Changeset 141

Timestamp:

12/17/07 15:27:35 (1 year ago)

Author:

slawrence

Message:

Added stigs to kickstart

Files:

• trunk/RHEL5.1/kickstart/clip.ks (modified) (14 diffs)

trunk/RHEL5.1/kickstart/clip.ks

@@ -416 +416 @@
-                chmod 644 /var/log/maillog
-
+                ## (GEN004480: CAT II) (Previously – G135) The SA will ensure the owner of the
+                ## critical sendmail log file is root.
+                chown root /var/log/maillog
+
-                ## (GEN003180: CAT II) (Previously – G210) The SA will ensure cron logs have 
-                ## permissions of 600, or more restrictive.
@@ -589 +593 @@
-                        auth.*                                  /var/log/authlog" >> /etc/syslog.conf
-
+                        ## (GEN004440: CAT IV) (Previously – G133) The SA will ensure the sendmail
+                        ## logging level (the detail level of e-mail tracing and debugging
+                        ## information) in the sendmail.cf file is set to a value no lower than
+                        ## nine (9).
+                        sed -i '/LogLevel/ c\O LogLevel=9' /etc/mail/sendmail.cf
+
-
-# 4.B.4.a(7) 
@@ -673 +683 @@
-                sed -i "s/difok\=3/difok\=3 dcredit\=-2 ucredit\=-2 ocredit\=-2 lcredit\=-2/" /etc/pam.d/system-auth
-
-
-                # Running the authconfig tool WILL clobber these changes!
-                # Taking the executable permissions off of /usr/sbin/authconfig
@@ -725 +734 @@
-                chmod 400 /etc/shadow
-
+                ## (GEN000560: CAT I) (Previously – G018) The SA will ensure each account in 
+                ## the /etc/passwd file has a password assigned or is disabled in the 
+                ## password, shadow, or equivalent, file by disabling the password and/or by 
+                ## assigning a false shell in the password file.
+                for USERINFO in `cat /etc/shadow`; do
+            if [ -z "`echo $USERINFO | cut -d: -f2`" ]
+            then
+                /usr/sbin/usermod -L -s /dev/null `echo $USERINFO | cut -d: -f1`
+            fi
+                done;
-
-# 4.B.4.a(12) 
@@ -734 +753 @@
-#                    the /etc/ssh/ssh_config file to use stronger encryption.
-#                    AES with 256-bit key Cycpher Block Chaining  
-
+
+
-        perl -npe 's/\#\s+Cipher\s+3des/Ciphers aes256-cbc/' -i /etc/ssh/ssh_config 
-
@@ -789 +809 @@
-        # to be easily done using pam_passwdqc
-        # Further restricting root logins
+        ## TODO: Find stig for this
-        cat <<-EOF > /etc/pam.d/su
-                # %PAM-1.0
@@ -1075 +1096 @@
-                echo "console" > /etc/securetty
-
+                ## (LNX00620: CAT II) The SA will ensure the group owner of the /etc/securetty
+                ## file is root, sys, or bin.
+                chgrp root /etc/securetty
+
+                ## (LNX00640: CAT II) The SA will ensure the owner of the /etc/securetty file
+                ## is root.
+                chown root /etc/securetty
+
+                ## (LNX00660: CAT II) The SA will ensure the /etc/securetty file has
+                ## permissions of 640, or more restrictive.
+                chmod 640 /etc/securetty
+
-                ## (GEN001020: CAT II) The IAO will enforce users requiring root privileges to
-                ## log on to their personal account and invoke the /bin/su - command to switch
@@ -1123 +1156 @@
-
-                # World Writable files
-
+
+
+
-                for part in `awk '($3== "ext2" || $3 == "ext3") { print $2 }' /etc/fstab`
-                do
-
-
+
-                done
+                gzip --best $OUTFILE
+                )
-
-                # SUID | SGID files
-
+
+
+
-                for part in `awk '($3== "ext2" || $3 == "ext3") { print $2 }' /etc/fstab`
-                do
-
-
+
-                done
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-                awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
-
@@ -1274 +1314 @@
-                chgrp root /var/spool/cron
-
+                ## (GEN003500: CAT III) The SA will ensure core dumps are disabled or
+                ## restricted.
+                echo "* - core 0" >> /etc/security/limits.conf
+
-                ## (GEN003520: CAT III) The SA will ensure the owner and group owner of the
-                ## core dump  data directory is root with permissions of 700, or more
@@ -1290 +1334 @@
