[PATCH 00/17] Added mappings to DISA CCI numbers

[Willy Santos]

These patches contain mappings of Rules to DISA CCI

Willy Santos (17):
  Mapped CCI-001141 to network_ssl group
  Mapped CCI-001436 to disable_vsftpd
  Mapped CCI-001436 to disable_telnet_service
  Mapped CCI-001436 to disable_rcp
  Mapped CCI-001436 to disable_rlogin
  Mapped CCI-001436 to disable_tftp
  Mapped CCI-001452 to deny_password_attempts
  Mapped CCI-001453 to ssh group
  Mapped CCI-001148 to network_ssl
  Mapped CCI-001589 to auditd_configure_rules
  Mapped CCI-001619 to password_require_specials
  Mapped CCI-001297 to aide_periodic_cron_checking
  Mapped CCI-000044 to deny_password_attempts
  Mapped CCI-000047 to deny_password_attempts
  Mapped CCI-000048 to set_system_login_banner
  Mapped CCI-000048 to enable_gdm_login_banner and
    set_gdm_login_banner_text
  Mapped CCI-000160 to enable_ntpd and ntpd_specify_remote_server

rhel6/src/input/services/ftp.xml              |    2 +-
 rhel6/src/input/services/ntp.xml              |    4 ++++
 rhel6/src/input/services/obsolete.xml         |    4 ++++
 rhel6/src/input/services/ssh.xml              |    1 +
 rhel6/src/input/system/accounts/banners.xml   |    6 +++---
 rhel6/src/input/system/accounts/pam.xml       |    4 ++--
 rhel6/src/input/system/auditing.xml           |    2 +-
 rhel6/src/input/system/network/ssl.xml        |    1 +
 rhel6/src/input/system/software/integrity.xml |    2 +-
 9 files changed, 18 insertions(+), 8 deletions(-)

[PATCH 01/17] Mapped CCI-001141 to network_ssl group

[Willy Santos]

CCI-001141 requires the OS to produce, control, and distribute crypto keys using NSA-approved technology and processes. This met by using SSL which is implemented in RHEL with OpenSSL.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/network/ssl.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/system/network/ssl.xml b/rhel6/src/input/system/network/ssl.xml
index c439ed4..3a91efe 100644
--- a/rhel6/src/input/system/network/ssl.xml
+++ b/rhel6/src/input/system/network/ssl.xml
@@ -34,6 +34,7 @@ can be appropriate. The major steps in this process are:
 <li>Enable client support by distributing the CA’s certificate</li>
 </ol>
 </description>
+<ref disa="1141" />

<Rule id="network_ssl_create_ca">
 <title>Create a CA to Sign Certificates</title>

[PATCH 01/17] Mapped CCI-001141 to network_ssl group

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001141 requires the OS to produce, control, and distribute crypto keys using NSA-approved technology and processes. This met by using SSL which is implemented in RHEL with OpenSSL.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/network/ssl.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/system/network/ssl.xml b/rhel6/src/input/system/network/ssl.xml
> index c439ed4..3a91efe 100644
> --- a/rhel6/src/input/system/network/ssl.xml
> +++ b/rhel6/src/input/system/network/ssl.xml
> @@ -34,6 +34,7 @@ can be appropriate. The major steps in this process are:
>
>   <li>Enable client support by distributing the CA’s certificate</li>
>   </ol>
>   </description>
> +<ref disa="1141" />
>
>   <Rule id="network_ssl_create_ca">
>   <title>Create a CA to Sign Certificates</title>

Ack

[PATCH 02/17] Mapped CCI-001436 to disable_vsftpd

[Willy Santos]

CCI-001436 requires disabling of networking protocols deemed to be nonsecure. disable_vsftpd meets that requirement, among others.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/ftp.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/services/ftp.xml b/rhel6/src/input/services/ftp.xml
index 98a9e98..5955e87 100644
--- a/rhel6/src/input/services/ftp.xml
+++ b/rhel6/src/input/services/ftp.xml
@@ -28,7 +28,7 @@ a risk of compromising sensitive information.
 </rationale>
 <ident cce="3919-8" />
 <oval id="service_vsftpd_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6, CM-7" disa="1436"/>
 </Rule>

