[PATCH 00/14] Mapped more CCI numbers to SSG content

[PATCH] Fixed OVAL Checks and...

[PATCH v2 0/2] M1 Incomplete...

Willy Santos

Friday, 4 May 2012 Fri, 4 May '12

8:50 a.m.

More CCI mappings to SSG content. Willy Santos (14): Mapped CCI-000056 to gui_screen_locking group and install_vlock_package Mapped CCI-000057 to gui_screen_locking group Mapped CCI-000058 to install_vlock_package Mapped CCI-000060 to gui_screen_locking Mapped CCI-000068 to ssh_server group Mapped CCI-000087 to mountopt_noexec_on_removable_partitions Mapped CCI-000192 to password_require_uppercases Mapped CCI-000193 to password_require_lowercases Mapped CCI-001384 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001385 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001386 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001387 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001388 to set_system_login_banner and set_gdm_login_banner_text Mapped CCI-001069 to aide group rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/accounts/banners.xml | 4 ++-- rhel6/src/input/system/accounts/pam.xml | 4 ++-- rhel6/src/input/system/accounts/physical.xml | 3 ++- rhel6/src/input/system/permissions/partitions.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-) -- 1.7.7.6

Show replies by date

Willy Santos

Friday, 4 May Fri, 4 May

8:50 a.m.

New subject: [PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package

CCI-000056 requires the use of session locks until user reauthenticates, the gui_screen_locking group meets this requirement for graphical environments and install_vlock_package meets the requirements for text console sessions. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/physical.xml | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 45ad144..96bbe69 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,6 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. +<ref disa="56" /> Because users should be trained to lock the screen when they @@ -288,7 +289,7 @@ for users who may need to suspend console logins. </rationale> <ident cce="3910-7" /> <oval id="package_vlock_installed" /> -<ref nist="CM-6, CM-7" /> +<ref nist="CM-6, CM-7" disa="56" /> </Rule> </Group> </Group> -- 1.7.7.6

Willy Santos

8:50 a.m.

New subject: [PATCH 02/14] Mapped CCI-000057 to gui_screen_locking group

CCI-000057 requires initiating a session lock after an organization-defined period of inactivity, the gui_screen_locking group meets this requirement. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index 96bbe69..e1a3e69 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. -<ref disa="56" /> +<ref disa="56,57" /> Because users should be trained to lock the screen when they -- 1.7.7.6

Willy Santos

8:50 a.m.

New subject: [PATCH 03/14] Mapped CCI-000058 to install_vlock_package

CCI-000058 requires the OS to provide the user with the capability of directly initiating a session lock, install_vlock_package meets this requirement for the CLI. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index e1a3e69..afd2cfc 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -289,7 +289,7 @@ for users who may need to suspend console logins. </rationale> <ident cce="3910-7" /> <oval id="package_vlock_installed" /> -<ref nist="CM-6, CM-7" disa="56" /> +<ref nist="CM-6, CM-7" disa="56,58" /> </Rule> </Group> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 04/14] Mapped CCI-000060 to gui_screen_locking

CCI-000060 requires the session lock mechanism to hide what was previously on the screen, gui_screen_locking meets this requirement for a graphical environment. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/physical.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml index afd2cfc..99d7e2b 100644 --- a/rhel6/src/input/system/accounts/physical.xml +++ b/rhel6/src/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time. -<ref disa="56,57" /> +<ref disa="56,57,60" /> Because users should be trained to lock the screen when they -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 05/14] Mapped CCI-000068 to ssh_server group

CCI-000068 requires the use of encryption to protect remote access sessions, ssh_server meets this requirement. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/services/ssh.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/services/ssh.xml b/rhel6/src/input/services/ssh.xml index 0fd4585..9df23f0 100644 --- a/rhel6/src/input/services/ssh.xml +++ b/rhel6/src/input/services/ssh.xml @@ -38,7 +38,7 @@ certain changes should be made to the OpenSSH daemon configuration file <tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied to this file. See the <tt>sshd_config(5)</tt> man page for more detailed information.</description> -<ref disa="197,888" /> +<ref disa="68,197,888" /> <Rule id="sshd_allow_only_protocol2" severity="high"> <title>Allow Only SSH Protocol 2</title> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 06/14] Mapped CCI-000087 to mountopt_noexec_on_removable_partitions

