What changed in Solaris 11 SPARC STIG V3R7V3R7 changes

Title

The operating system must generate audit records for the selected list of auditable events as defined in DoDW list of events.

V-216251 in V3R7

Title

User passwords must be changed at least every 6180 days.

Check text

The root role is required. Determine if user passwords are properly configured to be changed every 60180 days. Determine the OS version to be secured. # uname -v For Solaris 11, 11.1, 11.2, and 11.3: # logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && ( $11 > "56175" || $11 &lt "1" )) { print }' If output is returned and the listed account is accessed via direct logon, this is a finding. Check that "/etc/default/password" is configured to enforce password expiration every eight25 weeks or less. # grep "^MAXWEEKS=" /etc/default/passwd If the command does not report "MAXWEEKS=825" or less, this is a finding. For Solaris 11.4 or newer: # logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && ($11 > "60180"|| $11 &lt "1")) { print }' If output is returned and the listed account is accessed via direct logon, this is a finding. Check that "/etc/default/password" is configured to enforce password expiration every 60180 days or less. Note: It is an error to set both the WEEKS and the DAYS variant for a given MIN/MAX/WARN variable. # grep "^MAXDAYS=" /etc/default/passwd If the command does not report "MAXDAYS=60180" or less, this is a finding. # grep "^MAXWEEKS=" /etc/default/passwd If output is returned, this is a finding.

Fix text

The User Security role is required. For Solaris 11, 11.1, 11.2, and 11.3: Change each username to enforce 56175 day password changes. # pfexec passwd -x 56175 [username] # pfedit /etc/default/passwd Search for "MAXWEEKS". Change the line to read: MAXWEEKS=825 For Solaris 11.4 or newer: Change each username to enforce 60 180-day password changes. # pfexec passwd -x 60180 [username] # pfedit /etc/default/passwd Note: It is an error to set both the WEEKS and the DAYS variant for a given MIN/MAX/WARN variable. Search for "MAXDAYS". Change the line to read: MAXDAYS=60180 Search for "MAXWEEKS". Change the line to read: #MAXWEEKS=

Discussion

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Solaris 11.4 introduced new password security features that allow for a more granular approach to password duration parameters. The introduction of "MAXDAYS", "MINDAYS", and "WARNDAYS" allow the "/etc/default/passwd" configuration file to enforce a password change every 60180 days.

V-216321 in V3R7

Discussion

If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoDDoW-defined time period of 72 hours. When temporary and emergency accounts are created, there is a risk the temporary account may remain in place and active after the need for the account no longer exists. To address this, in the event temporary accounts are required, accounts designated as temporary in nature must be automatically terminated after 72 hours. Such a process and capability greatly reduces the risk of accounts being misused, hijacked, or data compromised.

V-216322 in V3R7

Title

The operating system must display the DODoW-approved system use notification message or banner before granting access to the system for general system logons.

Check text

Review the contents of these two files and check that the proper DODDoW banner message is configured. # cat /etc/motd # cat /etc/issue If the DODDoW-approved banner text is not in the files, this is a finding.

Fix text

The root role is required. Edit the contents of these two files and ensure that the proper DODDoW banner message is viewable. # pfedit /etc/motd # pfedit /etc/issue The DOD DoW-required text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

V-216395 in V3R7

Title

The operating system must display the DoD W-approved system use notification message or banner for SSH connections.

Fix text

The root role is required. Edit the SSH configuration file. # pfedit /etc/ssh/sshd_config Locate the file containing: Banner Change the line to read: Banner /etc/issue Edit the /etc/issue file # pfedit /etc/issue The DoD DoW-required text is: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Restart the SSH service # svcadm restart svc:/network/ssh

V-216396 in V3R7

Title

The GNOME service must display the DODoW-approved system use notification message or banner before granting access to the system.

Check text

This item does not apply if a graphic login is not configured. Log in to the Gnome Graphical interface. If the approved banner message does not appear, this is a finding. # cat /etc/issue # grep /etc/gdm/Init/Default zenity If "/etc/issue" does not contain thatthe DODDoW-approved banner message or "/etc/gdm/Init/Default" does not contain the line: /usr/bin/zenity --text-info --width=800 --height=300 1 --title="Security Message" --filename=/etc/issue this is a finding.

Fix text

The root role is required. If the system does not use XWindows, this is not applicable. # pfedit /etc/issue Insert the proper DODDoW banner message text. The DOD DoW-required text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. # pfedit /etc/gdm/Init/Default Add the following content before the "exit 0" line of the file. /usr/bin/zenity --text-info --width=800 --height=300 1 --title="Security Message" --filename=/etc/issue

V-216397 in V3R7

Title

The FTP service must display the DODoW-approved system use notification message or banner before granting access to the system.

