Changeset 218

Show
Ignore:
Timestamp:
07/24/08 08:53:37 (4 months ago)
Author:
slawrence
Message:

Backport 5.2 stig/ks changes to 5.1, including:
- Use different audit rules for 32-bit and 64-bit archs
- Fix installation of audit.rules
- Specify audit dispatcher in auditd.conf
- Specifiy dispatcher in auditd.conf
- Use pam_passwdqc instead of pam_cracklib
- Update password minimum length and max days
- Use different audit rules for 32 and 64 bit archs
- Permission updates to meet stigs

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/RHEL5.1/RPM/clip.spec

    r133 r218  
    22Name: clip 
    33Version: 2.0 
    4 Release: 1 
     4Release: 2 
    55License: GPL 
    66Group: System Environment/Base 
    …… 
    3737%defattr(-,root,root,-) 
    3838/usr/share/clip/conf/audit/auditd.conf 
    39 /usr/share/clip/conf/audit/audit.rules 
     39/usr/share/clip/conf/audit/audit-i386.rules 
     40/usr/share/clip/conf/audit/audit-x86_64.rules 
    4041/usr/share/clip/conf/pam/login.pam 
    4142/usr/share/clip/conf/pam/newrole.pam 

  • trunk/RHEL5.1/conf/audit/auditd.conf

    r1 r218  
    99freq = 20 
    1010num_logs = 4 
    11 #dispatcher = /root/src/skeleton 
     11dispatcher = /sbin/audispd 
    1212max_log_file = 5  
    1313max_log_file_action = ROTATE 

  • trunk/RHEL5.1/conf/pam/system-auth.pam

    r154 r218  
    1010account     required      pam_unix.so 
    1111account     required      pam_tally3.so 
    12 password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     12password    required      pam_passwdqc.so min=disabled,disabled,disabled,disabled,14 max=40 passphrase=0 match=0 similar=deny random=0 enforce=everyone retry=3 
    1313password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
    1414 

