Changeset 144

Show
Ignore:
Timestamp:
12/20/07 15:02:06 (1 year ago)
Author:
slawrence
Message:

Update STIGs to match those in the kickstart

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/RHEL5.1/scripts/stig-fix/cat1/gen002700.sh

    r121 r144  
    66echo 'Patching GEN002700: Set audit file permissions' 
    77echo '===================================================' 
    8 chmod 600 /var/log/audit/* 
     8chmod 640 /var/log/audit/* 
     9chmod 640 /etc/audit/audit.rules 

  • trunk/RHEL5.1/scripts/stig-fix/cat1/gen004640.sh

    r115 r144  
    77echo '===================================================' 
    88sed --in-place s/^decode\:/\#decode\:/ /etc/aliases 
     9/usr/bin/newaliases 

  • trunk/RHEL5.1/scripts/stig-fix/cat1/gen005500.sh

    r113 r144  
    1313        echo "Protocol 2" >> /etc/ssh/sshd_config 
    1414fi 
     15echo 'Ciphers aes256-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,3des-cbc' >> /etc/ssh/ssh_config 

  • trunk/RHEL5.1/scripts/stig-fix/cat1/lnx00580.sh

    r115 r144  
    77echo ' Patching LNX00580: Disable CTRL-ALT-DELETE' 
    88echo '===================================================' 
    9 sed --in-place s/ca\:\:ctrlaltdel/\#ca\:\:ctrlaltdel/ /etc/inittab 
     9sed --in-place "s/ca\:\:ctrlaltdel/\#ca\:\:ctrlaltdel/" /etc/inittab 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000020.sh

    r121 r144  
    1111echo "" >> /etc/inittab 
    1212echo "#Require password in single-user mode" >> /etc/inittab 
    13 echo "~:S:wait:/sbin/sulogin" >> /etc/inittab 
     13echo "~~:S:wait:/sbin/sulogin" >> /etc/inittab 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000400.sh

    r115 r144  
    66echo ' Patching GEN000400: Providing logon-warning banner' 
    77echo '===================================================' 
    8 echo "THIS IS A DEPARTMENT OF DEFENSE COMPUTER SYSTEM.  THIS COMPUTER SYSTEM, 
     8cat <<-EOF > /etc/issue 
     9THIS IS A DEPARTMENT OF DEFENSE COMPUTER SYSTEM.  THIS COMPUTER SYSTEM, 
    910INCLUDING ALL RELATED EQUIPMENT, NETWORKS, AND NETWORK DEVICES 
    1011(SPECIFICALLY INCLUDING INTERNET ACCESS), ARE PROVIDED ONLY FOR AUTHORIZED 
    …… 
    2425MONITORING MAY BE USED FOR ADMINISTRATIVE, CRIMINAL, OR OTHER ADVERSE ACTION. 
    2526USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING FOR THESE PURPOSES. 
    26 " > /etc/issue 
     27EOF 
    2728 
    2829# Change banner for SSH logins so that it matches the above 
    29 sed --in-place /banner/d /etc/ssh/sshd_config 
    30 sed --in-place /Banner/d /etc/ssh/sshd_config 
    31 echo " 
    32 # use the same banner as local logins 
    33 Banner /etc/issue" >> /etc/ssh/sshd_config 
     30sed -i "/^#Banner/ c\Banner /etc/issue" /etc/ssh/sshd_config 
     31 
     32# Add code to /etc/gdm/PreSession/Default so graphical login shows etc/issue 
     33sed -i  "s/^\(PATH=.*\)/\/usr\/bin\/gdialog --yesno \"\`cat \/etc\/issue\`\"\nif( test 1 -eq \$\? ); then\n  \/usr\/bin\/gdialog --infobox \"Logging out in 10 Seconds\" 1 20 \&\n  sleep 10\n  exit 1\nfi\n\n\1/" /etc/gdm/PreSession/Default 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000700.sh

    r115 r144  
    77echo '                    between password changes' 
    88echo '===================================================' 
    9 sed -i '/^PASS_MAX_DAYS/ c\ 
    10 PASS_MAX_DAYS\t90' /etc/login.defs 
     9sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000920.sh

    r115 r144  
    77echo ' Patching GEN000920: /root is only readable by root' 
    88echo '===================================================' 
    9 chmod -R 700 /root 
     9chmod 700 /root 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001120.sh

    r121 r144  
    66echo 'Patching GEN001120: Do not allow root remote login' 
    77echo '===================================================' 
    8 sed -i "/^#PermitRootLogin/ c\ 
    9 PermitRootLogin no" /etc/ssh/sshd_config 
     8sed -i "/^#PermitRootLogin/ c\PermitRootLogin no" /etc/ssh/sshd_config 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001260.sh

    r115 r144  
    77echo '                     log files.' 
    88echo '===================================================' 
    9 chmod 640 /var/log/wtmp 
     9find /var/log/ -type f -exec chmod 640 '{}' \; 
     10sed -i "s/chmod 0664/chmod 0640/" /etc/rc.d/rc.sysinit 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001720.sh

    r112 r144  
    77echo '                    initialization files' 
    88echo '===================================================' 
    9 FILES="/etc/profile /etc/bashrc /etc/environment" 
    10 chmod 644 $FILES 
     9chmod 644 /etc/{profile,bashrc,environment} 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001740.sh

