The /home file system is mounted with the nosuid option

From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 1EDE6138200 for ; Tue, 17 Sep 2013 19:07:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9A40CE0CD8; Tue, 17 Sep 2013 19:07:12 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id DFBEAE0CCD for ; Tue, 17 Sep 2013 19:07:11 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id C918933ED0D for ; Tue, 17 Sep 2013 19:07:10 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 8205DE530A for ; Tue, 17 Sep 2013 19:07:09 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379444499.d88ab0ae8f09a427faea0822761bba3a6596f216.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/ X-VCS-Repository: proj/hardened-docs X-VCS-Files: xml/SCAP/Makefile xml/SCAP/gentoo-oval.xml xml/SCAP/gentoo-oval.xml.result.xml xml/SCAP/gentoo-xccdf.xml xml/SCAP/report.html xml/SCAP/results-xccdf.xml X-VCS-Directories: xml/SCAP/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: d88ab0ae8f09a427faea0822761bba3a6596f216 X-VCS-Branch: master Date: Tue, 17 Sep 2013 19:07:09 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 9633edf8-c2de-4bdf-b174-6d88534abd60 X-Archives-Hash: a72bb0edff91d63f0921842a5a12cb2b commit: d88ab0ae8f09a427faea0822761bba3a6596f216 Author: Sven Vermeulen siphos be> AuthorDate: Tue Sep 17 19:01:39 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Tue Sep 17 19:01:39 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=d88ab0ae Updates on SCAP - Test and generate fix code --- xml/SCAP/Makefile | 12 +- xml/SCAP/gentoo-oval.xml | 35 +++- xml/SCAP/gentoo-oval.xml.result.xml | 166 ------------------ xml/SCAP/gentoo-xccdf.xml | 33 +++- xml/SCAP/report.html | 292 -------------------------------- xml/SCAP/results-xccdf.xml | 326 ------------------------------------ 6 files changed, 72 insertions(+), 792 deletions(-) diff --git a/xml/SCAP/Makefile b/xml/SCAP/Makefile index 81ebe1c..5964888 100644 --- a/xml/SCAP/Makefile +++ b/xml/SCAP/Makefile @@ -1,2 +1,12 @@ +all: report.html guide.html + report.html: gentoo-cpe.xml gentoo-xccdf.xml gentoo-oval.xml - oscap xccdf eval --cpe gentoo-cpe.xml --results results-xccdf.xml --oval-results --report report.html gentoo-xccdf.xml + oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default --results results-xccdf.xml --oval-results --report report.html gentoo-xccdf.xml + +guide.html: gentoo-cpe.xml gentoo-xccdf.xml gentoo-oval.xml + oscap xccdf generate guide --profile xccdf_org.gentoo.dev.swift_profile_default --output guide.html gentoo-xccdf.xml + +eval: + oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default gentoo-xccdf.xml + +.PHONY: all eval diff --git a/xml/SCAP/gentoo-oval.xml b/xml/SCAP/gentoo-oval.xml index d2ece23..b520353 100644 --- a/xml/SCAP/gentoo-oval.xml +++ b/xml/SCAP/gentoo-oval.xml @@ -53,6 +53,24 @@ + + + + The /home file system is mounted with the nosuid option + + Gentoo Linux + + + This definition tests whether the /home partition is mounted with the nosuid + mount option. + + + + + + + + @@ -70,6 +88,15 @@

