rpms / scap-security-guide

Clone
Source Code
GIT

Files

  1.   9be3b2b3a7baf71e5aae9dcb7cfb5328882f332d
  2.   SOURCES
  3.   scap-security-guide-0.1.58-add_some_rules_to_rhel7_stig-PR_7484.patch
Blob Blame History Raw 
From 27804748b2b50e472a7c22c8809d1179f49b50cb Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 30 Aug 2021 14:16:21 +0200
Subject: [PATCH 1/5] Enable sudo_require_reauthentication in RHEL7 and select
 it in STIG.

Assign the STIG id RHEL-07-010343.
---
 .../software/sudo/sudo_require_reauthentication/rule.yml      | 4 +++-
 products/rhel7/profiles/stig.profile                          | 1 +
 shared/references/cce-redhat-avail.txt                        | 1 -
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
index 8622d6af9c1..bc94a705124 100644
--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: rhel8,sle12,sle15
+prodtype: rhel7,rhel8,sle12,sle15
 
 title: 'The operating system must require Re-Authentication when using the sudo command.
  Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout'
@@ -25,6 +25,7 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel7: CCE-85963-7
     cce@rhel8: CCE-87838-9
     cce@sle12: CCE-83231-1
     cce@sle15: CCE-85764-9
@@ -33,6 +34,7 @@ references:
     disa: CCI-002038
     nist: IA-11
     srg: SRG-OS-000373-GPOS-00156
+    stigid@rhel7: RHEL-07-010343
     stigid@rhel8: RHEL-08-010384
     stigid@sle12: SLES-12-010113
     stigid@sle15: SLES-15-020102
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index f073da46836..409078670a2 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -107,6 +107,7 @@ selections:
     - sudo_remove_nopasswd
     - sudo_restrict_privilege_elevation_to_authorized
     - sudo_remove_no_authenticate
+    - sudo_require_reauthentication
     - sudoers_validate_passwd
     - accounts_logon_fail_delay
     - gnome_gdm_disable_automatic_login
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index ee4c156b79c..56a6586de7d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -84,7 +84,6 @@ CCE-85959-5
 CCE-85960-3
 CCE-85961-1
 CCE-85962-9
-CCE-85963-7
 CCE-85965-2
 CCE-85966-0
 CCE-85967-8

From 309a57fe36c4fe214060883d11c937eb1e42daf2 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 30 Aug 2021 14:44:44 +0200
Subject: [PATCH 2/5] Enable accounts_authorized_local_users in RHEL7 and
 select it in STIG.

Assign the STIG id RHEL-07-020270.
---
 .../accounts_authorized_local_users/rule.yml                  | 4 +++-
 .../var_accounts_authorized_local_users_regex.var             | 1 +
 products/rhel7/profiles/stig.profile                          | 2 ++
 shared/references/cce-redhat-avail.txt                        | 1 -
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
index e2311f6a5c3..189accf892a 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,sle12,sle15,fedora,rhel8
+prodtype: ol7,sle12,sle15,fedora,rhel7,rhel8
 
 title: 'Only Authorized Local User Accounts Exist on Operating System'
 
@@ -26,6 +26,7 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel7: CCE-88380-1
     cce@rhel8: CCE-85987-6
     cce@sle12: CCE-83195-8
     cce@sle15: CCE-85561-9
@@ -34,6 +35,7 @@ references:
     disa: CCI-000366
     nist@sle12: CM-6(b),CM-6.1(iv)
     srg: SRG-OS-000480-GPOS-00227
+    stigid@rhel7: RHEL-07-020270
     stigid@rhel8: RHEL-08-020320
     stigid@sle12: SLES-12-010630
     stigid@sle15: SLES-15-020090
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
index 2f456764617..e376906b005 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
+++ b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
@@ -22,6 +22,7 @@ operator: pattern match
 interactive: true
 
