Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules description

On 3/21/14, 10:31 AM, Jan Lieskovsky wrote: When we originally started authoring content, some 2 years ago, the XCCDF variable inclusion was not working (hence the comments scattered around). Applied your patch locally - everything looks great! Note a few whitespace errors, however this could be how I downloaded: $ git apply /tmp/j1.patch /tmp/j1.patch:104: trailing whitespace. <tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt> warning: 1 line adds whitespace errors. Unclear on the purpose of the tabs though. For example: In this case it gives the user the impression these values should be prefaced with a tab. While technically acceptable, in /etc/login.defs everything is defined starting as the first character. Is there a reason for the tab? > > 0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch > > > From a05cfa4500f487466605b59053aa94d92a8ce866 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky&lt;jlieskov(a)redhat.com&gt; > Date: Fri, 21 Mar 2014 15:22:04 +0100 > Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules > description > > Signed-off-by: Jan Lieskovsky&lt;jlieskov(a)redhat.com&gt; > --- > Fedora/input/services/ntp.xml | 2 +- > Fedora/input/services/ssh.xml | 26 +++++------ > .../accounts/restrictions/password_expiration.xml | 40 +++++++++-------- > .../system/accounts/restrictions/root_logins.xml | 22 +++++----- > Fedora/input/system/permissions/files.xml | 50 +++++++++++----------- > Fedora/input/system/settings/disable_prelink.xml | 4 +- > Fedora/input/system/software/updating.xml | 4 +- > Fedora/transforms/shorthand2xccdf.xslt | 4 +- > 8 files changed, 76 insertions(+), 76 deletions(-) > > diff --git a/Fedora/input/services/ntp.xml b/Fedora/input/services/ntp.xml > index 61fc8c8..5d48733 100644 > --- a/Fedora/input/services/ntp.xml > +++ b/Fedora/input/services/ntp.xml > @@ -51,7 +51,7 @@http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</rationale> > <description>To specify a remote NTP server for time synchronization, edit > the file <tt>/etc/ntp.conf</tt>. Add or correct the following lines, > substituting the IP or hostname of a remote NTP server for <em>ntpserver</em>: > -<pre>server <i>ntpserver</i></pre> > +<pre> server <b>ntpserver</b></pre> > This instructs the NTP software to contact that remote server to obtain time > data. > </description> > diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml > index ce289b1..7ca7173 100644 > --- a/Fedora/input/services/ssh.xml > +++ b/Fedora/input/services/ssh.xml > @@ -28,9 +28,9 @@ information.</description> > <Rule id="sshd_disable_root_login" severity="medium"> > <title>SSH Root Login Disabled</title> > <description>The root user should never be allowed to login to a system > -directly over a network. To disable root login via SSH, add or correct the > -following line in <tt>/etc/ssh/sshd_config</tt>: > -<pre>PermitRootLogin no</pre> > +directly over a network. To disable root login via SSH, edit the > +<tt>/etc/ssh/sshd_config</tt> file as follows: > +<pre> PermitRootLogin <b>no</b></pre> > </description> > <rationale> > Permitting direct root login reduces auditable information about who ran > @@ -44,8 +44,8 @@ root's password. > <Rule id="sshd_disable_empty_passwords" severity="high"> > <title>SSH Access via Empty Passwords Disabled</title> > <description>To explicitly disallow remote login from accounts with empty > -passwords, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>: > -<pre>PermitEmptyPasswords no</pre> > +passwords, edit the <tt>/etc/ssh/sshd_config</tt> file as follows: > +<pre> PermitEmptyPasswords <b>no</b></pre> > Any accounts with empty passwords should be disabled immediately, and PAM > configuration should prevent users from being able to assign themselves empty > passwords. > @@ -64,11 +64,13 @@ misconfiguration elsewhere. > <description>SSH allows administrators to set an idle timeout interval. > After this interval has passed, the idle user will be automatically logged out. > <br /><br /> > -To set an idle timeout interval, edit the following line in > -<tt>/etc/ssh/sshd_config</tt> as follows: > -<pre>ClientAliveInterval <b>INTERVAL</b></pre> > +To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file, > +locate the following line: > +<pre> ClientAliveInterval <b>INTERVAL</b></pre> > +and correct it to have the form of: > +<pre> ClientAliveInterval <b><sub idref="sshd_idle_timeout_value" /></b></pre> > The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15 > -minutes, set <b>interval</b> to 900. > +minutes, set <b>INTERVAL</b> to 900. > <br /><br /> > If a shorter timeout has already been set for the login shell, that value will > preempt any SSH setting made here. Keep in