SV-37439r1: Inetd or xinetd logging/tracing must be enabled. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

Inetd or xinetd logging/tracing must be enabled.

Description

Discussion Text

Inetd or xinetd logging and tracing allows the system administrators to observe the IP addresses connecting to their machines and what network services are being sought. This provides valuable information when trying to find the source of malicious users and potential malicious users.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000134

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:263
# Inetd or xinetd logging/tracing must be enabled.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# xinetd not running
# process_object (process_test)
test_1() {
  ! ( ps -e -o comm= | grep -Pq '^xinetd([ 	]|$)' &>/dev/null )
}
# global log_type
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '^[ 	]*log_type[ 	]+[+]?=[ 	]+SYSLOG[ 	]+authpriv([ 	]+info)?[ 	]*$' '/etc/xinetd.conf' &>/dev/null
}
# global log_on_success host
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])HOST([ 	]|$)'
}
# global log_on_success pid
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  (sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])PID([ 	]|$)'
}
# global log_on_success userid
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  (sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])USERID([ 	]|$)'
}
# global log_on_success exit
# textfilecontent54_object (textfilecontent54_test)
test_6() {
  (sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])EXIT([ 	]|$)'
}
# global log_on_failure host
# textfilecontent54_object (textfilecontent54_test)
test_7() {
  (sed -En 's/^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])HOST([ 	]|$)'
}
# global log_on_failure userid
# textfilecontent54_object (textfilecontent54_test)
test_8() {
  (sed -En 's/^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p' '/etc/xinetd.conf') | grep -Pq '(^|[ 	])USERID([ 	]|$)'
}
# local log_type
# textfilecontent54_object (textfilecontent54_test)
test_9() {
  grep -rqP --include='*' '^[ 	]*log_type[ 	]+[+]?=[ 	]+SYSLOG[ 	]+authpriv([ 	]+info)?[ 	]*$' '/etc/xinetd.d' &>/dev/null
}
# local log_on_success host
# textfilecontent54_object (textfilecontent54_test)
test_10() {
  (grep -rhP --include='*' '^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])HOST([ 	]|$)'
}
# local log_on_success pid
# textfilecontent54_object (textfilecontent54_test)
test_11() {
  (grep -rhP --include='*' '^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])PID([ 	]|$)'
}
# local log_on_success userid
# textfilecontent54_object (textfilecontent54_test)
test_12() {
  (grep -rhP --include='*' '^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])USERID([ 	]|$)'
}
# local log_on_success exit
# textfilecontent54_object (textfilecontent54_test)
test_13() {
  (grep -rhP --include='*' '^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])EXIT([ 	]|$)'
}
# local log_on_failure host
# textfilecontent54_object (textfilecontent54_test)
test_14() {
  (grep -rhP --include='*' '^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])HOST([ 	]|$)'
}
# local log_on_failure userid
# textfilecontent54_object (textfilecontent54_test)
test_15() {
  (grep -rhP --include='*' '^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)' '/etc/xinetd.d' | sed -En 's/^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)/\1/p') | grep -Pq '(^|[ 	])USERID([ 	]|$)'
}
# test all filenames have log_type
# file_object (file_test)
test_16() {
  ! ( find '/etc/xinetd.d' -maxdepth 1 -name '*' | grep -q . &>/dev/null )
}
# test all filenames have log_on_success
# file_object (file_test)
test_17() {
  ! ( find '/etc/xinetd.d' -maxdepth 1 -name '*' | grep -q . &>/dev/null )
}
# test all filenames have log_on_failure
# file_object (file_test)
test_18() {
  ! ( find '/etc/xinetd.d' -maxdepth 1 -name '*' | grep -q . &>/dev/null )
}

if ( test_1 || ( test_2 && test_3 && test_4 && test_5 && test_6 && test_7 && test_8 && test_9 && test_10 && test_11 && test_12 && test_13 && test_14 && test_15 && test_16 && test_17 && test_18 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Edit each file in the /etc/xinetd.d directory and the /etc/xinetd.conf file to contain:
log_type = SYSLOG authpriv
log_on_success = HOST PID USERID EXIT
log_on_failure = HOST USERID

The /etc/xinetd.conf file contains default values that will hold true for all services unless individually modified in the service's xinetd.d file.

To make the new settings effective, restart the xinetd service:
# service xinetd restart