<Rule id="uninstall_vsftpd">

[PATCH 02/17] Mapped CCI-001436 to disable_vsftpd

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001436 requires disabling of networking protocols deemed to be nonsecure. disable_vsftpd meets that requirement, among others.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/ftp.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/services/ftp.xml b/rhel6/src/input/services/ftp.xml
> index 98a9e98..5955e87 100644
> --- a/rhel6/src/input/services/ftp.xml
> +++ b/rhel6/src/input/services/ftp.xml
> @@ -28,7 +28,7 @@ a risk of compromising sensitive information.
>
>   </rationale>
>   <ident cce="3919-8" />
>   <oval id="service_vsftpd_disabled" />
> -<ref nist="CM-6, CM-7" />
> +<ref nist="CM-6, CM-7" disa="1436"/>
>   </Rule>
>
>   <Rule id="uninstall_vsftpd">

Ack

[PATCH 03/17] Mapped CCI-001436 to disable_telnet_service

[Willy Santos]

CCI-001436 requires disabling of networkin protocols deemed to be nonsecure, disable_telnet_service meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/obsolete.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
index 8e04cac..167c114 100644
--- a/rhel6/src/input/services/obsolete.xml
+++ b/rhel6/src/input/services/obsolete.xml
@@ -93,6 +93,7 @@ subject to man in the middle attacks.
 </rationale>
 <ident cce="3390-2" />
 <oval id="service_telnetd_disabled" />
+<ref disa="1436" />
 </Rule>

<Rule id="uninstall_telnet_server">

[PATCH 03/17] Mapped CCI-001436 to disable_telnet_service

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001436 requires disabling of networkin protocols deemed to be nonsecure, disable_telnet_service meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/obsolete.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
> index 8e04cac..167c114 100644
> --- a/rhel6/src/input/services/obsolete.xml
> +++ b/rhel6/src/input/services/obsolete.xml
> @@ -93,6 +93,7 @@ subject to man in the middle attacks.
>
>   </rationale>
>   <ident cce="3390-2" />
>   <oval id="service_telnetd_disabled" />
> +<ref disa="1436" />
>   </Rule>
>
>   <Rule id="uninstall_telnet_server">

Ack

[PATCH 04/17] Mapped CCI-001436 to disable_rcp

[Willy Santos]

CCI-001436 requires disabling networking protocols deemed nonsecure, disable_rcp meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/obsolete.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
index 167c114..2ab54f2 100644
--- a/rhel6/src/input/services/obsolete.xml
+++ b/rhel6/src/input/services/obsolete.xml
@@ -143,6 +143,7 @@ uninstalled.</description>
 <description>The <tt>rsh</tt> service should be disabled.</description>
 <ident cce="4141-8" />
 <oval id="service_rsh_disabled" />
+<ref disa="1436" />
 </Rule>

<Rule id="disable_rlogin">

[PATCH 04/17] Mapped CCI-001436 to disable_rcp

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001436 requires disabling networking protocols deemed nonsecure, disable_rcp meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/obsolete.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
> index 167c114..2ab54f2 100644
> --- a/rhel6/src/input/services/obsolete.xml
> +++ b/rhel6/src/input/services/obsolete.xml
> @@ -143,6 +143,7 @@ uninstalled.</description>
>   <description>The<tt>rsh</tt>  service should be disabled.</description>
>
>   <ident cce="4141-8" />
>   <oval id="service_rsh_disabled" />
> +<ref disa="1436" />
>   </Rule>
>
>   <Rule id="disable_rlogin">

Ack

[PATCH 05/17] Mapped CCI-001436 to disable_rlogin

[Willy Santos]

CCI-001436 requires disabling networking protocols deemed nonsecure, disable_rlogin meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/obsolete.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
index 2ab54f2..91b26c5 100644
--- a/rhel6/src/input/services/obsolete.xml
+++ b/rhel6/src/input/services/obsolete.xml
@@ -151,6 +151,7 @@ uninstalled.</description>
 <description>The <tt>rlogin</tt> service should be disabled.</description>
 <ident cce="3537-8" />
 <oval id="service_rlogin_disabled" />
+<ref disa="1436" />
 </Rule>

