</description> + +<Group id="all_human_users_group"> +<title> Create and Maintain a Group Containing All Human Users</title> +<description> +Identify all user accounts on the system which correspond to human users. Depending on your system +configuration, this may be all entries in <tt>/etc/passwd</tt> with UID values of at least 500. Once, you have +identified such a set of users, create a group named usergroup (substitute some name appropriate to your +environment) and populate it with each human user: +<pre># groupadd <i>usergroup</i> +# usermod -G <i>usergroup human1</i> +# usermod -G <i>usergroup human2</i> +... +# usermod -G <i>usergroup humanN</i></pre> +Then modify your procedure for creating new user accounts by adding <tt>-G</tt> <i>usergroup</i> to the set of flags with +which <tt>useradd</tt> is invoked, so that new human users will be placed in the correct group by default. + +Creating a group of human users does not, by itself, enhance system security. However, as you work on securing +your system, you will often find commands which never need to be run by system accounts, or which are only +ever needed by users logged into the graphical console (which should only ever be available to human users, even +on workstations). Once a group of users has been created, it is easy to restrict access to a given command, for +instance <i>/path/to/graphical/command</i>, to authorized users: +<pre># chgrp <i>usergroup /path/to/graphical/command</i> +# chmod 750 <i>/path/graphical/command</i></pre> +Without a group of human users, it is necessary to restrict access by somehow preventing each system account +from running the command, which is an error-prone process even when it is possible at all.</description> +<!-- <oval id="accounts_all_human_users_group_maintained" /> --> +</Group> </Group> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index bc91277..0782e1d 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -309,6 +309,31 @@ prevents direct password guessing attacks.
</Group>
+<!-- Removed: Too complicated to enforce +<Rule id="restrict_userhelper_execution"> +<title> Restrict Execution of <tt>userhelper</tt> to Console Users</title> +<description> +If your environment has defined a group, <i>usergroup</i> containing all the human users of your system, restrict +execution of the <tt>userhelper</tt> program to only that group: +<pre># chgrp usergroup /usr/sbin/userhelper +# chmod 4710 /usr/sbin/userhelper</pre> +The <tt>userhelper</tt> program provides authentication for graphical services which must run with <tt>root</tt> privileges, +such as the <tt>system-config<tt>- family of graphical configuration utilities. Only human users logged into the system +console are likely to ever have a legitimate need to run these utilities. This step provides some protection against +possible flaws in <tt>userhelper</tt>'s implementation, and against further privilege escalation when system accounts +are compromised. See Section 2.3.2.2 for more information on creating a group of human users. +The <tt>userhelper</tt> program is configured by the files in <tt>/etc/security/console.apps/</tt>. Each file specifies, for +some program, what user the program should run as, and what program should be executed after successful +authentication. +Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in combination with the PAM configura- +tion of the service defined in <tt>/etc/pam.d/</tt>. First, <tt>userhelper</tt> determines what user the service should run as. +(Typically, this will be <tt>root</tt>.) Next, <tt>userhelper</tt> uses the PAM API to allow the user who ran the program to +attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if the application's +configuration requests one.</description> +<ident cce="4185-5, 3952-9" /> +<oval id="accounts_pam_userhelper_execution_restricted" /> +</Rule> +-->
<Rule id="set_password_hashing_algorithm"> <title>Set Password Hashing Algorithm</title> @@ -374,7 +399,18 @@ compromised could be used yet again by an attacker. <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/> <ref nist="IA-5" /> </Rule> -</Group> +</Group> <!-- End <Group id="limiting_password_reuse"> --> + +<Rule id="pam_ccreds_removed"> +<title> Remove the <tt>pam_ccreds</tt> Package if Possible</title> +<description> +Unless its credential caching functionality is required, remove the <tt>pam_ccreds</tt> package: +<pre># yum erase pam_ccreds</pre> +The <tt>pam_ccreds</tt> package contains the setuid program <tt>/usr/sbin/ccreds_validate</tt> and should be removed +unless it provides essential functionality. Any credentials cached on a system would also be compromised if an +attacker obtains control of the system.</description> +<oval id="package_pam_ccreds_removed" /> +</Rule>
</Group>
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 45ad144..27441e0 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an attacker to quickly or undetectably modify a system from its console.</description>
+<Group id="bios_password"> +<title>Set BIOS Password</title> +<description>BIOS (on x86 systems) is the first code to execute during system startup and controls many important +system parameters, including which devices the system will try to boot from, and in which order. +Assign a password to prevent any unauthorized changes to the BIOS configuration. The exact steps will +vary depending on your machine, but are likely to include: +1.Reboot the machine. +2.Press the appropriate key during the initial boot screen (F2 is typical). +3.Navigate the BIOS configuration menu to add a password. +The exact process will be system-specific and the system's hardware manual may provide detailed instructions. +This password should prevent attackers with physical access from attempting to change important parameters, +such as those described in Sections 2.5.2.2.1 and 2.2.2.2.4. However, an attacker with physical access can usually +clear the BIOS password. The password should be written down and stored in a physically-secure location, such +as a safe, in the event that it is forgotten and must be retrieved. +</description> +</Group> + <Group id="bootloader"> <title>Set Boot Loader Password</title> <description>During the boot process, the boot loader is @@ -133,6 +150,30 @@ services, weakening system security. <ref nist="CM-7, IA-4, SC-2"/> </Rule>
+<Rule id="login_shell_inactivity_timeout"> +<title> Implement Inactivity Time-out for Login Shells</title> +<description> +If the system does not run X Windows, then the login shells can be configured to automatically log users out after +a period of inactivity. The following instructions are not practical for systems which run X Windows, as they +will close terminal windows in the X environment. For information on how to automatically lock those systems, +see Section 2.3.5.6. +To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt> shell, create a new file <tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with the following lines: +<pre>TMOUT=900 +readonly TMOUT +export TMOUT</pre> +To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a new file <tt>autologout.csh</tt> in the directory +<tt>/etc/profile.d</tt> with the following line: +<pre>set -r autologout 15</pre> +Similar actions should be taken for any other login shells used. +The example time-out here of 15 minutes should be adjusted to whatever your security policy requires. The +readonly line for <tt>bash</tt> and the <tt>-r</tt> option for <tt>tcsh</tt> can be omitted if policy allows users to override the value. +The automatic shell logout only occurs when the shell is the foreground process. If, for example, a <tt>vi</tt> session is +left idle, then automatic logout would not occur. +When logging in through a remote connection, as with SSH, it may be more effective to set the timeout value +directly through that service. To learn how to set automatic timeout intervals for SSH, see Section 3.5.2.3.</description> +<ident cce="3689-7, 3707-7" /> +<oval id="accounts_login_shell_timeout_implemented" /> +</Rule>
