scap-security-guide October 2013

scap-security-guide@lists.fedorahosted.org

32 participants
82 discussions

[PATCH] [RHEL6] Apply spec file changes required by review request (RH BZ#1018905)
by Jan Lieskovsky 25 Oct '13

25 Oct '13

This patch projects fixes for objections raised within scap-security-guide RPM package review request (RH BZ#1018905) to RHEL6 content building functionality too, so we could package it into EPEL-6. More exactly: * remove BuildRoot (not needed already), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * remove coreutils from BuildRequires, filesystem from Requires (not needed), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * add xml-common to Requires (so /usr/share/xml/scap directory would be also owned by scap-security-guide RPM - see also below), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 * update %description to be more clear (some sentences were reported as to be harder to understand), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c9 https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c10 * replace $RPM_BUILD_ROOT with %{buildroot} in %install section (%{buildroot} is defined on RHEL6 as can be verified with: rpm --eval '%{buildroot}' command) https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * remove not necessary %install section bits (removing former RPM_BUILD_ROOT etc.) https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c1 * adjust adding of core content (replace $RPM_BUILD_ROOT, exactly list directories that will get copied - IOW copy just content/ and policytables/ ones. HTML guides from previous guide/ will be stored under scap-security-guide's %doc directory), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 * don't directly compress the manual page and rather let the build system to choose which compress algorithm to use (for case compression algorithm would change) https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * don't confine the manual page (not needed), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * remove the %clean section (not needed), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * remove defattr from %files section (was required only on rpm < 4.4), http://fedoraproject.org/wiki/Packaging:Guidelines#File_Permissions * modify %files path after %{_datadir} (replace /xml/scap/ssg with /xml/scap so /usr/share/xml/scap/ directory is also owned by scap-security-guide package, and removed too by package removal), https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 * add LICENSE into RHEL6 subdirectory, https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c4 * package LICENSE, RHEL6 and JBossEAP5 guide under scap-security-guide's RPM %doc directory. https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 Sanity && regression testing: - make tarball, make srpm, make rpm => PASS, - RHEL6's make, make validate, make validate-xml, make content, make guide, make dist, make eval-common, make checks, make tables => PASS, - oscap xccdf eval for generated XCCDF file: $ export SSG="/usr/share/xml/scap/ssg/content" $ oscap xccdf eval --profile common --cpe $SSG/ssg-rhel6-cpe-dictionary.xml \ --report /tmp/el6.html $SSG/ssg-rhel6-xccdf.xml => PASS, - HTML guides for both RHEL6 and JBossEAP are packaged too, and look reasonable in quick firefox preview. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 3

