9:31 a.m.
Based on xccdf:sub elements thread:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/0...
switch on OVAL variables evaluation for Fedora content in XCCDF rules description.
Together with that change, indent content of <pre> elements with one heading tab
character.
Tested on Fedora (both make & make validate seems to be working properly).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
5:45 p.m.
On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
Based on xccdf:sub elements thread:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/0...
switch on OVAL variables evaluation for Fedora content in XCCDF rules description.
Together with that change, indent content of <pre> elements with one heading tab
character.
Tested on Fedora (both make & make validate seems to be working properly).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
When we originally started authoring content, some 2 years ago, the
XCCDF variable inclusion was not working (hence the comments scattered
around). Applied your patch locally - everything looks great! Note a few
whitespace errors, however this could be how I downloaded:
$ git apply /tmp/j1.patch
/tmp/j1.patch:104: trailing whitespace.
<tt>ClientAliveCountMax</tt> is set, edit the
<tt>/etc/ssh/sshd_config</tt>
warning: 1 line adds whitespace errors.
Unclear on the purpose of the tabs though. For example:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre> PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre> PASS_MIN_DAYS <b><sub
idref="var_accounts_minimum_age_login_defs" /></b></pre>
+A value greater than 1 day is considered to be sufficient for many environments.
In this case it gives the user the impression these values should be
prefaced with a tab. While technically acceptable, in /etc/login.defs
everything is defined starting as the first character. Is there a reason
for the tab?
>
> 0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch
>
>
> From a05cfa4500f487466605b59053aa94d92a8ce866 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov(a)redhat.com>
> Date: Fri, 21 Mar 2014 15:22:04 +0100
> Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
> description
>
> Signed-off-by: Jan Lieskovsky<jlieskov(a)redhat.com>
> ---
> Fedora/input/services/ntp.xml | 2 +-
> Fedora/input/services/ssh.xml | 26 +++++------
> .../accounts/restrictions/password_expiration.xml | 40 +++++++++--------
> .../system/accounts/restrictions/root_logins.xml | 22 +++++-----
> Fedora/input/system/permissions/files.xml | 50 +++++++++++-----------
> Fedora/input/system/settings/disable_prelink.xml | 4 +-
> Fedora/input/system/software/updating.xml | 4 +-
> Fedora/transforms/shorthand2xccdf.xslt | 4 +-
> 8 files changed, 76 insertions(+), 76 deletions(-)
>
> diff --git a/Fedora/input/services/ntp.xml b/Fedora/input/services/ntp.xml
> index 61fc8c8..5d48733 100644
> --- a/Fedora/input/services/ntp.xml
> +++ b/Fedora/input/services/ntp.xml
> @@ -51,7 +51,7
@@http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</rationale>
> <description>To specify a remote NTP server for time synchronization, edit
> the file <tt>/etc/ntp.conf</tt>. Add or correct the following lines,
> substituting the IP or hostname of a remote NTP server for
<em>ntpserver</em>:
> -<pre>server <i>ntpserver</i></pre>
> +<pre> server <b>ntpserver</b></pre>
> This instructs the NTP software to contact that remote server to obtain time
> data.
> </description>
> diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
> index ce289b1..7ca7173 100644
> --- a/Fedora/input/services/ssh.xml
> +++ b/Fedora/input/services/ssh.xml
> @@ -28,9 +28,9 @@ information.</description>
> <Rule id="sshd_disable_root_login" severity="medium">
> <title>SSH Root Login Disabled</title>
> <description>The root user should never be allowed to login to a system
> -directly over a network. To disable root login via SSH, add or correct the
> -following line in <tt>/etc/ssh/sshd_config</tt>:
> -<pre>PermitRootLogin no</pre>
> +directly over a network. To disable root login via SSH, edit the
> +<tt>/etc/ssh/sshd_config</tt> file as follows:
> +<pre> PermitRootLogin <b>no</b></pre>
> </description>
> <rationale>
> Permitting direct root login reduces auditable information about who ran
> @@ -44,8 +44,8 @@ root's password.