<Group id="screen_locking"> <title>Configure Screen Locking</title> diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml b/rhel6/src/input/system/accounts/restrictions/restrictions.xml index febead6..cfee882 100644 --- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml +++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml @@ -10,4 +10,103 @@ console. Therefore, mechanisms for accessing accounts by entering usernames and passwords should be restricted to those which are operationally necessary.</description>
+<!-- +<Rule id="limit_su_access_to_root"> +<title> Limit <tt>su</tt> Access to the Root Account</title> +<description>"1.Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed +to execute commands as root are members of that group. +<pre># grep ^wheel /etc/group</pre> +2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line: +<pre>auth required pam_wheel.so use_uid</pre> +The <tt>su</tt> command allows a user to gain the privileges of another user by entering the password for that user's +account. It is desirable to restrict the root user so that only known administrators are ever allowed to access the +root account. This restricts password-guessing against the root account by unauthorized users or by accounts +which have been compromised. <br /> +By convention, the group <tt>wheel</tt> contains all users who are allowed to run privileged commands. The PAM +module <tt>pam_wheel.so</tt> is used to restrict root access to this set of users.</description> +<ident cce="14088-9, 15047-4" /> +<oval id="accounts_su_access_limited" /> +<ref nist="AC-2, AC-3, CM-6" /> +</Rule> +--> + +<Group id="configure_sudo"> +<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root Access</title> +<description> +The <tt>sudo</tt> command allows fine-grained control over which users can execute commands using other accounts. +The primary benefit of <tt>sudo</tt> when configured as above is that it provides an audit trail of every command run +by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an +established procedure that all root commands are run using <tt>sudo</tt>, then it is easy for an auditor to detect unusual +behavior when this procedure is not followed. <br /> +</description> + +<warning> +Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration error may make it impossible to access +the root account remotely. The recommended means of editing this file is using the <tt>visudo</tt> command, which +checks the file's syntax for correctness before allowing it to be saved. <br /> + +Note that <tt>sudo</tt> allows any attacker who gains access to the password of an administrator account to run commands +as root. This is a downside which must be weighed against the benefits of increased audit capability and of being +able to heavily restrict the use of the high-value root password (which can be logistically difficult to change +often). As a basic precaution, <i>never</i> use the <tt>NOPASSWD</tt> directive, which would allow anyone with access to an administrator account to execute commands as root without knowing the administrator's password. <br /> +</warning> + +<Rule id="verify_wheel_exists"> +<description> +Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed +to execute commands as root are members of that group. +<pre># grep ^wheel /etc/group</pre></description> +<oval id="accounts_wheel_exists" /> +</Rule> + +<Rule id="verify_sudo_audit_trail"> +<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line: +<pre>%wheel ALL=(ALL) ALL</pre> +</description> +<oval id="accounts_root_auditing_improved" /> +</Rule> +</Group> + +<Group id="remove_password_parameters"> +<title> Remove Password Parameters from <tt>libuser.conf</tt></title> +<description>The <tt>/etc/libuser.conf</tt> file contains configuration options for the libuser library, which is intended to implement +a standardized interface for manipulating and administering user and group accounts. By default, it sources +password settings from <tt>/etc/login.defs</tt>, but it can override these parameters. The man page <tt>libuser.conf(5)</tt> contains more information.</description> + +<Rule id="verify_libuser_login_defs_import"> +<title>Verify Line Under Import Section</title> +<description> +Ensure the following line exists within the file <tt>/etc/libuser.conf</tt> under the <tt>[import]</tt> section. +<pre>login_defs = /etc/login.defs</pre></description> +<oval id="libuser_login_defs_import" /> +</Rule> + +<Rule id="verify_libuser_login_defs_userdefaults"> +<title>Verify Lines do not Appear in Userdefaults Section</title> +<description> +Ensure that no lines beginning with the following appear in the <tt>[userdefaults]</tt> section of the file, as +these override settings from <tt>/etc/login.defs</tt>: +<pre>LU_SHADOWMAX +LU_SHADOWMIN +LU_SHADOWWARNING</pre></description> +<oval id="libuser_login_defs_userdefaults" /> +</Rule> +</Group> + + +<Rule id="verify_accounts_disabled_after_expiration"> +<title> Set Accounts to Disable After Password Expiration</title> +<description> +In order to automatically disable local accounts some number of <i>DAYS</i> after password expiration, add or +modify the following line in <tt>/etc/default/useradd</tt>: +<pre>INACTIVE=<i>DAYS</i></pre> +For example, if <pre>INACTIVE=30</pre> and if the password is currently on the verge of expiration, then 30 days remain +until the account is automatically disabled. If the password will not expire for another 60 days, then 90 days +remain until the account is automatically disabled. See <tt>useradd(8)</tt> for more information. +Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period +of inactivity for users in your environment. Setting the timeout too low incurs support costs and also has the +potential to impact availability of the system to legitimate users.</description> +<oval id="accounts_disabled_after_expiration" /> +</Rule> + </Group> diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml index 00b5a8d..f7e6530 100644 --- a/rhel6/src/input/system/accounts/session.xml +++ b/rhel6/src/input/system/accounts/session.xml @@ -114,6 +114,19 @@ groups or ACLs. <ref nist="AC-3, CM-6"/> </Rule>
+<Rule id="ensure_dot_files_not_world_writable"> +<title> Ensure that User Dot-Files are not World-writable</title> +<description> +For each human user <i>USER</i> of the system, view the permissions of all dot-files in the user's home directory: +<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre> +Ensure that none of these files are group- or world-writable. Correct each misconfigured file <i>FILE</i> by exe- +cuting: +<pre># chmod go-w /home/USER /FILE</pre> +A user who can modify another user's configuration files can likely execute commands with the other user's +privileges, including stealing data, destroying files, or launching further attacks on the system.</description> +<oval id="accounts_user_dot_files_not_world_writable" /> +</Rule> + <Group id="user_umask"> <title>Ensure that Users Have Sensible Umask Values</title> <description> @@ -168,6 +181,17 @@ operator="equals" interactive="0"> <value selector="077">077</value> </Value>
+<Group id="ensure_no_netrc_files"> +<title> Ensure that Users do not Have <tt>.netrc</tt> Files</title> +<description> +For each human user <i>USER</i> of the system, ensure that the user has no <tt>.netrc</tt> file. The command: +<pre># ls -l /home/<i>USER</i> /.netrc</pre> +should return the error "No such file or directory". If any user has such a file, approach that user to discuss +removing this file. +The <tt>.netrc</tt> file is a configuration file used to make unattended logins to other systems via FTP. When this file +exists, it frequently contains unencrypted passwords which may be used to attack other systems.</description> +</Group> + <Rule id="user_umask_bashrc"> <title> Ensure the Default Bash Umask is Set Correctly
Some issues for this patch:
1) Does pam_ccreds exist on RHEL 6? (I didn't think it did.) There is an expectation that things are tested at least once (on RHEL 6) before they're proposed for a commit.
