Changeset 238

Timestamp:

08/14/08 14:52:21 (3 months ago)

Author:

slawrence

Message:

Install /var/log/tallylog3 so pam_tally will have something to log to
Update INSTALL file
Update policy to allow anacron to run unix_update and create pid files
Update policy to allow ssh to bind to 0.0.0.0

Files:

• trunk/RHEL5.2/INSTALL (modified) (1 diff)
• trunk/RHEL5.2/README (modified) (1 diff)
• trunk/RHEL5.2/RPM/clip.spec (modified) (1 diff)
• trunk/RHEL5.2/pam_tally3/Makefile (modified) (3 diffs)
• trunk/RHEL5.2/refpolicy/src/selinux-policy-clip/policy/modules/services/cron.te (modified) (2 diffs)
• trunk/RHEL5.2/refpolicy/src/selinux-policy-clip/policy/modules/services/ssh.if (modified) (1 diff)

trunk/RHEL5.2/INSTALL

@@ -2 +2 @@
-=================================================
-
-
-
+
-
-
-
-
-
-
+
-
-
+
-
-
-
-
-
+
+
-
-
-
+
-
-
-
-
+
-
-
-
-
-
-
-
-
-
-
+
-
+Boot from Disc 1 of the RHEL5.2 Server installation discs, supplying the kickstart script as a kernel boot parameter:
+
+Accessing the kickstart file:
+
+        boot> linux ks=http://someserver/clip.ks
+
+        - or -
+
+        boot> linux ks=http://ipaddr/clip.ks
+
+        - or -
+
+        boot> linux ks=<device name>:/clip.ks
+
+This will initiate the installation process. The user will choose appropriate values for settings prompted for by anaconda. At this point, anaconda will install the operating system and a few packages. At the end of the installation, you will be prompted to create a password for the 'root' and 'clipuser' users.  Once this is complete, a reboot will be necessary.
+
+After rebooting, login to the system with the 'clipuser' account and the password you created. (The user name should be entered without quotes.)
+
+Once this account has been authenticated, you will need to switch to the superuser account via the su command to complete the remaining steps of the CLIP installation. The password for this account is the root password you created.
+
+
+=== Installing Packages ===
+
+A full CLIP installation requires an update SELinux toolchain, modified policy and some other userland tools included in the clip rpm. You can optionally install the IPTables rpm to have the ability to dynamically label packets.
+
+The installation of RHEL 5.2 CLIP packages needs to occur in two phases, the second of which requires setting SELinux's enforcing mode to permissive.
+
+First, install the CLIP RPM for your architecture found in the Userland Packages section of http://oss.tresys.com/projects/clip/wiki/DownloadRelease#RHEL5.2:
+
+        # rpm -ivh --force clip-2.0-1.$ARCH.rpm
+
+The --force option is needed because a package installed in this step will overwrite files already installed by another package. During this step, some system configuration files will be backed up and replaced by files provided by CLIP.
+
+CLIP distributes an optionally installed IPTables package update that supports per packet labeling using SECMARK. A detailed description of SECMARK is available at: http://james-morris.livejournal.com/11010.html. The IPTables package is available at http://oss.tresys.com/projects/clip/wiki/DownloadRelease#RHEL5.2.
+
+To use the update first install the rpm:
+
+        # rpm -Uvh iptables-1.3.5-4.99.el5.$ARCH.rpm
+
+After installing the rpm you must turn off the compat_net option that is enabled by the clip kickstart file. You can enable this at runtime by using the command
+
+        # echo "0" > /selinux/compat_net
+
+In order to make this change persistent across reboots edit the file /boot/grub/grub.conf and set selinux_compat_net=0
+
+Finally packets can be labeled using rules such as:
+
+        # iptables -A INPUT -t mangle -p tcp --dport 21 -j SECMARK --selctx system_u:object_r:ftp_client_packet_t:s0 
+        # iptables -A INPUT -t mangle -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore 
+
+The first rule will label all tcp packets received on port 21 system_u:object_r:ftp_client_packet_t:s0. The second rule ensures that all further packets that are part of initial connection will keep that label. All rules must be added to the mangle table. If a rule has an invalid context IPTables will return a very bad error code that is not descriptive. This problem exists because of the way that IPTables returns errors and was not easily solvable as part of our back port.
+
+Now download the updated SELinux toolchain and policy RPMs found in the SELinux Policy section of DownloadRelease. To install the new policy, it is necessary to temporarily force SELinux into permissive mode:
+
+        # setenforce 0
+        # rpm -Uvh libsepol-1.16.14-1.$ARCH.rpm
+        # rpm -Uvh --force libselinux-1.34.15-1.$ARCH.rpm
+        # rpm -Uvh libselinux-python-1.34.15-1.$ARCH.rpm
+        # rpm -Uvh libsemanage-1.10.9-1.$ARCH.rpm
+        # rpm -Uvh checkpolicy-1.34.7-1.$ARCH.rpm
+        # rpm -Uvh policycoreutils-1.34.16-1.$ARCH.rpm policycoreutils-newrole-1.34.16-1.$ARCH.rpm
+        # rpm -ivh selinux-policy-clip-2.0-3.noarch.rpm
+
+Note: Because the selinux-policy-clip rpm makes changes to class definitions, the policy will fail to load after installation.  A reboot is require before the policy will load.
+
+        # reboot
+
+After rebooting, login to the system with the 'clipuser' account and password.
+
+Once this account has been authenticated, the user will be assigned a context of root:sysadm_r:sysadm_t. The user will still need to switch to the superuser account via the su command to perform administrative actions. These steps are necessary to meet auditing requirements specified by DCID 6/3.
+
+
+=== Configuring System Services ===
+
+In order to minimize attack vectors into the system, the default installation of CLIP enables a minimal subset of services. The following services will be enabled when booted into runlevel 3 (the default for CLIP):
+
+        atd auditd crond iptables network syslog sysstat
+
+An administrator who wishes to enable additional services should consider enabling the SELinux policy module(s) associated with the services being added. The chkconfig(8) utility should be used to add or remove services from a particular runlevel.
+
+=== Additional Operational Considerations ===
+
+The CLIP installation process also defines a password for the bootloader, as required by the DCID 6/3, which is '123)(*qweASD'. 