> <Rule id="sshd_disable_empty_passwords" severity="high">
> <title>SSH Access via Empty Passwords Disabled</title>
> <description>To explicitly disallow remote login from accounts with empty
> -passwords, add or correct the following line in
<tt>/etc/ssh/sshd_config</tt>:
> -<pre>PermitEmptyPasswords no</pre>
> +passwords, edit the <tt>/etc/ssh/sshd_config</tt> file as follows:
> +<pre> PermitEmptyPasswords <b>no</b></pre>
> Any accounts with empty passwords should be disabled immediately, and PAM
> configuration should prevent users from being able to assign themselves empty
> passwords.
> @@ -64,11 +64,13 @@ misconfiguration elsewhere.
> <description>SSH allows administrators to set an idle timeout interval.
> After this interval has passed, the idle user will be automatically logged out.
> <br /><br />
> -To set an idle timeout interval, edit the following line in
> -<tt>/etc/ssh/sshd_config</tt> as follows:
> -<pre>ClientAliveInterval <b>INTERVAL</b></pre>
> +To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt>
file,
> +locate the following line:
> +<pre> ClientAliveInterval <b>INTERVAL</b></pre>
> +and correct it to have the form of:
> +<pre> ClientAliveInterval <b><sub
idref="sshd_idle_timeout_value" /></b></pre>
> The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of
15
> -minutes, set <b>interval</b> to 900.
> +minutes, set <b>INTERVAL</b> to 900.
> <br /><br />
> If a shorter timeout has already been set for the login shell, that value will
> preempt any SSH setting made here. Keep in mind that some processes may stop
> @@ -85,9 +87,9 @@ one system leading trivially to compromises on another.
> <Rule id="sshd_set_keepalive">
> <title>SSH Client Alive Count Used</title>
> <description>To ensure the SSH idle timeout occurs precisely when the
> -<tt>ClientAliveCountMax</tt> is set, edit
<tt>/etc/ssh/sshd_config</tt> as
> -follows:
> -<pre>ClientAliveCountMax 0</pre>
> +<tt>ClientAliveCountMax</tt> is set, edit the
<tt>/etc/ssh/sshd_config</tt>
> +file as follows:
> +<pre> ClientAliveCountMax <b>0</b></pre>
> </description>
> <rationale>
> This ensures a user login will be terminated as soon as the
> diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml
b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> index fd4646e..055c408 100644
> --- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
> +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> @@ -25,7 +25,7 @@ users 7 days of warnings at login time that their passwords are
about to expire.
> For example, for each existing human user <i>USER</i>, expiration
parameters
> could be adjusted to a 180 day maximum password age, 7 day minimum password
> age, and 7 day warning period with the following command:
> -<pre># chage -M 180 -m 7 -W 7 USER</pre>
> +<pre> # chage -M 180 -m 7 -W 7 USER</pre>
> </description>
>
> <Value id="var_accounts_password_minlen_login_defs"
type="number" >
> @@ -77,10 +77,10 @@ age, and 7 day warning period with the following command:
> <Rule id="accounts_password_minlen_login_defs"
severity="medium">
> <title>Password Minimum Length</title>
> <description>To specify password length requirements for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the following
> -lines:
> -<pre>PASS_MIN_LEN 12<!-- <sub
idref="var_accounts_password_minlen_login_defs"> --></pre>
> -<br/><br/>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre> PASS_MIN_LEN <b>LENGTH</b></pre>
> +and correct it to have the form of:
> +<pre> PASS_MIN_LEN <b><sub
idref="var_accounts_password_minlen_login_defs" /></b></pre>
> Nowadays recommended values, considered as secure by various organizations
> focused on topic of computer security, range from <tt>12 (FISMA)</tt>
up to
> <tt>14 (DoD)</tt> characters for password length requirements.
> @@ -109,15 +109,16 @@ counterproductive behavior that may result.
> <Rule id="accounts_minimum_age_login_defs"
severity="medium">
> <title>Password Minimum Age</title>
> <description>To specify password minimum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre> PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre> PASS_MIN_DAYS <b><sub
idref="var_accounts_minimum_age_login_defs" /></b></pre>
+A value greater than 1 day is considered to be sufficient for many environments.
> </description>
> <ocil clause="it is not set to the required value">
> To check the minimum password age, run the command:
> <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +A value greater than 1 day is considered to be sufficient for many environments.