    r112 r144  
    77echo '                    initialization files' 
    88echo '===================================================' 
    9 FILES="/etc/profile /etc/bashrc /etc/environment" 
    10 chown root $FILES 
     9chown root /etc/{profile,bashrc,environment} 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001760.sh

    r112 r144  
    77echo '                    initialization files' 
    88echo '===================================================' 
    9 FILES="/etc/profile /etc/bashrc /etc/environment" 
    10 chgrp root $FILES 
     9chgrp root /etc/{profile,bashrc,environment} 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002120.sh

    r113 r144  
    66echo 'Patching GEN002120: Set /etc/shells' 
    77echo '===================================================' 
    8 echo " 
     8cat <<EOF > /etc/shells 
    99/bin/sh 
    1010/bin/bash 
    …… 
    1212/bin/tcsh 
    1313/bin/csh 
    14 /bin/ksh" > /etc/shells 
     14/bin/ksh 
     15EOF 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002660.sh

    r121 r144  
    77echo '===================================================' 
    88/sbin/chkconfig auditd on 
     9cat <<-EOF > /etc/audit/audit.rules 
     10        # Remove any existing rules 
     11        -D 
     12        # Increase buffer size to handle the increased number of messages. 
     13        -b 8192 
     14EOF 
     15 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen003600.sh

    r121 r144  
    55echo ' Patching GEN003600: Set network parameters'  
    66echo '===================================================' 
    7 cat <<EOF > /etc/sysctl.conf 
    8 net.ipv4.ip_forward     = 0 
    9 net.ipv4.tcp_max_syn_backlog = 1280 
    10 net.ipv4.conf.all.accept_source_route =0 
    11 net.ipv4.icmp_echo_ignore_broadcasts = 1 
     7sed -i "/net\.ipv4\.conf\.all\.rp_filter/ c\net.ipv4.conf.all.rp_filter = 1" /etc/sysctl.conf 
     8sed -i "/net\.ipv4\.conf\.default\.accept_source_route/ c\net.ipv4.conf.default.accept_source_route = 0" /etc/sysctl.conf 
     9cat <<-EOF >> /etc/sysctl.conf 
     10       net.ipv4.tcp_max_syn_backlog = 1280 
     11       net.ipv4.icmp_echo_ignore_broadcasts = 1 
    1212EOF 
    13  

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen003740.sh

    r115 r144  
    1111echo '===================================================' 
    1212chmod -R 755 /etc/xinetd.d 
    13 chmod 400 /etc/xinetd.conf 
     13chmod 440 /etc/xinetd.conf 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen003960.sh

    r110 r144  
    66echo 'Patching GEN003960: Set traceroute comand owner' 
    77echo '===================================================' 
    8 whereis traceroute | cut -d " " -f 2 | xargs chown root 
     8chown root /bin/traceroute 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen003980.sh

    r110 r144  
    77echo '                    traceroute command' 
    88echo '===================================================' 
    9 whereis traceroute | cut -d " " -f 2 | xargs chgrp root 
     9chgrp root /bin/traceroute 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen004000.sh

    r121 r144  
    77echo '                     root user only.' 
    88echo '===================================================' 
    9 whereis traceroute | cut -d " " -f 2 | xargs chmod 700 
     9chmod 700 /bin/traceroute 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen006620.sh

    r115 r144  
    77echo ' Patching GEN006620: Set hosts.deny file' 
    88echo '===================================================' 
    9 echo " 
    10 ALL: ALL" >> /etc/hosts.deny 
     9echo "ALL: ALL" > /etc/hosts.deny 

  • trunk/RHEL5.1/scripts/stig-fix/cat3/gen001280.sh

    r115 r144  
    77echo ' Patching GEN001280: Set manual page permissions' 
    88echo '===================================================' 
    9 chmod -R 644 /usr/share/man 
     9find /usr/share/man -type f -exec chmod 644 {} \; 

  • trunk/RHEL5.1/scripts/stig-fix/cat3/gen001780.sh

    r121 r144  
    77echo '                    initialization files' 
    88echo '===================================================' 
    9 FILES="/etc/profile /etc/bashrc /etc/environment" 
    10 for FILE in $FILES; do 
     9for FILE in /etc/{profile,bashrc,environment}; do 
    1110        echo "mesg n" >> $FILE 
    1211done; 

  • trunk/RHEL5.1/scripts/stig-fix/cat3/gen003500.sh

    r110 r144  
    66echo 'Patching GEN003500: Disable core dumps' 
    77echo '===================================================' 
    8 echo " 
    9 * soft core 0 
    10 * hard core 0" >> /etc/security/limits.conf 
     8echo "* - core 0" >> /etc/security/limits.conf 

  • trunk/RHEL5.1/scripts/stig-fix/cat3/gen003520.sh

    r115 r144  
    77echo ' Patching GEN003520: Set crash log dir permissions' 
    88echo '===================================================' 
     9chown root:root /var/crash 
    910chmod -R 700 /var/crash 

  • trunk/RHEL5.1/scripts/stig-fix/cat4/gen004440.sh

    r112 r144  
    88echo 'Patching GEN004440: Set sendmail logging level' 
    99echo '===================================================' 
    10 sed -i '/LogLevel/ c\ 
    11 O LogLevel=9' /etc/mail/sendmail.cf  
     10sed -i '/LogLevel/ c\O LogLevel=9' /etc/mail/sendmail.cf