From 73540cf1c601bc07e064c024981f82804c3b5690 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 26 Apr 2022 18:51:38 +0200 Subject: [PATCH 2/3] Update DISA RHEL7 STIG manual benchmark to V3R7. --- ...f-manual.xml => disa-stig-rhel7-v3r7-xccdf-manual.xml} | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) rename shared/references/{disa-stig-rhel7-v3r6-xccdf-manual.xml => disa-stig-rhel7-v3r7-xccdf-manual.xml} (99%) diff --git a/shared/references/disa-stig-rhel7-v3r6-xccdf-manual.xml b/shared/references/disa-stig-rhel7-v3r7-xccdf-manual.xml similarity index 99% rename from shared/references/disa-stig-rhel7-v3r6-xccdf-manual.xml rename to shared/references/disa-stig-rhel7-v3r7-xccdf-manual.xml index 62c5f363e18..2c680d73acc 100644 --- a/shared/references/disa-stig-rhel7-v3r6-xccdf-manual.xml +++ b/shared/references/disa-stig-rhel7-v3r7-xccdf-manual.xml @@ -1,4 +1,4 @@ -acceptedRed Hat Enterprise Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 6 Benchmark Date: 27 Jan 20223.2.2.360791.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>RHEL-07-010010The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.<VulnDiscussion>Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. +acceptedRed Hat Enterprise Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 7 Benchmark Date: 27 Apr 20223.3.0.273751.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>RHEL-07-010010The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.<VulnDiscussion>Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Red Hat Enterprise Linux 7DISADPMS TargetRed Hat Enterprise Linux 72899V-71849SV-86473CCI-001494CCI-001496CCI-002165CCI-002235Run the following command to determine which package owns the file: @@ -921,7 +921,7 @@ Check to see if an encrypted grub superusers password is set. On systems that us $ sudo grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash] -If the grub superusers password does not begin with "grub.pbkdf2.sha512", this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>RHEL-07-010500The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. +If the grub superusers password does not begin with "grub.pbkdf2.sha512", this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>RHEL-07-010500The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: @@ -942,7 +942,7 @@ Modify the "/etc/pam_pkcs11/pkcs11_eventmgr.conf" file to uncomment the followin #/usr/X11R6/bin/xscreensaver-command -lock -Modify the "/etc/pam_pkcs11/pam_pkcs11.conf" file to use the cackey module if required.Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication. +Modify the "/etc/pam_pkcs11/pam_pkcs11.conf" file to use the cackey module if required.Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication. Check to see if smartcard authentication is enforced on the system: @@ -956,7 +956,7 @@ If "smartcard removal action" is blank, this is a finding. # authconfig --test | grep "smartcard module" -If "smartcard module" is blank, ask the administrator to indicate the AO-approved multifactor authentication in use and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>RHEL-07-020000The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.<VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. +If any of the above checks are not configured, ask the administrator to indicate the AO-approved multifactor authentication in use and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>RHEL-07-020000The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.<VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). From 515c21c754224f1ef861674ba96c6ff1501ca410 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 26 Apr 2022 18:53:05 +0200 Subject: [PATCH 3/3] Update version of RHEL7 STIG profiles to V3R7. --- products/rhel7/profiles/stig.profile | 4 ++-- products/rhel7/profiles/stig_gui.profile | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index 06bc62e679b..da0efc12855 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -1,7 +1,7 @@ documentation_complete: true metadata: - version: V3R6 + version: V3R7 SMEs: - ggbecker @@ -11,7 +11,7 @@ title: 'DISA STIG for Red Hat Enterprise Linux 7' description: |- This profile contains configuration checks that align to the - DISA STIG for Red Hat Enterprise Linux V3R6. + DISA STIG for Red Hat Enterprise Linux V3R7. In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this configuration baseline as applicable to the operating system tier of diff --git a/products/rhel7/profiles/stig_gui.profile b/products/rhel7/profiles/stig_gui.profile index 932d0342c8e..24f2b886a74 100644 --- a/products/rhel7/profiles/stig_gui.profile +++ b/products/rhel7/profiles/stig_gui.profile @@ -1,7 +1,7 @@ documentation_complete: true metadata: - version: V3R6 + version: V3R7 SMEs: - ggbecker @@ -11,7 +11,7 @@ title: 'DISA STIG with GUI for Red Hat Enterprise Linux 7' description: |- This profile contains configuration checks that align to the - DISA STIG with GUI for Red Hat Enterprise Linux V3R6. + DISA STIG with GUI for Red Hat Enterprise Linux V3R7. In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this configuration baseline as applicable to the operating system tier of