</Group>

[PATCH 05/17] Mapped CCI-001436 to disable_rlogin

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001436 requires disabling networking protocols deemed nonsecure, disable_rlogin meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/obsolete.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
> index 2ab54f2..91b26c5 100644
> --- a/rhel6/src/input/services/obsolete.xml
> +++ b/rhel6/src/input/services/obsolete.xml
> @@ -151,6 +151,7 @@ uninstalled.</description>
>   <description>The<tt>rlogin</tt>  service should be disabled.</description>
>
>   <ident cce="3537-8" />
>   <oval id="service_rlogin_disabled" />
> +<ref disa="1436" />
>   </Rule>
>
>   </Group>

Ack

[PATCH 06/17] Mapped CCI-001436 to disable_tftp

[Willy Santos]

CCI-001436 requires disabling networking protocols deemed nonsecure, disable_tftp meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/obsolete.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
index 91b26c5..99350cf 100644
--- a/rhel6/src/input/services/obsolete.xml
+++ b/rhel6/src/input/services/obsolete.xml
@@ -215,6 +215,7 @@ uninstalled.</description>
 <description>The tftp service should be disabled.</description>
 <ident cce="4273-9" />
 <oval id="service_tftp_disabled" />
+<ref disa="1436" />
 </Rule>

<Rule id="tftpd_uses_secure_mode" severity="high">

[PATCH 06/17] Mapped CCI-001436 to disable_tftp

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001436 requires disabling networking protocols deemed nonsecure, disable_tftp meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/obsolete.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/obsolete.xml b/rhel6/src/input/services/obsolete.xml
> index 91b26c5..99350cf 100644
> --- a/rhel6/src/input/services/obsolete.xml
> +++ b/rhel6/src/input/services/obsolete.xml
> @@ -215,6 +215,7 @@ uninstalled.</description>
>   <description>The tftp service should be disabled.</description>
>
>   <ident cce="4273-9" />
>   <oval id="service_tftp_disabled" />
> +<ref disa="1436" />
>   </Rule>
>
>   <Rule id="tftpd_uses_secure_mode" severity="high">

Ack

[PATCH 07/17] Mapped CCI-001452 to deny_password_attempts

[Willy Santos]

CCI-001452 requires locking an account after an organization-defined number of failed login attempts, deny_password_attempts meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/pam.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index fe8b6cb..6708cb5 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -304,7 +304,7 @@ prevents direct password guessing attacks.
 </rationale>
 <ident cce="3410-8" />
 <oval id="accounts_passwords_pam_faillock_deny" />
-<ref nist="AC-7, CM-6" />
+<ref nist="AC-7, CM-6" disa="1452" />
 </Rule>

</Group>

[PATCH 07/17] Mapped CCI-001452 to deny_password_attempts

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001452 requires locking an account after an organization-defined number of failed login attempts, deny_password_attempts meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/pam.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
> index fe8b6cb..6708cb5 100644
> --- a/rhel6/src/input/system/accounts/pam.xml
> +++ b/rhel6/src/input/system/accounts/pam.xml
> @@ -304,7 +304,7 @@ prevents direct password guessing attacks.
>
>   </rationale>
>   <ident cce="3410-8" />
>   <oval id="accounts_passwords_pam_faillock_deny" />
> -<ref nist="AC-7, CM-6" />
> +<ref nist="AC-7, CM-6" disa="1452" />
>   </Rule>
>
>   </Group>

Ack

[PATCH 08/17] Mapped CCI-001453 to ssh group

[Willy Santos]

CCI-001453 requires the use of cryptograpy to protect the integrity of remote access sessions. The use of SSH for remote access sessions meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/ssh.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/ssh.xml b/rhel6/src/input/services/ssh.xml
index 40e7762..0fd4585 100644
--- a/rhel6/src/input/services/ssh.xml
+++ b/rhel6/src/input/services/ssh.xml
@@ -8,6 +8,7 @@ implementation included with the system is called OpenSSH, and more
 detailed documentation is available from its website,
 http://www.openssh.org. Its server program is called <tt>sshd</tt> and
 provided by the RPM package <tt>openssh-server</tt>.</description>
+<ref disa="1453" />

<Value id="sshd_idle_timeout_value" type="number"
 operator="equals" interactive="0">

