<Group id="disk_partitioning">
<title>Disk Partitioning</title>
<description>To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for 
<tt>/</tt>, <tt>/boot</tt>, and <tt>swap</tt>.
<ul>
<li>If starting with any of the default layouts, check the box to
"Review and modify partitioning." This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <tt>/</tt>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</li>
<li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</li>
</ul>
If a system has already been installed, and the default
partitioning scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.
See the LVM HOWTO at http://tldp.org/HOWTO/LVM-HOWTO/ for more
detailed information on LVM.</description>

<Rule id="partition_for_tmp">
<title>Ensure /tmp Located On Separate Partition</title>
<description>
The <tt>/tmp</tt> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.
</description>
<ocil><partition-check-macro part="/tmp "/></ocil>
<rationale>
The <tt>/tmp</tt> partition is used as temporary storage by many programs.
Placing <tt>/tmp</tt> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.
</rationale>
<ident cce="26435-8" stig="RHEL-06-000001" />
<oval id="partition_for_tmp" />
<ref nist="SC-32" disa="1208"/>
<tested by="MM" on="20120928"/>
</Rule>

<Rule id="partition_for_var">
<title>Ensure /var Located On Separate Partition</title>
<description>The <tt>/var</tt> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <tt>/var</tt> has its own partition
or logical volume at installation time, or migrate it using LVM.
</description>
<ocil><partition-check-macro part="/var "/></ocil>
<rationale>
Ensuring that <tt>/var</tt> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <tt>/var</tt> directory to contain
world-writable directories installed by other software packages.
</rationale>
<ident cce="26639-5" stig="RHEL-06-000002" />
<oval id="partition_for_var" />
<ref nist="SC-32" disa="1208"/>
<tested by="MM" on="20120928"/>
</Rule>

<Rule id="partition_for_var_log">
<title>Ensure /var/log Located On Separate Partition</title>
<description>
System logs are stored in the <tt>/var/log</tt> directory.
Ensure that it has its own partition or logical
volume at installation time, or migrate it using LVM.
</description>
<ocil><partition-check-macro part="/var/log "/></ocil>
<rationale>
Placing <tt>/var/log</tt> in its own partition
enables better separation between log files
and other files in <tt>/var/</tt>.
</rationale>
<ident cce="26215-4"  stig="RHEL-06-000003" />
<oval id="partition_for_var_log" />
<ref nist="AU-9,SC-32" disa="1208"/>
<tested by="MM" on="20120928"/>
</Rule>

<Rule id="partition_for_var_log_audit">
<title>Ensure /var/log/audit Located On Separate Partition</title>
<description>
Audit logs are stored in the <tt>/var/log/audit</tt> directory.  Ensure that it
has its own partition or logical volume at installation time, or migrate it
later using LVM. Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.
</description>
<ocil><partition-check-macro part="/var/log/audit "/></ocil>
<rationale>
Placing <tt>/var/log/audit</tt> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.
</rationale>
<ident cce="26436-6"  stig="RHEL-06-000004" />
<oval id="partition_for_var_log_audit" />
<ref nist="AU-4,AU-9,SC-32" disa="137,138,1208"/>
<tested by="MM" on="20120928"/>
</Rule>

<Rule id="partition_for_home">
<title>Ensure /home Located On Separate Partition</title>
<description>
If user home directories will be stored locally, create a separate partition
for <tt>/home</tt> at installation time (or migrate it later using LVM). If
<tt>/home</tt> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.
</description>
<ocil><partition-check-macro part="/home "/></ocil>
<rationale>
Ensuring that <tt>/home</tt> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.
</rationale>
<ident cce="26557-9"  stig="RHEL-06-000007" />
<oval id="partition_for_home" />
<ref nist="SC-32" disa="1208"/>
<tested by="MM" on="20120928"/>
</Rule>

<Rule id="encrypt_partitions" >
<title>Encrypt Partitions</title>
<description>
Red Hat Enterprise Linux 6 natively supports partition encryption through the
Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to 
encrypt a partition is during installation time.
<br /><br />
For manual installations, select the <tt>Encrypt</tt> checkbox during
partition creation to encrypt the partition. When this
option is selected the system will prompt for a passphrase to use in
decrypting the partition. The passphrase will subsequently need to be entered manually
every time the system boots.
<br /><br />
For automated/unattended installations, it is possible to use Kickstart by adding
the <tt>--encrypted</tt> and <tt>--passphrase=</tt> options to the definition of each partition to be
encrypted. For example, the following line would encrypt the root partition:
<pre>part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=<i>PASSPHRASE</i></pre>
Any <i>PASSPHRASE</i> is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly.
Omitting the <tt>--passphrase=</tt> option from the partition definition will cause the
installer to pause and interactively ask for the passphrase during installation.
<br /><br />
Detailed information on encrypting partitions using LUKS can be found on
the Red Hat Documentation web site:<br />
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html
</description>
<ocil clause="encryption must be used and is not employed">
Determine if encryption must be used to protect data on the system. 
</ocil>
<rationale>
The risk of a system's physical compromise, particularly mobile systems such as
laptops, places its data at risk of compromise.  Encrypting this data mitigates
the risk of its loss if the system is lost.
</rationale>
<ident cce="27596-6" stig="RHEL-06-000275" />
<ref nist="SC-13, SC-28" disa="1019,1199,1200" />
</Rule>

</Group>
