scap-security-guide August 2012

scap-security-guide@lists.fedorahosted.org

18 participants
49 discussions

[PATCH] quick patch to show some new transition notes for RHEL5 to RHEL6
by Jeffrey Blank 10 Aug '12

10 Aug '12

Jeffrey Blank (1): minor additions to transition notes file RHEL6/input/auxiliary/transition_notes.xml | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-)

2 2

Aqueduct IRC Channel
by Vincent Passaro 10 Aug '12

10 Aug '12

Jeff, For the helping out, we can use the Aqueduct channel for coordinating who's working on what. IRC: #aqueduct on freenode.net Vince = tummy Lee Kinser = [~syn] R/ Vincent C. Passaro CISSP, L|PT, E|CSA, C|EH, CEPT, CPT, LPIC-3 (Core/Security), RHCSA, Novell CLA, MCP, Security+, A+ CELL: 760-846-1812 Office: 888-75-FOTIS Fax: 617-454-1121 vincent.passaro(a)fotisnetworks.com<mailto:vincent.passaro@fotisnetworks.com> www.fotisnetworks.com<http://www.fotisnetworks.com>

1 0

People page updated
by Shawn Wells 10 Aug '12

10 Aug '12

for those tracking/watching the changes, I've just refreshed my people page (which updates the content linked from the wiki). The new updates contain the following change sets: $ git pull remote: Counting objects: 97, done. remote: Compressing objects: 100% (79/79), done. remote: Total 79 (delta 62), reused 0 (delta 0) Unpacking objects: 100% (79/79), done. From ssh://git.fedorahosted.org/git/scap-security-guide 2de2cf5..c0cab13 master -> origin/master Updating 2de2cf5..c0cab13 Fast-forward RHEL6/input/auxiliary/srg_support.xml | 6 +- .../accounts_passwords_pam_faillock_deny.xml | 50 ++++++++ .../checks/securetty_root_login_console_only.xml | 2 +- RHEL6/input/profiles/STIG-server.xml | 2 + RHEL6/input/system/accounts/banners.xml | 3 +- RHEL6/input/system/accounts/pam.xml | 25 +++- RHEL6/input/system/permissions/execution.xml | 134 ++++++++++---------- RHEL6/input/system/permissions/files.xml | 4 +- RHEL6/input/system/software/integrity.xml | 29 +++++ 9 files changed, 173 insertions(+), 82 deletions(-) create mode 100644 RHEL6/input/checks/accounts_passwords_pam_faillock_deny.xml

1 0

[PATCH] prose cleanup for execution.xml's XCCDF
by Jeffrey Blank 09 Aug '12

09 Aug '12

Looking for volunteer to deal with ticket 103 (and to inspect other OVAL associated with XCCDF in execution.xml). Jeffrey Blank (1): prose cleanup for execshield, daemon umask, core dumps * note that a ticket was also issued for the OVAL, which had problems RHEL6/input/system/permissions/execution.xml | 134 +++++++++++++------------- 1 files changed, 66 insertions(+), 68 deletions(-)

2 2

disa-stig-rhel5-v1r0.6-xccdf-manual.xml
by Willem Bos 08 Aug '12

08 Aug '12

Hi All, The GIT repo contains the file RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml. This is not part of the zipfile you can download from http://web.nvd.nist.gov/view/ncp/repository/checklist/download?id=1059. I could not find a Makefile target that creates it. What is its origin? Regards, Willem.

6 11

[PATCH] minor bugfix -- no acknowledgement required.
by Jeffrey Blank 07 Aug '12

07 Aug '12

Jeffrey Blank (1): minor bugfix: removed CCIs incorrectly/additionally tagged as unmet RHEL6/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

2 2

[PATCH] Fixed root virtual console logins check.
by Mike Palmiotto 07 Aug '12

07 Aug '12

Shouldn't we be doing a "none_exist" check on this one? Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com> --- .../checks/securetty_root_login_console_only.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/checks/securetty_root_login_console_only.xml b/RHEL6/input/checks/securetty_root_login_console_only.xml index c3472e6..1bb1de3 100644 --- a/RHEL6/input/checks/securetty_root_login_console_only.xml +++ b/RHEL6/input/checks/securetty_root_login_console_only.xml @@ -15,7 +15,7 @@ </criteria> </definition> - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="virtual consoles /etc/securetty" id="test_virtual_consoles_etc_securetty" version="1"> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="test_virtual_consoles_etc_securetty" version="1"> <ind:object object_ref="object_virtual_consoles_etc_securetty" /> </ind:textfilecontent54_test> -- 1.7.1

2 2

[PATCH 0/3] More updates based on DISA FSO feedback
by Willy Santos 07 Aug '12

07 Aug '12

Updates based on DISA FSO feedback for STIG profile. Willy Santos (3): Added value selector for dod_short and commented value selector for any_text; as reference in trac ticket #95 Mapped CCI-224 to no_files_unowned_by_user and no_files_unowned_by_group. Created group and added prose for use of antivirus. RHEL6/input/auxiliary/srg_support.xml | 4 ++-- RHEL6/input/system/accounts/banners.xml | 3 ++- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/input/system/software/integrity.xml | 14 ++++++++++++++ 4 files changed, 20 insertions(+), 5 deletions(-) -- 1.7.7.6

2 8

Content and profile management with SecState
by Spencer R. Shimko 02 Aug '12

02 Aug '12

Hi, I wanted show off some of the features that are unique to SecState and are very relevant to this project. All of you are likely familiar with oscap. This tool is great if your use case includes interpreting entire sets of content described in a profile. However, if you want to tweak a profile you must adjust the XML by hand. SecState is capable of content management. You can cherry pick elements relevant to your environment. What follows is an example of using SecState for the purpose. First you import a profile (thanks to SSG for the content!): # secstate import /usr/local/scap-security-guide/RHEL6/output/rhel6-xccdf-scap-security-guide.xml Next you disable content you don't want to interpret. This is great when you want to enter a continuous monitoring mode and you want to trim down the result sets. # secstate select -r RHEL-6 intro Then you run the audit: # secstate audit Remediate the findings (thanks to Aqueduct for the content!). # secstate remediate -y I would recommend re-running the audit to ensure the findings are fixed: # secstate audit The reports it generates can be seen here: http://oss.tresys.com/spencer/audit-localhost.localdomain-Sun-July-15-23_03… I've uploaded some packages from CLIP here and created a yum repo: http://oss.tresys.com/files/clip/secstate-ssg-aqueduct-alpha/ My rationale for this email is that I need others, particularly those developing SCAP content, to use and advocate the use of this tool. It provides a great feature set not available in other tools. Thanks, --Spencer

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2012