stig-fix-el6 ============ ABOUT ===== DISA STIG Scripts to harden a system to the RHEL 6 STIG. These scripts will harden a system to specifications that are based upon the the following hardening and specifications provided by the following projects: DISA RHEL 6 STIG V1 R2 http://iase.disa.mil/stigs/os/unix/red_hat.html NIST 800-53 (USGCB) Content for RHEL 5 http://usgcb.nist.gov/usgcb/rhel_content.html NSA SNAC Guide for Red Hat Enterprise Linux 5 http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf Aqueduct Project https://fedorahosted.org/aqueduct Tresys Certifiable Linux Integration Platform (CLIP) http://oss.tresys.com/projects/clip CONTENT ======= Scritps are designed to run out of /opt/stig-fix/ on a perferably fresh installation of RHEL 6.4+ (RHEL 6.4 updated pam_lastlog.so to disable incative users.) apply.sh - master script that runs scripts in cat1-cat4 and misc checkpoint.sh - checkpoint the current configuration so re-running apply.sh will not squash changes toggle_ipv6.sh - toggles IPv6 support, requires reboot (default is off) toggle_nousb.sh - toggles the 'nousb' kernel flag only toggle_udf.sh - toggles 'udf' mounting of DVDs (USGCB Blacklists udf) toggle_usb.sh - toggles 'nousb' kernel flag and the mass storage kernel module config - Directory with some pre-STIGed configurations (auditd,iptables,system-auth-local,etc.) cat1 - CAT I STIG Scripts cat2 - CAT II STIG Scripts cat3 - CAT III STIG Scripts cat4 - CAT IV STIG Scripts misc - NSA SNAC, GNOME, and Other miscellenous lockdown scripts manual - Manaully run (There be dragons here) backups - Backup copy of modified files to compare and restore configurations Run is logged in /var/log/stig-fix-YYYY-MM-DD.log HOWTO ===== 1. Hardening the BIOS configuration (Disable USB Booting, set administrative passwords, etc.) 2. Enable Drive Encryption (LUKS on your LVM VG or Hardware-based FIPS 140-2 compliant) 3. Partitioning the system to minimally include the following: /boot swap / /home /tmp /var /var/log /var/log/audit /var/www (Optional, Web Servers) /rhnsat (Optional, RHN Satellite 5.5 and earlier, 5.6 uses /var) /opt (Optional, Commercial Applications) 4. Select a GRUB password (SHA512, using grub-crypt or during Install) 5. Install a minimal installation (include rsyslog, ntp, aide, scrub, vlock, screen, logwatch, openswan, openscap, openscap-utils, dracut-fips) [RPM pulls the base requirements] 6. Register a system with a patch server - either a disconnected RHN Satellite or local/web-based (preferably SSL) repository: Kickstart can register a system with rhnreg_ks --activationkey="<KEY>" With a disconnected RHN Satellite, be sure to include the proper /etc/sysconfig/rhn/up2date configuration and SSL Certificate. For a local or web-based repository, create a .repo file in /etc/yum.repos.d/ # vi /etc/yum.repos.d/rhel-dvd.repo [rhel-dvd] name=Red Hat Enterprise Linux $releasever - $basearch - DVD baseurl=file:///media/ enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release # mount /dev/dvd /media # yum clean all # yum update For a repository, synchronize patches via a RHEL system connected to the Public RHN: To synchronize a channel with only the newest packages, use the following command: # reposync -n -l -p <directory> -repoid=’<channel>’ To synchronize an entire channel, use the following command: # reposync -l -p <directory> -repoid=’<channel>’ After the packages have been downloaded into the directory in the previous step, create a repository with the RPMs. # createrepo <directory> To export the directory, create an ISO image from the directory to burn to DVD: # mkisofs -RJ -o repo-export.iso <directory> 7. Include the stig-fix scirpts in the Kickstart and run the configuration '/sbin/stig-fix -q &> /dev/null' in the %post section -OR- install the RPM afterwards and run manually (/sbin/stig-fix) 8. Configure NTP (/etc/ntp.conf) for the local time sources (or military ones) that are approved 9. Configure Syslog forwarding (/etc/rsyslog.conf) to a local rsyslog instance (or Splunk as the case may be) 10. Add users with root access to the 'wheel' group, for users with ssh access add them to the 'sshusers' group. 11. Review the manual scripts in (/opt/stig-fix/manual) - putting the kernel in FIPS 140-2 mode can cause various weaker authentication not to work (e.g. RHN Satellite is still using md5) 12. The following scripts have been included for convenience (RPM Symbolic Links to scripts): /sbin/toggle_ipv6 (for IPv6 support - defualt is off) /sbin/toggle_udf (for mounting DVDs) /sbin/toggle_usb (for enabling and disabling USB storage) /sbin/toggle_nousb (for enabling USB Keyboards that don't work with the 'nousb' kernel option) 13. Configure Firewalls/TCP_WRAPPERS: Edit the iptables, ip6tables, hosts.allow, and hosts.deny as requried, copy any changes back to the ./config/ directory for iptables/ip6tables and modify cat2/gen006620.sh (TCP_WRAPPERS) to ensure changes are applied if the stig-fix command is run again. 14. Install site approved monitoring tools and virus scan. Examples include, but are not limited to, the following: - McAfee VSE for Linux - McAfee HBSS - ClamAV - HP OpenView 15. Create users: Remote Access (no ssh without this group) # useradd -m -c "Remote User" -G sshusers remoteuser System Administrator (SA) # useradd -m -c "System Administrator" -G sshusers,wheel admin Audit Administrator (AA) # useradd -m -c "Audit Administrator" -G sshusers,isso auditor (Optional) After adding SAs to the system, lock the root account: # passwd -l root 16. System Checkpoint - to prevent apply.sh from overwriting your configuration you should checkpoint your system. A checkpoint will backup the current configuration into the 'backup' directory and overwrite the configurations contained in the 'config' directory. # ./checkpoint.sh (In progress - working on a method to re-package script changes into a custom RPM for validation and to distribute configurations to other systems) PROJECT WORK ============ - Map DISA STIG RHEL 5 GEN controls to DISA STIG RHEL 6 SRG and NIST 800-53 controls (each sub script has an echo block stating what GEN it applies to - adding the SRG and NIST controls will help security people to understand what was inteneded during the C&A process. - Help verify the configurations against SSG OpenSCAP Content - Add updates to with new security features in RHEL 6.5 and newer - RPM re-package after system configuration checkpoint