mind that some processes may stop > @@ -85,9 +87,9 @@ one system leading trivially to compromises on another. > <Rule id="sshd_set_keepalive"> > <title>SSH Client Alive Count Used</title> > <description>To ensure the SSH idle timeout occurs precisely when the > -<tt>ClientAliveCountMax</tt> is set, edit <tt>/etc/ssh/sshd_config</tt> as > -follows: > -<pre>ClientAliveCountMax 0</pre> > +<tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt> > +file as follows: > +<pre> ClientAliveCountMax <b>0</b></pre> > </description> > <rationale> > This ensures a user login will be terminated as soon as the > diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml > index fd4646e..055c408 100644 > --- a/Fedora/input/system/accounts/restrictions/password_expiration.xml > +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml > @@ -25,7 +25,7 @@ users 7 days of warnings at login time that their passwords are about to expire. > For example, for each existing human user <i>USER</i>, expiration parameters > could be adjusted to a 180 day maximum password age, 7 day minimum password > age, and 7 day warning period with the following command: > -<pre># chage -M 180 -m 7 -W 7 USER</pre> > +<pre> # chage -M 180 -m 7 -W 7 USER</pre> > </description> > > <Value id="var_accounts_password_minlen_login_defs" type="number" > > @@ -77,10 +77,10 @@ age, and 7 day warning period with the following command: > <Rule id="accounts_password_minlen_login_defs" severity="medium"> > <title>Password Minimum Length</title> > <description>To specify password length requirements for new accounts, > -edit the file <tt>/etc/login.defs</tt> and add or correct the following > -lines: > -<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre> > -<br/><br/> > +edit the file <tt>/etc/login.defs</tt>, locate the following line: > +<pre> PASS_MIN_LEN <b>LENGTH</b></pre> > +and correct it to have the form of: > +<pre> PASS_MIN_LEN <b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre> > Nowadays recommended values, considered as secure by various organizations > focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to > <tt>14 (DoD)</tt> characters for password length requirements. > @@ -109,15 +109,16 @@ counterproductive behavior that may result. > <Rule id="accounts_minimum_age_login_defs" severity="medium"> > <title>Password Minimum Age</title> > <description>To specify password minimum age for new accounts, > -edit the file <tt>/etc/login.defs</tt> and add or correct the > -following line, replacing the <i>DAYS</i> item as appropriate: > </description> > <ocil clause="it is not set to the required value"> > To check the minimum password age, run the command: > <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre> > -A value of 1 day is considered to be sufficient for many environments. > +A value greater than 1 day is considered to be sufficient for many environments. > </ocil> > <rationale> > Setting the minimum password age protects against users cycling > @@ -131,15 +132,16 @@ requirement. > <Rule id="accounts_maximum_age_login_defs" severity="medium"> > <title>Password Maximum Age</title> > <description>To specify password maximum age for new accounts, > -edit the file <tt>/etc/login.defs</tt> and add or correct the > -following line, replacing the <i>DAYS</i> item appropriately: > -<pre>PASS_MAX_DAYS <i>DAYS</i></pre> > -A value of 180 days is sufficient for many environments. > +edit the file <tt>/etc/login.defs</tt>, locate the following line: > +<pre> PASS_MAX_DAYS <b>DAYS</b></pre> > +and correct it to have the form of: > +<pre> PASS_MAX_DAYS <b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre> > +A value less than 180 days is sufficient for many environments. > </description> > <ocil clause="it is not set to the required value"> > To check the maximum password age, run the command: > <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre> > -A value of 180 days is sufficient for many environments. > +A value less than 180 days is sufficient for many environments. > </ocil> > <rationale> > Setting the password maximum age ensures users are required to > @@ -155,11 +157,11 @@ location subject to physical compromise.