2) Per our brief discussion about the intent behind Rules verify_wheel_exists and accounts_root_auditing_improved, there's too much variation in the real world to insist that everyone call their admin group wheel. It may be better as general discussion in a Group (i.e to recommend that a group is used for all admin).
3) The group bios_password is a nice addition, except that it's referencing section numbers which don't exist or aren't correct (and aren't going to be correct). Let's avoid any references to sections via section number in this project; in the other guide they were only made because it was easy to keep straight by doing a \ref{} to a \label{} (in LaTeX). (I don't know if there is a similar facility in XCCDF / XHTML / DocBook, or whether it's worth the trouble here). Prior to commit, there's a general expectation of proofreading, especially following a copy-paste from the RHEL 5 guide. Ditto for the section reference in Rule login_shell_inactivity_timeout.
On 04/10/2012 05:24 PM, Mike Palmiotto wrote:
From: Michael Palmiotto mpalmiotto@tresys.com
.../checks/accounts_disabled_after_expiration.xml | 24 +++++ .../accounts_login_shell_timeout_implemented.xml | 55 +++++++++++ .../input/checks/accounts_netrc_files_checked.xml | 25 +++++ .../checks/accounts_root_auditing_improved.xml | 30 ++++++ .../accounts_user_dot_files_not_world_writable.xml | 33 +++++++ .../checks/libuser_login_defs_userdefaults.xml | 50 ++++++++++ rhel6/src/input/system/accounts/accounts.xml | 27 ++++++ rhel6/src/input/system/accounts/pam.xml | 38 +++++++- rhel6/src/input/system/accounts/physical.xml | 41 ++++++++ .../system/accounts/restrictions/restrictions.xml | 99 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 24 +++++ 11 files changed, 445 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml create mode 100644 rhel6/src/input/checks/accounts_root_auditing_improved.xml create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xml b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml new file mode 100644 index 0000000..334c1dd --- /dev/null +++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml @@ -0,0 +1,24 @@ +<def-group>
<definition class="compliance" id="accounts_disabled_after_expiration" version="1">
<metadata>
<title> Ensure Accounts Set to Disable After Password Expiration</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="TODO" source="CCE" /><description> Check for INACTIVE line in useradd.</description></metadata>
<criteria operator="AND">
<criterion comment="inactive set" test_ref="test_accounts_disabled_after_expiration_inactive" /></criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="inactive set in useradd" id="test_accounts_disabled_after_expiration_inactive" version="1">
- <ind:object object_ref="object_accounts_disabled_after_expiration_inactive" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_disabled_after_expiration_inactive" version="1">
- ind:path/etc/default</ind:path>
- ind:filenameuseradd</ind:filename>
- <ind:pattern operation="pattern match">^INACTIVE=[\d{1,3}]\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml new file mode 100644 index 0000000..aa330c8 --- /dev/null +++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml @@ -0,0 +1,55 @@ +<def-group>
<!-- THIS FILE IS GENERATED by create_file_entries.py. -->
<definition class="compliance" id="accounts_login_shell_timeout_implemented" version="1">
<metadata>
<title> Implement Inactivity Time-out for Login Shells</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="CCE-3689-7, CCE-3707-7" source="CCE" /><description> Check if login shells set to automatically log users out after a certain period of inactivity.</description></metadata>
<criteria operator="AND">
<criterion comment="check readonly line" test_ref="test_accounts_login_shell_timeout_implemented_readonly" /><criterion comment="check timeout line" test_ref="test_accounts_login_shell_timeout_implemented_idle" /><criterion comment="check export line" test_ref="test_accounts_login_shell_timeout_implemented_export" /><criterion comment="check autologout line" test_ref="test_accounts_login_shell_timeout_implemented_implement" /></criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="readonly timeout" id="test_accounts_login_shell_timeout_implemented_readonly" version="1">
- <ind:object object_ref="object_accounts_login_shell_timeout_implemented_readonly" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_readonly" version="1">
- ind:path/etc/profile.d</ind:path>
- ind:filenametmout.sh</ind:filename>
- <ind:pattern operation="pattern match">^readonly[\s]+TMOUT\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" comment="idle timeout" id="test_accounts_login_shell_timeout_implemented_idle" version="1">
- <ind:object object_ref="object_accounts_login_shell_timeout_implemented_idle" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_idle" version="1">
- ind:path/etc/profile.d</ind:path>
- ind:filenametmout.sh</ind:filename>
- <ind:pattern operation="pattern match">^TMOUT=\d{3,5}\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" comment="export timeout" id="test_accounts_login_shell_timeout_implemented_export" version="1">
- <ind:object object_ref="object_accounts_login_shell_timeout_implemented_export" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_export" version="1">
- ind:path/etc/profile.d</ind:path>
- ind:filenametmout.sh</ind:filename>
- <ind:pattern operation="pattern match">^export[\s]+TMOUT\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" comment="autologout" id="test_accounts_login_shell_timeout_implemented_implement" version="1">
- <ind:object object_ref="object_accounts_login_shell_timeout_implemented_implement" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_login_shell_timeout_implemented_implement" version="1">
- ind:path/etc/profile.d</ind:path>
- ind:filenameautologout.csh</ind:filename>
- <ind:pattern operation="pattern match">^set[\s]+-r[\s]+autologout[\s]+\d{1,3}\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rhel6/src/input/checks/accounts_netrc_files_checked.xml new file mode 100644 index 0000000..2a4a6ca --- /dev/null +++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml @@ -0,0 +1,25 @@ +<def-group>
<definition class="compliance" id="accounts_netrc_files_checked" version="1">
<metadata>
<title>Ensure No .netrc Files</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="CCE-TODO" source="CCE" /><description>Check that .netrc files are missing from all user accounts.</description></metadata>
<criteria >
<criterion comment=".netrc files" test_ref="test_accounts_netrc_files_checked" negate="true" /></criteria>
</definition>
- <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_netrc_files_checked" version="1">
- <unix:object object_ref="object_accounts_netrc_files_checked" />
- </unix:file_test>
- <unix:file_object comment=".netrc files" id="object_accounts_netrc_files_checked" version="1">
- <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
- <unix:path operation="equals">/home</unix:path>
- <unix:filename operation="pattern match">.netrc</unix:filename>
- </unix:file_object>
+</def-group>
diff --git a/rhel6/src/input/checks/accounts_root_auditing_improved.xml b/rhel6/src/input/checks/accounts_root_auditing_improved.xml new file mode 100644 index 0000000..648bc02 --- /dev/null +++ b/rhel6/src/input/checks/accounts_root_auditing_improved.xml @@ -0,0 +1,30 @@ +<def-group>
