NSA RHEL5 Checklist

Question

The NSA has came up with the "Guide to the Secure Conguration of Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is amazing information. My question is, is there a program out there that you can run on your server and it can tell you which sections you are compliant on?

For example it would say 2.2.1.3.1 "Add nodev, nosuid, and noexec Options to /tmp" is not correctly configured?

If there was a program like this it could help to make sure that you have configured everything correctly. I know there are kickstart programs and such not but this would be helpful for already running servers.

Answer 1

The commercial version of Nessus contains NSA audit templates (including RHEL 5):

Answer 2

Outside of the audit files available to Nessus Pro Feed users, I am unaware of any applications that validate against the NSA hardening guide. You are likely on your own to develop a audit script.

I would recommend taking a look at the Center for Internet Security benchmarks as a place to start. As a companion piece to their hardening guides they also include shell scripts to audit against the benchmark. The guides should be similar enough that their scripts would be an acceptable starting place for developing your own.