</rationale> > <title>Password Warning Age</title> > <description>To specify how many days prior to password > expiration that a warning will be issued to users, > -edit the file <tt>/etc/login.defs</tt> and add or correct > - the following line, replacing the <i>DAYS</i> item as appropriate: > -<pre>PASS_WARN_AGE <i>DAYS</i></pre> > +edit the file <tt>/etc/login.defs</tt>, locate the following line: > +<pre> PASS_WARN_AGE <b>DAYS</b></pre> > +and correct it to have the form of: > +<pre> PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre> > A value of 7 days would be nowadays considered to be a standard. > -<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> --> > </description> > <ocil clause="it is not set to the required value"> > To check the password warning age, run the command: > diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml b/Fedora/input/system/accounts/restrictions/root_logins.xml > index c04dc22..b299d54 100644 > --- a/Fedora/input/system/accounts/restrictions/root_logins.xml > +++ b/Fedora/input/system/accounts/restrictions/root_logins.xml > @@ -37,9 +37,7 @@ only allows the root user to login at the console physically attached to the > machine. To prevent root from logging in, remove the contents of this file. > To prevent direct root logins, remove the contents of this file by typing the > following command: > -<pre> > -echo > /etc/securetty > -</pre> > +<pre> echo > /etc/securetty</pre> > </description> > <ocil clause="the /etc/securetty file is not empty"> > To ensure root may not directly login to the system over physical consoles, > @@ -61,10 +59,10 @@ by security standards. > <description> > To restrict root logins through the (deprecated) virtual console devices, > ensure lines of this form do not appear in <tt>/etc/securetty</tt>: > -<pre>vc/1 > -vc/2 > -vc/3 > -vc/4</pre> > +<pre> vc/1 > + vc/2 > + vc/3 > + vc/4</pre> > </description> > <ocil clause="root login over virtual console devices is permitted"> > To check for virtual console entries which permit root login, run the > @@ -85,8 +83,8 @@ using the root account. > <title>Serial Port Root Logins Restricted</title> > <description>To restrict root logins on serial ports, > ensure lines of this form do not appear in <tt>/etc/securetty</tt>: > -<pre>ttyS0 > -ttyS1</pre> > +<pre> ttyS0 > + ttyS1</pre> > <!-- TODO: discussion/description of serial port --> > </description> > <ocil clause="root login over serial ports is permitted"> > @@ -134,7 +132,7 @@ in <tt>/etc/passwd</tt>. System accounts are those user accounts with a user ID > 500. The user ID is stored in the third field. > If any system account <i>SYSACCT</i> (other than root) has a login shell, > disable it with the command: > -<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre> > +<pre> # usermod -s /sbin/nologin <i>SYSACCT</i></pre> > </description> > <ocil clause="any system account (other than root) has a login shell"> > To obtain a listing of all users, > @@ -185,8 +183,8 @@ access to root privileges in an accountable manner. > <title>Root Path Is Vendor Default</title> > <description> > Assuming root shell is bash, edit the following files: > -<pre>~/.profile</pre> > -<pre>~/.bashrc</pre> > +<pre> ~/.profile</pre> > +<pre> ~/.bashrc</pre> > Change any <tt>PATH</tt> variables to the vendor default for root and remove any > empty <tt>PATH</tt> entries or references to relative paths. > </description> > diff --git a/Fedora/input/system/permissions/files.xml b/Fedora/input/system/permissions/files.xml > index b365f1c..dba01f4 100644 > --- a/Fedora/input/system/permissions/files.xml > +++ b/Fedora/input/system/permissions/files.xml > @@ -12,17 +12,16 @@ correctly and restrictively. > <description>System-wide shared library files, which are linked to executables > during process load time or run time, are stored in the following directories > by default: > -<pre>/lib > -/lib64 > -/usr/lib > -/usr/lib64 > -</pre> > +<pre> /lib > + /lib64 > + /usr/lib > + /usr/lib64</pre> > Kernel modules, which can be added to the kernel during runtime, are stored in > <tt>/lib/modules</tt>. All files in these directories should not be > group-writable or world-writable. If any file in these directories is found to > be group-writable or world-writable, correct its permission with the following > command: > -<pre># chmod go-w <i>FILE</i></pre> > +<pre> # chmod go-w <i>FILE</i></pre> > </description> > <rationale>Files from shared library directories are loaded into the address > space of processes (including privileged ones) or of the kernel itself at > @@ -38,17 +37,16 @@ system. > <description>System-wide shared library files, which are linked to executables > during process load time or run time, are stored in the following directories > by default: > -<pre>/lib > -/lib64 > -/usr/lib > -/usr/lib64 > -</pre> > +<pre> /lib > + /lib64 > + /usr/lib > + /usr/lib64</pre> > Kernel modules, which can be added to the kernel during runtime, are also > stored in <tt>/lib/modules</tt>. All files in these directories should be owned > by the <tt>root</tt> user. If the directory, or any file in these directories, > is found to be owned by a user other than root correct its ownership with the > following command: > -<pre># chown root <i>FILE</i></pre> > +<pre> # chown root <i>FILE</i></pre> > </description> > <rationale>Files from shared