<definition class="compliance" id="accounts_root_auditing_improved" version="1">
<metadata>
<title>Verify Sudo Audit Trail</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="CCE-4044-4" source="CCE" /><description>Check if the following line appears in /etc/sudoers.</description></metadata>
<criteria operator="AND">
<criterion comment="check_sudoers" test_ref="test_accounts_root_auditing_improved_sudoers" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="check sudoers" id="test_accounts_root_auditing_improved_sudoers" version="1">
- <ind:object object_ref="object_accounts_root_auditing_improved_sudoers" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_root_auditing_improved_sudoers" version="1">
- ind:path /etc</ind:path>
- ind:filename sudoers</ind:filename>
- <ind:pattern operation="pattern match">^%wheel[\s]+[\s]+ALL=(ALL)[\s]+[\s]+ALL\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml new file mode 100644 index 0000000..82a9e45 --- /dev/null +++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml @@ -0,0 +1,33 @@ +<def-group>
<definition class="compliance" id="accounts_user_dot_files_not_world_writable" version="1">
<metadata>
<title>Ensure User Dot Files not World Writable</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="CCE-TODO" source="CCE" /><description>File permissions should be set correctly for dot-files for all user accounts.</description></metadata>
<criteria >
<criterion comment="user dot files" test_ref="test_accounts_user_dot_files_not_world_writable" negate="true" /></criteria>
</definition>
- <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="test_accounts_user_dot_files_not_world_writable" version="1">
- <unix:object object_ref="object_accounts_user_dot_files_not_world_writable" />
- <unix:state state_ref="state_dot_files_wrong_perm" />
- </unix:file_test>
- <unix:file_object comment="user dot files" id="object_accounts_user_dot_files_not_world_writable" version="1">
- <unix:behaviors recurse="files" recurse_direction="down" max_depth="1" recurse_file_system="all" />
- <unix:path operation="equals">/home</unix:path>
- <unix:filename operation="pattern match">.*</unix:filename>
- <filter action="include">state_dot_files_wrong_perm</filter>
- </unix:file_object>
- <unix:file_state id="state_dot_files_wrong_perm" version="1" operator="OR">
- <unix:suid datatype="boolean">true</unix:suid>
- <unix:sgid datatype="boolean">true</unix:sgid>
- <unix:sticky datatype="boolean">true</unix:sticky>
- <unix:gwrite datatype="boolean">true</unix:gwrite>
- <unix:owrite datatype="boolean">true</unix:owrite>
- </unix:file_state>
+</def-group>
diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml new file mode 100644 index 0000000..66345a5 --- /dev/null +++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml @@ -0,0 +1,50 @@ +<def-group>
<definition class="compliance" id="libuser_login_defs_userdefaults" version="1">
<metadata>
<title>Check if Password Parameters are Removed from libuser.conf</title><affected family="unix"><platform>Red Hat Enterprise Linux 6</platform></affected><reference ref_id="TODO" source="CCE" /><description> Make sure the password password parameters are removed from libuser.conf.</description></metadata>
<criteria operator="AND">
<criterion comment="shadowmin removed" test_ref="test_libuser_login_defs_removed_shadowmin" /><criterion comment="shadowmax removed" test_ref="test_libuser_login_defs_removed_shadowmax" /><criterion comment="shadowwarn removed" test_ref="test_libuser_login_defs_removed_shadowwarn" /></criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmin removed from login.defs" id="test_libuser_login_defs_removed_shadowmin" version="1">
- <ind:object object_ref="object_libuser_login_defs_removed_shadowmin" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmin" version="1">
- ind:path/etc</ind:path>
- ind:filenamelogin.defs</ind:filename>
- <ind:pattern operation="pattern match">^LU_SHADOWMIN\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowmax removed from login.defs" id="test_libuser_login_defs_removed_shadowmax" version="1">
- <ind:object object_ref="object_libuser_login_defs_removed_shadowmax" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowmax" version="1">
- ind:path/etc</ind:path>
- ind:filenamelogin.defs</ind:filename>
- <ind:pattern operation="pattern match">^LU_SHADOWMAX\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="shadowwarn removed from login.defs" id="test_libuser_login_defs_removed_shadowwarn" version="1">
- <ind:object object_ref="object_libuser_login_defs_removed_shadowwarn" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_libuser_login_defs_removed_shadowwarn" version="1">
- ind:path/etc</ind:path>
- ind:filenamelogin.defs</ind:filename>
- <ind:pattern operation="pattern match">^LU_SHADOWWARNING\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/input/system/accounts/accounts.xml index fbdeb39..e5b61a6 100644 --- a/rhel6/src/input/system/accounts/accounts.xml +++ b/rhel6/src/input/system/accounts/accounts.xml @@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts, is a necessary part of securing a system. This section introduces mechanisms for restricting access to accounts under RHEL6.</description>
+<Group id="all_human_users_group"> +<title> Create and Maintain a Group Containing All Human Users</title> +<description> +Identify all user accounts on the system which correspond to human users. Depending on your system +configuration, this may be all entries in <tt>/etc/passwd</tt> with UID values of at least 500. Once, you have +identified such a set of users, create a group named usergroup (substitute some name appropriate to your +environment) and populate it with each human user: +<pre># groupadd <i>usergroup</i> +# usermod -G <i>usergroup human1</i> +# usermod -G <i>usergroup human2</i> +... +# usermod -G <i>usergroup humanN</i></pre> +Then modify your procedure for creating new user accounts by adding <tt>-G</tt> <i>usergroup</i> to the set of flags with +which <tt>useradd</tt> is invoked, so that new human users will be placed in the correct group by default.
+Creating a group of human users does not, by itself, enhance system security. However, as you work on securing +your system, you will often find commands which never need to be run by system accounts, or which are only +ever needed by users logged into the graphical console (which should only ever be available to human users, even +on workstations). Once a group of users has been created, it is easy to restrict access to a given command, for +instance <i>/path/to/graphical/command</i>, to authorized users: +<pre># chgrp <i>usergroup /path/to/graphical/command</i> +# chmod 750 <i>/path/graphical/command</i></pre> +Without a group of human users, it is necessary to restrict access by somehow preventing each system account +from running the command, which is an error-prone process even when it is possible at all.</description> +<!-- <oval id="accounts_all_human_users_group_maintained" /> --> +</Group>
</Group> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index bc91277..0782e1d 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -309,6 +309,31 @@ prevents direct password guessing attacks.
</Group>
+<!-- Removed: Too complicated to enforce +<Rule id="restrict_userhelper_execution"> +<title> Restrict Execution of <tt>userhelper</tt> to Console Users</title> +<description> +If your environment has defined a group, <i>usergroup</i> containing all the human users of your system, restrict +execution of the <tt>userhelper</tt> program to only that group: +<pre># chgrp usergroup /usr/sbin/userhelper +# chmod 4710 /usr/sbin/userhelper</pre> +The <tt>userhelper</tt> program provides authentication for graphical services which must run with <tt>root</tt> privileges, +such as the <tt>system-config<tt>- family of graphical configuration utilities. Only human users logged into the system +console are likely to ever have a legitimate need to run these utilities. This step provides some protection against +possible flaws in <tt>userhelper</tt>'s implementation, and against further privilege escalation when system accounts +are compromised. See Section 2.3.2.2 for more information on creating a group of human users. +The <tt>userhelper</tt> program is configured by the files in <tt>/etc/security/console.apps/</tt>. Each file specifies, for +some program, what user the program should run as, and what program should be executed after successful +authentication. +Note: The configuration in <tt>/etc/security/console.apps/</tt> is applied in combination with the PAM configura- +tion of the service defined in <tt>/etc/pam.d/</tt>. First, <tt>userhelper</tt> determines what user the service should run as. +(Typically, this will be <tt>root</tt>.) Next, <tt>userhelper</tt> uses the PAM API to allow the user who ran the program to +attempt to authenticate as the desired user. The PAM API exchange is wrapped in a GUI if the application's +configuration requests one.</description> +<ident cce="4185-5, 3952-9" /> +<oval id="accounts_pam_userhelper_execution_restricted" /> +</Rule> +-->
<Rule id="set_password_hashing_algorithm"> <title>Set Password Hashing Algorithm</title> @@ -374,7 +399,18 @@ compromised could be used yet again by an attacker. <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/> <ref nist="IA-5" /> </Rule> -</Group> +</Group> <!-- End <Group id="limiting_password_reuse"> --> + +<Rule id="pam_ccreds_removed"> +<title> Remove the <tt>pam_ccreds</tt> Package if Possible</title> +<description> +Unless its credential caching functionality is required, remove the <tt>pam_ccreds</tt> package: +<pre># yum erase pam_ccreds</pre> +The <tt>pam_ccreds</tt> package contains the setuid program <tt>/usr/sbin/ccreds_validate</tt> and should be removed +unless it provides essential functionality. Any credentials cached on a system would also be compromised if an +attacker obtains control of the system.</description> +<oval id="package_pam_ccreds_removed" /> +</Rule>
</Group>
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 45ad144..27441e0 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -7,6 +7,23 @@ there are some steps which, if taken, make it more difficult for an attacker to quickly or undetectably modify a system from its console.</description>
+<Group id="bios_password"> +<title>Set BIOS Password</title> +<description>BIOS (on x86 systems) is the first code to execute during system startup and controls many important +system parameters, including which devices the system will try to boot from, and in which order. +Assign a password to prevent any unauthorized changes to the BIOS configuration. The exact steps will +vary depending on your machine, but are likely to include: +1.Reboot the machine. +2.Press the appropriate key during the initial boot screen (F2 is typical). +3.Navigate the BIOS configuration menu to add a password. +The exact process will be system-specific and the system's hardware manual may provide detailed instructions. +This password should prevent attackers with physical access from attempting to change important parameters, +such as those described in Sections 2.5.2.2.1 and 2.2.2.2.4. However, an attacker with physical access can usually +clear the BIOS password. The password should be written down and stored in a physically-secure location, such +as a safe, in the event that it is forgotten and must be retrieved. +</description> +</Group>
<Group id="bootloader"> <title>Set Boot Loader Password</title> <description>During the boot process, the boot loader is @@ -133,6 +150,30 @@ services, weakening system security. <ref nist="CM-7, IA-4, SC-2"/> </Rule>
+<Rule id="login_shell_inactivity_timeout"> +<title> Implement Inactivity Time-out for Login Shells</title> +<description> +If the system does not run X Windows, then the login shells can be configured to automatically log users out after +a period of inactivity. The following instructions are not practical for systems which run X Windows, as they +will close terminal windows in the X environment. For information on how to automatically lock those systems, +see Section 2.3.5.6. +To implement a 15-minute idle time-out for the default <tt>/bin/bash</tt> shell, create a new file <tt>tmout.sh</tt> in the directory <tt>/etc/profile.d</tt> with the following lines: +<pre>TMOUT=900 +readonly TMOUT +export TMOUT</pre> +To implement a 15-minute idle time-out for the <tt>tcsh</tt> shell, create a new file <tt>autologout.csh</tt> in the directory +<tt>/etc/profile.d</tt> with the following line: +<pre>set -r autologout 15</pre> +Similar actions should be taken for any other login shells used. +The example time-out here of 15 minutes should be adjusted to whatever your security policy requires. The +readonly line for <tt>bash</tt> and the <tt>-r</tt> option for <tt>tcsh</tt> can be omitted if policy allows users to override the value. +The automatic shell logout only occurs when the shell is the foreground process. If, for example, a <tt>vi</tt> session is +left idle, then automatic logout would not occur. +When logging in through a remote connection, as with SSH, it may be more effective to set the timeout value +directly through that service. To learn how to set automatic timeout intervals for SSH, see Section 3.5.2.3.</description> +<ident cce="3689-7, 3707-7" /> +<oval id="accounts_login_shell_timeout_implemented" /> +</Rule>
<Group id="screen_locking"> <title>Configure Screen Locking</title> diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xml b/rhel6/src/input/system/accounts/restrictions/restrictions.xml index febead6..cfee882 100644 --- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml +++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml @@ -10,4 +10,103 @@ console. Therefore, mechanisms for accessing accounts by entering usernames and passwords should be restricted to those which are operationally necessary.</description>
+<!-- +<Rule id="limit_su_access_to_root"> +<title> Limit <tt>su</tt> Access to the Root Account</title> +<description>"1.Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed +to execute commands as root are members of that group. +<pre># grep ^wheel /etc/group</pre> +2.Edit the file <tt>/etc/pam.d/su</tt>. Add, uncomment, or correct the line: +<pre>auth required pam_wheel.so use_uid</pre> +The <tt>su</tt> command allows a user to gain the privileges of another user by entering the password for that user's +account. It is desirable to restrict the root user so that only known administrators are ever allowed to access the +root account. This restricts password-guessing against the root account by unauthorized users or by accounts +which have been compromised. <br /> +By convention, the group <tt>wheel</tt> contains all users who are allowed to run privileged commands. The PAM +module <tt>pam_wheel.so</tt> is used to restrict root access to this set of users.</description> +<ident cce="14088-9, 15047-4" /> +<oval id="accounts_su_access_limited" /> +<ref nist="AC-2, AC-3, CM-6" /> +</Rule> +-->
+<Group id="configure_sudo"> +<title> Verify <tt>sudo</tt> is Configured to Improve Auditing of Root Access</title> +<description> +The <tt>sudo</tt> command allows fine-grained control over which users can execute commands using other accounts. +The primary benefit of <tt>sudo</tt> when configured as above is that it provides an audit trail of every command run +by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an +established procedure that all root commands are run using <tt>sudo</tt>, then it is easy for an auditor to detect unusual +behavior when this procedure is not followed. <br /> +</description>
