From 4f431dfb02b8d85da546df821d8d711d4e82a683 Mon Sep 17 00:00:00 2001 From: Gabe Date: Thu, 3 Sep 2020 15:37:59 -0600 Subject: [PATCH 1/4] Add RHCOS STIG content and enable for NIST --- rhcos4/CMakeLists.txt | 7 + rhcos4/overlays/srg_support.xml | 173 ++++++++++ rhcos4/profiles/ospp.profile | 311 ++++++++++++++++++ rhcos4/profiles/stig.profile | 23 ++ rhcos4/transforms/cci2html.xsl | 6 + rhcos4/transforms/constants.xslt | 2 +- rhcos4/transforms/table-add-srgitems.xslt | 7 + rhcos4/transforms/table-sortbyref.xslt | 6 + rhcos4/transforms/table-srgmap.xslt | 11 + rhcos4/transforms/table-style.xslt | 5 + .../transforms/xccdf-apply-overlay-stig.xslt | 8 + rhcos4/transforms/xccdf2stigformat.xslt | 7 + rhcos4/transforms/xccdf2table-byref.xslt | 9 + rhcos4/transforms/xccdf2table-cce.xslt | 9 + .../xccdf2table-profileanssirefs.xslt | 8 + .../xccdf2table-profileccirefs.xslt | 9 + .../xccdf2table-profilecisrefs.xslt | 9 + .../xccdf2table-profilenistrefs-cui.xslt | 8 + .../xccdf2table-profilenistrefs.xslt | 8 + rhcos4/transforms/xccdf2table-stig.xslt | 9 + 20 files changed, 634 insertions(+), 1 deletion(-) create mode 100644 rhcos4/overlays/srg_support.xml create mode 100644 rhcos4/profiles/ospp.profile create mode 100644 rhcos4/profiles/stig.profile create mode 100644 rhcos4/transforms/cci2html.xsl create mode 100644 rhcos4/transforms/table-add-srgitems.xslt create mode 100644 rhcos4/transforms/table-sortbyref.xslt create mode 100644 rhcos4/transforms/table-srgmap.xslt create mode 100644 rhcos4/transforms/table-style.xslt create mode 100644 rhcos4/transforms/xccdf-apply-overlay-stig.xslt create mode 100644 rhcos4/transforms/xccdf2stigformat.xslt create mode 100644 rhcos4/transforms/xccdf2table-byref.xslt create mode 100644 rhcos4/transforms/xccdf2table-cce.xslt create mode 100644 rhcos4/transforms/xccdf2table-profileanssirefs.xslt create mode 100644 rhcos4/transforms/xccdf2table-profileccirefs.xslt create mode 100644 rhcos4/transforms/xccdf2table-profilecisrefs.xslt create mode 100644 rhcos4/transforms/xccdf2table-profilenistrefs-cui.xslt create mode 100644 rhcos4/transforms/xccdf2table-profilenistrefs.xslt create mode 100644 rhcos4/transforms/xccdf2table-stig.xslt diff --git a/rhcos4/CMakeLists.txt b/rhcos4/CMakeLists.txt index 01e628ca174..3ab1b56e4dd 100644 --- a/rhcos4/CMakeLists.txt +++ b/rhcos4/CMakeLists.txt @@ -8,3 +8,10 @@ set(DISA_SRG_TYPE "os") set(PRODUCT_REMEDIATION_LANGUAGES "ignition;kubernetes") ssg_build_product(${PRODUCT}) + +ssg_build_html_table_by_ref(${PRODUCT} "nist") +ssg_build_html_nistrefs_table(${PRODUCT} "standard") +ssg_build_html_nistrefs_table(${PRODUCT} "ospp") +ssg_build_html_nistrefs_table(${PRODUCT} "stig") +ssg_build_html_cce_table(${PRODUCT}) +ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE}) diff --git a/rhcos4/overlays/srg_support.xml b/rhcos4/overlays/srg_support.xml new file mode 100644 index 00000000000..7c89f52017e --- /dev/null +++ b/rhcos4/overlays/srg_support.xml @@ -0,0 +1,173 @@ + diff --git a/rhcos4/profiles/ospp.profile b/rhcos4/profiles/ospp.profile new file mode 100644 index 00000000000..5db9a88168d --- /dev/null +++ b/rhcos4/profiles/ospp.profile @@ -0,0 +1,311 @@ +documentation_complete: true + +title: 'Protection Profile for General Purpose Operating Systems' + +description: |- + This profile reflects mandatory configuration controls identified in the + NIAP Configuration Annex to the Protection Profile for General Purpose + Operating Systems (Protection Profile Version 4.2.1). + + This configuration profile is consistent with CNSSI-1253, which requires + U.S. National