[PATCH 08/17] Mapped CCI-001453 to ssh group

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001453 requires the use of cryptograpy to protect the integrity of remote access sessions. The use of SSH for remote access sessions meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/ssh.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/ssh.xml b/rhel6/src/input/services/ssh.xml
> index 40e7762..0fd4585 100644
> --- a/rhel6/src/input/services/ssh.xml
> +++ b/rhel6/src/input/services/ssh.xml
> @@ -8,6 +8,7 @@ implementation included with the system is called OpenSSH, and more
>   detailed documentation is available from its website,
>   http://www.openssh.org. Its server program is called<tt>sshd</tt>  and
>   provided by the RPM package<tt>openssh-server</tt>.</description>
> +<ref disa="1453" />
>
> <Value id="sshd_idle_timeout_value" type="number"
>   operator="equals" interactive="0">

Ack.

If we want to pile on to the "don't use telnet" campaign, you could map 
this to disable_telnet_service too.

[PATCH 09/17] Mapped CCI-001148 to network_ssl

[Willy Santos]

CCI-001148 requires the use of FIPS-validated and NSA-approved cryptography to implement digital signatures. network_ssl meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/network/ssl.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/network/ssl.xml b/rhel6/src/input/system/network/ssl.xml
index 3a91efe..eb68e11 100644
--- a/rhel6/src/input/system/network/ssl.xml
+++ b/rhel6/src/input/system/network/ssl.xml
@@ -34,7 +34,7 @@ can be appropriate. The major steps in this process are:
 <li>Enable client support by distributing the CA’s certificate</li>
 </ol>
 </description>
-<ref disa="1141" />
+<ref disa="1141,1148" />

<Rule id="network_ssl_create_ca">
 <title>Create a CA to Sign Certificates</title>

[PATCH 09/17] Mapped CCI-001148 to network_ssl

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001148 requires the use of FIPS-validated and NSA-approved cryptography to implement digital signatures. network_ssl meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/network/ssl.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/network/ssl.xml b/rhel6/src/input/system/network/ssl.xml
> index 3a91efe..eb68e11 100644
> --- a/rhel6/src/input/system/network/ssl.xml
> +++ b/rhel6/src/input/system/network/ssl.xml
> @@ -34,7 +34,7 @@ can be appropriate. The major steps in this process are:
>
>   <li>Enable client support by distributing the CA’s certificate</li>
>   </ol>
>   </description>
> -<ref disa="1141" />
> +<ref disa="1141,1148" />
>
>   <Rule id="network_ssl_create_ca">
>   <title>Create a CA to Sign Certificates</title>

Ack

[PATCH 10/17] Mapped CCI-001589 to auditd_configure_rules

[Willy Santos]

CCI-001589 requires the tracking of unauthorized, security-relevant configuration changes. auditd provides the mechanism for the tracking of such events.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/auditing.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 5b0ceb4..c79471f 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -133,7 +133,7 @@ After reviewing all the rules, reading the following sections, and
 editing as needed, activate the new rules:
 <pre># service auditd restart</pre>
 </description>
-<ref disa="171,172,1115,1454,1487,1571" />
+<ref disa="171,172,1115,1454,1487,1571,1589" />

<Rule id="audit_time_rules">
 <title>Records Events that Modify Date and Time Information</title>

[PATCH 10/17] Mapped CCI-001589 to auditd_configure_rules

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001589 requires the tracking of unauthorized, security-relevant configuration changes. auditd provides the mechanism for the tracking of such events.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/auditing.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
> index 5b0ceb4..c79471f 100644
> --- a/rhel6/src/input/system/auditing.xml
> +++ b/rhel6/src/input/system/auditing.xml
> @@ -133,7 +133,7 @@ After reviewing all the rules, reading the following sections, and
>   editing as needed, activate the new rules:
>
>   <pre># service auditd restart</pre>
>
>   </description>
> -<ref disa="171,172,1115,1454,1487,1571" />
> +<ref disa="171,172,1115,1454,1487,1571,1589" />
>
>   <Rule id="audit_time_rules">
>   <title>Records Events that Modify Date and Time Information</title>

Ack

[PATCH 11/17] Mapped CCI-001619 to password_require_specials

[Willy Santos]