+<warning> +Editing <tt>/etc/sudoers</tt> by hand can be dangerous, since a configuration error may make it impossible to access +the root account remotely. The recommended means of editing this file is using the <tt>visudo</tt> command, which +checks the file's syntax for correctness before allowing it to be saved. <br />
+Note that <tt>sudo</tt> allows any attacker who gains access to the password of an administrator account to run commands +as root. This is a downside which must be weighed against the benefits of increased audit capability and of being +able to heavily restrict the use of the high-value root password (which can be logistically difficult to change +often). As a basic precaution, <i>never</i> use the <tt>NOPASSWD</tt> directive, which would allow anyone with access to an administrator account to execute commands as root without knowing the administrator's password. <br /> +</warning>
+<Rule id="verify_wheel_exists"> +<description> +Ensure that the group <tt>wheel</tt> exists, and that the usernames of all administrators who should be allowed +to execute commands as root are members of that group. +<pre># grep ^wheel /etc/group</pre></description> +<oval id="accounts_wheel_exists" /> +</Rule>
+<Rule id="verify_sudo_audit_trail"> +<description>Edit the file <tt>/etc/sudoers</tt>. Add, uncomment, or correct the line: +<pre>%wheel ALL=(ALL) ALL</pre> +</description> +<oval id="accounts_root_auditing_improved" /> +</Rule> +</Group>
+<Group id="remove_password_parameters"> +<title> Remove Password Parameters from <tt>libuser.conf</tt></title> +<description>The <tt>/etc/libuser.conf</tt> file contains configuration options for the libuser library, which is intended to implement +a standardized interface for manipulating and administering user and group accounts. By default, it sources +password settings from <tt>/etc/login.defs</tt>, but it can override these parameters. The man page <tt>libuser.conf(5)</tt> contains more information.</description>
+<Rule id="verify_libuser_login_defs_import"> +<title>Verify Line Under Import Section</title> +<description> +Ensure the following line exists within the file <tt>/etc/libuser.conf</tt> under the <tt>[import]</tt> section. +<pre>login_defs = /etc/login.defs</pre></description> +<oval id="libuser_login_defs_import" /> +</Rule>
+<Rule id="verify_libuser_login_defs_userdefaults"> +<title>Verify Lines do not Appear in Userdefaults Section</title> +<description> +Ensure that no lines beginning with the following appear in the <tt>[userdefaults]</tt> section of the file, as +these override settings from <tt>/etc/login.defs</tt>: +<pre>LU_SHADOWMAX +LU_SHADOWMIN +LU_SHADOWWARNING</pre></description> +<oval id="libuser_login_defs_userdefaults" /> +</Rule> +</Group>
+<Rule id="verify_accounts_disabled_after_expiration"> +<title> Set Accounts to Disable After Password Expiration</title> +<description> +In order to automatically disable local accounts some number of <i>DAYS</i> after password expiration, add or +modify the following line in <tt>/etc/default/useradd</tt>: +<pre>INACTIVE=<i>DAYS</i></pre> +For example, if <pre>INACTIVE=30</pre> and if the password is currently on the verge of expiration, then 30 days remain +until the account is automatically disabled. If the password will not expire for another 60 days, then 90 days +remain until the account is automatically disabled. See <tt>useradd(8)</tt> for more information. +Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period +of inactivity for users in your environment. Setting the timeout too low incurs support costs and also has the +potential to impact availability of the system to legitimate users.</description> +<oval id="accounts_disabled_after_expiration" /> +</Rule>
</Group> diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/input/system/accounts/session.xml index 00b5a8d..f7e6530 100644 --- a/rhel6/src/input/system/accounts/session.xml +++ b/rhel6/src/input/system/accounts/session.xml @@ -114,6 +114,19 @@ groups or ACLs. <ref nist="AC-3, CM-6"/> </Rule>
+<Rule id="ensure_dot_files_not_world_writable"> +<title> Ensure that User Dot-Files are not World-writable</title> +<description> +For each human user <i>USER</i> of the system, view the permissions of all dot-files in the user's home directory: +<pre># ls -ld /home/USER /.[A-Za-z0-9]*</pre> +Ensure that none of these files are group- or world-writable. Correct each misconfigured file <i>FILE</i> by exe- +cuting: +<pre># chmod go-w /home/USER /FILE</pre> +A user who can modify another user's configuration files can likely execute commands with the other user's +privileges, including stealing data, destroying files, or launching further attacks on the system.</description> +<oval id="accounts_user_dot_files_not_world_writable" /> +</Rule>
<Group id="user_umask"> <title>Ensure that Users Have Sensible Umask Values</title> <description> @@ -168,6 +181,17 @@ operator="equals" interactive="0"> <value selector="077">077</value> </Value>
+<Group id="ensure_no_netrc_files"> +<title> Ensure that Users do not Have <tt>.netrc</tt> Files</title> +<description> +For each human user <i>USER</i> of the system, ensure that the user has no <tt>.netrc</tt> file. The command: +<pre># ls -l /home/<i>USER</i> /.netrc</pre> +should return the error "No such file or directory". If any user has such a file, approach that user to discuss +removing this file. +The <tt>.netrc</tt> file is a configuration file used to make unattended logins to other systems via FTP. When this file +exists, it frequently contains unencrypted passwords which may be used to attack other systems.</description> +</Group>
<Rule id="user_umask_bashrc"> <title> Ensure the Default Bash Umask is Set Correctly
From: Michael Palmiotto mpalmiotto@tresys.com
--- .../checks/audit_rules_logon_modification.xml | 34 +++++++++ .../checks/audit_rules_session_modification.xml | 47 ++++++++++++ .../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++++++++ .../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++++++++ rhel6/src/input/profiles/common.xml | 27 +++++++ rhel6/src/input/system/auditing.xml | 77 +++++++++++++++++++- rhel6/src/input/system/logging.xml | 67 +++++++++++++++++ 7 files changed, 392 insertions(+), 1 deletions(-) create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/rhel6/src/input/checks/audit_rules_logon_modification.xml new file mode 100644 index 0000000..97d170d --- /dev/null +++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml @@ -0,0 +1,34 @@ +<def-group> + <definition class="compliance" id="audit_rules_logon_modification" version="1"> + <metadata> + <title> Record Attempts to Alter Logon and Logout Events</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id=" CCE-14904-7" source="CCE" /> + <description> Audit attempted manual edits of files involved in storing logon events.</description> + </metadata> + <criteria operator = "AND"> + <criterion comment="watch on lastlog" test_ref="test_audit_rules_logon_modification_lastlog" /> + <criterion comment="watch on faillog" test_ref="test_audit_rules_logon_modification_faillog" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" comment="lastlog watch" id="test_audit_rules_logon_modification_lastlog" version="1"> + <ind:object object_ref="object_audit_rules_logon_modification_lastlog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_logon_modification_lastlog" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + <ind:textfilecontent54_test check="all" comment="faillog watch" id="test_audit_rules_logon_modification_faillog" version="1"> + <ind:object object_ref="object_audit_rules_logon_modification_faillog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_logon_modification_faillog" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml b/rhel6/src/input/checks/audit_rules_session_modification.xml new file mode 100644 index 0000000..22b0cb6 --- /dev/null +++ b/rhel6/src/input/checks/audit_rules_session_modification.xml @@ -0,0 +1,47 @@ +<def-group> + <definition class="compliance" id="audit_rules_session_modification" version="1"> + <metadata> + <title></title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-14679-5" source="CCE" /> + <description>Ensure that watches are placed on utmp, btmp, and wtmp, sessions.