> </ocil>
> <rationale>
> Setting the minimum password age protects against users cycling
> @@ -131,15 +132,16 @@ requirement.
> <Rule id="accounts_maximum_age_login_defs"
severity="medium">
> <title>Password Maximum Age</title>
> <description>To specify password maximum age for new accounts,
> -edit the file <tt>/etc/login.defs</tt> and add or correct the
> -following line, replacing the <i>DAYS</i> item appropriately:
> -<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
> -A value of 180 days is sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre> PASS_MAX_DAYS <b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre> PASS_MAX_DAYS <b><sub
idref="var_accounts_maximum_age_login_defs" /></b></pre>
> +A value less than 180 days is sufficient for many environments.
> </description>
> <ocil clause="it is not set to the required value">
> To check the maximum password age, run the command:
> <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
> -A value of 180 days is sufficient for many environments.
> +A value less than 180 days is sufficient for many environments.
> </ocil>
> <rationale>
> Setting the password maximum age ensures users are required to
> @@ -155,11 +157,11 @@ location subject to physical compromise.</rationale>
> <title>Password Warning Age</title>
> <description>To specify how many days prior to password
> expiration that a warning will be issued to users,
> -edit the file <tt>/etc/login.defs</tt> and add or correct
> - the following line, replacing the <i>DAYS</i> item as appropriate:
> -<pre>PASS_WARN_AGE <i>DAYS</i></pre>
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre> PASS_WARN_AGE <b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre> PASS_WARN_AGE <b><sub
idref="var_accounts_password_warn_age_login_defs" /></b></pre>
> A value of 7 days would be nowadays considered to be a standard.
> -<!-- <sub
idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
> </description>
> <ocil clause="it is not set to the required value">
> To check the password warning age, run the command:
> diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml
b/Fedora/input/system/accounts/restrictions/root_logins.xml
> index c04dc22..b299d54 100644
> --- a/Fedora/input/system/accounts/restrictions/root_logins.xml
> +++ b/Fedora/input/system/accounts/restrictions/root_logins.xml
> @@ -37,9 +37,7 @@ only allows the root user to login at the console physically
attached to the
> machine. To prevent root from logging in, remove the contents of this file.
> To prevent direct root logins, remove the contents of this file by typing the
> following command:
> -<pre>
> -echo > /etc/securetty
> -</pre>
> +<pre> echo > /etc/securetty</pre>
> </description>
> <ocil clause="the /etc/securetty file is not empty">
> To ensure root may not directly login to the system over physical consoles,
> @@ -61,10 +59,10 @@ by security standards.
> <description>
> To restrict root logins through the (deprecated) virtual console devices,
> ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> -<pre>vc/1
> -vc/2
> -vc/3
> -vc/4</pre>
> +<pre> vc/1
> + vc/2
> + vc/3
> + vc/4</pre>
> </description>
> <ocil clause="root login over virtual console devices is
permitted">
> To check for virtual console entries which permit root login, run the
> @@ -85,8 +83,8 @@ using the root account.
> <title>Serial Port Root Logins Restricted</title>
> <description>To restrict root logins on serial ports,
> ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
> -<pre>ttyS0
> -ttyS1</pre>
> +<pre> ttyS0
> + ttyS1</pre>
> <!-- TODO: discussion/description of serial port -->
> </description>
> <ocil clause="root login over serial ports is permitted">
> @@ -134,7 +132,7 @@ in <tt>/etc/passwd</tt>. System accounts are those
user accounts with a user ID
> 500. The user ID is stored in the third field.
> If any system account <i>SYSACCT</i> (other than root) has a login
shell,
> disable it with the command:
> -<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
> +<pre> # usermod -s /sbin/nologin <i>SYSACCT</i></pre>
> </description>
> <ocil clause="any system account (other than root) has a login
shell">
> To obtain a listing of all users,
> @@ -185,8 +183,8 @@ access to root privileges in an accountable manner.
> <title>Root Path Is Vendor Default</title>
> <description>
> Assuming root shell is bash, edit the following files:
> -<pre>~/.profile</pre>
> -<pre>~/.bashrc</pre>
> +<pre> ~/.profile</pre>
> +<pre> ~/.bashrc</pre>
> Change any <tt>PATH</tt> variables to the vendor default for root and
remove any
> empty <tt>PATH</tt> entries or references to relative paths.
