OS SRG mappings -- items differing
by Jeffrey Blank
Below is a list of items initially tagged in the OS SRG mapping, but
which may have additional considerations.
This email thread is to allow for further discussion on how these
requirements could be met and to drive adjustments to the OS SRG mapping.
CCI-000040: In addition to auditing use of all identified setuid
programs, would it be possible also to audit all processes with system
UIDs started by interactive UIDs? Something along the lines of
-a always,exit -F auid>=500 -F auid!=4294967295 -F uid<500
CCI-000040: It is also a good idea to audit use of the sudo(8) command.
CCI-000048: Do not forget FTP and SSH login banners.
CCI-000054: Do not forget the MaxSessions configuration in sshd_config(5).
CCI-000056: Is there a setting for the gconftool-2 command to set
mandatory screen locking enforcement?
CCI-000057: This is the same as CCI-000056 with mandatory screensaver
timeout enforcement.
CCI-000060: When this check was coded for RHEL5 in OVAL, we limited the
screensaver options to appropriate values among those included with the RPM.
CCI-000067: Ensure logging of all FTP and SSH sessions, as well.
CCI-000068: Disable and remove rcmd, rsh, and rlogind services.
CCI-000068: Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.
CCI-000085: Disable all firewire and Bluetooth facilities and remove
them from the system.
CCI-000086: Disable all firewire and Bluetooth facilities and remove
them from the system.
CCI-000130: Enable FTP daemon logging.
CCI-000130, et seq.: Unless there is no way to configure auditd such
that it will not capture the required information, the product does not
meet the requirement by design.
CCI-000134: Enable xinetd(8) logging.
CCI-000135, et seq.: Can illustrative examples be provided?
CCI-000136: The system must use a remote logging host for audit data.
CCI-000160: At least two NTP servers must be configured.
CCI-000160: Unless the system is an NTP server for the local enclave,
all its NTP servers must be in the local enclave.
CCI-000166: Please provide an example.
CCI-000171: How can "designated organizational personnel" be identified
as such under RHEL6?
CCI-000185: Are DoD certificates signed by "established CAs"?
CCI-000187: How are PKI-authenticated identities mapped to user accounts?
CCI-000196: Disabling telnet is covered in CCI-000196.
CCI-000196: Password hashes must be generated using FIPS 140-2 approved
algorithms.
CCI-000196: There must be no .netrc files on the system.
CCI-000196: There must be no passwords stored in the ldap.conf
configuration file.
CCI-000200: The pam_unix.so module has the "remember=n" option to
retain n generations of user passwords.
CCI-000205: The system must use password hashes that are computed using
the entire password provided by the end-user.
CCI-000347: Please provide examples.
CCI-000370, et seq.: I identified these as not applicable, but a
third-party application may satisfy these requirements (NA-DEP).
CCI-000374: The system must utilize a file-integrity tool.
CCI-000382: The SCTP, DCCP, UDP-Lite, IPX, AppleTalk, DECnet, RDS, and
TIPC protocols must be disabled unless required.
CCI-000416: Can AIDE track the addition of devices to the system
without blowing up after system reboots?
CCI-000764: The system must not have special privilege accounts, such
as shutdown and halt.
CCI-000764: The Linux NFS Server must not have the insecure file
locking option.
CCI-000764: All accounts on the system must have unique user or account
names.
CCI-000764: All accounts must be assigned unique User Identification
Numbers (UIDs).
CCI-000765, et seq.: If there is a canonical method for enabling PKI
under RHEL6, please provide it.
CCI-000770: Direct logins must not be permitted to shared, default,
application, or utility accounts.
CCI-000770: The root account must not be used for direct log in.
CCI-000770: The system must prevent the root account from directly
logging in except from the system console.
CCI-000880: Please provide examples.
CCI-001084: Please provide examples.
CCI-001090: Please provide examples.
CCI-001154: The system must not have a public Instant Messaging (IM)
client installed.
CCI-001233: The system package management tool must not automatically
obtain updates.
CCI-001297: Please provide configuration examples.
CCI-001356: Please provide examples of an RHEL6-included log analysis
package checking for atypical use patterns.
CCI-001436: Disable rpcbind, X, UUCP, peer-to-peer applications, samba,
SWAT, and NIS/NIS+ over UDP, unless required.
CCI-001436: The SSH daemon and client must use only version 2 of the
SSH protocol.
CCI-001453: Enable SNMP encryption, preferably using FIPS 140-2
approved encryption algorithms.
CCI-001453: If the system is using LDAP for authentication or account
information, the system must use a TLS connection using FIPS 140-2
approved cryptographic algorithms.
CCI-001462: Does this requirement imply session replaying? I don't know.
CCI-001493, et seq.: The ownerships and permissions are ostensibly
correct at startup. Do they automatically correct themselves should
they be tampered with?
CCI-001589: Please provide configuration examples.
CCI-001632: This looks more like an out-of-band network management
requirement. Does RHEL6 support VLAN functionality that would separate
management traffic?
CCI-001674: Please explain how RHEL6 would implement the
organization-defined responses and alternative actions?
11 years, 9 months
OS SRG mappings -- items unclear/impractical
by Jeffrey Blank
Below is a list of items initially tagged as impractical, out of scope,
or unclear in the OS SRG mapping, along with suggestions/questions on
how to meet the requirements.
This email thread is to allow for further discussion on how these
requirements could be met, or provide documentation as such.
CCI-000024: BIOS settings, such as enabling hardware virtualization
and setting the BIOS password, are examples of security-relevant
information.
CCI-000037: Can RHEL6 mimic Solaris RBAC functionality via SELinux?
CCI-000066: Wouldn't an appropriate IPtables configuration satisfy
this requirement?
CCI-000213: The system must require authentication upon booting into
single-user and maintenance modes.
CCI-000213: System BIOS or system controllers supporting password
protection must have administrator accounts/passwords configured, and
no others.
CCI-000213: The system boot loader must require authentication
against hashes computed with FIPS 140-2 approved algorithms.
CCI-000224: All files and directories must have a valid owner and
group. (Borrowed from CCI-000366)
CCI-000535, et seq.: Does RHEL6 include any backup software, or is
this NA-DEP?
CCI-000553: All file systems must employ transaction-based file
systems.
CCI-001111: The operating system must not terminate virtual private
network (VPN) client sessions, unless it is documented as a VPN
concentrator.
CCI-001112: Can RHEL6 force proxy settings on mail and web traffic?
CCI-001126: Can RHEL6 iptables be set to default to "deny all" when
the iptables service is stopped? It looks like changing "set_policy
ACCEPT" to "set_policy DROP" in /etc/init.d/iptables might do the
trick, but that's profoundly evil.
CCI-001169, et seq.: NA, dependent upon application (browser, etc.)
requiring DoD-signed content.
CCI-001239: NA-DEP
CCI-001291: NA-DEP
CCI-001352: Get these audit records to a remote log server ASAP?
CCI-001372, et seq.: NA-DEP
CCI-001401: Regarding the "binding of organization-defined security
attributes to information in transmission", might a combination of
non-squashed UID mapping with tight controls on which remote systems
are allowed non-squashed NFS access cover this requirement?
CCI-001414: Use IPtables?
CCI-001555, et seq.: NA-DEP
CCI-001668: The system must use and update a DoD-approved virus scan
program.
CCI-001682: NA-DEP
CCI-001695: NA-DEP
11 years, 9 months
