scap-security-guide June 2013

scap-security-guide@lists.fedorahosted.org

20 participants
35 discussions

[PATCH] DoD banner check (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 14 Jun '13

14 Jun '13

Classification: UNCLASSIFIED Caveats: NONE Attached is a patch that modifies the DoD banner check to allow more whitespace flexibility (the intention is to allow newlines instead of spaces). The RHEL5 OVAL content does effectively the same thing, though it's written differently. This allows reasonable formatting of the text for 80-column displays (or GDM banners) so that mid-word wrapping does not occur. Also note that the RHEL5 STIG specifies: ..."USG interests- -not for your"... while the RHEL6 STIG specifies: ..."USG interests -- not for your"... So this may need further modification if the first one is correct; could we get clarification on that? [This very thing just came up during an inspection recently; they like it to be exactly right. I strongly suspect that the banner is supposed to be the same for both.] --Ray Classification: UNCLASSIFIED Caveats: NONE

2 1

Anyone at Summit?
by Shawn Wells 11 Jun '13

11 Jun '13

Anyone at Summit this week? Thought I'd ping the list and see if anyone wanted to meetup for drinks or dinner one of these nights. There's a session on Wednesday night where we'll be chatting through security and compliance, but thought an informal get together would be good too.

4 4

[PATCH] a check and fix for pam_cracklib.so minclass=X
by Brian Millett 10 Jun '13

10 Jun '13

A check and a fix for testing a password algorithm of minclass for cracklib in /etc/pam.d/system-auth pam_cracklib.so minclass=3 Brian Millett (1): A check and fix for minclass password checking option .../accounts_password_minclass_login_defs.xml | 43 ++++++++++++++++++++++ .../fixes/bash/password_require_minimun_class.sh | 6 +++ 2 files changed, 49 insertions(+) create mode 100644 RHEL6/input/checks/accounts_password_minclass_login_defs.xml create mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh -- 1.8.2.1

1 1

[PATCH] fix the accounts_umask_* checks to reference var_accounts_user_umask.
by Brian Millett 10 Jun '13

10 Jun '13

accounts_umask_* checks are referencing the wrong variables. Brian Millett (1): RHEL6/input/system/accounts/session.xml only references the variable "var_accounts_user_umask" so the checkes defined in RHEL6/input/checks/accounts_umask* error doing an evaluation. This patch is to have the RHEL6/input/checks/accounts_umask* reference the same variable referenced in RHEL6/input/system/accounts/session.xml RHEL6/input/checks/accounts_umask_bashrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_cshrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_etc_profile.xml | 4 ++-- RHEL6/input/checks/accounts_umask_login_defs.xml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) -- 1.8.2.1

2 2

[PATCH] OVAL cleanup to address validation errors
by David Smith 10 Jun '13

10 Jun '13

--- .../input/checks/file_ownership_var_log_audit.xml | 2 -- .../checks/file_permissions_unauthorized_sgid.xml | 1 - .../checks/file_permissions_unauthorized_suid.xml | 1 - ...ile_permissions_unauthorized_world_writable.xml | 1 - 4 files changed, 0 insertions(+), 5 deletions(-) diff --git a/RHEL6/input/checks/file_ownership_var_log_audit.xml b/RHEL6/input/checks/file_ownership_var_log_audit.xml index a6e5c19..bfadd48 100644 --- a/RHEL6/input/checks/file_ownership_var_log_audit.xml +++ b/RHEL6/input/checks/file_ownership_var_log_audit.xml @@ -14,11 +14,9 @@ </definition> <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_ownership_var_log_audit_directories" version="1"> <unix:object object_ref="object_ownership_var_log_audit_directories" /> - <unix:state state_ref="state_owner_not_root_root_var_log_audit" /> </unix:file_test> <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="test_ownership_var_log_audit_files" version="1"> <unix:object object_ref="object_ownership_var_log_audit_files" /> - <unix:state state_ref="state_owner_not_root_root_var_log_audit" /> </unix:file_test> <unix:file_object comment="/var/log/audit directories" id="object_ownership_var_log_audit_directories" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml index 5f10e5d..098143b 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_sgid" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_sgid" /> - <unix:state state_ref="state_file_permissions_unauthorized_sgid" /> </unix:file_test> <unix:file_object comment="files with sgid set" id="object_file_permissions_unauthorized_sgid" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml index 14beff4..07bb09f 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_suid" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_suid" /> - <unix:state state_ref="state_file_permissions_unauthorized_suid" /> </unix:file_test> <unix:file_object comment="files with suid set" id="object_file_permissions_unauthorized_suid" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml b/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml index 74b2336..599ad98 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="test_file_permissions_unauthorized_world_write" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_world_write" /> - <unix:state state_ref="state_file_permissions_unauthorized_world_write" /> </unix:file_test> <unix:file_object comment="world writable" id="object_file_permissions_unauthorized_world_write" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> -- 1.7.1

1 0

[PATCH 5/5] Updated selinux_all_devicefiles_labeled
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 4/5] Removed unreferenced OVAL rsyslog_files_exist_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 3/5] Mapped OVAL file_permissions_unauthorized_world_writable to XCCDF world_writeable_files
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 2/5] Removing unreferenced OVAL file_ssh_host_keys_public_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 1/5] Removing unreferenced file_ssh_host_keys_private_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2013