CCI-001619 requires enforcing password complexity by using special characters, this is met by password_require_specials.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/pam.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index 6708cb5..dc12aad 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -211,7 +211,7 @@ more difficult by ensuring a larger search space.
 </rationale>
 <ident cce="14122-6" />
 <oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
-<ref nist="IA-5" />
+<ref nist="IA-5" disa="1619" />
 </Rule>

<Rule id="password_require_lowercases">

[PATCH 11/17] Mapped CCI-001619 to password_require_specials

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001619 requires enforcing password complexity by using special characters, this is met by password_require_specials.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/pam.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
> index 6708cb5..dc12aad 100644
> --- a/rhel6/src/input/system/accounts/pam.xml
> +++ b/rhel6/src/input/system/accounts/pam.xml
> @@ -211,7 +211,7 @@ more difficult by ensuring a larger search space.
>
>   </rationale>
>   <ident cce="14122-6" />
>   <oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
> -<ref nist="IA-5" />
> +<ref nist="IA-5" disa="1619" />
>   </Rule>
>
>   <Rule id="password_require_lowercases">

Ack

[PATCH 12/17] Mapped CCI-001297 to aide_periodic_cron_checking

[Willy Santos]

CCI-001297 requires teh detection of unauthorized changes to software and information, aide_periodic_cron_checking meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/software/integrity.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml
index 902ad8f..5fd76c2 100644
--- a/rhel6/src/input/system/software/integrity.xml
+++ b/rhel6/src/input/system/software/integrity.xml
@@ -92,7 +92,7 @@ AIDE can be executed periodically through other means; this is merely one exampl
 By default, AIDE does not install itself for periodic execution. Periodically
 running AIDE may reveal unexpected changes in installed files.
 </rationale>
-<ref nist="CM-6, SC-28, SI-7" disa="416"/>
+<ref nist="CM-6, SC-28, SI-7" disa="416,1297"/>
 </Rule>

<Rule id="aide_verify_integrity_manually">

[PATCH 12/17] Mapped CCI-001297 to aide_periodic_cron_checking

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001297 requires teh detection of unauthorized changes to software and information, aide_periodic_cron_checking meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/software/integrity.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml
> index 902ad8f..5fd76c2 100644
> --- a/rhel6/src/input/system/software/integrity.xml
> +++ b/rhel6/src/input/system/software/integrity.xml
> @@ -92,7 +92,7 @@ AIDE can be executed periodically through other means; this is merely one exampl
>   By default, AIDE does not install itself for periodic execution. Periodically
>   running AIDE may reveal unexpected changes in installed files.
>
>   </rationale>
> -<ref nist="CM-6, SC-28, SI-7" disa="416"/>
> +<ref nist="CM-6, SC-28, SI-7" disa="416,1297"/>
>   </Rule>
>
>   <Rule id="aide_verify_integrity_manually">

Nack

Associating this with only aide_periodic_cron_checking could lead one to 
believe they only have to install aide and throw it into a cron job, 
versus stepping through the other rules in the section. I'd rather see 
this associated with the overall aide group vs a specific rule.

[PATCH 12/17] Mapped CCI-001297 to aide_periodic_cron_checking

[Willy Santos]

On 05/01/2012 08:29 PM, Shawn Wells wrote:
> On 5/1/12 7:18 PM, Willy Santos wrote:
> > CCI-001297 requires teh detection of unauthorized changes to software 
> > and information, aide_periodic_cron_checking meets this requirement.
> > Signed-off-by: Willy Santos
> >
> > rhel6/src/input/system/software/integrity.xml |    2 +-
> >   1 files changed, 1 insertions(+), 1 deletions(-)
> >
> > diff --git a/rhel6/src/input/system/software/integrity.xml 
> > b/rhel6/src/input/system/software/integrity.xml
> > index 902ad8f..5fd76c2 100644
> > --- a/rhel6/src/input/system/software/integrity.xml
> > +++ b/rhel6/src/input/system/software/integrity.xml
> > @@ -92,7 +92,7 @@ AIDE can be executed periodically through other 
> > means; this is merely one exampl
> >   By default, AIDE does not install itself for periodic execution. 
> > Periodically
> >   running AIDE may reveal unexpected changes in installed files.
> >
> > </rationale>
> > -<ref nist="CM-6, SC-28, SI-7" disa="416"/>
> > +<ref nist="CM-6, SC-28, SI-7" disa="416,1297"/>
> > </Rule>
> >
> > <Rule id="aide_verify_integrity_manually">
>
> Nack
>
> Associating this with only aide_periodic_cron_checking could lead one 
> to believe they only have to install aide and throw it into a cron 
> job, versus stepping through the other rules in the section. I'd 
> rather see this associated with the overall aide group vs a specific 
> rule.