library directories are loaded into the address > space of processes (including privileged ones) or of the kernel itself at > @@ -62,16 +60,16 @@ runtime. Proper ownership is necessary to protect the integrity of the system. > <title>System Executables Have Restrictive Permissions</title> > <description> > System executables are stored in the following directories by default: > -<pre>/bin > -/usr/bin > -/usr/local/bin > -/sbin > -/usr/sbin > -/usr/local/sbin</pre> > +<pre> /bin > + /usr/bin > + /usr/local/bin > + /sbin > + /usr/sbin > + /usr/local/sbin</pre> > All files in these directories should not be group-writable or world-writable. > If any file <i>FILE</i> in these directories is found to be group-writable or > world-writable, correct its permission with the following command: > -<pre># chmod go-w <i>FILE</i></pre> > +<pre> # chmod go-w <i>FILE</i></pre> > </description> > <rationale>System binaries are executed by privileged users, as well as system > services, and restrictive permissions are necessary to ensure execution of > @@ -85,16 +83,16 @@ these programs cannot be co-opted. > <title>System Executables Have Root Ownership</title> > <description> > System executables are stored in the following directories by default: > -<pre>/bin > -/usr/bin > -/usr/local/bin > -/sbin > -/usr/sbin > -/usr/local/sbin</pre> > +<pre> /bin > + /usr/bin > + /usr/local/bin > + /sbin > + /usr/sbin > + /usr/local/sbin</pre> > All files in these directories should be owned by the <tt>root</tt> user. If > any file <i>FILE</i> in these directories is found to be owned by a user other > than root, correct its ownership with the following command: > -<pre># chown root <i>FILE</i></pre> > +<pre> # chown root <i>FILE</i></pre> > </description> > <rationale>System binaries are executed by privileged users as well as system > services, and restrictive permissions are necessary to ensure that their > diff --git a/Fedora/input/system/settings/disable_prelink.xml b/Fedora/input/system/settings/disable_prelink.xml > index a5871a6..079e68c 100644 > --- a/Fedora/input/system/settings/disable_prelink.xml > +++ b/Fedora/input/system/settings/disable_prelink.xml > @@ -4,10 +4,10 @@ > The prelinking feature changes binaries in an attempt to decrease their startup > time. In order to disable it, change or add the following line inside the file > <tt>/etc/sysconfig/prelink</tt>: > -<pre>PRELINKING=no</pre> > +<pre> PRELINKING=no</pre> > Next, run the following command to return binaries to a normal, non-prelinked > state: > -<pre># /sbin/prelink -ua</pre> > +<pre> # /sbin/prelink -ua</pre> > </description> > <rationale> > The prelinking feature can interfere with the operation of checksum integrity > diff --git a/Fedora/input/system/software/updating.xml b/Fedora/input/system/software/updating.xml > index 84de806..3b9f6a3 100644 > --- a/Fedora/input/system/software/updating.xml > +++ b/Fedora/input/system/software/updating.xml > @@ -22,7 +22,7 @@ checking of an RPM package's signature always occurs prior to its > installation. To configure yum to check package signatures before installing > them, ensure the following line appears in <tt>/etc/yum.conf</tt> in > the <tt>[main]</tt> section: > -<pre>gpgcheck=1</pre> > +<pre> gpgcheck=1</pre> > </description> > <ocil clause="GPG checking is not enabled"> > To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>, > @@ -46,7 +46,7 @@ protects against malicious tampering. > <title>gpgcheck Enabled For All Yum Package Repositories</title> > <description>To ensure signature checking is not disabled for > any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form: > -<pre>gpgcheck=0</pre> > +<pre> gpgcheck=0</pre> > </description> > <ocil clause="GPG checking is disabled"> > To determine whether <tt>yum</tt> has been configured to disable > diff --git a/Fedora/transforms/shorthand2xccdf.xslt b/Fedora/transforms/shorthand2xccdf.xslt > index c0f4546..a0da413 100644 > --- a/Fedora/transforms/shorthand2xccdf.xslt > +++ b/Fedora/transforms/shorthand2xccdf.xslt > @@ -383,12 +383,12 @@ > > <xsl:template match="service-disable-macro"> > The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command: > - <xhtml:pre># systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre> > + <xhtml:pre> # systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre> > </xsl:template> > > <xsl:template match="service-enable-macro"> > The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command: > - <xhtml:pre># systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre> > + <xhtml:pre> # systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre> > </xsl:template> > > <xsl:template match="service-disable-check-macro"> > -- 1.8.3.1 -- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells