rpms/scap-security-guide
7
0
Fork 0
Code Issues Pull Requests Releases Activity
5d623aa88d
scap-security-guide/SOURCES/scap-security-guide-0.1.61-rhel8_stig_v1r5-PR_8050.patch
CentOS Sources c24c37eb20 import scap-security-guide-0.1.57-9.el8_5
2022-04-26 18:09:24 +00:00

335 lines
16 KiB
Diff
Raw Blame History

commit b2b8afa337bce598b9b56a243e7ad0be7ee9194e
Author: Gabriel Becker <ggasparb@redhat.com>
Date: Fri Feb 25 14:18:51 2022 +0100
Manual edited patch scap-security-guide-0.1.61-rhel8_stig_v1r5-PR_8050.patch.
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
new file mode 100644
index 0000000..1c151a1
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
@@ -0,0 +1,5 @@
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhv
+
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
new file mode 100644
index 0000000..24fdbe4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
@@ -0,0 +1,19 @@
+<def-group>
+ <definition class="compliance" id="set_password_hashing_algorithm_passwordauth" version="1">
+ {{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.") }}}
+ <criteria operator="AND">
+ <criterion test_ref="test_pam_unix_passwordauth_sha512" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/password-auth for correct settings" id="test_pam_unix_passwordauth_sha512" version="1">
+ <ind:object object_ref="object_pam_unix_passwordauth_sha512" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object comment="check /etc/pam.d/password-auth for correct settings" id="object_pam_unix_passwordauth_sha512" version="1">
+ <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
new file mode 100644
index 0000000..9375269
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
@@ -0,0 +1,72 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
+
+title: "Set PAM's Password Hashing Algorithm - password-auth"
+
+description: |-
+ The PAM system service can be configured to only store encrypted
+ representations of passwords. In
+ <tt>/etc/pam.d/password-auth</tt>,
+ the
+ <tt>password</tt> section of the file controls which PAM modules execute
+ during a password change. Set the <tt>pam_unix.so</tt> module in the
+ <tt>password</tt> section to include the argument <tt>sha512</tt>, as shown
+ below:
+ <br />
+ <pre>password sufficient pam_unix.so sha512 <i>other arguments...</i></pre>
+ <br />
+ This will help ensure when local users change their passwords, hashes for
+ the new passwords will be generated using the SHA-512 algorithm. This is
+ the default.
+
+rationale: |-
+ Passwords need to be protected at all times, and encryption is the standard
+ method for protecting passwords. If passwords are not encrypted, they can
+ be plainly read (i.e., clear text) and easily compromised. Passwords that
+ are encrypted with a weak algorithm are no more protected than if they are
+ kepy in plain text.
+ <br /><br />
+ This setting ensures user and group account administration utilities are
+ configured to store only encrypted representations of passwords.
+ Additionally, the <tt>crypt_style</tt> configuration option ensures the use
+ of a strong hashing algorithm that makes password cracking attacks more
+ difficult.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-85943-9
+ cce@rhel8: CCE-85945-4
+ cce@rhel9: CCE-85946-2
+
+references:
+ anssi: BP28(R32)
+ cis-csc: 1,12,15,16,5
+ cis@rhel7: 5.4.3
+ cis@rhel8: 5.4.4
+ cjis: 5.6.2.2
+ cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
+ cui: 3.13.11
+ disa: CCI-000196
+ isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
+ isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1'
+ ism: 0418,1055,1402
+ iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
+ nist: IA-5(c),IA-5(1)(c),CM-6(a)
+ nist-csf: PR.AC-1,PR.AC-6,PR.AC-7
+ pcidss: Req-8.2.1
+ srg: SRG-OS-000073-GPOS-00041
+ stigid@rhel7: RHEL-07-010200
+ stigid@rhel8: RHEL-08-010160
+ vmmsrg: SRG-OS-000480-VMM-002000
+
+ocil_clause: 'it does not'
+
+ocil: |-
+ Inspect the <tt>password</tt> section of <tt>/etc/pam.d/password-auth</tt>
+ and ensure that the <tt>pam_unix.so</tt> module includes the argument
+ <tt>sha512</tt>:
+ <pre>$ grep sha512 /etc/pam.d/password-auth</pre>
+
+platform: pam
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
new file mode 100644
index 0000000..a924fe5
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
new file mode 100644
index 0000000..68e925a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/sha512//g" "/etc/pam.d/password-auth"
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
index 02af406..e7503fe 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
@@ -1,7 +1,9 @@
# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
index d76b6f8..a754a84 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
@@ -3,6 +3,9 @@
{{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.") }}}