Security Systems to adhere to certain configuration + parameters. Accordingly, this configuration profile is suitable for + use in U.S. National Security Systems. + +selections: + + ####################################################### + ### GENERAL REQUIREMENTS + ### Things needed to meet OSPP functional requirements. + ####################################################### + + ### Partitioning + - mount_option_home_nodev + - mount_option_home_nosuid + - mount_option_tmp_nodev + - mount_option_tmp_noexec + - mount_option_tmp_nosuid + - mount_option_var_tmp_nodev + - mount_option_var_tmp_noexec + - mount_option_var_tmp_nosuid + - mount_option_dev_shm_nodev + - mount_option_dev_shm_noexec + - mount_option_dev_shm_nosuid + - mount_option_nodev_nonroot_local_partitions + - mount_option_boot_nodev + - mount_option_boot_nosuid + - partition_for_home + - partition_for_var + - mount_option_var_nodev + - partition_for_var_log + - mount_option_var_log_nodev + - mount_option_var_log_nosuid + - mount_option_var_log_noexec + - partition_for_var_log_audit + - mount_option_var_log_audit_nodev + - mount_option_var_log_audit_nosuid + - mount_option_var_log_audit_noexec + + ### Services + # sshd + - sshd_disable_root_login + - sshd_enable_strictmodes + - disable_host_auth + - sshd_disable_empty_passwords + - sshd_disable_kerb_auth + - sshd_disable_gssapi_auth + - var_sshd_set_keepalive=0 + - sshd_set_keepalive + - sshd_enable_warning_banner + - sshd_rekey_limit + - var_rekey_limit_size=1G + - var_rekey_limit_time=1hour + + # Time Server + - chronyd_client_only + - chronyd_no_chronyc_network + + ### Network Settings + - sysctl_net_ipv6_conf_all_accept_ra + - sysctl_net_ipv6_conf_default_accept_ra + - sysctl_net_ipv4_conf_all_accept_redirects + - sysctl_net_ipv4_conf_default_accept_redirects + - sysctl_net_ipv6_conf_all_accept_redirects + - sysctl_net_ipv6_conf_default_accept_redirects + - sysctl_net_ipv4_conf_all_accept_source_route + - sysctl_net_ipv4_conf_default_accept_source_route + - sysctl_net_ipv6_conf_all_accept_source_route + - sysctl_net_ipv6_conf_default_accept_source_route + - sysctl_net_ipv4_conf_all_secure_redirects + - sysctl_net_ipv4_conf_default_secure_redirects + - sysctl_net_ipv4_conf_all_send_redirects + - sysctl_net_ipv4_conf_default_send_redirects + - sysctl_net_ipv4_conf_all_log_martians + - sysctl_net_ipv4_conf_default_log_martians + - sysctl_net_ipv4_conf_all_rp_filter + - sysctl_net_ipv4_conf_default_rp_filter + - sysctl_net_ipv4_icmp_ignore_bogus_error_responses + - sysctl_net_ipv4_icmp_echo_ignore_broadcasts + - sysctl_net_ipv4_tcp_syncookies + + ### systemd + - disable_ctrlaltdel_reboot + - disable_ctrlaltdel_burstaction + - service_debug-shell_disabled + + ### umask + - var_accounts_user_umask=027 + - accounts_umask_etc_profile + - accounts_umask_etc_bashrc + - accounts_umask_etc_csh_cshrc + + ### Software update + - ensure_redhat_gpgkey_installed + + ### Kernel Config + ## Boot prompt + - grub2_audit_argument + - grub2_audit_backlog_limit_argument + - grub2_slub_debug_argument + - grub2_page_poison_argument + - grub2_vsyscall_argument + - grub2_vsyscall_argument.role=unscored + - grub2_vsyscall_argument.severity=info + - grub2_pti_argument + + ## Security Settings + - sysctl_kernel_kptr_restrict + - sysctl_kernel_dmesg_restrict + - sysctl_kernel_kexec_load_disabled + - sysctl_kernel_yama_ptrace_scope + - sysctl_kernel_perf_event_paranoid + - sysctl_user_max_user_namespaces + - sysctl_user_max_user_namespaces.role=unscored + - sysctl_user_max_user_namespaces.severity=info + - sysctl_kernel_unprivileged_bpf_disabled + - sysctl_net_core_bpf_jit_harden + + ## File System Settings + - sysctl_fs_protected_hardlinks + - sysctl_fs_protected_symlinks + + ### Audit + - service_auditd_enabled + - var_auditd_flush=incremental_async + - auditd_data_retention_flush + - auditd_local_events + - auditd_write_logs + - auditd_log_format + - auditd_freq + - auditd_name_format + + ### Module Blacklist + - kernel_module_cramfs_disabled + - kernel_module_bluetooth_disabled + - kernel_module_sctp_disabled + - kernel_module_firewire-core_disabled + - kernel_module_atm_disabled + - kernel_module_can_disabled + - kernel_module_tipc_disabled + + ### rpcbind + + ### Install Required Packages + - package_usbguard_installed + - package_audit_installed + + ### Remove Prohibited Packages + - package_sendmail_removed + + ### Login + - disable_users_coredumps + - sysctl_kernel_core_pattern + - coredump_disable_storage + - coredump_disable_backtraces + - service_systemd-coredump_disabled + - var_accounts_max_concurrent_login_sessions=10 + - accounts_max_concurrent_login_sessions + + ### SELinux Configuration + - var_selinux_state=enforcing + - selinux_state + - var_selinux_policy_name=targeted + - selinux_policytype + + ### Application Whitelisting (RHEL 8) + - package_fapolicyd_installed + - service_fapolicyd_enabled + + ### Configure USBGuard + - service_usbguard_enabled + - configure_usbguard_auditbackend + - usbguard_allow_hid_and_hub + + ### Enable / Configure FIPS + - enable_fips_mode + - var_system_crypto_policy=fips_ospp + - configure_crypto_policy + - configure_ssh_crypto_policy + - configure_openssl_crypto_policy + - configure_libreswan_crypto_policy + - configure_kerberos_crypto_policy + - enable_dracut_fips_module + + ## Enable Screen Lock + ## FMT_MOF_EXT.1 + - package_tmux_installed + - configure_bashrc_exec_tmux + - no_tmux_in_shells + - configure_tmux_lock_command + - configure_tmux_lock_after_time + + ## Set Screen Lock Timeout Period to 30 Minutes or Less + ## AC-11(a) / FMT_MOF_EXT.1 + ## We deliberately set sshd timeout to 1 minute before tmux lock timeout + - sshd_idle_timeout_value=14_minutes + - sshd_set_idle_timeout + + ## Disable Unauthenticated Login (such as Guest Accounts) + ## FIA_UAU.1 + - require_singleuser_auth + - grub2_disable_interactive_boot + - grub2_uefi_password + - no_empty_passwords + + ## Enable Host-Based Firewall + ## SC-7(12) / FMT_MOF_EXT.1 + - service_iptables_enabled + + ## Set Logon Warning Banner + ## AC-8(a) / FMT_MOF_EXT.1 + + ## Audit All Logons (Success/Failure) and Logoffs (Success) + ## CNSSI 1253 Value or DoD-Specific Values: + ## (1) Logons (Success/Failure) + ## (2) Logoffs (Success) + ## AU-2(a) / FAU_GEN.1.1.c + + ## Audit File and Object Events (Unsuccessful) + ## CNSSI 1253 Value or DoD-specific Values: + ## (1) Create (Success/Failure) + ## (2) Access (Success/Failure) + ## (3) Delete (Sucess/Failure) + ## (4) Modify (Success/Failure) + ## (5) Permission Modification (Sucess/Failure) + ## (6) Ownership Modification (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + ## + ## + ## (1) Create (Success/Failure) + ## (open with O_CREAT) + ## (2) Access (Success/Failure) + ## (3) Delete (Success/Failure) + ## (4) Modify (Success/Failure) + ## (5) Permission Modification (Success/Failure) + ## (6) Ownership Modification (Success/Failure) + + ## Audit User and Group Management Events (Success/Failure) + ## CNSSI 1253 Value or DoD-specific Values: + ## (1) User add, delete, modify, disable, enable (Success/Failure) + ## (2) Group/Role add, delete, modify (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + ## + ## Generic User and Group Management Events (Success/Failure) + ## Selection of setuid programs that relate to + ## user accounts. + ## + ## CNSSI 1253: (1) User add, delete, modify, disable, enable (Success/Failure) + ## + ## CNSSI 1252: (2) Group/Role add, delete, modify (Success/Failure) + ## + ## Audit Privilege or Role Escalation Events (Success/Failure) + ## CNSSI 1253 Value or DoD-specific Values: + ## - Privilege/Role escalation (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + ## Audit All Audit and Log Data Accesses (Success/Failure) + ## CNSSI 1253 Value or DoD-specific Values: + ## - Audit and log data access (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + ## Audit Cryptographic Verification of Software (Success/Failure) + ## CNSSI 1253 Value or DoD-specific Values: + ## - Applications (e.g. Firefox, Internet Explorer, MS Office Suite, + ## etc) initialization (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + ## Audit Kernel Module Loading and Unloading Events (Success/Failure) + ## AU-2(a) / FAU_GEN.1.1.c + - audit_basic_configuration + - audit_immutable_login_uids + - audit_create_failed + - audit_create_success + - audit_modify_failed + - audit_modify_success + - audit_access_failed + - audit_access_success + - audit_delete_failed + - audit_delete_success + - audit_perm_change_failed + - audit_perm_change_success + - audit_owner_change_failed + - audit_owner_change_success + - audit_ospp_general + - audit_module_load + + # Prevent Kerberos use by system daemons + - kerberos_disable_no_keytab + + # set ssh client rekey limit + - ssh_client_rekey_limit + - var_ssh_client_rekey_limit_size=1G + - var_ssh_client_rekey_limit_time=1hour + + # zIPl specific rules + - zipl_bls_entries_only + - zipl_bootmap_is_up_to_date + - zipl_audit_argument + - zipl_audit_backlog_limit_argument + - zipl_slub_debug_argument + - zipl_page_poison_argument + - zipl_vsyscall_argument + - zipl_vsyscall_argument.role=unscored + - zipl_vsyscall_argument.severity=info + - zipl_pti_argument diff --git a/rhcos4/profiles/stig.profile b/rhcos4/profiles/stig.profile new file mode 100644 index 00000000000..0d5b4679083 --- /dev/null +++ b/rhcos4/profiles/stig.profile @@ -0,0 +1,23 @@ +documentation_complete: true + +title: '[DRAFT] DISA STIG for Red Hat Enterprise Linux CoreOS' + +description: |- + This profile contains configuration checks that align to the + [DRAFT] DISA STIG for Red Hat Enterprise Linux CoreOS which + is the operating system layer of Red Hat OpenShift Container + Platform. + +extends: ospp + +selections: + - login_banner_text=dod_banners + - banner_etc_issue + - audit_rules_usergroup_modification_passwd + - sssd_enable_smartcards + - sssd_offline_cred_expiration + - encrypt_partitions + - accounts_tmout + - sudo_remove_no_authenticate + - sudo_remove_nopasswd + - sudo_require_authentication diff --git a/rhcos4/transforms/cci2html.xsl b/rhcos4/transforms/cci2html.xsl new file mode 100644 index 00000000000..59d708ad679 --- /dev/null +++ b/rhcos4/transforms/cci2html.xsl @@ -0,0 +1,6 @@ + + + + + + diff --git a/rhcos4/transforms/constants.xslt b/rhcos4/transforms/constants.xslt index eee9e6735b6..d0555aae470 100644 --- a/rhcos4/transforms/constants.xslt +++ b/rhcos4/transforms/constants.xslt @@ -10,7 +10,7 @@ empty - + diff --git a/rhcos4/transforms/table-add-srgitems.xslt b/rhcos4/transforms/table-add-srgitems.xslt new file mode 100644 index 00000000000..e741fb89615 --- /dev/null +++ b/rhcos4/transforms/table-add-srgitems.xslt @@ -0,0 +1,7 @@ + + + + + + + diff --git