> </description>
> diff --git a/Fedora/input/system/permissions/files.xml
b/Fedora/input/system/permissions/files.xml
> index b365f1c..dba01f4 100644
> --- a/Fedora/input/system/permissions/files.xml
> +++ b/Fedora/input/system/permissions/files.xml
> @@ -12,17 +12,16 @@ correctly and restrictively.
> <description>System-wide shared library files, which are linked to
executables
> during process load time or run time, are stored in the following directories
> by default:
> -<pre>/lib
> -/lib64
> -/usr/lib
> -/usr/lib64
> -</pre>
> +<pre> /lib
> + /lib64
> + /usr/lib
> + /usr/lib64</pre>
> Kernel modules, which can be added to the kernel during runtime, are stored in
> <tt>/lib/modules</tt>. All files in these directories should not be
> group-writable or world-writable. If any file in these directories is found to
> be group-writable or world-writable, correct its permission with the following
> command:
> -<pre># chmod go-w <i>FILE</i></pre>
> +<pre> # chmod go-w <i>FILE</i></pre>
> </description>
> <rationale>Files from shared library directories are loaded into the address
> space of processes (including privileged ones) or of the kernel itself at
> @@ -38,17 +37,16 @@ system.
> <description>System-wide shared library files, which are linked to
executables
> during process load time or run time, are stored in the following directories
> by default:
> -<pre>/lib
> -/lib64
> -/usr/lib
> -/usr/lib64
> -</pre>
> +<pre> /lib
> + /lib64
> + /usr/lib
> + /usr/lib64</pre>
> Kernel modules, which can be added to the kernel during runtime, are also
> stored in <tt>/lib/modules</tt>. All files in these directories should
be owned
> by the <tt>root</tt> user. If the directory, or any file in these
directories,
> is found to be owned by a user other than root correct its ownership with the
> following command:
> -<pre># chown root <i>FILE</i></pre>
> +<pre> # chown root <i>FILE</i></pre>
> </description>
> <rationale>Files from shared library directories are loaded into the address
> space of processes (including privileged ones) or of the kernel itself at
> @@ -62,16 +60,16 @@ runtime. Proper ownership is necessary to protect the integrity
of the system.
> <title>System Executables Have Restrictive Permissions</title>
> <description>
> System executables are stored in the following directories by default:
> -<pre>/bin
> -/usr/bin
> -/usr/local/bin
> -/sbin
> -/usr/sbin
> -/usr/local/sbin</pre>
> +<pre> /bin
> + /usr/bin
> + /usr/local/bin
> + /sbin
> + /usr/sbin
> + /usr/local/sbin</pre>
> All files in these directories should not be group-writable or world-writable.
> If any file <i>FILE</i> in these directories is found to be
group-writable or
> world-writable, correct its permission with the following command:
> -<pre># chmod go-w <i>FILE</i></pre>
> +<pre> # chmod go-w <i>FILE</i></pre>
> </description>
> <rationale>System binaries are executed by privileged users, as well as
system
> services, and restrictive permissions are necessary to ensure execution of
> @@ -85,16 +83,16 @@ these programs cannot be co-opted.