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="watch on wtmp" test_ref="test_audit_rules_session_modification_wtmp" /> + <criterion comment="watch on utmp" test_ref="test_audit_rules_session_modification_utmp" /> + <criterion comment="watch on btmp" test_ref="test_audit_rules_session_modification_btmp" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" comment="wtmp session watch" id="test_audit_rules_session_modification_wtmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_wtmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_wtmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/wtmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="utmp session watch" id="test_audit_rules_session_modification_utmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_utmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_utmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/utmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="btmp session watch" id="test_audit_rules_session_modification_btmp" version="1"> + <ind:object object_ref="object_audit_rules_session_modification_btmp" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_audit_rules_session_modification_btmp" version="1"> + ind:path/etc/audit</ind:path> + ind:filenameaudit.rules</ind:filename> + <ind:pattern operation="pattern match">^-w[\s]+/var/log/btmp[\s]+wa[\s]+-k[\s]+session\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml new file mode 100644 index 0000000..2a99b92 --- /dev/null +++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml @@ -0,0 +1,71 @@ +<def-group> + <definition class="compliance" id="logwatch_configured_on_logserver" version="1"> + <metadata> + <title>Ensure Logwatch Configured on the Central Log Server</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="CCE-4323-2" source="CCE" /> + <description>Check if logwatch service is enabled and configured.</description> + </metadata> + <criteria operator="AND"> + <criterion comment="hostlimit" test_ref="test_logwatch_configured_on_logserver_hostlimit" /> + <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" /> + <criterion comment="multiemail" test_ref="test_logwatch_configured_on_logserver_multiemail" /> + <criterion comment="service" test_ref="test_logwatch_configured_on_logserver_service" /> + + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_on_logserver_hostlimit" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_hostlimit" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_hostlimit" version="1"> + <ind:subexpression operation="equals">no</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_hostlimit" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_on_logserver_splithosts" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_splithosts" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_splithosts" version="1"> + <ind:subexpression operation="equals">yes</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_splithosts" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test MultiEmail" id="test_logwatch_configured_on_logserver_multiemail" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_multiemail" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_multiemail" version="1"> + <ind:subexpression operation="equals">no</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_multiemail" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test Service" id="test_logwatch_configured_on_logserver_service" version="1"> + <ind:object object_ref="object_logwatch_configured_on_logserver_service" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_service" version="1"> + <ind:subexpression operation="equals">-zz-disk_space</ind:subexpression> + </ind:textfilecontent54_state> + <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_service" version="1"> + ind:path/etc/logwatch/conf</ind:path> + ind:filenamelogwatch.conf</ind:filename> + <ind:pattern operation="pattern match">^[\s]Service[\s]*=[\s]*-zz-disk_space+\s*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6/src/input/checks/rsyslog_messages_captured.xml new file mode 100644 index 0000000..0639653 --- /dev/null +++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml @@ -0,0 +1,70 @@ +<def-group> + <definition class="compliance" id="rsyslog_messages_captured" + version="1"> + <metadata> + <title>Ensure Important Messages are Captured</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <reference ref_id="TODO" source="CCE" /> + <description>Make sure appropriate lines are in rsyslog.conf. </description> + </metadata> + <criteria operator="AND"> + <criterion comment="messages" test_ref="test_rsyslog_messages_captured_messages" /> + <criterion comment="kern.log" test_ref="test_rsyslog_messages_captured_kern" /> + <criterion comment="daemon.log" test_ref="test_rsyslog_messages_captured_daemon" /> + <criterion comment="syslog" test_ref="test_rsyslog_messages_captured_syslog" /> + <criterion comment="unused.log" test_ref="test_rsyslog_messages_captured_unused" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" comment="messages" id="test_rsyslog_messages_captured_messages" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_messages" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_messages" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^auth.*[\s]*,[\s]*user.*[\s]+/var/log/messages$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="kern.log" id="test_rsyslog_messages_captured_kern" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_kern" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> +<ind:pattern operation="pattern match">^kern.*[\s]+/var/log/kern.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="daemon.log" id="test_rsyslog_messages_captured_daemon" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_daemon" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> +<ind:pattern operation="pattern match">^daemon.*[\s]+/var/log/daemon.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="syslog" id="test_rsyslog_messages_captured_syslog" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_syslog" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^syslog.*[\s]+/var/log/syslog$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> + + <ind:textfilecontent54_test check="all" comment="unused" id="test_rsyslog_messages_captured_unused" version="1"> + <ind:object object_ref="object_rsyslog_messages_captured_unused" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused" version="1"> + ind:path/etc</ind:path> + ind:filenamersyslog.conf</ind:filename> + <ind:pattern operation="pattern match">^lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*[\s]+/var/log/unused.log$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml index 20853f5..e426f83 100644 --- a/rhel6/src/input/profiles/common.xml +++ b/rhel6/src/input/profiles/common.xml @@ -20,6 +20,17 @@ <select idref="selinux_unlabeled_device_files" selected="true"/> <select idref="restrict_root_console_logins" selected="true"/> <select idref="restrict_serial_port_logins" selected="true"/> + +<select idref="verify_wheel_exists" selected="true"/> +<select idref="verify_sudo_audit_trail" selected="true"/> +<select idref="verify_libuser_login_defs_import" selected="true"/> +<select idref="verify_libuser_login_defs_userdefaults" selected="true"/> +<select idref="verify_accounts_disabled_after_expiration" selected="true"/> +<select idref="pam_ccreds_removed" selected="true"/> +<select idref="ensure_dot_files_not_world_writable" selected="true" /> +<select idref="ensure_no_netrc_files" selected="true" /> +<select idref="login_shell_inactivity_timeout" selected="true"/> + <select idref="no_shelllogin_for_systemaccounts" selected="true"/> <select idref="no_empty_passwords" selected="true"/> <select idref="no_hashes_outside_shadow" selected="true"/> @@ -76,14 +87,18 @@ <select idref="install_openswan" selected="true"/> <select idref="package_rsyslog_installed" selected="true"/> <select idref="enable_rsyslog" selected="true"/> +<select idref="ensure_rsyslog_messages_captured" selected="true"/> <select idref="userowner_rsyslog_files" selected="true"/> <select idref="groupowner_rsyslog_files" selected="true"/> <select idref="rsyslog_file_permissions" selected="true"/> <select idref="rsyslog_send_messages_to_logserver" selected="true"/> <!