Agreed. Was debating the placement myself. I'll make the change and 
submit new patch.
> scap-security-guide mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/scap-security-guide

[PATCH 13/17] Mapped CCI-000044 to deny_password_attempts

[Willy Santos]

CCI-000044 requires enforcing a limit of consecutive invalid access attempts by user, deny_password_attempts meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/pam.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index dc12aad..6b8ce8a 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -304,7 +304,7 @@ prevents direct password guessing attacks.
 </rationale>
 <ident cce="3410-8" />
 <oval id="accounts_passwords_pam_faillock_deny" />
-<ref nist="AC-7, CM-6" disa="1452" />
+<ref nist="AC-7, CM-6" disa="1452,44" />
 </Rule>

</Group>

[PATCH 13/17] Mapped CCI-000044 to deny_password_attempts

[Shawn Wells]

On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-000044 requires enforcing a limit of consecutive invalid access attempts by user, deny_password_attempts meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/pam.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
> index dc12aad..6b8ce8a 100644
> --- a/rhel6/src/input/system/accounts/pam.xml
> +++ b/rhel6/src/input/system/accounts/pam.xml
> @@ -304,7 +304,7 @@ prevents direct password guessing attacks.
>
>   </rationale>
>   <ident cce="3410-8" />
>   <oval id="accounts_passwords_pam_faillock_deny" />
> -<ref nist="AC-7, CM-6" disa="1452" />
> +<ref nist="AC-7, CM-6" disa="1452,44" />
>   </Rule>
>
>   </Group>

Ack

[PATCH 14/17] Mapped CCI-000047 to deny_password_attempts

[Willy Santos]

CCI-000047 requires an account to be locked out when maximum number of unsuccessfull attempts is exceeded, deny_password_attempts meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/pam.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
index 6b8ce8a..78b6d7b 100644
--- a/rhel6/src/input/system/accounts/pam.xml
+++ b/rhel6/src/input/system/accounts/pam.xml
@@ -304,7 +304,7 @@ prevents direct password guessing attacks.
 </rationale>
 <ident cce="3410-8" />
 <oval id="accounts_passwords_pam_faillock_deny" />
-<ref nist="AC-7, CM-6" disa="1452,44" />
+<ref nist="AC-7, CM-6" disa="1452,44,47" />
 </Rule>

</Group>

[PATCH 14/17] Mapped CCI-000047 to deny_password_attempts

[Shawn Wells]

On 5/1/12 7:19 PM, Willy Santos wrote:
> CCI-000047 requires an account to be locked out when maximum number of unsuccessfull attempts is exceeded, deny_password_attempts meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/pam.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml
> index 6b8ce8a..78b6d7b 100644
> --- a/rhel6/src/input/system/accounts/pam.xml
> +++ b/rhel6/src/input/system/accounts/pam.xml
> @@ -304,7 +304,7 @@ prevents direct password guessing attacks.
>
>   </rationale>
>   <ident cce="3410-8" />
>   <oval id="accounts_passwords_pam_faillock_deny" />
> -<ref nist="AC-7, CM-6" disa="1452,44" />
> +<ref nist="AC-7, CM-6" disa="1452,44,47" />
>   </Rule>
>
>   </Group>

Ack

[PATCH 15/17] Mapped CCI-000048 to set_system_login_banner

[Willy Santos]