  • trunk/RHEL5.1/kickstart/clip.ks

    r192 r218  
    344344        encryption or biometric access controls provide security for the benefit of 
    345345        the USG. These protections are not provided for your benefit or privacy and 
    346         may be modified or elimiated at the USG's discretion. 
     346        may be modified or eliminated at the USG's discretion. 
    347347 
    348348EOF 
    …… 
    359359cat <<-EOF > /etc/pam.d/system-auth 
    360360#%PAM-1.0 
    361 auth        required      pam_tally.so deny=3 onerr=fail unlock_time=900 quiet 
     361auth        required      pam_tally.so deny=3 onerr=fail unlock_time=900 
    362362 
    363363auth        required      pam_env.so 
    …… 
    366366account     required      pam_unix.so 
    367367account     required      pam_tally.so 
    368 password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     368password    required      pam_passwdqc.so min=disabled,disabled,disabled,disabled,14 max=40 passphrase=0 match=0 similar=deny random=0 enforce=everyone retry=3  
    369369password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
    370370 
    …… 
    384384## mechanism is used and is set to lock the screen after 15 minutes of 
    385385## inactivity. 
    386 echo "TMOUT=900" >> /etc/profile 
     386echo "readonly TMOUT=900" >> /etc/profile 
    387387 
    388388## (GEN000540: CAT II) (Previously – G004) The SA will ensure passwords are 
    …… 
    403403## (GEN000580: CAT II) (Previously – G019) The IAO will ensure all passwords contain a 
    404404## minimum of eight characters. 
    405 sed -i "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t8/" /etc/login.defs 
     405sed -i "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t14/" /etc/login.defs 
    406406 
    407407## (GEN000600: CAT II) (Previously – G019) The IAO will ensure passwords include at 
    …… 
    411411## (GEN000700: CAT II) (Previously – G020) The SA will ensure passwords are 
    412412## changed at least every 90 days. 
    413 sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs 
     413sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t60' /etc/login.defs 
    414414 
    415415## (GEN000800: CAT II) (Previously – G606) The SA will ensure passwords will not be 
    …… 
    516516## (GEN001780: CAT III) (Previously – G112) The SA will ensure global 
    517517## initialization files contain the command mesg –n. 
    518 for FILE in /etc/{profile,bashrc,environment}; do 
     518for FILE in /etc/{profile,bashrc}; do 
    519519        echo "mesg n" >> $FILE 
    520520done; 
    …… 
    623623## (GEN002560: CAT II) (Previously – G089) The SA will ensure the system and 
    624624## user umask is 077. 
    625 echo "umask 077" >> /etc/bashrc 
     625sed -i "/umask/ c\umask 077" /etc/bashrc 
     626sed -i "/umask/ c\umask 077" /etc/csh.cshrc 
     627 
    626628 
    627629## (GEN002640: CAT II) (Previously – G092) The SA will ensure logon capability 
    …… 
    655657EOF 
    656658 
     659cat <<-EOF > /etc/audit/auditd.conf 
     660        log_file = /var/log/audit/audit.log 
     661        log_format = RAW 
     662        priority_boost = 3 
     663        flush = INCREMENTAL 
     664        freq = 20 
     665        num_logs = 4 
     666        dispatcher = /sbin/audispd 
     667        max_log_file = 5  
     668        max_log_file_action = ROTATE 
     669        space_left = 75 
     670        space_left_action = SYSLOG 
     671        action_mail_acct = root 
     672        admin_space_left = 50 
     673        admin_space_left_action = HALT 
     674        disk_full_action = HALT 
     675        disk_error_action = HALT 
     676EOF 
     677 
    657678## (GEN002680: CAT II) (Previously – G094) The SA will ensure audit data files 
    658679## and directories will be readable only by personnel authorized by the IAO. 
    …… 
    678699cat <<-EOF >> /etc/audit/audit.rules 
    679700        # DAC permission changes 
    680         -a exit,always -S chmod -S chown -S chown32 -S fchmod -S fchown -S fchown32 -S lchown -S lchown32 
    681  
    682701EOF 
     702echo -n "-a exit,always -S chmod -S chown -S fchmod -S fchown -S lchown" >> /etc/audit/audit.rules 
     703if [ "$(uname -i)" != "x86_64" ] 
     704then 
     705        echo -n " -S chown32 -S fchown32 -S lchown32" >> /etc/audit/audit.rules 
     706fi 
     707echo -e "\n" >> /etc/audit/audit.rules 
    683708 
    684709## (GEN002760: CAT II) The SA will configure the auditing system to audit 
    …… 
    686711cat <<-EOF >> /etc/audit/audit.rules 
    687712        # unauthorized file access attempts 
    688         -a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S truncate64 -S ftruncate -S ftruncate64 
    689  
    690713EOF 
     714echo "-a exit,always -S open -F success=0" >> /etc/audit/audit.rules 
     715echo -n "-a exit,always -F success=0 -S mknod -S pipe -S mkdir -S creat -S truncate -S ftruncate" >> /etc/audit/audit.rules 
     716if [ "$(uname -i)" != "x86_64" ] 
     717then 
     718        echo -n " -S truncate64 -S ftruncate64" >> /etc/audit/audit.rules 
     719fi 
     720echo -e "\n" >> /etc/audit/audit.rules 
    691721 
    692722## (GEN002780: CAT II) The SA will configure the auditing system to audit 
    …… 
    694724cat <<-EOF >> /etc/audit/audit.rules 
    695725        # privileged commands 
    696         -a exit,always -S chroot -S mount -S umount -S umount2 -S adjtimex -S kill 
    697726        -w /usr/sbin/pwck 
    698727        -w /bin/chgrp 
    …… 
    707736        -w /usr/bin/setfacl 
    708737        -w /usr/bin/chacl 
    709  
    710738EOF 
     739echo -n "-a exit,always -S chroot -S mount -S umount2 -S adjtimex -S kill" >> /etc/audit/audit.rules 
     740if [ "$(uname -i)" != "x86_64" ] 
     741then 
     742        echo -n " -S umount" >> /etc/audit/audit.rules 
     743fi 
     744echo -e "\n" >> /etc/audit/audit.rules 
    711745 
    712746## (GEN002800: CAT II) The SA will configure the auditing system to audit 
    …… 
    722756cat <<-EOF >> /etc/audit/audit.rules 
    723757        # system administration actions 
    724         # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
    725758        -w /var/log/audit/audit.log 
    726759        -w /var/log/audit/audit[1-4].log 
    …… 
    741774        -w /var/run/utmp 
    742775        -w /var/run/wtmp 
    743         -a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S stime -S swapon 
    744  
    745776EOF 
     777echo -n "-a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S swapon" >> /etc/audit/audit.rules 
     778if [ "$(uname -i)" != "x86_64" ] 
     779then 
     780        echo -n " -S stime" >> /etc/audit/audit.rules 
     781fi 
     782echo -e "\n" >> /etc/audit/audit.rules 
    746783 
    747784## (GEN002840: CAT II) The SA will configure the auditing system to audit 
    …… 
    771808## file has permissions of 600, or more restrictive. 
    772809chmod 600 /etc/cron.allow 
     810# see bottom of file 
    773811 
    774812## (GEN003040: CAT II) The SA will ensure the owner of crontabs is root or the 
    …… 
    9641002## (GEN004500: CAT II) (Previously – G136) The SA will ensure the critical 
    9651003## sendmail log file has permissions of 644, or more restrictive. 
    966 chmod 644 /var/log/maillog 
     1004chmod 640 /var/log/maillog 
    9671005 
    9681006## (GEN004540: CAT II) The SA will ensure the help sendmail command is 
    …… 
    9701008mv /etc/mail/helpfile /etc/mail/helpfile.bak 
    9711009echo "" > /etc/mail/helpfile 
     1010sed -i '/HelpFile/s/^/#/' /etc/mail/sendmail.cf 
    9721011 
    9731012## (GEN004560: CAT II) (Previously – G646) To help mask the e-mail version, 
    …… 
    11271166/usr/sbin/userdel halt 
    11281167/usr/sbin/userdel sync 
     1168/usr/sbin/userdel ftp 
    11291169 
    11301170## (LNX00340: CAT II) (Previously – L142) The SA will delete accounts that 
    …… 
    11881228chmod 640 /etc/securetty 
    11891229 
     1230 
     1231#check numbers of chvt  
     1232chvt 3  
     1233clear  
     1234echo "Please choose a root password"  
     1235passwd root  
     1236echo "Please choose a password for clipuser"  
     1237passwd clipuser  
     1238clear  
     1239chvt 7 
    11901240 
    11911241 
    …… 
    36443694# Kickstart Actions: None - PROCEDURAL REQUIREMENT 
    36453695 
     3696# see GEN002980 
     3697# something above is changing cron.allow to 644 
     3698# putting this here deals with that until I can figure out what is doing it 
     3699chmod 600 /etc/cron.allow 
     3700 
    36463701eject 
    36473702 