+ + + + + + +

@@ -85,10 +112,14 @@ - Introduction @@ -106,7 +108,7 @@ the following command is used to generate the HTML output: ### Command to generate this guide ### -# oscap xccdf generate guide scap-gentoo-xccdf.xml > output.html +# oscap xccdf generate guide gentoo-xccdf.xml > output.html Secondly, together with this XCCDF XML, you will also find an OVAL XML file. @@ -116,11 +118,11 @@ Now, to validate the tests, you can use the following commands: ### Testing the rules mentioned in the XCCDF document ### -# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default scap-gentoo-xccdf.xml +# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default gentoo-xccdf.xml To generate a full report in HTML as well, you can use the next command: ### Testing the rules and generating an HTML report ### -# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default --results xccdf-results.xml --report report.html scap-gentoo-xccdf.xml +# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default --results xccdf-results.xml --report report.html gentoo-xccdf.xml Finally, this benchmark will suggest some settings which you do not want @@ -280,13 +282,34 @@ The /home location should be on its own partition, allowing the administrator to mount this location with specific options targetting the file systems' security settings or quota. + + + Next to the separate file system, it should also be mounted with + the nosuid mount option. When a vulnerability in a + software, or a rogue user, would somehow place a setuid binary in + this home directory in order to create a simple backdoor to gain + root privileges, this mount option disables the setuid ability. - + Test if /home is a separate partition

+ + Test if /home is mounted with nosuid + Mount /home with nosuid mount option + + +mount -o remount,nosuid /home + + + + + @@ -921,7 +944,7 @@ session required pam_unix.so World writeable directories must have sticky bit set World writeable directories must have sticky bit set - + diff --git a/xml/SCAP/report.html b/xml/SCAP/report.html deleted file mode 100644 index 76fed49..0000000 --- a/xml/SCAP/report.html +++ /dev/null @@ -1,292 +0,0 @@ - - - - - - XCCDF test result - - - - - - - -

- -

-

-

Introduction

-

-

Test Result

-

- - - - - - - - - - - - - - - - - - - - - -

Result ID	Profile	Start time	End time	Benchmark	Benchmark version
xccdf_org.open-scap_testresult_default-profile	- (Default profile) -	- 2013-09-17 20:24 -	- 2013-09-17 20:24 -	- embedded -	20130917.1

-

-

-

-

Target info

-

- - - - - - - - - - -

-

Targets

-

hpl

-

-

Addresses

-

127.0.0.1
192.168.1.3
192.168.100.1
::1
fe80::f27b:cbff:fe0f:5a3b
2001:db8:81:e2:0:26b5:365b:5072
fe80::2045:eaff:fe47:e569

-

-

Platforms

-

cpe:/o:gentoo:linux

-

-

-

-

-

Score

-

- - - - - - - - - - - - - - - - - - - -

system	score	max	%	bar
urn:xccdf:scoring:default	100.00	100.00	100.00%	- - - -

-

-

-

-

-

Results overview

-

-

Rule Results Summary

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

pass	fixed	fail	error	not selected	not checked	not applicable	informational	unknown	total
- 1 -	- 0 -	- 0 -	- 0 -	- 0 -	- 0 -	- 0 -	- 0 -	- 0 -	- 1 -

