Added policy for 'fileserver' security level.

2 files changed, 143 insertions, 0 deletions

diff --git a/conf/level.fileserver b/conf/level.fileserver
new file mode 100644
index 0000000..2ed7f74
--- /dev/null
+++ b/conf/level.fileserver
@@ -0,0 +1,67 @@
+BASE_LEVEL=fileserver
+ALLOW_X_CONNECTIONS=no
+CHECK_WRITABLE=weekly
+ENABLE_IP_SPOOFING_PROTECTION=yes
+MAIL_EMPTY_CONTENT=no
+ACCEPT_BROADCASTED_ICMP_ECHO=yes
+CHECK_PERMS=daily
+CHECK_PERMS_ENFORCE=yes
+CHECK_SECTOOL=weekly
+CHECK_SECTOOL_LEVEL=3
+CHECK_USER_FILES=daily
+ENABLE_SUDO=wheel
+ALLOW_XSERVER_TO_LISTEN=no
+CHECK_CHKROOTKIT=weekly
+SHELL_HISTORY_SIZE=-1
+ALLOW_REBOOT=yes
+CHECK_SUID_ROOT=weekly
+SYSLOG_WARN=yes
+ENABLE_AT_CRONTAB=yes
+ACCEPT_BOGUS_ERROR_RESPONSES=no
+CHECK_PASSWD=daily
+PASSWORD_HISTORY=0
+CHECK_SUID_MD5=weekly
+CHECK_SHOSTS=daily
+MAIL_USER=root
+ALLOW_AUTOLOGIN=no
+ENABLE_PAM_WHEEL_FOR_SU=no
+CHECK_SHADOW=daily
+ALLOW_ROOT_LOGIN=yes
+CHECK_UNOWNED=weekly
+FIX_UNOWNED=yes
+CHECK_USERS=daily
+CHECK_GROUPS=daily
+ENABLE_CONSOLE_LOG=yes
+ALLOW_USER_LIST=yes
+ENABLE_DNS_SPOOFING_PROTECTION=yes
+CREATE_SERVER_LINK=remote
+ENABLE_PASSWORD=yes
+NOTIFY_WARN=no
+WIN_PARTS_UMASK=000
+CHECK_OPEN_PORT=daily
+CHECK_FIREWALL=daily
+SHELL_TIMEOUT=0
+ALLOW_REMOTE_ROOT_LOGIN=without-password
+ENABLE_LOG_STRANGE_PACKETS=yes
+USER_UMASK=022
+CHECK_RPM_PACKAGES=weekly
+CHECK_RPM_INTEGRITY=monthly
+SECURE_TMP=yes
+ENABLE_SULOGIN=yes
+ENABLE_PAM_ROOT_FROM_WHEEL=no
+MAIL_WARN=yes
+ALLOW_XAUTH_FROM_ROOT=no
+CHECK_SECURITY=yes
+ACCEPT_ICMP_ECHO=yes
+PASSWORD_LENGTH=6,0,0
+AUTHORIZE_SERVICES=yes
+ROOT_UMASK=022
+ENABLE_MSEC_CRON=yes
+TTY_WARN=no
+CHECK_SGID=weekly
+CHECK_PROMISC=daily
+ENABLE_STARTUP_MSEC=yes
+ENABLE_STARTUP_PERMS=yes
+ALLOW_CURDIR_IN_PATH=no
+CHECK_ON_BATTERY=no
+LOG_RETENTION=24
diff --git a/conf/perm.fileserver b/conf/perm.fileserver
new file mode 100644
index 0000000..7e908f7
--- /dev/null
+++ b/conf/perm.fileserver
@@ -0,0 +1,76 @@
+# default permissions level
+###
+/						root.adm		755
+/bin/						root.root		755
+/bin/ping					root.root		4755
+/bin/rpm					rpm.rpm			755
+/boot/						root.root		755
+/dev/						root.root		755
+/etc/						root.root		755
+/etc/conf.modules				root.root		644
+/etc/cron.daily/				root.root		755
+/etc/cron.hourly/				root.root		755
+/etc/cron.monthly/				root.root		755
+/etc/cron.weekly/				root.root		755
+/etc/crontab					root.root		644
+/etc/dhcpcd/					root.root		755
+/etc/dhcpcd/*					root.root		644
+/etc/hosts.allow				root.root		644
+/etc/hosts.deny					root.root		644
+/etc/hosts.equiv				root.root		644
+/etc/inittab					root.root		644
+/etc/ld.so.conf					root.root		644
+/etc/mandrake-release				root.root		644
+/etc/modules.conf				root.root		644
+/etc/motd					root.root		644
+/etc/printcap					root.root		644
+/etc/profile.d/*				root.root		755
+/etc/rc.d/					root.root		755
+/etc/rc.d/init.d/				root.root		755
+/etc/rc.d/init.d/functions			root.root		644
+/etc/securetty					root.root		644
+/etc/shutdown.allow				root.root		644
+/etc/ssh/ssh_config				root.root		644
+/etc/ssh/ssh_host_*key				root.root		600
+/etc/ssh/ssh_host_*key.pub			root.root		644
+/etc/ssh/sshd_config				root.root		644
+/etc/sysconfig					root.root		755
+/etc/syslog.conf				root.root		644
+/home/						root.root		755
+/home/*						current.current		755
+/lib/						root.root		755
+/mnt/						root.root		755
+/proc						root.root		555
+/root/						root.root		700
+/sbin/						root.root		755
+/tmp/						root.root		1777
+/usr/						root.root		755
+/usr/*						root.root		755
+/usr/bin/					root.root		755
+/usr/bin/cc					root.root		755
+/usr/bin/finger					root.root		755
+/usr/bin/g++*					root.root		755
+/usr/bin/gcc*					root.root		755
+/usr/bin/ssh					root.root		755
+/usr/bin/telnet					root.root		755
+/usr/bin/w					root.root		755
+/usr/bin/who					root.root		755
+/usr/lib/rpm/rpm?				rpm.rpm			755
+/usr/sbin/					root.root		755
+/usr/sbin/sendmail.postfix			root.root		755
+/usr/sbin/sendmail.sendmail			root.mail		2755
+/usr/sbin/traceroute				root.bin		4755
+/usr/tmp					root.root		1777
+/var/						root.root		755
+/var/lib/rpm/Packages				rpm.rpm			644
+/var/lock/subsys				root.root		755
+/var/log/					root.root		755
+/var/log/security.log				root.adm		640 force
+/var/log/msec.log				root.adm		640 force
+/var/log/security/				root.adm		740 force
+/var/log/security/*				root.adm		640 force
+/var/log/btmp					root.utmp		600 force
+/var/log/wtmp					root.utmp		664 force
+/var/log/lp-errs				lp.lp			600
+/var/spool/mail/				root.mail		2775
+/var/tmp					root.root		1777