CCI-000048 requires the display of the approved system use banner before granting access to the system, set_system_login_banner meets this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/banners.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml
index 488a9ac..20caeb8 100644
--- a/rhel6/src/input/system/accounts/banners.xml
+++ b/rhel6/src/input/system/accounts/banners.xml
@@ -49,7 +49,7 @@ reinforces policy awareness during the logon process.
 </rationale>
 <ident cce="4060-0" />
 <oval id="banner_etc_issue" value="login_banner_text"/>
-<ref nist="AC-3, CM-6, AC-8" />
+<ref nist="AC-3, CM-6, AC-8" disa="48" />
 </Rule>

<Group id="gui_login_banner">

[PATCH 15/17] Mapped CCI-000048 to set_system_login_banner

[Shawn Wells]

On 5/1/12 7:19 PM, Willy Santos wrote:
> CCI-000048 requires the display of the approved system use banner before granting access to the system, set_system_login_banner meets this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/banners.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml
> index 488a9ac..20caeb8 100644
> --- a/rhel6/src/input/system/accounts/banners.xml
> +++ b/rhel6/src/input/system/accounts/banners.xml
> @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process.
>
>   </rationale>
>   <ident cce="4060-0" />
>   <oval id="banner_etc_issue" value="login_banner_text"/>
> -<ref nist="AC-3, CM-6, AC-8" />
> +<ref nist="AC-3, CM-6, AC-8" disa="48" />
>   </Rule>
>
>   <Group id="gui_login_banner">

Ack

[PATCH 16/17] Mapped CCI-000048 to enable_gdm_login_banner and set_gdm_login_banner_text

[Willy Santos]

CCI-000048 requires the display of the approved system use banner before granting access to the system, enable_gdm_login_banner and set_gdm_login_banner meet this requirement for graphical login.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/system/accounts/banners.xml |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml
index 20caeb8..85b511e 100644
--- a/rhel6/src/input/system/accounts/banners.xml
+++ b/rhel6/src/input/system/accounts/banners.xml
@@ -79,7 +79,7 @@ reinforces policy awareness during the logon process.
 </rationale>
 <ident cce="4188-9" />
 <oval id="banner_gui_enabled" />
-<ref nist="AC-3, CM-6, AC-8" />
+<ref nist="AC-3, CM-6, AC-8" disa="48" />
 </Rule>

<Rule id="set_gdm_login_banner_text">
@@ -102,7 +102,7 @@ reinforces policy awareness during the logon process.
 </rationale>
 <ident cce="4188-9" />
 <oval id="banner_gui_text_set" value="login_banner_text" />
-<ref nist="AC-3, CM-6, AC-8" />
+<ref nist="AC-3, CM-6, AC-8" disa="48" />
 </Rule>

</Group>

[PATCH 16/17] Mapped CCI-000048 to enable_gdm_login_banner and set_gdm_login_banner_text

[Shawn Wells]

On 5/1/12 7:19 PM, Willy Santos wrote:
> CCI-000048 requires the display of the approved system use banner before granting access to the system, enable_gdm_login_banner and set_gdm_login_banner meet this requirement for graphical login.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/system/accounts/banners.xml |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml
> index 20caeb8..85b511e 100644
> --- a/rhel6/src/input/system/accounts/banners.xml
> +++ b/rhel6/src/input/system/accounts/banners.xml
> @@ -79,7 +79,7 @@ reinforces policy awareness during the logon process.
>
>   </rationale>
>   <ident cce="4188-9" />
>   <oval id="banner_gui_enabled" />
> -<ref nist="AC-3, CM-6, AC-8" />
> +<ref nist="AC-3, CM-6, AC-8" disa="48" />
>   </Rule>
>
>   <Rule id="set_gdm_login_banner_text">
> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process.
>   </rationale>
>   <ident cce="4188-9" />
>   <oval id="banner_gui_text_set" value="login_banner_text" />
> -<ref nist="AC-3, CM-6, AC-8" />
> +<ref nist="AC-3, CM-6, AC-8" disa="48" />
>   </Rule>
>
>   </Group>

Ack

Good call mapping to both this and the system banner btw

[PATCH 17/17] Mapped CCI-000160 to enable_ntpd and ntpd_specify_remote_server

[Willy Santos]

CCI-000160 requires the OS to synchronize system clocks with organization-defined authoritative time source, enable_ntpd and ntpd_specify_remote_server meet this requirement.