> <title>System Executables Have Root Ownership</title>
> <description>
> System executables are stored in the following directories by default:
> -<pre>/bin
> -/usr/bin
> -/usr/local/bin
> -/sbin
> -/usr/sbin
> -/usr/local/sbin</pre>
> +<pre> /bin
> + /usr/bin
> + /usr/local/bin
> + /sbin
> + /usr/sbin
> + /usr/local/sbin</pre>
> All files in these directories should be owned by the <tt>root</tt>
user. If
> any file <i>FILE</i> in these directories is found to be owned by a
user other
> than root, correct its ownership with the following command:
> -<pre># chown root <i>FILE</i></pre>
> +<pre> # chown root <i>FILE</i></pre>
> </description>
> <rationale>System binaries are executed by privileged users as well as
system
> services, and restrictive permissions are necessary to ensure that their
> diff --git a/Fedora/input/system/settings/disable_prelink.xml
b/Fedora/input/system/settings/disable_prelink.xml
> index a5871a6..079e68c 100644
> --- a/Fedora/input/system/settings/disable_prelink.xml
> +++ b/Fedora/input/system/settings/disable_prelink.xml
> @@ -4,10 +4,10 @@
> The prelinking feature changes binaries in an attempt to decrease their startup
> time. In order to disable it, change or add the following line inside the file
> <tt>/etc/sysconfig/prelink</tt>:
> -<pre>PRELINKING=no</pre>
> +<pre> PRELINKING=no</pre>
> Next, run the following command to return binaries to a normal, non-prelinked
> state:
> -<pre># /sbin/prelink -ua</pre>
> +<pre> # /sbin/prelink -ua</pre>
> </description>
> <rationale>
> The prelinking feature can interfere with the operation of checksum integrity
> diff --git a/Fedora/input/system/software/updating.xml
b/Fedora/input/system/software/updating.xml
> index 84de806..3b9f6a3 100644
> --- a/Fedora/input/system/software/updating.xml
> +++ b/Fedora/input/system/software/updating.xml
> @@ -22,7 +22,7 @@ checking of an RPM package's signature always occurs prior to
its
> installation. To configure yum to check package signatures before installing
> them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
> the <tt>[main]</tt> section:
> -<pre>gpgcheck=1</pre>
> +<pre> gpgcheck=1</pre>
> </description>
> <ocil clause="GPG checking is not enabled">
> To determine whether <tt>yum</tt> is configured to use
<tt>gpgcheck</tt>,
> @@ -46,7 +46,7 @@ protects against malicious tampering.
> <title>gpgcheck Enabled For All Yum Package Repositories</title>
> <description>To ensure signature checking is not disabled for
> any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of
the form:
> -<pre>gpgcheck=0</pre>
> +<pre> gpgcheck=0</pre>
> </description>
> <ocil clause="GPG checking is disabled">
> To determine whether <tt>yum</tt> has been configured to disable
> diff --git a/Fedora/transforms/shorthand2xccdf.xslt
b/Fedora/transforms/shorthand2xccdf.xslt
> index c0f4546..a0da413 100644
> --- a/Fedora/transforms/shorthand2xccdf.xslt
> +++ b/Fedora/transforms/shorthand2xccdf.xslt
> @@ -383,12 +383,12 @@
>
> <xsl:template match="service-disable-macro">
> The <xhtml:code><xsl:value-of
select="@service"/></xhtml:code> service can be disabled with the
following command:
> - <xhtml:pre># systemctl disable <xsl:value-of
select="@service"/>.service</xhtml:pre>
> + <xhtml:pre> # systemctl disable <xsl:value-of
select="@service"/>.service</xhtml:pre>
> </xsl:template>
>
> <xsl:template match="service-enable-macro">
> The <xhtml:code><xsl:value-of
select="@service"/></xhtml:code> service can be enabled with the
following command:
> - <xhtml:pre># systemctl enable <xsl:value-of
select="@service"/>.service</xhtml:pre>
> + <xhtml:pre> # systemctl enable <xsl:value-of
select="@service"/>.service</xhtml:pre>
> </xsl:template>
>
> <xsl:template match="service-disable-check-macro">
> -- 1.8.3.1
--
Shawn Wells
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
@shawndwells
9:07 a.m.
New subject: [PATCH v2] [Fedora] Switch on OVAL variables evaluation in rules description {was: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules description}
Thank you for the review, Shawn.
----- Original Message -----
From: "Shawn Wells" <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Friday, March 21, 2014 11:45:23 PM
Subject: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules description
On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
Based on xccdf:sub elements thread:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/0...
switch on OVAL variables evaluation for Fedora content in XCCDF rules
description.
Together with that change, indent content of <pre> elements with one heading
tab character.
Tested on Fedora (both make & make validate seems to be working properly).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
When we originally started authoring content, some 2 years ago, the XCCDF
variable inclusion was not working (hence the comments scattered around).
Applied your patch locally - everything looks great! Note a few whitespace
errors, however this could be how I downloaded:
$ git apply /tmp/j1.patch
/tmp/j1.patch:104: trailing whitespace.
