aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEugeni Dodonov <eugeni@mandriva.org>2010-02-18 18:17:04 +0000
committerEugeni Dodonov <eugeni@mandriva.org>2010-02-18 18:17:04 +0000
commit0b879f1ccd0d3da358ba5cceeddc6bc1101d683f (patch)
tree8ba8b43c1784f8d0b85949fb0a00014b3d448c03
parent14d32c3ad700d1e57f8d8e99a5680a29b1990977 (diff)
downloadmsec-0b879f1ccd0d3da358ba5cceeddc6bc1101d683f.tar
msec-0b879f1ccd0d3da358ba5cceeddc6bc1101d683f.tar.gz
msec-0b879f1ccd0d3da358ba5cceeddc6bc1101d683f.tar.bz2
msec-0b879f1ccd0d3da358ba5cceeddc6bc1101d683f.tar.xz
msec-0b879f1ccd0d3da358ba5cceeddc6bc1101d683f.zip
Added policy for 'fileserver' security level.
-rw-r--r--conf/level.fileserver67
-rw-r--r--conf/perm.fileserver76
2 files changed, 143 insertions, 0 deletions
diff --git a/conf/level.fileserver b/conf/level.fileserver
new file mode 100644
index 0000000..2ed7f74
--- /dev/null
+++ b/conf/level.fileserver
@@ -0,0 +1,67 @@
+BASE_LEVEL=fileserver
+ALLOW_X_CONNECTIONS=no
+CHECK_WRITABLE=weekly
+ENABLE_IP_SPOOFING_PROTECTION=yes
+MAIL_EMPTY_CONTENT=no
+ACCEPT_BROADCASTED_ICMP_ECHO=yes
+CHECK_PERMS=daily
+CHECK_PERMS_ENFORCE=yes
+CHECK_SECTOOL=weekly
+CHECK_SECTOOL_LEVEL=3
+CHECK_USER_FILES=daily
+ENABLE_SUDO=wheel
+ALLOW_XSERVER_TO_LISTEN=no
+CHECK_CHKROOTKIT=weekly
+SHELL_HISTORY_SIZE=-1
+ALLOW_REBOOT=yes
+CHECK_SUID_ROOT=weekly
+SYSLOG_WARN=yes
+ENABLE_AT_CRONTAB=yes
+ACCEPT_BOGUS_ERROR_RESPONSES=no
+CHECK_PASSWD=daily
+PASSWORD_HISTORY=0
+CHECK_SUID_MD5=weekly
+CHECK_SHOSTS=daily
+MAIL_USER=root
+ALLOW_AUTOLOGIN=no
+ENABLE_PAM_WHEEL_FOR_SU=no
+CHECK_SHADOW=daily
+ALLOW_ROOT_LOGIN=yes
+CHECK_UNOWNED=weekly
+FIX_UNOWNED=yes
+CHECK_USERS=daily
+CHECK_GROUPS=daily
+ENABLE_CONSOLE_LOG=yes
+ALLOW_USER_LIST=yes
+ENABLE_DNS_SPOOFING_PROTECTION=yes
+CREATE_SERVER_LINK=remote
+ENABLE_PASSWORD=yes
+NOTIFY_WARN=no
+WIN_PARTS_UMASK=000
+CHECK_OPEN_PORT=daily
+CHECK_FIREWALL=daily
+SHELL_TIMEOUT=0
+ALLOW_REMOTE_ROOT_LOGIN=without-password
+ENABLE_LOG_STRANGE_PACKETS=yes
+USER_UMASK=022
+CHECK_RPM_PACKAGES=weekly
+CHECK_RPM_INTEGRITY=monthly
+SECURE_TMP=yes
+ENABLE_SULOGIN=yes
+ENABLE_PAM_ROOT_FROM_WHEEL=no
+MAIL_WARN=yes
+ALLOW_XAUTH_FROM_ROOT=no
+CHECK_SECURITY=yes
+ACCEPT_ICMP_ECHO=yes
+PASSWORD_LENGTH=6,0,0
+AUTHORIZE_SERVICES=yes
+ROOT_UMASK=022
+ENABLE_MSEC_CRON=yes
+TTY_WARN=no
+CHECK_SGID=weekly
+CHECK_PROMISC=daily
+ENABLE_STARTUP_MSEC=yes
+ENABLE_STARTUP_PERMS=yes
+ALLOW_CURDIR_IN_PATH=no