scap-security-guide v0.1-12 released
by Shawn Wells 24 Oct '13

24 Oct '13

On 2-MAY the SSG v0.1-11 update was released, reflecting the inclusion of DISA FSO feedback on the (then) Draft RHEL6 STIG and several OVAL improvements. It was a huge milestone, driving us over 1,800 unique code commits! We've since had an additional 88 commits, largely around OVAL content cleanup and the rewrite of combinefixes.py to handle parameters for OpenSCAP remediation generation (thanks, Jeff!). User feedback also prompted us to fix the build system when compiling on Fedora 18+ and the upcoming RHEL release. SSG v0.1-12 has been released to the EPEL repository to reflect these recent bugfixes and enhancements. Download instructions available on the wiki: https://fedorahosted.org/scap-security-guide/wiki/downloads CHANGELOG: > $ git log --oneline --after={2013-05-02} --no-merges > fe2a0b6 Some corrections to the PAM cracklib guidance as follows: > corrected pam_cracklib.so line to include all discussed parame > 532aeb8 Modified the DoD banner check to accept either a newline or > space between each word, as the RHEL5 version does. This al > ded2ef4 Created remediation template: create_services_disabled.py - > Based off OVAL services file > a96cdc3 Added sysctl remediation scripts - Updated template to reflect > proper naming of sysctl scripts > c3355eb Added bash templates directory, added sample sysctl script - > Makefile based off OVAL, same usage - CVS files point to > f75ad8d Module is freevxfs, not freevsfs > cd940ef Fix build of OpenStack and RHEVM3 parts on Fedora 18+ > df19413 Fix build on Fedora 18+ and the upcoming RHEL release > 2ddbbb7 Subexpression datatype shall equal to the variable datatype > 4cd7650 Ok, to fix the "error" doing an evaluation for the various > umask checks, changed the following variables referenced in t > 5fa190d changed a typo var_acocunts_umask_bashrc => > var_accounts_umask_bashrc > 7d772db Update from deprecated rpmverify_* to rpmverifyfile_* checks > 2026606 made xccdf-addfixes insert all text and child nodes of a fix > d6703f4 rewrite of combinefixes.py to handle parameters for OpenSCAP > remedation generation > c13fafa incomplete support file for bash remediations * does at least > warn when undefined variable exists > f87d817 example remediation script which takes a parameter > 24f2c2e Removing deprecated recurse="files" behavior > f078b8f Removing deprecated recurse=files behavior. > b12d669 Replacing deprecated <ind:environmentvariable_...> tags with > <ind:environmentvariable58_...> tags > 5ed6dc2 Created OVAL for ensure_gpgcheck_never_disabled XCCDF rule > called nonexisting OVAL, created it. > 0d69487 Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 295184c Adding check for no_netrc_files > e1aede3 Adding check for pam_lastlog.so > 9c21556 additional copy editing > 3fd9f3f copy editing > 9db6e3d Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 4109078 Adding check for no_netrc_files > 6f31c05 Adding check for pam_lastlog.so > 0e15e2d Adding check for disabling GNOME thumbnailers in gconf > d10f08e modified makefile to remove test attestation from prose guide > -- revised > 4f3ea5f corrections for typos in OVAL references > d50c71b removal of references to nonexistent OVAL for some NFS guidance > 980f686 refine verify-references to deal only with OVAL compliance > checks for OVAL > 6051ea6 removal of comments, reference to nonexistent OVAL > 8251580 removal or correction of misnamed or obsolete OVAL checks > 76e93ef removal of packages from check templates > 69f31e0 Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some m > c22ed9c Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some more f > c58ac2b Fixing indenting for external variable line. > 95d5a4b removal of unused OVAL checks > bcc1495 bugfixes for undisciplined renaming jaunt, missing OVAL references > 9a378b9 removal of unused OVAL checks > 3b82cf5 deletion of unused OVAL checks > 6a89088 removal of commented text, some redundant/unnecessary Rules > from Profiles > 9705192 deletion of unused/obsoleted OVAL checks (and commented out XCCDF) > 36a75ec deletion of unused OVAL checks > 48e9900 removal of unnecessary guidance from SSL section > 7682f9c removal of commented/obsolete text from logging section > a1f2d30 removal of commented text, invalid CCE from root logins guidance > 0a3577b update to NFS section (still perhaps incomplete) > 1a3d854 changed Dovecot Rule to Group as it is guidance and not a > compliance check > fb4a29b removal of commented/obsolete items for base services > 9a228d5 updates to the CCE verification script to be more informative > ff25fc9 cleanup of comments, unnecessary Rules in DNS (bind) service > 7a16cda Deleting duplicate check for disabling IPv6 > d9d1741 Minor typo, removing slash at end of description > 330258c added version info for RHEL, URL for project > f36ecf3 removed some now-obsolete advice from samba > 8d5ee52 added some clarifying text to the intro > 6c9f047 removing some unnecessary (for compliance-focus) text from cups > de705e9 Updated service_tftpd_disabled As reflected from update to > template file > 356405f Removed duplicate references to var_samba_private_directory > Updated OVAL to have unique IDs > 034b8b3 Removed duplicate references object_etc_skel_files Updated > OVAL to have unique names > d609d6b Removed duplicate var_ssh_config_directory references Updated > OVAL to have unique names > 8a7a3f3 Removed duplicate state_uid_root Updated OVAL to have unique names > e421d69 Modified template_OVAL_package_installed and > template_package_removed These files were causing build errors > regarding ob > 1ae4c30 Removed duplicate references to var_accounts_user_umask > Assigned unique identifiers > ea10f13 Removed duplicate references to object_lib_modules_files > Assigned unique identifiers > 882e341 Removed duplicate object_usr_lib64_files references Assigned > unique identifiers within OVAL > 9d89e61 Removed duplicate object_usr_lib64_dir references Assigned > unique identifiers in OVAL > 863aa19 Removed duplicate object_usr_lib_files references Assigned > unique identifiers to OVAL checks > 714c3c1 Removed duplicate object_usr_lib_dir Updated OVAL to have > unique names > dffd29b Removed duplicates of object_lib64_files Updated OVAL to have > unique names > bc6fbcd Removed duplicate object_lib64_dir Updated OVAL checks to have > unique names > fe089dc Removed duplicate object_lib_files Updated OVAL checks for > unique names > 7546f2e Removed duplicate object_lib_dir references Created unique > names in the OVAL templates > b376e27 Updated mount_option_* OVAL variable var_removable_partition > These OVAL files were using duplicate 'var_remove_partition > 7fae707 Updated template_permissions to place FILEID into strings > e31dc7b Updated state_gid_0 to reflect per check naming > 07380c0 Updated state_uid_0 names within OVAL Multiple OVAL checks > were using "state_uid_0" causing build errors. Updated so eve > f5b90ce Updated rpm_verify_hashes for OVAL 5.10 compliance The old > rpmverify_* is now depricated, updated check to rpmverifyfile > e3b5697 modified transform to only match test attestation > 02a19e2 transform designed to remove the 'tested by' information > a330ccf deleting files for imprecise and obsolete OVAL checks, manual > remediation > ca71cde simplification of Postfix service configuration > 14397cd Removing a newline to fix XHTML formatting > 7d1ab28 deletion of manual audit profile, OVAL for obsolete ldap > server checks > d7f3ca4 removed obsolete LDAP guidance, checks

