Tightening Stig hardening
This commit is contained in:
Audiobuzz
@@ -34,6 +34,79 @@ Posture decisions (2026-06-18, lab phase):
|
||||
|
||||
| 11 | **Login banner content** (`banner_etc_issue`, `banner_etc_issue_net`, `banner_etc_motd`) | STIG requires the verbatim DoD/USG "you are accessing a U.S. Government Information System" text. This is a fictional starship fleet, not a USG system, so `/etc/issue{,.net}` + `/etc/motd` carry the fleet (ISV AURELIAN) notice instead (provisioner step 2e, `files/banner/fleet-issue`). The content rules therefore fail by design. | The banner **keeps its security function**: it still states authorized-crew-only, that the terminal is monitored/logged, and that unauthorized access is prohibited — only the wording is themed. `sshd_enable_warning_banner` (Banner is shown) still passes. |
|
||||
|
||||
## 12. Report triage 2026-06-19 (scan `app-9f7d8d1`)
|
||||
|
||||
Triage of the 21 REVIEW rows from the post-fix hardened scan (398 pass / 12 fail
|
||||
/ 9 notchecked — a valid scan). All but one are dispositioned below; the rule IDs
|
||||
are unselected in `diskless-tailoring.xml` (or made to pass / N/A) so they no
|
||||
longer surface as REVIEW. **Remaining open: `selinux_context_elevation_for_sudo`**
|
||||
(see end).
|
||||
|
||||
**Waived — covered by an existing register entry (Bucket A):**
|
||||
- `encrypt_partitions`, `auditd_audispd_configure_sufficiently_large_partition` —
|
||||
single erofs+tmpfs root, no partitions (#1).
|
||||
- `grub2_password` — UKI, no GRUB (#2).
|
||||
- `sysctl_crypto_fips_enabled`, `harden_sshd_macs_openssh_conf_crypto_policy`,
|
||||
`harden_sshd_macs_opensshserver_conf_crypto_policy` — FIPS off (#5).
|
||||
- `configured_firewalld_default_deny` — firewall off for the lab boot LAN (#4).
|
||||
- `sssd_enable_certmap`, `sssd_has_trust_anchor` — no SSSD/PKI/smartcard; local
|
||||
key-only host, no domain join (#7).
|
||||
|
||||
**Waived — architecturally absent, N/A (Bucket B):** `account_temp_expire_date`
|
||||
(no temporary accounts), `accounts_user_home_paths_only` (appliance accounts,
|
||||
fixed home layout), `libreswan_approved_tunnels` (no IPsec/libreswan),
|
||||
`security_patches_up_to_date` (rebuild-from-current model — a scanner can't assess
|
||||
patch currency against a future rebuild), `ssh_keys_passphrase_protected` (no
|
||||
private keys stored on the host; host keys regenerate per boot).
|
||||
|
||||
**Waived — decisions (Bucket C):**
|
||||
- `installed_OS_is_vendor_supported` — Rocky **is** vendor-supported; the rule
|
||||
fails only because the RHEL datastream's CPE checks for an RHEL subscription.
|
||||
- `network_configure_name_resolution` — single DHCP-provided resolver by design
|
||||
on the boot LAN; the multi-DNS requirement is N/A to the netboot model.
|
||||
- `sysctl_user_max_user_namespaces_no_remediation` — **KEEP user namespaces
|
||||
enabled**: the Chromium kiosk sandbox requires them. Disabling userns would
|
||||
break the kiosk.
|
||||
- `accounts_authorized_local_users` — the authorized-users check doesn't know the
|
||||
key-only appliance accounts (`fleetadmin`, `kiosk`); they are authorized (see
|
||||
#10). *Production note: prefer setting the SSG authorized-users regex variable
|
||||
to assert these two explicitly rather than waiving the whole check.*
|
||||
- `package_postfix_installed` — **postfix removed** (provisioner 2c-STIG): the
|
||||
appliance sends no mail and ships audit off-box via rsyslog (2f), so a local
|
||||
MTA is dead attack surface. This also makes `postfix_prevent_unrestricted_relay`
|
||||
N/A. Audit-failure notification relies on the remote offload, not email
|
||||
(`auditd ... action_mail_acct` stays configured but is not the alerting path).
