Aaron Prayther LCE

1. An Approach to Building &
Maintaining a STIG’D RHEL Server
Red Hat Satellite Server
Forge.mil (https://software.forge.mil/sf/go/wiki3316
SPAWAR Linux Management Wiki)
Kickstart
Puppet
Tresys CLIP
Aaron Prayther
aprayther@lce.com
843 218 2178 Mil‐OSS WG2
2ND‐5TH AUGUST 2010 – WASHINGTON D.C.

2. 1)Checklist 2)Relation 3)Application
4)Assessment 5)Maintenance
1
UNIX 2
Security
Checklist IAVA 3
CVE
RED HAT Kickstart 4
YUM
Puppet Reporting?
SRR
5
Oval
Satellite Satellite
Forge.mil
2

3. Creating a more manageable and
reproducible STIG’D RHEL server
• There are some tools to help STIG a box
• There is an image that can be copied
• Nothing that is very reproducible over the long term
• We can create STIG’D servers and maintain them.
• The infrastructure, Satellite Server, is not a STIG
compliant server in the environment I work in
• Google: “STIG”
– The Stig is the name given to the racing driver character on
the BBC Television show Top Gear.
– Security Technical Implementation Guides
3

4. 1. UNIX Security Checklist
Is there an easier or better way?
UNIX Security
Checklist IAVA
CVE
RED HAT Kickstart
YUM
Puppet Reporting?
SRR
Oval
Satellite Satellite
Forge.mil
4

5. Unix Security Checklist (634 GEN, UNIX
& IAVA items)
5

6. 2. IAVA / CVE / Red Hat Security Advisory
A way to relate IAVA to patches
UNIX
Security
Checklist
IAVA
CVE
RED HAT Kickstart
YUM
Puppet Reporting?
SRR
Oval
Satellite Satellite
Forge.mil
6

7. Satellite Flags Errata
7

8. Satellite references CVE
8

9. 3. Kickstart, YUM & Puppet
“Applying”
UNIX
Security
Checklist IAVA
CVE
RED HAT Kickstart
YUM
Puppet Reporting?
SRR
Oval
Satellite Satellite
Forge.mil
9

10. Apply the Checklist
10

11. Tresys CLIP Puppet content
class lnx00160 {
## (LNX00160: CAT II) (Previously ‐ L074)
The SA will ensure the grub.conf
## file has permissions of 600, or more
restrictive.
file { "/boot/grub/grub.conf": mode => 600
}
}
11

12. 4. Satellite & Forge.mil
Custom software repositories
UNIX
Security
Checklist IAVA
CVE
RED HAT
Kickstart
Puppet Reporting?
SRR
Oval
Satellite
Satellite
Forge.mil
12

13. Assessment
13

14. Confirm ongoing compliance
• Oval seems to have a lot of potential
– Evaluating Oval and how to integrate
• Evaluating using SRR scripts in a cron job
• Satellite does a pretty good job of reporting
on CVE’s
• Would ultimately want to have a way of just
getting the interesting information for
hundreds (thousands) of servers
14

15. 5. Reporting
Confirm compliancy through life of server
UNIX
Security
Checklist
IAVA
CVE
RED HAT
Kickstart
YUM
Puppet Reporting?
SRR Satellite
Oval Forge.mil
Satellite
15

16. Maintain
16

17. Automating provisioning & maintenance is
an evolutionary process…
• Long messy kickstart file but a good
source of information
• Need to finish a “baseline” and modify
build process accordingly
• Need to move the vast majority of the
kickstart content to puppet server
• Disclaimers out of the way…
17

18. What it does today
• It does build a consistent server from scratch (you
can reverse engineer the entire build process and
know every configuration change made)
• This is not an image
• It utilizes controlled software repositories in
Satellite so that you can have a release process.
• It does setup the ability to manage compliance
over the life cycle of the server
• It has backups, centralized audit and log server
functionality
18

19. Use Forge.mil to collaborate
• https://software.forge.mil/sf/go/wiki3316
SPAWAR Linux Management Wiki
• This brief is located there
• Some instructions on howto use what is
available today are there.
• Contacts are being added so you know who to
consult with about different pieces, like Red
Hat Satellite Server
19

20. Forge.mil / Satellite
20

21. Summary
• Build a reproducible RHEL server, bare metal
or virtual.
• Build process results in something very close
to a STIG compliant (IA will say it’s compliant)
RHEL server
• The beginnings, of a server life cycle that
maintains & confirms compliance
• Currently functioning at a single project level
in an R&D environment
21

22. References
• https://software.forge.mil/sf/go/wiki3316 SPAWAR Linux
Management Wiki
• spawar‐dodbastile@software.Forge.mil SPAWAR Linux
Management Discussion email
• https://software.forge.mil/sf/discussion/do/listTopics/proje
cts.dodbastile/discussion.spawar_linux_managment
SPAWAR Linux Management Discussion page
• https://software.forge.mil/sf/docman/do/listDocuments/pr
ojects.dodbastile/docman.root.spawarlinuxmanagement
SPAWAR Linux Management Documents
• https://software.forge.mil/sf/docman/do/downloadDocum
ent/projects.dodbastile/docman.root.spawarlinuxmanage
ment/doc7520 SPAWAR Linux Management this brief
Aaron Prayther
aprayther@lce.com
843 218 2178
22