-- <select idref="rsyslog_accept_remote_messages" selected="true"/> --> <select idref="ensure_logrotate_activated" selected="true"/> +<select idref="configure_logwatch_on_logserver" selected="true"/> +<select idref="disable_logwatch_for_logserver" selected="true"/> <select idref="enable_auditd_service" selected="true"/> <select idref="enable_auditd_bootloader" selected="true"/> +<select idref="configure_auditd_data_retention" selected="true"/> <select idref="audit_time_rules" selected="true"/> <select idref="audit_account_changes" selected="true"/> <select idref="audit_network_modifications" selected="true"/> @@ -93,6 +108,8 @@ <select idref="audit_privileged_commands" selected="true"/> <select idref="audit_media_exports" selected="true"/> <select idref="audit_file_deletions" selected="true"/> +<select idref="audit_manual_logon_edits" selected="true"/> +<select idref="audit_manual_session_edits" selected="true"/> <select idref="audit_sysadmin_actions" selected="true"/> <select idref="audit_kernel_module_loading" selected="true"/> <select idref="audit_config_immutable" selected="true"/> @@ -165,6 +182,16 @@ <select idref="disable_smb_server" selected="true"/> <select idref="require_smb_client_signing" selected="true"/> <select idref="require_smb_client_signing_mount.cifs" selected="true"/> +<select idref="select_squid_listening_port" selected="true"/> +<select idref="verify_default_secure_settings" selected="true"/> +<select idref="change_default_insecure_settings" selected="true"/> +<select idref="configure_authentication" selected="true"/> +<select idref="access_control_lists" selected="true"/> +<select idref="configure_icp" selected="true"/> +<select idref="allow_proxy_server_access" selected="true"/> +<select idref="forward_logs_to_syslogd" selected="true"/> +<select idref="run_squid_in_chroot_jail" selected="true"/> +<select idref="lower_privileges" selected="true"/> <select idref="disable_squid" selected="true"/> <select idref="uninstall_squid" selected="true"/> <select idref="disable_snmpd" selected="true"/> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index e75754f..1d18eaf 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -95,6 +95,51 @@ process during boot. <ref nist="AU-2" /> </Rule>
+<!-- +<Group id="configure_auditd_data_retention"> +<title> Configure <tt>auditd</tt> Data Retention</title> +<description> +<ul> + +<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log +file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:</li> +<pre>max_log_file = <i>STOREMB</i></tt> + +<li>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition +or logical volume during system installation time. The partition should be larger than the maximum +space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied +by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</li> + +<li>If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt> +to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or +correct the following lines:</li> +<pre>space_left_action = email +action_mail_acct = root +admin_space_left_action = halt</pre> +</ul> +The default action to take when the logs reach their maximum size is to rotate the log files, discarding the +oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility +of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line: +<pre>max_log_file_action = keep_logs</pre> +By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly +auditing system activity, this is likely to be insuffcient. +The log file size needed will depend heavily on what types of events are being audited. First configure auditing +to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will +allow you to keep the required data for the correct time period. +Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if +they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit +trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.) +Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then +<tt>auditd</tt> can be configured to halt the machine if it runs out of space. +<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated +away before they can be viewed. +<i>If your system is configured to halt when logging cannot be performed, make sure this can never +happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and +that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description> +<oval id="service_auditd_data_retention_configured" /> +</Group> +--> + <Group id="auditd_configure_rules"> <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title> <description>The <tt>auditd</tt> program can perform comprehensive @@ -171,7 +216,6 @@ to capture events that modify account changes: <ref nist="AU-2(a)" /> </Rule>
- <Rule id="audit_network_modifications"> <title>Record Events that Modify the System’s Network Environment</title> <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting @@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy should be au <ref nist="AU-2" /> </Rule>
+<Rule id="audit_manual_logon_edits"> +<title> Record Attempts to Alter Logon and Logout Events</title> +<description> +The audit system already collects login info for all users and root. To watch for attempted manual edits of +files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/log/faillog -p wa -k logins +-w /var/log/lastlog -p wa -k logins +</pre> +</description> +<ident cce="14904-7" /> +<oval id="audit_rules_logon_modification" /> +<ref nist="TODO" /> +</Rule> + + +<Rule id="audit_manual_session_edits"> +<title> Record Attempts to Alter Process and Session Initiation Information</title> +<description> +The audit system already collects process information for all users and root. To watch for attempted manual +edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>: +<pre> +-w /var/run/utmp -p wa -k session +-w /var/log/btmp -p wa -k session +-w /var/log/wtmp -p wa -k session +</pre> +</description> +<ident cce="14679-5" /> +<oval id="audit_rules_session_modification" /> +<ref nist="TODO" /> +</Rule>
<Rule id="audit_dac_actions"> <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml index 839484e..fc6b311 100644 --- a/rhel6/src/input/system/logging.xml +++ b/rhel6/src/input/system/logging.xml @@ -54,6 +54,25 @@ logging services. <ref nist="AU-2" /> </Rule>
+<Rule id="ensure_rsyslog_messages_captured"> +<title> Ensure Important Messages are Captured</title> +<description> +Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your +environment: +<pre> +auth.*,user.* /var/log/messages +kern.* /var/log/kern.log +daemon.* /var/log/daemon.log +syslog.* /var/log/syslog +lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.* /var/log/unused.log +</pre> +See the man page <tt>rsyslog.conf(5)</tt> for more information. +<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en- +vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i> +<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description> +<oval id="rsyslog_messages_captured" /> +</Rule> + <Group id="log_file_permissions"> <title>Confirm Existence and Permissions of System Log Files</title> <description>For each log file LOGFILE referenced in @@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale> <ref nist="AU-2, AU-9, CM-6" /> </Rule> </Group> + +<Rule id="configure_logwatch_on_logserver"> +<title> Configure Logwatch on the Central Log Server</title> +<description> +Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or +correct the following lines: +<pre> +HostLimit = no +SplitHosts = yes +MultiEmail = no +Service = -zz-disk_space +</pre> +Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): +<pre># cd /etc/cron.daily +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch +</pre> +On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate +on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it +is running. +If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly +more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that +information is almost always necessary. If <tt>MultiEmail</tt> is set, then each host's information will be sent in a +separate e-mail message. This is a matter of preference. +The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to +the logserver.</description> +<ident cce="4323-2" /> +<oval id="logwatch_configured_on_logserver" /> +</Rule> + + +<Rule id="disable_logwatch_for_logserver"> +<title> Disable Logwatch on Clients if a Logserver Exists</title> +<description> +Does your site have a central logserver which has been configured to report on logs received from all systems? +If so: +<pre> +# rm /etc/cron.daily/0logwatch +</pre> +If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central +logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier +and less time-intensive for administrators.</description> +<oval id="logwatch_disabled_for_logserver" /> +</Rule> </Group> +
scap-security-guide@lists.fedorahosted.org
-
Jeffrey Blank -
Kevin Spargur -
Mike Palmiotto -
Spencer R. Shimko