a/rhcos4/transforms/table-sortbyref.xslt b/rhcos4/transforms/table-sortbyref.xslt new file mode 100644 index 00000000000..bd97ee1cab2 --- /dev/null +++ b/rhcos4/transforms/table-sortbyref.xslt @@ -0,0 +1,6 @@ + + + + + + diff --git a/rhcos4/transforms/table-srgmap.xslt b/rhcos4/transforms/table-srgmap.xslt new file mode 100644 index 00000000000..23c2f60a2c2 --- /dev/null +++ b/rhcos4/transforms/table-srgmap.xslt @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/rhcos4/transforms/table-style.xslt b/rhcos4/transforms/table-style.xslt new file mode 100644 index 00000000000..218d0f75421 --- /dev/null +++ b/rhcos4/transforms/table-style.xslt @@ -0,0 +1,5 @@ + + + + + diff --git a/rhcos4/transforms/xccdf-apply-overlay-stig.xslt b/rhcos4/transforms/xccdf-apply-overlay-stig.xslt new file mode 100644 index 00000000000..38b354afb89 --- /dev/null +++ b/rhcos4/transforms/xccdf-apply-overlay-stig.xslt @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/rhcos4/transforms/xccdf2stigformat.xslt b/rhcos4/transforms/xccdf2stigformat.xslt new file mode 100644 index 00000000000..5421604fa3c --- /dev/null +++ b/rhcos4/transforms/xccdf2stigformat.xslt @@ -0,0 +1,7 @@ + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-byref.xslt b/rhcos4/transforms/xccdf2table-byref.xslt new file mode 100644 index 00000000000..88a53f50abd --- /dev/null +++ b/rhcos4/transforms/xccdf2table-byref.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-cce.xslt b/rhcos4/transforms/xccdf2table-cce.xslt new file mode 100644 index 00000000000..1ffb22215c2 --- /dev/null +++ b/rhcos4/transforms/xccdf2table-cce.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-profileanssirefs.xslt b/rhcos4/transforms/xccdf2table-profileanssirefs.xslt new file mode 100644 index 00000000000..b790974c802 --- /dev/null +++ b/rhcos4/transforms/xccdf2table-profileanssirefs.xslt @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-profileccirefs.xslt b/rhcos4/transforms/xccdf2table-profileccirefs.xslt new file mode 100644 index 00000000000..5a104d956f1 --- /dev/null +++ b/rhcos4/transforms/xccdf2table-profileccirefs.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-profilecisrefs.xslt b/rhcos4/transforms/xccdf2table-profilecisrefs.xslt new file mode 100644 index 00000000000..92cbdf9b455 --- /dev/null +++ b/rhcos4/transforms/xccdf2table-profilecisrefs.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-profilenistrefs-cui.xslt b/rhcos4/transforms/xccdf2table-profilenistrefs-cui.xslt new file mode 100644 index 00000000000..7596f8b49cd --- /dev/null +++ b/rhcos4/transforms/xccdf2table-profilenistrefs-cui.xslt @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-profilenistrefs.xslt b/rhcos4/transforms/xccdf2table-profilenistrefs.xslt new file mode 100644 index 00000000000..8e97c33344a --- /dev/null +++ b/rhcos4/transforms/xccdf2table-profilenistrefs.xslt @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/rhcos4/transforms/xccdf2table-stig.xslt b/rhcos4/transforms/xccdf2table-stig.xslt new file mode 100644 index 00000000000..2fb56fa7d0a --- /dev/null +++ b/rhcos4/transforms/xccdf2table-stig.xslt @@ -0,0 +1,9 @@ + + + + + + + + + From 415191bf7834e19c9a1ef652171da8097dc0a4b8 Mon Sep 17 00:00:00 2001 From: Gabe Date: Mon, 14 Sep 2020 17:12:11 -0600 Subject: [PATCH 2/4] Add SRG overlay --- rhcos4/overlays/srg_support.xml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/rhcos4/overlays/srg_support.xml b/rhcos4/overlays/srg_support.xml index 7c89f52017e..039e0bacfa2 100644 --- a/rhcos4/overlays/srg_support.xml +++ b/rhcos4/overlays/srg_support.xml @@ -1,7 +1,7 @@