SSG v0.1-10 Bugs/Notes - scap-security-guide - Fedora mailing-lists

8 Mar 2013


      I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have found some bugs/notes.  Each of the following seems to be an issue with the OVAL content/test.
*   Ensure All Files Are Owned by a User
     *   This reports PASS for me, but is a false positive.  Running 'find / -xdev -nouser -print' reveals files that have a user owner that is not local to the system.
*   Ensure All Files Are Owned by a Group
     *   This reports PASS for me, but is a false positive.  Running 'find / -xdev -nogroup -print' reveals files that have a group that is not local to the system.
*   Set Daemon Umask
     *   The test states it is looking for a umask of 022 or 027.  In my /etc/init.d/functions, the umask is 022, but the test reports FAIL.  This is a false positive.
*   Set GNOME Login Inactivity Timeout
  *   GNOME Desktop Screensaver Mandatory Use
  *   Enable Screen Lock Activation After Idle Period
  *   Implement Blank Screen Saver
  *   Enable GUI Warning Banner Text
     *   Each of these tests assume that the execution is on an X system.  My system does not have X installed or running, so the tests report FAIL.  The test should first check if it is applicable to the test system and if not report NOT APPLICABLE or something similar versus FAIL.
*   Modify the System Login Banner
     *   This test appears to check for exactly the DoD banner text.  Since the verbage states "a message compliant with the local site policy", suggest modifying the test to check for the presence of content in /etc/issue, but perhaps not an exact match, as not all deployments may be DoD systems.
*   Ensure Host Logs Sent to Remote Host
     *   For TCP, this checks for the following in the rsyslog file:
*.* @@loghost.example.com
*   Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in general they are?  In my configuration, I have *.info versus the *.* and the test reports FAIL.  I would like to understand the intent on this one so I can comply.
     *   Additionally, my filter portion excludes some logs marked via other ways (read in from files) with the string "*.info;local0.none   @@dest-ip" and I want to make sure that even if my string needs to be modified to "*.*;local0.none   @@dest-ip" to comply that the test will pass.  i.e. that the test is robust enough to understand the negation in the rsyslog configuration and report the correct assessment value.
*   Configure auditd space_left Action on Low Disk Space
  *   Configure auditd admin_space_left Action on Low Disk Space
     *   For both of these, the contents of /etc/audit/auditd.conf contain the correct key with a case-insensitive value (all caps value of one of the possible values) and the test reports FAIL.  THis is a false negative.  Suggest making the test case-insensitive in the value match portion.
*   Disable Network Console (netconsole)
  *   Disable Network Router Discovery Daemon (rdisc)
     *   For both of these, the service is not active/installed, but the test reports FAIL.  This is a false negative.
*   Disable SSH Support for .rhosts Files
  *   Disable Host-Based Authentication
  *   Disable SSH Root Login
     *   For all of these, the required value is present in its entirety, but is preceeded by the comment character, making it inactive.  The test reports PASS, which is a false positive.
     *   Additionally, for the SSH Root Login test, the commented value is incorrect and the test reports PASS.
In addition to these bugs, I found that the following items did not have any check content ref specified in the XCCDF, thus reported NOTCHECKED.  I realize some of the check cannot be performed automatically, but each of these can be, but is not.
*   Disable Ctrl-Alt-Del Reboot Activation
  *   Install the screen Package
  *   Set GUI Warning Banner Text
  *   Set Default IPTables Policy for Forwarded Packets
  *   Disable ntpdate Service (ntpdate)
  *   Ensure Insecure File Locking is Not Allowed
  *   Verify No netrc Files Exist
  *   Ensure All Accounts on the System Have Unique Names
  *   Set Password to Maximum of Three Consecutive Repeating Characters
  *   Set Password Hashing Algorithm in /etc/pam.d/system-auth
  *   Set Password Hashing Algorithm in /etc/login.defs
  *   Set Password Hashing Algorithm in /etc/libuser.conf
*   Verify that Shared Library Files Have Restrictive Permissions
  *   Verify that Shared Library Files Have Root Ownership
  *   Verify that System Executables Have Restrictive Permissions
  *   Verify that System Executables Have Root Ownership
  *   Ensure No World-Writable Files Exist
     *   Each of the 5 above can be tested using one of:
        *   `find $dir -xdev -perm /o=w ! ( -type d -perm /o=t ) ! -type l -print`
        *   `find $dir -xdev ! -user root ! -type d ! -type l -print`
*   Limit the Number of Concurrent Login Sessions Allowed Per User
     *   For this one, perhaps check that the key is present, as the value is up to the system owner.
*   Uninstall Sendmail Package
     *   Additionally, suggest naming this "Ensure sendmail not installed" or something of that flavor more indicative of what the test is checking for, versus an action.
*   Enable Logging of All FTP Transactions
  *   Create Warning Banners for All FTP Users
  *   Configure SNMP Service to Use Only SNMPv3 or Newer
  *   Ensure Default Password Is Not Used
     *   For the previous 4, the test must first check applicability (much like the GNOME tests), as my system does not have/support FTP or SNMP and should not have FAIL reported.
And the last item--each of the following reports UNKNOWN as the check-content-ref element in the XCCDF references a non-existent id in the OVAL.
*   Ensure Log Files Are Owned By Appropriate Group
  *   Ensure System Log Files Have Correct Permissions
  *   Ensure Logrotate Runs Periodically
--Logan Rodrian