-                ##   O SmtpGreetingMessage= Mail Server Ready ; $b
-                sed -i '/SmtpGreetingMessage/ c\O SmtpGreetingMessage= Mail Server Ready ; $b' /etc/mail/sendmail.cf
+
+                ## (GEN004540: CAT II) The SA will ensure the help sendmail command is
+                ## disabled.
+                mv /etc/mail/helpfile /etc/mail/helpfile.bak
+                echo "" > /etc/mail/helpfile
+
+                ## (GEN004580: CAT I) (Previously – G647) The SA will ensure .forward files
+                ## are not used.
+                for HOMEDIR in `cut -d: -f6 /etc/passwd`; do
+            if [ -f $HOMEDIR/.forward ]
+                then
+                        rm $HOMEDIR/.forward
+                fi
+                done;
-
-                ## (GEN004360: CAT II) (Previously – G127) The SA will ensure the aliases file 
@@ -1314 +1372 @@
-                EOF
-
+                ## (LNX00480: CAT II) (Previously – L204) The SA will ensure the owner of the 
+                ## /etc/sysctl.conf file is root.
+                chown root /etc/sysctl.conf
+
+                ## (LNX00500: CAT II) (Previously – L206) The SA will ensure the group owner 
+                ## of the /etc/sysctl.conf file is root.
+                chgrp root /etc/sysctl.conf
+
-                ## (LNX00520: CAT II) (Previously – L208) The SA will ensure the
-                ## /etc/sysctl.conf file has permissions of 600, or more restrictive.
@@ -1343 +1409 @@
-                /usr/sbin/userdel nfsnobody
-
+                ## (GEN002640: CAT II) (Previously – G092) The SA will ensure logon capability
+                ## to default system accounts (e.g., bin, lib, uucp, news, sys, guest, daemon,
+                ## and any default account not normally logged onto) will be disabled by
+                ## making the default shell /bin/false, /usr/bin/false, /sbin/false,
+                ## /sbin/nologin, or /dev/null, and by locking the password.
+                for NAME in `cut -d: -f1 /etc/passwd`; do
+                        NAMEID=`id -u $NAME`
+                        if [ $NAMEID -lt 500 -a $NAME != 'root' ]; then
+                                /usr/sbin/usermod -L -s /dev/null $NAME
+                        fi
+                done
+
+                ## (GEN001080: CAT III) (Previously – G229) The SA will ensure the root shell
+                ## is not located in /usr if /usr is partitioned.
+                /usr/sbin/usermod -s /bin/bash root
+
+                ## (GEN001460: CAT IV) (Previously – G052) The SA will ensure all home
+                ## directories defined in the /etc/passwd file exist.
+                for HOMEDIR in `cut -d: -f6 /etc/passwd`; do
+                if [  ! -d $HOMEDIR ]
+                then
+                        mkdir $HOMEDIR
+                fi
+                done;
+
-                ## (GEN004640: CAT I) (Previously – V126) The SA will ensure the decode entry
-                ## is disabled (deleted or commented out) from the alias file.
@@ -1348 +1439 @@
-                /usr/bin/newaliases
-
+                ## (LNX00400: CAT II) (Previously – L044) The SA will ensure the owner of the
+                ## /etc/login.access or /etc/security/access.conf file is root.
+                chown root /etc/security/access.conf
+
+                ## (LNX00420: CAT II) (Previously – L045) The SA will ensure the group owner 
+                ## of the /etc/login.access or /etc/security/access.conf file is root.
+                chgrp root /etc/security/access.conf
+
-                ## (LNX00440: CAT II) (Previously – L046) The SA will ensure /etc/login.access
-                ## or /etc/security/access.conf file will be 640, or more restrictive.
-                chmod 640 /etc/security/access.conf
+
+                ## (LNX00160: CAT II) (Previously – L074) The SA will ensure the grub.conf
+                ## file has permissions of 600, or more restrictive.
+                chmod 600 /boot/grub/grub.conf
+
+                ## (LNX00220: CAT II) (Previously – L080) The SA will ensure the lilo.conf
+                ## file has permissions of 600 or more restrictive.
+                chmod 600 /etc/lilo.conf
-
-                ## (GEN006100: CAT II) (Previously – L050) The SA will ensure the owner of 
@@ -1416 +1523 @@
-                ## of all files in /etc/news is root or news.
-                chgrp -R root /etc/news/*
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-# 4.B.4.b(6)