1 1

[PATCH] [Fedora] Add .gitignore for Fedora output directory. Make 0.1-3 release
by Jan Lieskovsky 22 Oct '13

22 Oct '13

Based on: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-October/0… add the .gitignore file for the Fedora/output directory (not to need explicitly to create $(OUT) in the Makefile). Thanks, Shawn! Besides that merge previous changelog entries into 0.1-3 release, so I could push the content into Fedora {18, 19, 20} Git repositories already. Changes: * Fedora/Makefile - remove the explicit creation of $(OUT) directory, * introduce Fedora/output/.gitignore, * Fedora/scap-security-guide.spec - merge previous changelog entries under 0.1-3 release Testing: * Passed basic sanity && regression testing. Proposal pushed to master branch (to be able to push it into corresponding Fedora Git SCM branches). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

RPM database checks
by Robert Sanders 21 Oct '13

21 Oct '13

Greetings all, Haven't been doing much on this list except for lurking lately, but I was wondering if there has been any additional work on the various 'rpm -V' checks. Specifically on removing false positives. Some months ago I was doing the manual checks as per the official STIG compared to what the SSG was showing and noticed the SSG seemed to be filtering things, but w/o explicitly calling out the filtering in the human readable prose. Also had some questions if there would be wording put in place to deal with things like /usr/share/ibus-table/tables/latex.db and /usr/share/ibus-table/tables/compose.db (from the 'ibus-table-additional' RPM), or dealing with cases where the checksums have changed due to STIG actions, such as /etc/init/control-alt-delete.conf (part of the 'initscripts' package altered by RHEL-06-000286). I am working with a Security Blanket customer (using RHEL6.4) on these latter issues now, explaining that some of these issues are due to cases where the RPM in question is mis-configured, or post-installation/startup settings change things from how the RPM was packaged, and others are just due to the effects of the STIG guidance themselves. A quick way to show the first set of mis-verifications is to do the 'rpm -Va' command immediately after installing a RHEL instance. I've rippled several of these findings back to RedHat several months ago, but here is list (scrubbed of files marked as configuration files) from a RHEL6.4 test vm where there is a content/ownership/permission discrepancy between RPM and what is on disk (note - RHEL-06-000286 was manually applied): .M.....G.. /var/log/gdm group ownership expected to be root, found gdm DACs expected to be drwxr-xr-x, found drwxrwx--T .M....... /var/run/gdm DACS expected to be drwxr-xr-t, found drwx--x--x missing /var/run/gdm/greeter S.5....T. /etc/init/control-alt-delete.conf manual edited file as per RHEL-06-000286 resulting in checksum/timestamp difference ..5.....T. /usr/share/ibus-table/tables/compose.db not sure where/who altered ..5.....T. /usr/share/ibus-table/tables/latex.db not sure where/who altered .M....... /var/cache/libvirt/qemu DACS expected to be drwxr-x---, found drwxr-xr-x S.5....T. /usr/share/texmf/web2c/updmap.cfg not sure where/who altered I understand that if the RPM is mispackaged this is an issue for RedHat and/or the upstream maintainers to deal with, but I've fielded several questions from customers trying to understand why the RPM checks are having these findings. Granted that if some of these packages were not installed (qemu for instance) then that issue evaporates. Part of my concern is that if the SCAP checks are filtering the output of 'rpm -V', then those filters need to be called out in the manual prose as well. -Rob

1 0

[PATCH 2/2] [Fedora] Create output directory in case it doesn't exist (git doesn't support adding of empty dirs)
by Jan Lieskovsky 21 Oct '13

