Changeset 197

Show
Ignore:
Timestamp:
06/10/08 12:23:51 (4 months ago)
Author:
slawrence
Message:

Update stigs/kickstart to meet latest stig update.
Update stigs/kickstart to audit different system calls on 64-bit and 32-bit machines.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/RHEL5.2/kickstart/clip.ks

    r195 r197  
    412412## (GEN000580: CAT II) (Previously – G019) The IAO will ensure all passwords contain a 
    413413## minimum of eight characters. 
    414 sed -i "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t8/" /etc/login.defs 
     414sed -i "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t14/" /etc/login.defs 
    415415 
    416416## (GEN000600: CAT II) (Previously – G019) The IAO will ensure passwords include at 
    …… 
    420420## (GEN000700: CAT II) (Previously – G020) The SA will ensure passwords are 
    421421## changed at least every 90 days. 
    422 sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs 
     422sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t60' /etc/login.defs 
    423423 
    424424## (GEN000800: CAT II) (Previously – G606) The SA will ensure passwords will not be 
    …… 
    633633## user umask is 077. 
    634634echo "umask 077" >> /etc/bashrc 
     635echo "umask 077" >> /etc/csh.cshrc 
    635636 
    636637## (GEN002640: CAT II) (Previously – G092) The SA will ensure logon capability 
    …… 
    687688cat <<-EOF >> /etc/audit/audit.rules 
    688689        # DAC permission changes 
    689         -a exit,always -S chmod -S chown -S chown32 -S fchmod -S fchown -S fchown32 -S lchown -S lchown32 
    690  
    691690EOF 
     691echo -n "-a exit,always -S chmod -S chown -S fchmod -S fchown -S lchown" >> /etc/audit/audit.rules 
     692if [ "$(uname -i)" != "x86_64" ] 
     693then 
     694        echo -n " -S chown32 -S fchown32 -S lchown32" >> /etc/audit/audit.rules 
     695fi 
     696echo -e "\n" >> /etc/audit/audit.rules 
    692697 
    693698## (GEN002760: CAT II) The SA will configure the auditing system to audit 
    …… 
    695700cat <<-EOF >> /etc/audit/audit.rules 
    696701        # unauthorized file access attempts 
    697         -a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S truncate64 -S ftruncate -S ftruncate64 
    698  
    699702EOF 
     703echo -n "-a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S ftruncate" >> /etc/audit/audit.rules 
     704if [ "$(uname -i)" != "x86_64" ] 
     705then 
     706        echo -n " -S truncate64 -S ftruncate64" >> /etc/audit/audit.rules 
     707fi 
     708echo -e "\n" >> /etc/audit/audit.rules 
    700709 
    701710## (GEN002780: CAT II) The SA will configure the auditing system to audit 
    …… 
    703712cat <<-EOF >> /etc/audit/audit.rules 
    704713        # privileged commands 
    705         -a exit,always -S chroot -S mount -S umount -S umount2 -S adjtimex -S kill 
    706714        -w /usr/sbin/pwck 
    707715        -w /bin/chgrp 
    …… 
    716724        -w /usr/bin/setfacl 
    717725        -w /usr/bin/chacl 
    718  
    719726EOF 
     727echo -n "-a exit,always -S chroot -S mount -S umount2 -S adjtimex -S kill" >> /etc/audit/audit.rules 
     728if [ "$(uname -i)" != "x86_64" ] 
     729then 
     730        echo -n " -S umount" >> /etc/audit/audit.rules 
     731fi 
     732echo -e "\n" >> /etc/audit/audit.rules 
    720733 
    721734## (GEN002800: CAT II) The SA will configure the auditing system to audit 
    …… 
    750763        -w /var/run/utmp 
    751764        -w /var/run/wtmp 
    752         -a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S stime -S swapon 
    753  
    754765EOF 
     766echo -n "-a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S swapon" >> /etc/audit/audit.rules 
     767if [ "$(uname -i)" != "x86_64" ] 
     768then 
     769        echo -n " -S stime" >> /etc/audit/audit.rules 
     770fi 
     771echo -e "\n" >> /etc/audit/audit.rules 
    755772 
    756773## (GEN002840: CAT II) The SA will configure the auditing system to audit 
    …… 
    973990## (GEN004500: CAT II) (Previously – G136) The SA will ensure the critical 
    974991## sendmail log file has permissions of 644, or more restrictive. 
    975 chmod 644 /var/log/maillog 
     992chmod 640 /var/log/maillog 
    976993 
    977994## (GEN004540: CAT II) The SA will ensure the help sendmail command is 
    …… 
    979996mv /etc/mail/helpfile /etc/mail/helpfile.bak 
    980997echo "" > /etc/mail/helpfile 
     998sed -i '/HelpFile/s/^/#/' /etc/mail/sendmail.cf 
    981999 
    9821000## (GEN004560: CAT II) (Previously – G646) To help mask the e-mail version, 
    …… 
    11361154/usr/sbin/userdel halt 
    11371155/usr/sbin/userdel sync 
     1156/usr/sbin/userdel ftp 
    11381157 
    11391158## (LNX00340: CAT II) (Previously – L142) The SA will delete accounts that 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen000580.sh

    r115 r197  
    66echo ' Patching GEN000580: Set minimum Password length.' 
    77echo '===================================================' 
    8 sed --in-place "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t8/" /etc/login.defs 
     8sed --in-place "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t14/" /etc/login.defs 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen000700.sh

    r144 r197  
    77echo '                    between password changes' 
    88echo '===================================================' 
    9 sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs 
     9sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t60' /etc/login.defs 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002560.sh