<tt>ClientAliveCountMax</tt> is set, edit the
<tt>/etc/ssh/sshd_config</tt>
warning: 1 line adds whitespace errors.
You are truly right, there was one whitespace noise case (didn't actually
try to apply the patch. Sorry for that -- second version shouldn't have it already).
Unclear on the purpose of the tabs though. For example:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre> PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre> PASS_MIN_DAYS <b><sub
idref="var_accounts_minimum_age_login_defs"
/></b></pre>
+A value greater than 1 day is considered to be sufficient for many
environments.
In this case it gives the user the impression these values should be prefaced
with a tab. While technically acceptable, in /etc/login.defs everything is
defined starting as the first character. Is there a reason for the tab?
The intention was to prefix the particular row in HTML form of the guide with
a tab character to separate HTML text from command line syntax (IOW so the
command-line input would be differentiated not just by <pre> element, but also
intended from left by one tab).
But agree with you this might bring more confusion than the desired effect actually
(didn't look at this the way you did) thus removed the tabs from the attached second
version.
Please review [*].
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] make / make validate & basic testing passed.
--
Shawn Wells
Director, Innovation Programs shawn(a)redhat.com | 443.534.0130
@shawndwells
10:49 p.m.
New subject: [PATCH v2] [Fedora] Switch on OVAL variables evaluation in rules description {was: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules description}
On 3/24/14, 10:07 AM, Jan Lieskovsky wrote:
Thank you for the review, Shawn.
----- Original Message -----
> >From: "Shawn Wells"<shawn(a)redhat.com>
> >To:scap-security-guide@lists.fedorahosted.org
> >Sent: Friday, March 21, 2014 11:45:23 PM
> >Subject: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in
rules description
> >
> >On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
> >
> >
> >
> >Based on xccdf:sub elements thread:
>
>https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005104.html
> >switch on OVAL variables evaluation for Fedora content in XCCDF rules
> >description.
> >
> >Together with that change, indent content of <pre> elements with one
heading
> >tab character.
> >
> >Tested on Fedora (both make & make validate seems to be working properly).
> >
> >Please review.
> >
> >Thank you && Regards, Jan.
> >--
> >Jan iankko Lieskovsky / Red Hat Security Technologies Team
> >
> >When we originally started authoring content, some 2 years ago, the XCCDF
> >variable inclusion was not working (hence the comments scattered around).
> >Applied your patch locally - everything looks great! Note a few whitespace
> >errors, however this could be how I downloaded:
> >
> >$ git apply /tmp/j1.patch
> >/tmp/j1.patch:104: trailing whitespace.
> ><tt>ClientAliveCountMax</tt> is set, edit the
<tt>/etc/ssh/sshd_config</tt>
> >warning: 1 line adds whitespace errors.
You are truly right, there was one whitespace noise case (didn't actually
try to apply the patch. Sorry for that -- second version shouldn't have it already).
> >
> >Unclear on the purpose of the tabs though. For example:
> >
> >
> >
> >-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> >-A value of 1 day is considered to be sufficient for many environments.
> >+edit the file <tt>/etc/login.defs</tt>, locate the following line:
> >+<pre> PASS_MIN_DAYS <b>DAYS</b></pre>
> >+and correct it to have the form of:
> >+<pre> PASS_MIN_DAYS <b><sub
idref="var_accounts_minimum_age_login_defs"
> >/></b></pre>
> >+A value greater than 1 day is considered to be sufficient for many
> >environments.
> >
> >In this case it gives the user the impression these values should be prefaced
> >with a tab. While technically acceptable, in /etc/login.defs everything is
> >defined starting as the first character. Is there a reason for the tab?
The intention was to prefix the particular row in HTML form of the guide with
a tab character to separate HTML text from command line syntax (IOW so the
command-line input would be differentiated not just by <pre> element, but also
intended from left by one tab).
But agree with you this might bring more confusion than the desired effect actually
(didn't look at this the way you did) thus removed the tabs from the attached second
version.
Please review [*].
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] make / make validate & basic testing passed.
Ack.