trunk/RHEL5.2/README

@@ -60 +60 @@
-        make clip-rpm selinux-policy-clip-rpm
-
-
+system 
-
-        clip/RPM/clip-2.0-1.$ARCH.rpm

trunk/RHEL5.2/RPM/clip.spec

@@ -41 +41 @@
-/%{_lib}/security/pam_tally3.so
-/usr/share/doc/pam_tally3
+/var/log/tally3
-/sbin/pam_tally3
-/usr/sbin/xar

trunk/RHEL5.2/pam_tally3/Makefile

@@ -10 +10 @@
-APP=pam_tally3
-
+LOG=/var/log/
-LIB_SECURITY=/lib/security
-LIB64_SECURITY=/lib64/security
@@ -36 +37 @@
-        test -d $(DESTDIR)$(SBIN) || install -m 755 -d $(DESTDIR)$(SBIN)
-        test -d $(DESTDIR)$(DOC) || install -m 755 -d $(DESTDIR)$(DOC)
+        test -d $(DESTDIR)$(LOG) || install -m 755 -d $(DESTDIR)$(LOG)
-        install -s -m755 $(PAM_MODULE) $(DESTDIR)$(LIB_SECURITY)
-        install -s -m755 $(APP) $(DESTDIR)$(SBIN)
-        install  -m644 doc/* $(DESTDIR)$(DOC)
+        touch $(DESTDIR)$(LOG)/tally3
+        chmod 640 $(DESTDIR)$(LOG)/tally3
-
-installx86_64:
@@ -44 +48 @@
-        test -d $(DESTDIR)$(SBIN) || install -m 755 -d $(DESTDIR)$(SBIN)
-        test -d $(DESTDIR)$(DOC) || install -m 755 -d $(DESTDIR)$(DOC)
+        test -d $(DESTDIR)$(LOG) || install -m 755 -d $(DESTDIR)$(LOG)
-        install -s -m755 $(PAM_MODULE) $(DESTDIR)$(LIB64_SECURITY)
-        install -s -m755 $(APP) $(DESTDIR)$(SBIN)
-        install  -m644 doc/* $(DESTDIR)$(DOC)
+        touch $(DESTDIR)$(LOG)/tally3
+        chmod 640 $(DESTDIR)$(LOG)/tally3

trunk/RHEL5.2/refpolicy/src/selinux-policy-clip/policy/modules/services/cron.te

@@ -129 +129 @@
-auth_domtrans_chk_passwd(crond_t)
-
+# allow running of unix_update, needed by anacron
+auth_domtrans_upd_passwd(crond_t)
+
-corecmd_exec_shell(crond_t)
-corecmd_list_bin(crond_t)
@@ -226 +229 @@
-allow system_crond_t self:fifo_file rw_fifo_file_perms;
-allow system_crond_t self:passwd rootok;
+
+# This allows anacron to create pid files
+allow system_crond_t crond_var_run_t:file manage_file_perms;
+files_pid_filetrans(system_crond_t,crond_var_run_t,file)
-
-# This is to handle creation of files in /var/log directory.

trunk/RHEL5.2/refpolicy/src/selinux-policy-clip/policy/modules/services/ssh.if

@@ -483 +483 @@
-        corenet_tcp_connect_generic_port($1_t)
-        corenet_sendrecv_ssh_server_packets($1_t)
+        
+        # allow ssh to bind to 0.0.0.0 
+        corenet_tcp_bind_inaddr_any_node($1_t)
-
-        fs_dontaudit_getattr_all_fs($1_t)