 options:
+    rhel7: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$"
     rhel8: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$"
     ol7forsap: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$"
     saponol7 : "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$"
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index 409078670a2..05a1ccc6753 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -55,6 +55,7 @@ selections:
     - var_password_pam_retry=3
     - var_accounts_max_concurrent_login_sessions=10
     - var_accounts_tmout=15_min
+    - var_accounts_authorized_local_users_regex=rhel7
     - var_time_service_set_maxpoll=system_default
     - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
     - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
@@ -322,3 +323,4 @@ selections:
     - sysctl_net_ipv4_conf_default_rp_filter
     - package_mcafeetp_installed
     - agent_mfetpd_running
+    - accounts_authorized_local_users
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 56a6586de7d..137dba1e96d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -2434,7 +2434,6 @@ CCE-88376-9
 CCE-88377-7
 CCE-88378-5
 CCE-88379-3
-CCE-88380-1
 CCE-88381-9
 CCE-88382-7
 CCE-88383-5

From 5be99f99a40b3e5ac9173fc5552dfc903f2dd9a3 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 30 Aug 2021 15:17:40 +0200
Subject: [PATCH 3/5] Enable auditd_overflow_action in RHEL7 and select it in
 STIG.

Assign the STIG id RHEL-07-030210.
---
 .../auditd_overflow_action/rule.yml                             | 2 ++
 products/rhel7/profiles/stig.profile                            | 1 +
 shared/references/cce-redhat-avail.txt                          | 1 -
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
index d41ca000761..78898954f2f 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
@@ -15,12 +15,14 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel7: CCE-88073-2
     cce@rhel8: CCE-85889-4
 
 references:
     disa: CCI-001851
     nist: AU-4(1)
     srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
+    stigid@rhel7: RHEL-07-030210
     stigid@rhel8: RHEL-08-030700
 
 ocil_clause: 'auditd overflow action is not setup correctly'
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index 05a1ccc6753..3db49afa815 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -324,3 +324,4 @@ selections:
     - package_mcafeetp_installed
     - agent_mfetpd_running
     - accounts_authorized_local_users
+    - auditd_overflow_action
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 137dba1e96d..f022156d2bb 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -2134,7 +2134,6 @@ CCE-88069-0
 CCE-88070-8
 CCE-88071-6
 CCE-88072-4
-CCE-88073-2
 CCE-88074-0
 CCE-88075-7
 CCE-88076-5

From 92b54da56dcf0a75687d611eaca3fe0273d1ed3a Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 30 Aug 2021 15:25:58 +0200
Subject: [PATCH 4/5] Enable auditd_name_format in RHEL7 and select it in STIG.

Assign the STIG id RHEL-07-030211.
---
 .../configure_auditd_data_retention/auditd_name_format/rule.yml  | 1 +
 products/rhel7/profiles/stig.profile                             | 1 +
 2 files changed, 2 insertions(+)

diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
index b0bbf91f745..cb79b2dc8d2 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
@@ -26,6 +26,7 @@ references:
     ospp: FAU_GEN.1
     srg: SRG-OS-000039-GPOS-00017,SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
     stigid@ol7: OL07-00-030211
+    stigid@rhel7: RHEL-07-030211
     stigid@rhel8: RHEL-08-030062
 
 ocil_clause: name_format isn't set to hostname
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index 3db49afa815..5c2ae21326f 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -325,3 +325,4 @@ selections:
     - agent_mfetpd_running
     - accounts_authorized_local_users
     - auditd_overflow_action
+    - auditd_name_format

From ff65d97a9332af6df25031a06971f86b9958c337 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 30 Aug 2021 15:30:02 +0200
Subject: [PATCH 5/5] Remove STIG id RHEL-07-010090 from
 package_screen_installed.

This item has been removed from STIG during V2R7 -> V2R8 and there is no
reason to keep the reference assigned to that rule.
---
 .../console_screen_locking/package_screen_installed/rule.yml     | 1 -
 1 file changed, 1 deletion(-)

diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml
index 07d84b86ae4..7918554ba66 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml
@@ -39,7 +39,6 @@ references:
     ospp: FMT_MOF_EXT.1
     srg: SRG-OS-000029-GPOS-00010
     stigid@ol7: OL07-00-010090
-    stigid@rhel7: RHEL-07-010090
     vmmsrg: SRG-OS-000030-VMM-000110
 
 ocil_clause: 'the package is not installed'

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation