diff --git a/openscap.changes b/openscap.changes index f0584fc..bb896b2 100644 --- a/openscap.changes +++ b/openscap.changes @@ -12,6 +12,12 @@ Wed Aug 1 09:43:28 UTC 2012 - meissner@suse.com - results are validated only if an OSCAP_FULL_VALIDATION variable is set - bug fixes +------------------------------------------------------------------- +Wed Aug 1 09:18:06 UTC 2012 - dmacvicar@suse.de + +- add OVAL/XCCDF content based on yast2-security checks + and set them as the default content (using symlinks) + ------------------------------------------------------------------- Sat Jul 28 14:24:46 UTC 2012 - aj@suse.de diff --git a/openscap.spec b/openscap.spec index 7265f16..77d1cff 100644 --- a/openscap.spec +++ b/openscap.spec @@ -25,6 +25,12 @@ Release: 1.0 Source: http://www.open-scap.org/download/%name-%version.tar.gz Source1: oscap-scan.init Source2: sysconfig.oscap-scan +# SUSE specific profile, based on yast2-security +# checks. +# Generated from http://gitorious.org/test-suite/scap +Source3: scap-yast2sec-xccdf.xml +Source4: scap-yast2sec-oval.xml +# Url: http://www.open-scap.org/ BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: libacl-devel @@ -160,9 +166,12 @@ install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/oscap-scan install -m 644 %{SOURCE2} $RPM_BUILD_ROOT/var/adm/fillup-templates +install -m 644 %{SOURCE3} $RPM_BUILD_ROOT/%{_datadir}/openscap +install -m 644 %{SOURCE4} $RPM_BUILD_ROOT/%{_datadir}/openscap + # create symlinks to default content -ln -s %{_datadir}/openscap/scap-fedora14-oval.xml $RPM_BUILD_ROOT/%{_datadir}/openscap/scap-oval.xml -ln -s %{_datadir}/openscap/scap-fedora14-xccdf.xml $RPM_BUILD_ROOT/%{_datadir}/openscap/scap-xccdf.xml +ln -s %{_datadir}/openscap/scap-yast2sec-oval.xml $RPM_BUILD_ROOT/%{_datadir}/openscap/scap-oval.xml +ln -s %{_datadir}/openscap/scap-yast2sec-xccdf.xml $RPM_BUILD_ROOT/%{_datadir}/openscap/scap-xccdf.xml %post -n libopenscap%{soname} -p /sbin/ldconfig diff --git a/scap-yast2sec-oval.xml b/scap-yast2sec-oval.xml new file mode 100644 index 0000000..81446ff --- /dev/null +++ b/scap-yast2sec-oval.xml @@ -0,0 +1,577 @@ + + + + vim + 5.9 + 2011-10-31T12:00:00-04:00 + + + + + + + sysctl net.ipv4.ip_forward must be 0 + sysctl net.ipv4.ip_forward must be 0 + + + + + + + + sysctl net.ipv4.tcp_syncookies must be 1 + sysctl net.ipv4.tcp_syncookies must be 1 + + + + + + + + sysctl net.ipv6.conf.all.forwarding must be 0 + sysctl net.ipv6.conf.all.forwarding must be 0 + + + + + + + + sysctl net.ipv6.conf.default.forwarding must be 0 + sysctl net.ipv6.conf.default.forwarding must be 0 + + + + + + + + kernel config CONFIG_SYN_COOKIES must be y + kernel config CONFIG_SYN_COOKIES must be y + + + + + + + + file /etc/login.defs must have a line that matches ^PASS_MAX_DAYS.*99999 + file /etc/login.defs must have a line that matches ^PASS_MAX_DAYS.*99999 + + + + + + + + file /etc/login.defs must have a line that matches ^PASS_MIN_DAYS.*0 + file /etc/login.defs must have a line that matches ^PASS_MIN_DAYS.*0 + + + + + + + + file /etc/login.defs must have a line that matches ^PASS_WARN_AGE.*7 + file /etc/login.defs must have a line that matches ^PASS_WARN_AGE.*7 + + + + + + + + file /etc/pam.d/common-password must have a line that matches minlen=6 + file /etc/pam.d/common-password must have a line that matches minlen=6 + + + + + + + + file /etc/pam.d/common-password must have a line that matches remember= + file /etc/pam.d/common-password must have a line that matches remember= + + + + + + + + file /etc/login.defs may not have a line that matches ^FAIL_DELAY.*0 + file /etc/login.defs may not have a line that matches ^FAIL_DELAY.*0 + + + + + + + + file /etc/login.defs must have a line that matches ^FAIL_DELAY + file /etc/login.defs must have a line that matches ^FAIL_DELAY + + + + + + + + file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_REMOTE_ACCESS.*no + file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_REMOTE_ACCESS.*no + + + + + + + + file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no + file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no + + + + + + + + file /etc/login.defs must have a line that matches ^UID_MIN.*1000 + file /etc/login.defs must have a line that matches ^UID_MIN.*1000 + + + + + + + + file /etc/login.defs must have a line that matches ^UID_MAX.*60000 + file /etc/login.defs must have a line that matches ^UID_MAX.*60000 + + + + + + + + file /etc/login.defs must have a line that matches ^GID_MIN.*1000 + file /etc/login.defs must have a line that matches ^GID_MIN.