From 27804748b2b50e472a7c22c8809d1179f49b50cb Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 30 Aug 2021 14:16:21 +0200 Subject: [PATCH 1/5] Enable sudo_require_reauthentication in RHEL7 and select it in STIG. Assign the STIG id RHEL-07-010343. --- .../software/sudo/sudo_require_reauthentication/rule.yml | 4 +++- products/rhel7/profiles/stig.profile | 1 + shared/references/cce-redhat-avail.txt | 1 - 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml index 8622d6af9c1..bc94a705124 100644 --- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true -prodtype: rhel8,sle12,sle15 +prodtype: rhel7,rhel8,sle12,sle15 title: 'The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout' @@ -25,6 +25,7 @@ rationale: |- severity: medium identifiers: + cce@rhel7: CCE-85963-7 cce@rhel8: CCE-87838-9 cce@sle12: CCE-83231-1 cce@sle15: CCE-85764-9 @@ -33,6 +34,7 @@ references: disa: CCI-002038 nist: IA-11 srg: SRG-OS-000373-GPOS-00156 + stigid@rhel7: RHEL-07-010343 stigid@rhel8: RHEL-08-010384 stigid@sle12: SLES-12-010113 stigid@sle15: SLES-15-020102 diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index f073da46836..409078670a2 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -107,6 +107,7 @@ selections: - sudo_remove_nopasswd - sudo_restrict_privilege_elevation_to_authorized - sudo_remove_no_authenticate + - sudo_require_reauthentication - sudoers_validate_passwd - accounts_logon_fail_delay - gnome_gdm_disable_automatic_login diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index ee4c156b79c..56a6586de7d 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -84,7 +84,6 @@ CCE-85959-5 CCE-85960-3 CCE-85961-1 CCE-85962-9 -CCE-85963-7 CCE-85965-2 CCE-85966-0 CCE-85967-8 From 309a57fe36c4fe214060883d11c937eb1e42daf2 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 30 Aug 2021 14:44:44 +0200 Subject: [PATCH 2/5] Enable accounts_authorized_local_users in RHEL7 and select it in STIG. Assign the STIG id RHEL-07-020270. --- .../accounts_authorized_local_users/rule.yml | 4 +++- .../var_accounts_authorized_local_users_regex.var | 1 + products/rhel7/profiles/stig.profile | 2 ++ shared/references/cce-redhat-avail.txt | 1 - 4 files changed, 6 insertions(+), 2 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml index e2311f6a5c3..189accf892a 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true -prodtype: ol7,sle12,sle15,fedora,rhel8 +prodtype: ol7,sle12,sle15,fedora,rhel7,rhel8 title: 'Only Authorized Local User Accounts Exist on Operating System' @@ -26,6 +26,7 @@ rationale: |- severity: medium identifiers: + cce@rhel7: CCE-88380-1 cce@rhel8: CCE-85987-6 cce@sle12: CCE-83195-8 cce@sle15: CCE-85561-9 @@ -34,6 +35,7 @@ references: disa: CCI-000366 nist@sle12: CM-6(b),CM-6.1(iv) srg: SRG-OS-000480-GPOS-00227 + stigid@rhel7: RHEL-07-020270 stigid@rhel8: RHEL-08-020320 stigid@sle12: SLES-12-010630 stigid@sle15: SLES-15-020090 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var index 2f456764617..e376906b005 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var +++ b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var @@ -22,6 +22,7 @@ operator: pattern match interactive: true options: + rhel7: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$" rhel8: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$" ol7forsap: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$" saponol7 : "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$" diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index 409078670a2..05a1ccc6753 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -55,6 +55,7 @@ selections: - var_password_pam_retry=3 - var_accounts_max_concurrent_login_sessions=10 - var_accounts_tmout=15_min + - var_accounts_authorized_local_users_regex=rhel7 - var_time_service_set_maxpoll=system_default - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled @@ -322,3 +323,4 @@ selections: - sysctl_net_ipv4_conf_default_rp_filter - package_mcafeetp_installed - agent_mfetpd_running + - accounts_authorized_local_users diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 56a6586de7d..137dba1e96d 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -2434,7 +2434,6 @@ CCE-88376-9 CCE-88377-7 CCE-88378-5 CCE-88379-3 -CCE-88380-1 CCE-88381-9 CCE-88382-7 CCE-88383-5 From 5be99f99a40b3e5ac9173fc5552dfc903f2dd9a3 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 30 Aug 2021 15:17:40 +0200 Subject: [PATCH 3/5] Enable auditd_overflow_action in RHEL7 and select it in STIG. Assign the STIG id RHEL-07-030210. --- .../auditd_overflow_action/rule.yml | 2 ++ products/rhel7/profiles/stig.profile | 1 + shared/references/cce-redhat-avail.txt | 1 - 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml index d41ca000761..78898954f2f 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml @@ -15,12 +15,14 @@ rationale: |- severity: medium identifiers: + cce@rhel7: CCE-88073-2 cce@rhel8: CCE-85889-4 references: disa: CCI-001851 nist: AU-4(1) srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 + stigid@rhel7: RHEL-07-030210 stigid@rhel8: RHEL-08-030700 ocil_clause: 'auditd overflow action is not setup correctly' diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index 05a1ccc6753..3db49afa815 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -324,3 +324,4 @@ selections: - package_mcafeetp_installed - agent_mfetpd_running - accounts_authorized_local_users + - auditd_overflow_action diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 137dba1e96d..f022156d2bb 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -2134,7 +2134,6 @@ CCE-88069-0 CCE-88070-8 CCE-88071-6 CCE-88072-4 -CCE-88073-2 CCE-88074-0 CCE-88075-7 CCE-88076-5 From 92b54da56dcf0a75687d611eaca3fe0273d1ed3a Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 30 Aug 2021 15:25:58 +0200 Subject: [PATCH 4/5] Enable auditd_name_format in RHEL7 and select it in STIG. Assign the STIG id RHEL-07-030211. --- .../configure_auditd_data_retention/auditd_name_format/rule.yml | 1 + products/rhel7/profiles/stig.profile | 1 + 2 files changed, 2 insertions(+) diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml index b0bbf91f745..cb79b2dc8d2 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml @@ -26,6 +26,7 @@ references: ospp: FAU_GEN.1 srg: SRG-OS-000039-GPOS-00017,SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 stigid@ol7: OL07-00-030211 + stigid@rhel7: RHEL-07-030211 stigid@rhel8: RHEL-08-030062 ocil_clause: name_format isn't set to hostname diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index 3db49afa815..5c2ae21326f 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -325,3 +325,4 @@ selections: - agent_mfetpd_running - accounts_authorized_local_users - auditd_overflow_action + - auditd_name_format From ff65d97a9332af6df25031a06971f86b9958c337 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 30 Aug 2021 15:30:02 +0200 Subject: [PATCH 5/5] Remove STIG id RHEL-07-010090 from package_screen_installed. This item has been removed from STIG during V2R7 -> V2R8 and there is no reason to keep the reference assigned to that rule. --- .../console_screen_locking/package_screen_installed/rule.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml index 07d84b86ae4..7918554ba66 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_screen_installed/rule.yml @@ -39,7 +39,6 @@ references: ospp: FMT_MOF_EXT.1 srg: SRG-OS-000029-GPOS-00010 stigid@ol7: OL07-00-010090 - stigid@rhel7: RHEL-07-010090 vmmsrg: SRG-OS-000030-VMM-000110 ocil_clause: 'the package is not installed'