    r115 r197  
    66echo ' Patching GEN002560: Set default umask.' 
    77echo '===================================================' 
    8 echo " 
    9 # New files are only accessible to their owner by default. 
    10 umask 077" >> /etc/bashrc 
     8echo "umask 077" >> /etc/bashrc 
     9echo "umask 077" >> /etc/csh.cshrc 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002740.sh

    r192 r197  
    88echo '===================================================' 
    99cat <<-EOF >> /etc/audit/audit.rules 
    10         # DAC permission changes 
    11         -a exit,always -S chmod -S chown -S chown32 -S fchmod -S fchown -S fchown32 -S lchown -S lchown32 
    12  
     10    # DAC permission changes 
    1311EOF 
     12echo -n "-a exit,always -S chmod -S chown -S fchmod -S fchown -S lchown" >> /etc/audit/audit.rules 
     13if [ "$(uname -i)" != "x86_64" ] 
     14then 
     15    echo -n " -S chown32 -S fchown32 -S lchown32" >> /etc/audit/audit.rules 
     16fi 
     17echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002760.sh

    r192 r197  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # unauthorized file access attempts 
    10         -a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S truncate64 -S ftruncate -S ftruncate64 
    11  
     9    # unauthorized file access attempts 
    1210EOF 
     11echo -n "-a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S ftruncate" >> /etc/audit/audit.rules 
     12if [ "$(uname -i)" != "x86_64" ] 
     13then 
     14    echo -n " -S truncate64 -S ftruncate64" >> /etc/audit/audit.rules 
     15fi 
     16echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002780.sh

    r192 r197  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # privileged commands 
    10         -a exit,always -S chroot -S mount -S umount -S umount2 -S adjtimex -S kill 
    11         -w /usr/sbin/pwck 
    12         -w /bin/chgrp 
    13         -w /usr/bin/newgrp 
    14         -w /usr/sbin/groupadd 
    15         -w /usr/sbin/groupmod 
    16         -w /usr/sbin/groupdel 
    17         -w /usr/sbin/useradd 
    18         -w /usr/sbin/userdel 
    19         -w /usr/sbin/usermod 
    20         -w /usr/bin/chage 
    21         -w /usr/bin/setfacl 
    22         -w /usr/bin/chacl 
    23  
     9    # privileged commands 
     10    -w /usr/sbin/pwck 
     11    -w /bin/chgrp 
     12    -w /usr/bin/newgrp 
     13    -w /usr/sbin/groupadd 
     14    -w /usr/sbin/groupmod 
     15    -w /usr/sbin/groupdel 
     16    -w /usr/sbin/useradd 
     17    -w /usr/sbin/userdel 
     18    -w /usr/sbin/usermod 
     19    -w /usr/bin/chage 
     20    -w /usr/bin/setfacl 
     21    -w /usr/bin/chacl 
    2422EOF 
     23echo -n "-a exit,always -S chroot -S mount -S umount2 -S adjtimex -S kill" >> /etc/audit/audit.rules 
     24if [ "$(uname -i)" != "x86_64" ] 
     25then 
     26    echo -n " -S umount" >> /etc/audit/audit.rules 
     27fi 
     28echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002820.sh

    r192 r197  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # system administration actions 
    10         # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
    11         -w /var/log/audit/audit.log 
    12         -w /var/log/audit/audit[1-4].log 
    13         -w /var/log/messages 
    14         -w /var/log/lastlog 
    15         -w /var/log/faillog 
    16         -w /etc/audit/auditd.conf -p wa 
    17         -w /etc/audit/audit.rules -p wa 
    18         -w /etc/selinux/config -p wa 
    19         -w /etc/passwd -p wa 
    20         -w /etc/shadow -p wa 
    21         -w /etc/group  -p wa 
    22         -w /etc/ssh/sshd_config 
    23         -w /etc/pam.d 
    24         -w /etc/login.defs 
    25         -w /etc/rc.d/init.d 
    26         -w /etc/inittab -p wa 
    27         -w /var/run/utmp 
    28         -w /var/run/wtmp 
    29         -a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S stime -S swapon 
    30  
     9    # system administration actions 
     10    # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
     11    -w /var/log/audit/audit.log 
     12    -w /var/log/audit/audit[1-4].log 
     13    -w /var/log/messages 
     14    -w /var/log/lastlog 
     15    -w /var/log/faillog 
     16    -w /etc/audit/auditd.conf -p wa 
     17    -w /etc/audit/audit.rules -p wa 
     18    -w /etc/selinux/config -p wa 
     19    -w /etc/passwd -p wa 
     20    -w /etc/shadow -p wa 
     21    -w /etc/group  -p wa 
     22    -w /etc/ssh/sshd_config 
     23    -w /etc/pam.d 
     24    -w /etc/login.defs 
     25    -w /etc/rc.d/init.d 
     26    -w /etc/inittab -p wa 
     27    -w /var/run/utmp 
     28    -w /var/run/wtmp 
    3129EOF 
     30echo -n "-a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S swapon" >> /etc/audit/    audit.rules 
     31if [ "$(uname -i)" != "x86_64" ] 
     32then 
     33    echo -n " -S stime" >> /etc/audit/audit.rules 
     34fi 
     35echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen004500.sh

    r115 r197  
    66echo 'Patching GEN004500: Set mail log file permissions' 
    77echo '===================================================' 
    8 chmod 644 /var/log/maillog 
     8chmod 640 /var/log/maillog 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen004540.sh

    r115 r197  
    88mv /etc/mail/helpfile /etc/mail/helpfile.bak 
    99echo "" > /etc/mail/helpfile 
     10sed -i '/HelpFile/s/^/#/' /etc/mail/sendmail.cf 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/lnx00340.sh

    r121 r197  
    1212/usr/sbin/userdel gopher 
    1313/usr/sbin/userdel nfsnobody 
     14/usr/sbin/userdel ftp