  • trunk/RHEL5.1/rpmify

    r174 r218  
    22 
    33VERSION="2.0" 
    4 RELEASE="1" 
     4RELEASE="2" 
    55ARCH=$(uname -i) 
    66OS="RHEL5" 

  • trunk/RHEL5.1/scripts/installer.in

    r193 r218  
    3838 
    3939InstallAudit() { 
     40 
    4041    Copy $AUDITDIR/auditd.conf /etc/audit/auditd.conf 
    41     Copy $AUDITDIR/audit.rules /etc/audit/audit.rules 
     42    if [ "$(uname -i)" == "x86_64" ] 
     43    then 
     44        Copy $AUDITDIR/audit-x86_64.rules /etc/audit/audit.rules 
     45    else 
     46        Copy $AUDITDIR/audit-i386.rules /etc/audit/audit.rules 
     47    fi 
     48 
    4249    auditctl -R /etc/audit/audit.rules 
    4350} 
    …… 
    5360        for f in $MANDIR/*.8; do 
    5461                Copy $f /usr/share/man/man8/$(basename $f) 
    55         done 
    56 } 
    57  
    58 # Install a collection of scripts to make CLIP  
    59 # STIG-compliant.  
    60 # Since these scripts are not likely to be found on the system, 
    61 # cp and not Copy() is used to install these files.  
    62 InstallStig() { 
    63         for d in $(ls -R $STIGFIXDIR); do 
    64                 cp -r $d /usr/share/clip/scripts/stig-fix &2>/dev/null 
    6562        done 
    6663} 
    …… 
    9289InstallPam 
    9390InstallMan 
    94 InstallStig 
    9591#RunStigFixes 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000400.sh

    r146 r218  
    2828encryption or biometric access controls provide security for the benefit of  
    2929the USG. These protections are not provided for your benefit or privacy and  
    30 may be modified or elimiated at the USG's discretion. 
     30may be modified or eliminated at the USG's discretion. 
    3131 
    3232EOF 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000460.sh

    r154 r218  
    1010cat <<-EOF > /etc/pam.d/system-auth 
    1111#%PAM-1.0 
    12 auth       required      pam_tally.so deny=3 onerr=fail unlock_time=900 quiet 
     12auth       required      pam_tally.so deny=3 onerr=fail unlock_time=900 
    1313 
    1414auth        required      pam_env.so 
    …… 
    1717account     required      pam_unix.so 
    1818account     required     pam_tally.so 
    19 password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     19password    required      pam_passwdqc.so min=disabled,disabled,disabled,disabled,14 max=40 passphrase=0 match=0 similar=deny random=0 enforce=everyone retry=3 
    2020password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
    2121 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000500.sh

    r113 r218  
    99echo 'Patching GEN000500: Set inactive shell timeout' 
    1010echo '===================================================' 
    11 echo "TMOUT=900" >> /etc/profile 
     11echo "readonly TMOUT=900" >> /etc/profile 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000580.sh

    r115 r218  
    66echo ' Patching GEN000580: Set minimum Password length.' 
    77echo '===================================================' 
    8 sed --in-place "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t8/" /etc/login.defs 
     8sed --in-place "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t14/" /etc/login.defs 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000700.sh

    r144 r218  
    77echo '                    between password changes' 
    88echo '===================================================' 
    9 sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs 
     9sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t60' /etc/login.defs 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002560.sh

    r115 r218  
    66echo ' Patching GEN002560: Set default umask.' 
    77echo '===================================================' 
    8 echo " 
    9 # New files are only accessible to their owner by default. 
    10 umask 077" >> /etc/bashrc 
     8sed -i "/umask/ c\umask 077" /etc/bashrc 
     9sed -i "/umask/ c\umask 077" /etc/csh.cshrc 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002660.sh

    r192 r218  
    2222EOF 
    2323 
     24cat <<-EOF > /etc/audit/auditd.conf 
     25        log_file = /var/log/audit/audit.log 
     26        log_format = RAW 
     27        priority_boost = 3 
     28        flush = INCREMENTAL 
     29        freq = 20 
     30        num_logs = 4 
     31        dispatcher = /sbin/audispd 
     32        max_log_file = 5  
     33        max_log_file_action = ROTATE 
     34        space_left = 75 
     35        space_left_action = SYSLOG 
     36        action_mail_acct = root 
     37        admin_space_left = 50 
     38        admin_space_left_action = HALT 
     39        disk_full_action = HALT 
     40        disk_error_action = HALT 
     41EOF 
     42 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002740.sh

    r192 r218  
    88echo '===================================================' 
    99cat <<-EOF >> /etc/audit/audit.rules 
    10         # DAC permission changes 
    11         -a exit,always -S chmod -S chown -S chown32 -S fchmod -S fchown -S fchown32 -S lchown -S lchown32 
    12  
     10    # DAC permission changes 
    1311EOF 
     12echo -n "-a exit,always -S chmod -S chown -S fchmod -S fchown -S lchown" >> /etc/audit/audit.rules 
     13if [ "$(uname -i)" != "x86_64" ] 
     14then 
     15    echo -n " -S chown32 -S fchown32 -S lchown32" >> /etc/audit/audit.rules 
     16fi 
     17echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002760.sh

    r192 r218  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # unauthorized file access attempts 
    10         -a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S truncate64 -S ftruncate -S ftruncate64 
    11  
     9    # unauthorized file access attempts 
    1210EOF 
     11echo "-a exit,always -S open -F success=0" >> /etc/audit/audit.rules 
     12echo -n "-a exit,always -F success=0 -S mknod -S pipe -S mkdir -S creat -S truncate -S ftruncate" >> /etc/audit/audit.rules 
     13if [ "$(uname -i)" != "x86_64" ] 
     14then 
     15    echo -n " -S truncate64 -S ftruncate64" >> /etc/audit/audit.rules 
     16fi 
     17echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002780.sh

    r192 r218  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # privileged commands 
    10         -a exit,always -S chroot -S mount -S umount -S umount2 -S adjtimex -S kill 
    11         -w /usr/sbin/pwck 
    12         -w /bin/chgrp 
    13         -w /usr/bin/newgrp 
    14         -w /usr/sbin/groupadd 
    15         -w /usr/sbin/groupmod 
    16         -w /usr/sbin/groupdel 
    17         -w /usr/sbin/useradd 
    18         -w /usr/sbin/userdel 
    19         -w /usr/sbin/usermod 
    20         -w /usr/bin/chage 
    21         -w /usr/bin/setfacl 
    22         -w /usr/bin/chacl 
    23  
     9    # privileged commands 
     10    -w /usr/sbin/pwck 
     11    -w /bin/chgrp 
     12    -w /usr/bin/newgrp 
     13    -w /usr/sbin/groupadd 
     14    -w /usr/sbin/groupmod 
     15    -w /usr/sbin/groupdel 
     16    -w /usr/sbin/useradd 
     17    -w /usr/sbin/userdel 
     18    -w /usr/sbin/usermod 
     19    -w /usr/bin/chage 
     20    -w /usr/bin/setfacl 
     21    -w /usr/bin/chacl 
    2422EOF 
     23echo -n "-a exit,always -S chroot -S mount -S umount2 -S adjtimex -S kill" >> /etc/audit/audit.rules 
     24if [ "$(uname -i)" != "x86_64" ] 
     25then 
     26    echo -n " -S umount" >> /etc/audit/audit.rules 
     27fi 
     28echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen002820.sh

    r192 r218  
    77echo '===================================================' 
    88cat <<-EOF >> /etc/audit/audit.rules 
    9         # system administration actions 
    10         # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
    11         -w /var/log/audit/audit.log 
    12         -w /var/log/audit/audit[1-4].log 
    13         -w /var/log/messages 
    14         -w /var/log/lastlog 
    15         -w /var/log/faillog 
    16         -w /etc/audit/auditd.conf -p wa 
    17         -w /etc/audit/audit.rules -p wa 
    18         -w /etc/selinux/config -p wa 
    19         -w /etc/passwd -p wa 
    20         -w /etc/shadow -p wa 
    21         -w /etc/group  -p wa 
    22         -w /etc/ssh/sshd_config 
    23         -w /etc/pam.d 
    24         -w /etc/login.defs 
    25         -w /etc/rc.d/init.d 
    26         -w /etc/inittab -p wa 
    27         -w /var/run/utmp 
    28         -w /var/run/wtmp 
    29         -a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S stime -S swapon 
    30  
     9    # system administration actions 
     10    -w /var/log/audit/audit.log 
     11    -w /var/log/audit/audit[1-4].log 
     12    -w /var/log/messages 
     13    -w /var/log/lastlog 
     14    -w /var/log/faillog 
     15    -w /etc/audit/auditd.conf -p wa 
     16    -w /etc/audit/audit.rules -p wa 
     17    -w /etc/selinux/config -p wa 
     18    -w /etc/passwd -p wa 
     19    -w /etc/shadow -p wa 
     20    -w /etc/group  -p wa 
     21    -w /etc/ssh/sshd_config 
     22    -w /etc/pam.d 
     23    -w /etc/login.defs 
     24    -w /etc/rc.d/init.d 
     25    -w /etc/inittab -p wa 
     26    -w /var/run/utmp 
     27    -w /var/run/wtmp 
    3128EOF 
     29echo -n "-a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S swapon" >> /etc/audit/    audit.rules 
     30if [ "$(uname -i)" != "x86_64" ] 
     31then 
     32    echo -n " -S stime" >> /etc/audit/audit.rules 
     33fi 
     34echo -e "\n" >> /etc/audit/audit.rules 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen004500.sh

    r115 r218  
    66echo 'Patching GEN004500: Set mail log file permissions' 
    77echo '===================================================' 
    8 chmod 644 /var/log/maillog 
     8chmod 640 /var/log/maillog 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen004540.sh

    r115 r218  
    88mv /etc/mail/helpfile /etc/mail/helpfile.bak 
    99echo "" > /etc/mail/helpfile 
     10sed -i '/HelpFile/s/^/#/' /etc/mail/sendmail.cf 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/lnx00340.sh

    r121 r218  
    1212/usr/sbin/userdel gopher 
    1313/usr/sbin/userdel nfsnobody 
     14/usr/sbin/userdel ftp 

  • trunk/RHEL5.1/scripts/stig-fix/cat3/gen001780.sh

    r144 r218  
    77echo '                    initialization files' 
    88echo '===================================================' 
    9 for FILE in /etc/{profile,bashrc,environment}; do 
     9for FILE in /etc/{profile,bashrc}; do 
    1010        echo "mesg n" >> $FILE 
    1111done;