+CHECK_ON_BATTERY=no
+LOG_RETENTION=24
diff --git a/conf/perm.fileserver b/conf/perm.fileserver
new file mode 100644
index 0000000..7e908f7
--- /dev/null
+++ b/conf/perm.fileserver
@@ -0,0 +1,76 @@
+# default permissions level
+###
+/ root.adm 755
+/bin/ root.root 755
+/bin/ping root.root 4755
+/bin/rpm rpm.rpm 755
+/boot/ root.root 755
+/dev/ root.root 755
+/etc/ root.root 755
+/etc/conf.modules root.root 644
+/etc/cron.daily/ root.root 755
+/etc/cron.hourly/ root.root 755
+/etc/cron.monthly/ root.root 755
+/etc/cron.weekly/ root.root 755
+/etc/crontab root.root 644
+/etc/dhcpcd/ root.root 755
+/etc/dhcpcd/* root.root 644
+/etc/hosts.allow root.root 644
+/etc/hosts.deny root.root 644
+/etc/hosts.equiv root.root 644
+/etc/inittab root.root 644
+/etc/ld.so.conf root.root 644
+/etc/mandrake-release root.root 644
+/etc/modules.conf root.root 644
+/etc/motd root.root 644
+/etc/printcap root.root 644
+/etc/profile.d/* root.root 755
+/etc/rc.d/ root.root 755
+/etc/rc.d/init.d/ root.root 755
+/etc/rc.d/init.d/functions root.root 644
+/etc/securetty root.root 644
+/etc/shutdown.allow root.root 644
+/etc/ssh/ssh_config root.root 644
+/etc/ssh/ssh_host_*key root.root 600
+/etc/ssh/ssh_host_*key.pub root.root 644
+/etc/ssh/sshd_config root.root 644
+/etc/sysconfig root.root 755
+/etc/syslog.conf root.root 644
+/home/ root.root 755
+/home/* current.current 755
+/lib/ root.root 755
+/mnt/ root.root 755
+/proc root.root 555
+/root/ root.root 700
+/sbin/ root.root 755
+/tmp/ root.root 1777
+/usr/ root.root 755
+/usr/* root.root 755
+/usr/bin/ root.root 755
+/usr/bin/cc root.root 755
+/usr/bin/finger root.root 755
+/usr/bin/g++* root.root 755
+/usr/bin/gcc* root.root 755
+/usr/bin/ssh root.root 755
+/usr/bin/telnet root.root 755
+/usr/bin/w root.root 755
+/usr/bin/who root.root 755
+/usr/lib/rpm/rpm? rpm.rpm 755
+/usr/sbin/ root.root 755
+/usr/sbin/sendmail.postfix root.root 755
+/usr/sbin/sendmail.sendmail root.mail 2755
+/usr/sbin/traceroute root.bin 4755
+/usr/tmp root.root 1777
+/var/ root.root 755
+/var/lib/rpm/Packages rpm.rpm 644
+/var/lock/subsys root.root 755
+/var/log/ root.root 755
+/var/log/security.log root.adm 640 force
+/var/log/msec.log root.adm 640 force
+/var/log/security/ root.adm 740 force
+/var/log/security/* root.adm 640 force
+/var/log/btmp root.utmp 600 force
+/var/log/wtmp root.utmp 664 force
+/var/log/lp-errs lp.lp 600
+/var/spool/mail/ root.mail 2775
+/var/tmp root.root 1777