|
||||
|
||||
**Remediated to pass (not waived):**
|
||||
- `configure_usbguard_auditbackend` + `usbguard_allow_hid` / `usbguard_allow_hub`
|
||||
/ `usbguard_allow_hid_and_hub` — **decision: ENABLE USBGuard with enforcement.**
|
||||
usbguard was already installed + enabled, but its policy is generated on the
|
||||
build VM (no real USB), so under the default **block** target a physical console
|
||||
keyboard/mouse would be blocked. The provisioner now sets
|
||||
`AuditBackend=LinuxAudit` and writes a **hardware-independent HID + hub
|
||||
allowlist** (`allow with-interface match-all { 03:*:* }`, `{ 09:00:* }`, and the
|
||||
composite `{ 03:*:* 09:00:* }`) so console input survives while mass storage and
|
||||
other device classes are blocked. **⚠ BENCH-VERIFY physical console input on
|
||||
real hardware** — if a platform's input device doesn't match the HID/hub
|
||||
classes, fall back to a per-platform allow rule or re-waive
|
||||
`configure_usbguard_auditbackend`.
|
||||
|
||||
**Remediated with confinement (decision 2026-06-20) — `selinux_context_elevation_for_sudo`:**
|
||||
SSG ships no automated fix; the STIG manual remediation
|
||||
(`... TYPE=sysadm_t ROLE=sysadm_r ...`) requires the admin to reach the
|
||||
`sysadm_r` role, which `unconfined_u` cannot. So the provisioner (2c-STIG) now
|
||||
(1) rewrites the admin sudoers rule to `<admin> ALL=(ALL) TYPE=sysadm_t
|
||||
ROLE=sysadm_r NOPASSWD:ALL` (keeps NOPASSWD — the admin is key-only, #8 — and is
|
||||
what the OVAL check matches), and (2) maps the admin to the confined **`staff_u`**
|
||||
SELinux user (`semanage login`) so the `staff_r`→`sysadm_r` sudo transition is
|
||||
authorized at runtime. `staff_u` (not `sysadm_u`) is used so SSH login isn't gated
|
||||
by the `ssh_sysadm_login` boolean. **⚠ Two bench gates before trusting:** (a)
|
||||
admin SSH login + `sudo` + every privileged op must work under `staff_u`
|
||||
confinement — if it locks out, `enable_stig=false` is the escape hatch and this
|
||||
reverts to a justified deviation; (b) reproducibility — `semanage` rebuilds the
|
||||
SELinux policy store, so confirm the verity hash is stable across two builds (and
|
||||
normalize in 2d hygiene if it drifts).
|
||||
|
||||
## Things that are NOT deviations (kept / enforced)
|
||||
|
||||
- **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).
|
||||
@@ -44,6 +117,9 @@ Posture decisions (2026-06-18, lab phase):
|
||||
everything else stays RPM-trust-only. (fapolicyd blocking that binary was the
|
||||
original kiosk-won't-start cause.)
|
||||
- **auditd** enabled; STIG audit rules applied; logs locally.
|
||||
- **USBGuard** enabled + enforcing (`block` target) with a HID/hub allowlist and
|
||||
`AuditBackend=LinuxAudit` (see #12) — blocks USB mass storage / unknown device
|
||||
classes at the console while keeping keyboard/mouse working.
|
||||
- **sshd hardening**: root login off, password & keyboard-interactive auth off,
|
||||
key-only (drop-in `50-fleet-hardening.conf`); STIG ciphers/MACs/KEX applied.
|
||||
- **No per-host state**: SSH host keys stripped at build, regenerated at first
|
||||
|
||||
Reference in New Issue
Block a user