CCI-000087 requires disabling execution of code on mobile devices, mountopt_noexec_on_removable_partitions meets this requirement. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/permissions/partitions.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/permissions/partitions.xml b/rhel6/src/input/system/permissions/partitions.xml index 5fdd7ad..87e78df 100644 --- a/rhel6/src/input/system/permissions/partitions.xml +++ b/rhel6/src/input/system/permissions/partitions.xml @@ -59,7 +59,7 @@ certain types of worms or malicious code.</description> the system to potential compromise.</rationale> <ident cce="4275-4" /> <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" /> -<ref nist="CM-7, MP-2"/> +<ref nist="CM-7, MP-2" disa="87" /> </Rule> <Rule id="mountopt_nosuid_on_removable_partitions"> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 07/14] Mapped CCI-000192 to password_require_uppercases

CCI-000192 requires enfocing password complexity by the number of upper case character used, this is met by password_require_uppercases. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index 78b6d7b..9e77717 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -195,7 +195,7 @@ more difficult by ensuring a larger search space. </rationale> <ident cce="14672-0" /> <oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/> -<ref nist="IA-5" /> +<ref nist="IA-5" disa="192" /> </Rule> <Rule id="password_require_specials"> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 08/14] Mapped CCI-000193 to password_require_lowercases

CCI-000193 requires enforcing password complexity by the number of lower case charachters used, password_require_lowercases meets this requirement. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/system/accounts/pam.xml index 9e77717..5fa2d32 100644 --- a/rhel6/src/input/system/accounts/pam.xml +++ b/rhel6/src/input/system/accounts/pam.xml @@ -227,7 +227,7 @@ more difficult by ensuring a larger search space. </rationale> <ident cce="14712-4" /> <oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/> -<ref nist="IA-5" /> +<ref nist="IA-5" disa="193" /> </Rule> <Rule id="password_require_diffchars"> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 09/14] Mapped CCI-001384 to set_system_login_banner and set_gdm_login_banner_text

CCI-001384 requires the display fo system use information before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 85b511e..8aff9a5 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> </Rule> <Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> </Rule> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 10/14] Mapped CCI-001385 to set_system_login_banner and set_gdm_login_banner_text

CCI-001385 requires the display of reference to monitoring, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 8aff9a5..e8c4fbb 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> </Rule> <Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> </Rule> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 11/14] Mapped CCI-001386 to set_system_login_banner and set_gdm_login_banner_text

CCI-001386 requires the display of references to recording, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index e8c4fbb..9d60d2d 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> </Rule> <Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> </Rule> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 12/14] Mapped CCI-001387 to set_system_login_banner and set_gdm_login_banner_text

CCI-001387 requires the display of references to auditing, if any, before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index 9d60d2d..b2865b7 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> </Rule> <Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> </Rule> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 13/14] Mapped CCI-001388 to set_system_login_banner and set_gdm_login_banner_text

CCI-001388 requires the display of a description of the authorized uses of the system before granting further access, this is met by set_system_login_banner and set_gdm_login_banner_text. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/accounts/banners.xml | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/system/accounts/banners.xml b/rhel6/src/input/system/accounts/banners.xml index b2865b7..443fbed 100644 --- a/rhel6/src/input/system/accounts/banners.xml +++ b/rhel6/src/input/system/accounts/banners.xml @@ -49,7 +49,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> </Rule> <Group id="gui_login_banner"> @@ -102,7 +102,7 @@ reinforces policy awareness during the logon process. </rationale> <ident cce="4188-9" /> <oval id="banner_gui_text_set" value="login_banner_text" /> -<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387" /> +<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> </Rule> </Group> -- 1.7.7.6

Willy Santos

8:51 a.m.

New subject: [PATCH 14/14] Mapped CCI-001069 to aide group

CCI-001069 requires the automated detection of the presence of unauthorized software, this is met by the aide group. Signed-off-by: Willy Santos <wsantos(a)redhat.com> --- rhel6/src/input/system/software/integrity.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/system/software/integrity.xml b/rhel6/src/input/system/software/integrity.xml index e11b1c6..c203d01 100644 --- a/rhel6/src/input/system/software/integrity.xml +++ b/rhel6/src/input/system/software/integrity.xml @@ -27,7 +27,7 @@ impractical due to registration and software updates. AIDE is highly configurable. This advice is based on information provided in its documentation available in <tt>/usr/share/doc/aide-VERSION</tt></description> -<ref disa="1297"/> +<ref disa="1069,1297"/> <Rule id="install_aide"> <title>Install AIDE</title> -- 1.7.7.6

Jeffrey Blank

11:32 a.m.

I hereby deem this ACK-tastic. On 05/04/2012 09:50 AM, Willy Santos wrote:

...

4383

days inactive

4383

days old

scap-security-guide@lists.fedorahosted.org

Manage subscription

15 comments

2 participants

tags (0)

participants (2)

Jeffrey Blank
Willy Santos

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

[PATCH 00/14] Mapped more CCI numbers to SSG content