Check text

Determine if the FTP server package is installed: # pkg list service/network/ftp If the package is not installed, this check does not apply. # grep DisplayConnect /etc/proftpd.conf If: "DisplayConnect /etc/issue " does not appear, this is a finding. If "/etc/issue" does not contain the approved DODDoW text, this is a finding.

Fix text

The root role is required. The package: "pkg:/service/network/ftp" must be installed. # pfedit /etc/issue Insert the proper DODDoW banner message text. The DOD DoW-required text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. # echo "DisplayConnect /etc/issue" >> /etc/proftpd.conf # svcadm restart ftp

V-216398 in V3R7

Discussion

Encryption is only as good as the encryption modules utilizedused. Unapproved cryptographic module algorithms cannot be verified, and cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised due to weak algorithms. Applications utilizingusing encryption are required to use approved encryption modules meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance. FIPS 140-2 is the current standard for validating cryptographic modules, and NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified hardware based encryption modules. Satisfies: SRG-OS-000120, SRG-OS-000169

V-216402 in V3R7

Title

The operating system must implement DoDW-approved encryption to protect the confidentiality of remote access sessions.

V-216410 in V3R7

Check text

The operator will ensure that a DoD DoW-approved PKI system is installed, configured, and properly operating. Ask the operator to document the PKI software installation and configuration. If the operator is not able to provide a documented configuration for an installed PKI system or if the PKI system is not properly configured, maintained, or used, this is a finding.

Fix text

The operator will ensure that a DoD W-approved PKI software is installed and operating continuously.

V-216465 in V3R7

Title

The operating system must synchronize internal information system clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DODDoW network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

Check text

NTP must be used and used only in the global zone. Determine the zone to be secured. # zonename If the command output is not "global", then NTP must be disabled. Check the system for a running NTP daemon. # svcs -Ho state ntp If NTP is online, this is a finding. If the output from "zonename" is "global", then NTP must be enabled. Check the system for a running NTP daemon. # svcs -Ho state ntp If NTP is not online, this is a finding. If NTP is running, confirm the servers and peers or multicast client (as applicable) are local or an authoritative DODDoW source. For the NTP daemon: # more /etc/inet/ntp.conf If a nonlocal/nonauthoritative (non-DODDoW source, non-USNO-based, or non-GPS) time server is used, this is a finding. Determine if the time synchronization frequency is correct. # grep "maxpoll" /etc/inet/ntp.conf If the command returns "File not found" or any value for "maxpoll", this is a finding. Determine if the running NTP server is configured properly. # ntpq -p | awk '($6 ~ /[0-9]+/ && $6 > 86400) { print $1" "$6 }' This will print out the name of any time server whose current polling time is greater than 24 hours (along with the actual value). If there is any output, this is a finding.

Fix text

The root role is required. Determine the zone to be secured. # zonename If the command output is not "global", then NTP must be disabled. # svcadm disable ntp If the output from "zonename" is "global", then NTP must be enabled. To activate the ntpd daemon, the "ntp.conf" file must first be created. # cp /etc/inet/ntp.client /etc/inet/ntp.conf # pfedit /etc/inet/ntp.conf Make site-specific changes to this file as needed in the form. server [ntpserver] Locate the line containing "maxpoll" (if it exists). Delete the line. Start the ntpd daemon. # svcadm enable ntp Use a local authoritative time server synchronizing to an authorized DODDoW time source, a USNO-based time server, or a GPS. Ensure all systems in the facility feed from one or more local time servers that feed from the authoritative time server. Edit the NTP configuration files and make the necessary changes to add the approved time servers per Solaris documentation.

Discussion

To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DODDoW. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.

V-219986 in V3R7

Check text

Ask the operator if DoDDoW-approved SCAP compliance checking software is installed and run on a periodic basis. If DoDDoW-approved SCAP compliance checking software is not installed and/or not run on a periodic basis, this is a finding.

Fix text

Install, configure, and run DoDDoW-approved SCAP compliance checking software on a periodic basis. Review the output of the software and document any out-of-compliance issues.

V-219987 in V3R7

Check text

Ask the operator if DoDDoW-approved SCAP compliance checking software is installed and run on a periodic basis. If DoDDoW-approved SCAP compliance checking software is not installed and/or not run on a periodic basis, this is a finding.

Fix text

Install, configure, and run DoDDoW-approved SCAP compliance checking software on a periodic basis. Review the output of the software and document any out-of-compliance issues.

V-224671 in V3R7