Signed-off-by: Willy Santos 
---
 rhel6/src/input/services/ntp.xml |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/ntp.xml b/rhel6/src/input/services/ntp.xml
index 5034882..b1390ed 100644
--- a/rhel6/src/input/services/ntp.xml
+++ b/rhel6/src/input/services/ntp.xml
@@ -40,6 +40,7 @@ The NTP server configuration file is located at <tt>/etc/ntp.conf</tt>.</descrip
 <Group id="enabling_ntpd">
 <title>Enable the NTP Daemon</title>
 <description>If this machine is an NTP server, ensure that <tt>ntpd</tt> is enabled at boot time.</description>
+
 <Rule id="enable_ntpd">
 <title>Enable the NTP Daemon</title>
 <description>The <tt>ntpd</tt> service should be enabled.
@@ -50,8 +51,10 @@ Enabling the <tt>ntpd</tt> service ensures that the local system time will be th
 </rationale>
 <ident cce="4376-0" />
 <oval id="service_ntpd_enabled" />
+<ref disa="160" />
 </Rule>
 </Group>
+
 <Group id="configuring_ntpd_client">
 <title>Specify a Remote NTP Server for Time Data</title>
 <description>Find the IP address of an appropriate remote NTP server and configure <tt>ntpd</tt> to use it to obtain accurate time data. If your site does not require time data to be accurate, but merely to be synchronized among local machines, this step can be omitted, and the NTP server will default to providing time data from the local clock. However, it is a good idea to periodically synchronize the clock to some source of accurate time, even if it is not appropriate to do so automatically.</description>
@@ -69,6 +72,7 @@ Synchonizing <tt>ntpd</tt> with an accurate clock makes it easier to collate sys
 </rationale>
 <ident cce="4385-1" />
 <oval id="ntp_remote_server" />
+<ref disa="160" />
 </Rule>
 </Group>
 </Group>

[PATCH 17/17] Mapped CCI-000160 to enable_ntpd and ntpd_specify_remote_server

[Shawn Wells]

On 5/1/12 7:19 PM, Willy Santos wrote:
> CCI-000160 requires the OS to synchronize system clocks with organization-defined authoritative time source, enable_ntpd and ntpd_specify_remote_server meet this requirement.
> Signed-off-by: Willy Santos
>
> rhel6/src/input/services/ntp.xml |    4 ++++
>   1 files changed, 4 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/ntp.xml b/rhel6/src/input/services/ntp.xml
> index 5034882..b1390ed 100644
> --- a/rhel6/src/input/services/ntp.xml
> +++ b/rhel6/src/input/services/ntp.xml
> @@ -40,6 +40,7 @@ The NTP server configuration file is located at<tt>/etc/ntp.conf</tt>.</descrip
>
>   <Group id="enabling_ntpd">
>   <title>Enable the NTP Daemon</title>
>   <description>If this machine is an NTP server, ensure that<tt>ntpd</tt>  is enabled at boot time.</description>
> +
>   <Rule id="enable_ntpd">
>   <title>Enable the NTP Daemon</title>
>   <description>The<tt>ntpd</tt>  service should be enabled.
> @@ -50,8 +51,10 @@ Enabling the<tt>ntpd</tt>  service ensures that the local system time will be th
>   </rationale>
>   <ident cce="4376-0" />
>   <oval id="service_ntpd_enabled" />
> +<ref disa="160" />
>   </Rule>
>   </Group>
> +
>   <Group id="configuring_ntpd_client">
>   <title>Specify a Remote NTP Server for Time Data</title>
>   <description>Find the IP address of an appropriate remote NTP server and configure<tt>ntpd</tt>  to use it to obtain accurate time data. If your site does not require time data to be accurate, but merely to be synchronized among local machines, this step can be omitted, and the NTP server will default to providing time data from the local clock. However, it is a good idea to periodically synchronize the clock to some source of accurate time, even if it is not appropriate to do so automatically.</description>
> @@ -69,6 +72,7 @@ Synchonizing<tt>ntpd</tt>  with an accurate clock makes it easier to collate sys
>   </rationale>
>   <ident cce="4385-1" />
>   <oval id="ntp_remote_server" />
> +<ref disa="160" />
>   </Rule>
>   </Group>
>   </Group>

Ack