> >--
> >Shawn Wells
> >Director, Innovation Programsshawn(a)redhat.com | 443.534.0130
> >@shawndwells
0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch
From 2ec99f4a2840209f8a9ef834b6d67d7ccd142b07 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky<jlieskov(a)redhat.com>
Date: Mon, 24 Mar 2014 14:31:26 +0100
Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
description
Signed-off-by: Jan Lieskovsky<jlieskov(a)redhat.com>
---
Fedora/input/services/ssh.xml | 8 +++--
.../accounts/restrictions/password_expiration.xml | 42 ++++++++++++----------
2 files changed, 29 insertions(+), 21 deletions(-)
diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
index ce289b1..0489b4b 100644
--- a/Fedora/input/services/ssh.xml
+++ b/Fedora/input/services/ssh.xml
@@ -64,11 +64,13 @@ misconfiguration elsewhere.
<description>SSH allows administrators to set an idle timeout interval.
After this interval has passed, the idle user will be automatically logged out.
<br /><br />
-To set an idle timeout interval, edit the following line in
-<tt>/etc/ssh/sshd_config</tt> as follows:
+To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt>
file,
+locate the following line:
<pre>ClientAliveInterval <b>INTERVAL</b></pre>
+and correct it to have the form of:
+<pre>ClientAliveInterval <b><sub
idref="sshd_idle_timeout_value" /></b></pre>
The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
-minutes, set <b>interval</b> to 900.
+minutes, set <b>INTERVAL</b> to 900.
<br /><br />
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made here. Keep in mind that some processes may stop
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml
b/Fedora/input/system/accounts/restrictions/password_expiration.xml
index fd4646e..91a2fef 100644
--- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -77,10 +77,11 @@ age, and 7 day warning period with the following command:
<Rule id="accounts_password_minlen_login_defs"
severity="medium">
<title>Password Minimum Length</title>
<description>To specify password length requirements for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the following
-lines:
-<pre>PASS_MIN_LEN 12<!-- <sub
idref="var_accounts_password_minlen_login_defs"> --></pre>
-<br/><br/>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_LEN <b>LENGTH</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_LEN <b><sub
idref="var_accounts_password_minlen_login_defs" /></b></pre>
+<br />
Nowadays recommended values, considered as secure by various organizations
focused on topic of computer security, range from <tt>12 (FISMA)</tt> up
to
<tt>14 (DoD)</tt> characters for password length requirements.
@@ -109,15 +110,17 @@ counterproductive behavior that may result.
<Rule id="accounts_minimum_age_login_defs"
severity="medium">
<title>Password Minimum Age</title>
<description>To specify password minimum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_DAYS <b><sub
idref="var_accounts_minimum_age_login_defs" /></b></pre>
+<br />
+A value greater than 1 day is considered to be sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password age, run the command:
<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
-A value of 1 day is considered to be sufficient for many environments.
+A value greater than 1 day is considered to be sufficient for many environments.
</ocil>
<rationale>
Setting the minimum password age protects against users cycling
@@ -131,15 +134,17 @@ requirement.
<Rule id="accounts_maximum_age_login_defs"
severity="medium">
<title>Password Maximum Age</title>
<description>To specify password maximum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
-A value of 180 days is sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MAX_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MAX_DAYS <b><sub
idref="var_accounts_maximum_age_login_defs" /></b></pre>
+<br />
+A value less than 180 days is sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the maximum password age, run the command:
<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-A value of 180 days is sufficient for many environments.
+A value less than 180 days is sufficient for many environments.
</ocil>
<rationale>
Setting the password maximum age ensures users are required to
@@ -155,11 +160,12 @@ location subject to physical compromise.</rationale>
<title>Password Warning Age</title>
<description>To specify how many days prior to password
expiration that a warning will be issued to users,
-edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_WARN_AGE <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_WARN_AGE <b><sub
idref="var_accounts_password_warn_age_login_defs" /></b></pre>
+<br />
A value of 7 days would be nowadays considered to be a standard.
-<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value"
/> -->
</description>
<ocil clause="it is not set to the required value">
To check the password warning age, run the command:
-- 1.8.3.1
--
Shawn Wells
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
@shawndwells
3691
days inactive
3695
days old
scap-security-guide@lists.fedorahosted.org
3 comments
2 participants
participants (2)
-
Jan Lieskovsky -
Shawn Wells