From eed29b1db9dd62d014842340abb8601570fe6655 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Thu, 22 Jul 2021 14:26:49 -0400 Subject: [PATCH] New rule for RHEL-08-020270 --- .../account_emergency_expire_date/rule.yml | 52 +++++++++++++++++++ products/rhel8/profiles/stig.profile | 1 + shared/references/cce-redhat-avail.txt | 1 - .../data/profile_stability/rhel8/stig.profile | 1 + .../profile_stability/rhel8/stig_gui.profile | 1 + 5 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml new file mode 100644 index 0000000000..a47c7f39bc --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml @@ -0,0 +1,52 @@ +documentation_complete: true + +prodtype: fedora,rhel8 + +title: 'Assign Expiration Date to Emergency Accounts' + +description: |- + Emergency accounts are privileged accounts established in response to + crisis situations where the need for rapid account activation is required. + In the event emergency accounts are required, configure the system to + terminate them after a documented time period. For every emergency account, + run the following command to set an expiration date on it, substituting + ACCOUNT_NAME and YYYY-MM-DD + appropriately: + 
$ sudo chage -E YYYY-MM-DD ACCOUNT_NAME
+ YYYY-MM-DD indicates the documented expiration date for the + account. For U.S. Government systems, the operating system must be + configured to automatically terminate these types of accounts after a + period of 72 hours. + +rationale: |- + If emergency user accounts remain active when no longer needed or for + an excessive period, these accounts may be used to gain unauthorized access. + To mitigate this risk, automated termination of all emergency accounts + must be set upon account creation. +
+ +severity: medium + +identifiers: + cce@rhel8: CCE-85910-8 + +references: + cis-csc: 1,12,13,14,15,16,18,3,5,7,8 + cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS06.03 + disa: CCI-000016,CCI-001682 + isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4 + isa-62443-2013: 'SR 1.1,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 6.2' + iso27001-2013: A.12.4.1,A.12.4.3,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 + nist: AC-2(2),AC-2(3),CM-6(a) + nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6 + srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002 + stigid@rhel8: RHEL-08-020270 + vmmsrg: SRG-OS-000002-VMM-000020,SRG-OS-000123-VMM-000620 + +ocil_clause: 'any emergency accounts have no expiration date set or do not expire within a documented time frame' + +ocil: |- + For every emergency account, run the following command + to obtain its account aging and expiration information: + 
$ sudo chage -l ACCOUNT_NAME
+ Verify each of these accounts has an expiration date set as documented. diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile index 7270a8f91f..c4b9d02af5 100644 --- a/products/rhel8/profiles/stig.profile +++ b/products/rhel8/profiles/stig.profile @@ -558,6 +558,7 @@ selections: - account_disable_post_pw_expiration # RHEL-08-020270 + - account_emergency_expire_date # RHEL-08-020280 - accounts_password_pam_ocredit diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 665f903ead..f500179292 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -43,7 +43,6 @@ CCE-85906-6 CCE-85907-4 CCE-85908-2 CCE-85909-0 -CCE-85910-8 CCE-85911-6 CCE-85912-4 CCE-85913-2 diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile index 7d59cfff62..72e205b695 100644 --- a/tests/data/profile_stability/rhel8/stig.profile +++ b/tests/data/profile_stability/rhel8/stig.profile @@ -24,6 +24,7 @@ documentation_complete: true reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux selections: - account_disable_post_pw_expiration +- account_emergency_expire_date - account_temp_expire_date - accounts_have_homedir_login_defs - accounts_logon_fail_delay diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile index 2c2daad6f6..cc21621617 100644 --- a/tests/data/profile_stability/rhel8/stig_gui.profile +++ b/tests/data/profile_stability/rhel8/stig_gui.profile @@ -35,6 +35,7 @@ documentation_complete: true reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux selections: - account_disable_post_pw_expiration +- account_emergency_expire_date - account_temp_expire_date - accounts_have_homedir_login_defs - accounts_logon_fail_delay