21 Oct '13

Create the Fedora/output directory in case it doesn't exist yet (so fedora_guide.xslt generation would succeed), since Git doesn't support empty directories, just files (also required to support SCAP content on multiple / different Fedora versions). Passed basic sanity && regression testing, pushed to master. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH 1/2] [Fedora] Set up Fedora release name and CPE based on build system properties
by Jan Lieskovsky 21 Oct '13

21 Oct '13

This patch modifies content of Fedora/input/guide.xml based on full Fedora release name and CPE, based on the values are retrieved from the build system (AKA support Fedora SCAP SSG content on different Fedora releases). Sanity and regression testing passed, pushed to master. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: Content of Fedora/input/checks/* wrt to underlying Fedora release to be adjusted yet.

1 0

[PATCH] [Fedora] Apply further changes motivated by scap-security-guide Fedora RPM review request (RH BZ#1018905, c#8)
by Jan Lieskovsky 17 Oct '13

17 Oct '13

This patch applies fixes for second round of Fedora RPM package review objections raised within: [1] https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 Has pushed it already (again mainly *.spec file changes, and confirmed relevant tests still work) to get another version of review opinion. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 3

[PATCH] [Fedora] Use correct file paths in scap-security-guide(8) manual page (RH BZ#1018905, c#10)
by Jan Lieskovsky 17 Oct '13

17 Oct '13

This patch fixes file paths listed in EXAMPLES section of scap-security-guide(8) manual page yet, them to be the correct ones. Issue raised within: [1] https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c10 Pushed to master already (passed basic sanity && regression testing). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

Fwd: [Bug 1018905] Review Request: scap-security-guide - Security guidance and baselines in SCAP formats
by Shawn Wells 16 Oct '13

16 Oct '13

For those not aware, Jan has been working the processes for SSG inclusion as Fedora/EPEL RPMs.... amazing progress! Reference below! This is *fantastic* Jan! -------- Original Message -------- Subject: [Bug 1018905] Review Request: scap-security-guide - Security guidance and baselines in SCAP formats Date: Wed, 16 Oct 2013 17:26:02 +0000 From: bugzilla(a)redhat.com To: swells(a)redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1018905 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|fedora-review? |fedora-review+ --- Comment #10 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> --- Looks fine now. Rpmlint only complains about spelling, all false positives. Note that scap-secuirity-guide(8) still refers to the old path (with /content/). Package is APPROVED. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=4I0LqmK6B3&a=cc_unsubscribe

1 0

[PATCH] The name of the check did not reflect its content.
by Maura Dailey 15 Oct '13

15 Oct '13

Somewhat confusingly, the name of the check for pam_cracklib's minclass option was accounts_password_minclass_login_defs.xml. I corrected it and the id of the check inside the file. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- .../accounts_password_pam_cracklib_minclass.xml | 43 ++++++++++++++++++++ 1 files changed, 43 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml new file mode 100644 index 0000000..539164b --- /dev/null +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml @@ -0,0 +1,43 @@ +<def-group> + <definition class="compliance" id="accounts_password_pam_cracklib_minclass" version="1"> + <metadata> + <title>Set Password minclass Requirements</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The password minclass should meet minimum + requirements using pam_cracklib</description> + </metadata> + <criteria> + <criterion comment="Conditions for minclass are satisfied" + test_ref="test_password_pam_cracklib_minclass" /> + </criteria> + </definition> + + <ind:textfilecontent54_test check="all" + comment="check the configuration of /etc/pam.d/system-auth" + id="test_password_pam_cracklib_minclass" version="1"> + <ind:object object_ref="obj_password_pam_cracklib_minclass" /> + <ind:state state_ref="state_password_pam_cracklib_minclass" /> + </ind:textfilecontent54_test> + + <ind:textfilecontent54_state id="state_password_pam_cracklib_minclass" + version="1"> + <ind:instance datatype="int">1</ind:instance> + <ind:subexpression datatype="int" + operation="less than or equal" + var_ref="var_password_pam_cracklib_minclass" /> + </ind:textfilecontent54_state> + + <external_variable comment="External variable for pam_cracklib minclass" + datatype="int" id="var_password_pam_cracklib_minclass" + version="1" /> + + <ind:textfilecontent54_object id="obj_password_pam_cracklib_minclass" + version="1"> + <ind:path>/etc/pam.d</ind:path> + <ind:filename>system-auth</ind:filename> + <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern> + <ind:instance datatype="int" operation="less than or equal">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> -- 1.7.1

2 3

← Newer
1
2
3
4
5
6
7
8
9
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide October 2013