*1000 + + + + + + + + file /etc/login.defs must have a line that matches ^GID_MAX.*60000 + file /etc/login.defs must have a line that matches ^GID_MAX.*60000 + + + + + + + + sysctl kernel.sysrq must be 0 + sysctl kernel.sysrq must be 0 + + + + + + + + file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=md5 + file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=md5 + + + + + + + + file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=des + file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=des + + + + + + + + file /etc/sysconfig/security must have a line that matches ^CHECK_PERMISSIONS.*set + file /etc/sysconfig/security must have a line that matches ^CHECK_PERMISSIONS.*set + + + + + + + + file /etc/sysconfig/security must have a line that matches ^CHECK_SIGNATURES.*yes + file /etc/sysconfig/security must have a line that matches ^CHECK_SIGNATURES.*yes + + + + + + + + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_CHROOTED.*yes + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_CHROOTED.*yes + + + + + + + + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_AS.*dhcpd + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_AS.*dhcpd + + + + + + + + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_CHROOTED.*yes + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_CHROOTED.*yes + + + + + + + + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_AS.*dhcpd + file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_AS.*dhcpd + + + + + + + + file /etc/sysconfig/services must have a line that matches ^DISABLE_RESTART_ON_UPDATE.*yes + file /etc/sysconfig/services must have a line that matches ^DISABLE_RESTART_ON_UPDATE.*yes + + + + + + + + file /etc/sysconfig/services must have a line that matches ^DISABLE_STOP_ON_REMOVAL.*yes + file /etc/sysconfig/services must have a line that matches ^DISABLE_STOP_ON_REMOVAL.*yes + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /proc/sys/net/ipv4/ip_forward + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /proc/sys/net/ipv4/tcp_syncookies + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /usr/src/linux/.config + (CONFIG_SYN_COOKIES.*) + 1 + + + /proc/sys/net/ipv6/conf/all/forwarding + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /proc/sys/net/ipv6/conf/default/forwarding + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /proc/sys/kernel/sysrq + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/login.defs + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/pam.d/common-passwd + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/default/passwd + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/pam.d/common-password + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/sysconfig/dhcpd + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/sysconfig/displaymanager + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/sysconfig/security + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/sysconfig/services + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + + + + + + 0 + + + 1 + + + CONFIG_SYN_COOKIES=y + + + ^PASS_MAX_DAYS.*99999 + + + ^PASS_MIN_DAYS.*0 + + + ^PASS_WARN_AGE.*7 + + + ^minlen=6 + + + ^remember= + + + ^FAIL_DELAY.*0 + + + ^FAIL_DELAY + + + ^UID_MIN.*1000 + + + ^UID_MAX.*60000 + + + ^GID_MIN.*1000 + + + ^GID_MAX.*60000 + + + ^CRYPT_FILES=md5 + + + ^CRYPT_FILES=des + + + minlen=6 + + + remember= + + + ^DHCPD_RUN_CHROOTED.*yes + + + ^DHCPD_RUN_AS.*dhcpd + + + ^DHCPD6_RUN_CHROOTED.*yes + + + ^DHCPD6_RUN_AS.*dhcpd + + + ^DISPLAYMANAGER_REMOTE_ACCESS.*no + + + ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no + + + ^CHECK_PERMISSIONS.*set + + + ^CHECK_SIGNATURES.*yes + + + ^DISABLE_RESTART_ON_UPDATE.*yes + + + ^DISABLE_STOP_ON_REMOVAL.*yes + + + + + + + + + diff --git a/scap-yast2sec-xccdf.xml b/scap-yast2sec-xccdf.xml new file mode 100644 index 0000000..be4c10e --- /dev/null +++ b/scap-yast2sec-xccdf.xml @@ -0,0 +1,320 @@ + + + draft + Hardening Linux Kernel + + The Linux kernel is at the heart of every Linux system. With its extensive configuration + options, it comes to no surprise that specific settings can be enabled to further harden + your system. + + + In this guide, we focus on Linux kernel configuration entries that support additional + hardening of your system, as well as the configuration through the syctl + settings. + + + 1 + + + + Default vanilla kernel hardening + + Profile matching all standard (vanilla-kernel) hardening rules + + + + + + + + + + + + + + + +