<criteria operator="AND">
<criterion test_ref="test_pam_unix_sha512" />
+ {{%- if product == "rhel7" %}}
+ <extend_definition comment="check /etc/pam.d/password-auth for correct settings" definition_ref="set_password_hashing_algorithm_passwordauth" />
+ {{%- endif %}}
</criteria>
</definition>
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
index 24ab30d..58fcea9 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
@@ -69,7 +69,7 @@ references:
srg: SRG-OS-000073-GPOS-00041
stigid@ol7: OL07-00-010200
stigid@rhel7: RHEL-07-010200
- stigid@rhel8: RHEL-08-010160
+ stigid@rhel8: RHEL-08-010159
stigid@sle12: SLES-12-010230
stigid@sle15: SLES-15-020170
vmmsrg: SRG-OS-000480-VMM-002000
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
index 7e48176..fb9feec 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
@@ -1,7 +1,9 @@
#!/bin/bash
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
index 09bb82d..2f35381 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
@@ -1,7 +1,9 @@
#!/bin/bash
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile
index d76bb38..1045be3 100644
--- a/products/rhel8/profiles/rht-ccp.profile
+++ b/products/rhel8/profiles/rht-ccp.profile
@@ -54,6 +54,7 @@ selections:
- accounts_password_pam_difok
- accounts_passwords_pam_faillock_deny
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- require_singleuser_auth
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index d51e53a..705caa8 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -147,6 +147,9 @@ selections:
# RHEL-08-010152
- require_emergency_target_auth
+ # RHEL-08-010159
+ - set_password_hashing_algorithm_passwordauth
+
# RHEL-08-010160
- set_password_hashing_algorithm_systemauth
diff --git a/products/rhv4/profiles/pci-dss.profile b/products/rhv4/profiles/pci-dss.profile
index 90e196e..f1fb1f8 100644
--- a/products/rhv4/profiles/pci-dss.profile
+++ b/products/rhv4/profiles/pci-dss.profile
@@ -115,6 +115,7 @@ selections:
- service_pcscd_enabled
- sssd_enable_smartcards
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- file_owner_etc_shadow
diff --git a/products/rhv4/profiles/rhvh-stig.profile b/products/rhv4/profiles/rhvh-stig.profile
index ef28fa1..d17833b 100644
--- a/products/rhv4/profiles/rhvh-stig.profile
+++ b/products/rhv4/profiles/rhvh-stig.profile
@@ -355,6 +355,7 @@ selections:
- set_password_hashing_algorithm_libuserconf
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- package_opensc_installed
- var_smartcard_drivers=cac
- configure_opensc_card_drivers
diff --git a/products/rhv4/profiles/rhvh-vpp.profile b/products/rhv4/profiles/rhvh-vpp.profile
index 9be3e34..3b5802d 100644
--- a/products/rhv4/profiles/rhvh-vpp.profile
+++ b/products/rhv4/profiles/rhvh-vpp.profile
@@ -200,6 +200,7 @@ selections:
- accounts_password_pam_unix_remember
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_libuserconf
- no_empty_passwords
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index fef5fd8..d8daeb3 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -69,9 +69,6 @@ CCE-85939-7
CCE-85940-5
CCE-85941-3
CCE-85942-1
-CCE-85943-9
-CCE-85945-4
-CCE-85946-2
CCE-85947-0
CCE-85948-8
CCE-85949-6
diff --git a/tests/data/profile_stability/rhel8/pci-dss.profile b/tests/data/profile_stability/rhel8/pci-dss.profile
index f58bcf9..e235d49 100644
--- a/tests/data/profile_stability/rhel8/pci-dss.profile
+++ b/tests/data/profile_stability/rhel8/pci-dss.profile
@@ -1,5 +1,9 @@
+title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
description: Ensures PCI-DSS v3.2.1 security configuration settings are applied.
-documentation_complete: true
+extends: null
+metadata:
+ SMEs:
+ - yuumasato
reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
selections:
- account_disable_post_pw_expiration
@@ -136,4 +141,8 @@ selections:
- var_multiple_time_servers=rhel
- var_sshd_set_keepalive=0
- var_smartcard_drivers=cac
-title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
+platforms: !!set {}
+cpe_names: !!set {}
+platform: null
+filter_rules: ''
+documentation_complete: true
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 3b4b43a..1b4b955 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -332,6 +332,7 @@ selections:
- service_systemd-coredump_disabled
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
+- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_disable_compression
- sshd_disable_empty_passwords
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 2e0e161..3568e07 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -343,6 +343,7 @@ selections:
- service_systemd-coredump_disabled
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
+- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_disable_compression
- sshd_disable_empty_passwords
Reference in New Issue View Git Blame Copy Permalink