-

-

- - - - - - - - - - - - - - -

Title	Result
- Test if /home is a separate partition -	- pass -

-

-

-

-

Results details

-

-

Result for Test if /home is a separate partition

-

Result: pass

-

Rule ID: xccdf_org.gentoo.dev.swift_rule_partition-home

-

Time: 2013-09-17 20:24

-

- results overview -

-

-

-

- -

- - diff --git a/xml/SCAP/results-xccdf.xml b/xml/SCAP/results-xccdf.xml deleted file mode 100644 index db19a4c..0000000 --- a/xml/SCAP/results-xccdf.xml +++ /dev/null @@ -1,326 +0,0 @@ - - - draft - Gentoo Security Benchmark - - This benchmarks helps people in improving their system configuration to be - more resilient against attacks and vulnerabilities. - - - 20130917.1 - - - Default server setup settingsIntensive validation profile - - In this profile, we verify common settings for Gentoo Linux - configurations. The tests that are enabled in this profile can be ran - without visibly impacting the performance of the system. - - This profile extends the default server profile by including tests that - are more intensive to run on a system. Tests such as full file system - scans to find world-writable files or directories have an otherwise too - large impact on the performance of a server. - - - - - Introduction - - Since years, Gentoo Linux has a Gentoo Security Handbook - which provides a good insight in secure system - configuration for a Gentoo systems. Although this is important, an - improved method for describing and tuning a systems' security state has - emerged: SCAP, or the Security Content Automation Protocol. - - - As such, this benchmark is an update on the security - handbook, including both the in-depth explanation of settings as well as - the means to validate if a system complies with this or not. Now, during - the development of this benchmark document, we did not include all - information from the Gentoo Security Handbook as some of the settings are - specific to a service that is not all that default on a Gentoo Linux - system. Although these settings are important as well, it is our believe - that this is best done in separate benchmarks for those services instead. - - - Where applicable, this benchmark will refer to a different hardening guide - for specific purposes (such as the Hardening OpenSSH benchmark). - - Gentoo - Security Handbook - - This is no security policy - - It is very important to realize that this document is not a - policy. You are not obliged to follow this if you want a secure system - nor do you need to agree with everything said in the document. - - - The purpose of this document is to guide you in your quest to hardening - your system. It will provide pointers that could help you decide in - particular configuration settings and will do this hopefully using - sufficient background information to make a good choice. - - - You will find settings you don't agree with. That's fine, but - if you disagree with why we do this, we would like to hear it - and we'll add the feedback to the guide. - - - - A little more about SCAP and OVAL - - Within SCAP, NIST has defined some new standards of which XCCDF and OVAL - are notably important in light of the guide you are currently using. - - - XCCDF (Extensible Configuration Checklist Description Format) is - a specification language for writing security checklists and benchmarks - (such as the one you are reading now) - - - OVAL (Open Vulnerability and Assessment Language) is a standard to describe - and validate system settings - - - - Thanks to the OVAL and XCCDF standards, a security engineer can now describe - how the state of a system should be configured, how this can be checked - automatically and even report on these settings. Furthermore, within the - description, the engineer can make "profiles" of different states (such as - a profile for a workstation, server (generic), webserver, LDAP server, - ...) and reusing the states (rules) identified in a more global scope. - - - - Using this guide - - The guide you are currently reading is the guide generated from this SCAP - content (more specifically, the XCCDF document) using openscap, - a free software implementation for handling SCAP content. Within Gentoo, - the package app-forensics/openscap provides the tools, and - the following command is used to generate the HTML output: - - ### Command to generate this guide ### -# oscap xccdf generate guide scap-gentoo-xccdf.xml > output.html - - - Secondly, together with this XCCDF XML, you will also find an OVAL XML file. - The two files combined allow you to automatically validate various settings as - documented in the benchmark. - - - Now, to validate the tests, you can use the following commands: - ### Testing the rules mentioned in the XCCDF document ### -# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default scap-gentoo-xccdf.xml - - To generate a full report in HTML as well, you can use the next command: - ### Testing the rules and generating an HTML report ### -# oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default --results xccdf-results.xml --report report.html scap-gentoo-xccdf.xml - - - Finally, this benchmark will suggest some settings which you do not want - to enable. That is perfectly fine - even more, some settings might even - raise eyebrows left and right. We will try to document the reasoning behind - the settings but you are free to deviate from them. If that is the case, - you might want to disable the rules in the XCCDF document so that they are - not checked on your system. - - - - Available XCCDF Profiles - - As mentioned earlier, the XCCDF document supports multiple profiles. For the time - being, two profiles are defined: - - - - The default profile contains tests that are quick to validate - - - The intensive profile contains all tests, including those that - take a while (for instance because they perform full file system scans) - - - Substitute the profile information in the commands above with the profile you want to test on. - - - - - Before You Start - - Before you start deploying Gentoo Linux and start hardening it, it is wise - to take a step back and think about what you want to accomplish. Setting - up a more secured Gentoo Linux isn't a goal, but a means to reach - something. Most likely, you are considering setting up a Gentoo Linux - powered server. What is this server for? Where will you put it? What other - services will you want to run on the same OS? Etc. - - - Infrastructure Architecturing - - When considering your entire IT architecture, many architecturing - frameworks exist to write down and further design your infrastructure. - There are very elaborate ones, like TOGAF (The Open Group Architecture - Framework), but smaller ones exist as well. - - - A well written and maintained infrastructure architecture helps you - position new services or consider the impact of changes on existing - components. And the reason for mentioning such a well designed architecture - in a hardening guide is not weird. - - - Security is about reducing risks, not about harassing people or making - work for a system administrator harder. And reducing risks also means - that you need to keep a clear eye out on your architecture and all its - components. If you do not know what you are integrating, where you are - putting it or why, then you have more issues to consider than hardening - a system. - - - - Mapping Requirements - - When you design a service, you need to take both functional and - non-functional requirements into account. That does sound like - overshooting for a simple server installation, but it is not. Have you - considered auditing? Where do the audit logs need to be sent to? What - about authentication? Centrally managed, or manually set? And the server - you are installing, will it only host a particular service, or will it - provide several services? - - - When hosting multiple services on the same server, make sure that the - server is positioned within your network on an acceptable segment. It is - not safe to host your central LDAP infrastructure on the same system as - your web server that is facing the Internet. - - IBM DeveloperWorks article on "Capturing Architectural Requirements" - - - Non-Software Security Concerns - - From the next chapter onwards, we will only focus on the software side - hardening. There are of course also non-software concerns that you - should investigate. - - Site Security - Handbook (RFC2196) - - Physical Security - - Make sure that your system is only accessible (physically) by trusted - people. Fully hardening your system, only to have a malicious person - take out the harddisk and run away with your confidential data is not - something you want to experience. - - - When physical security cannot be guaranteed (like with laptops), make - sure that theft of the device only results in the loss of the hardware - and not of the data and software on it (backups), and also that the - data on it cannot be read by unauthorized people. We will come back on - disk encryption later. - - Data - Center Physical Security Checklist (SANS, PDF) - - - Policies and Contractual Agreements - - Create or validate the security policies in your organization. This is - not only as a stick (against internal people who might want to abuse - their powers) but also to document and describe why certain decisions - are made (both architecturally as otherwise). - - Technical - Writing for IT Security Policies in Five Easy Steps (SANS, - PDF) - Information - Security Policy Templates (SANS) - - - - - Installation Configuration - - Let's focus now on the OS hardening. Gentoo Linux allows you to update the - system as you want after installation, but it might be interesting to - consider the following aspects during installation if you do not want a - huge migration project later. - - - Storage Configuration - - Your storage is of utmost importance in any environment. It needs to be - sufficiently fast, not to jeopardize performance, but also secure and - manageable yet still remain flexible to handle future changes. - - - Partitioning - - Know which locations in your file system structure you want on a - different partition or logical volume. Separate locations allow for a - more distinct segregation (for instance, hard links between different - file systems) and low-level protection (file system corruption impact, - but also putting the right data on the right storage media). - - Filesystem Hierarchy - Standard - - /home Location - - The /home location should be on its own partition, - allowing the administrator to mount this location with specific - options targetting the file systems' security settings or quota. - - - Test if /home is a separate partition - - - - - - - - - - OSCAP Scan Result - swift - hpl - 127.0.0.1 - 192.168.1.3 - 192.168.100.1 - ::1 - fe80::f27b:cbff:fe0f:5a3b - 2001:db8:81:e2:0:26b5:365b:5072 - fe80::2045:eaff:fe47:e569 - - OpenSCAP - 0.9.8 - 00:00:00:00:00:00 - F0:7B:CB:0F:5A:3B - 22:45:EA:47:E5:69 - 00:00:00:00:00:00 - F0:7B:CB:0F:5A:3B - 22:45:EA:47:E5:69 - 22:45:EA:47:E5:69 - - - pass - - - - - 100.000000 - -