Ensure that disk volumes have protection settings that fall within the restrictions of the security policy.

Violation reports

Description

Disk volumes, like files and other resources, can be given protection settings. For the same reasons, their protection settings are important to a security manager.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

By default, a minimum of 0 percent of users must have access and a maximum of 100 percent of users may have access. Customizing As mentioned above, the default restrictive limit is too restrictive for most cases. It can be eased by changing the ABSOLUTLO limit to allow the owner, group, and world users to access the disk volume in some degree. Similarly, if the default permissive limit is too permissive for your site, you can change it by changing the ABSOLUTHI limit to deny some forms of access to some classes of users (system, owner, group, or world). selector Limits for constraints PERCENTLO and PERCENTHI can take a selector consisting of a VMS file access type: READ, WRITE, EXECUTE, DELETE or CONTROL. If no selector is specified, customization commands apply to all possible selector values.

Limits

Exemptions

Ensure that disk quotas are administered in compliance with security policy and that no single user is capable of filling the disk to a dangerous level.

Violation reports

Description

The VMS operating system handles disk space allocation differently from some others, notably most IBM systems. A quota of 1000 blocks, for example, allows the user to use up to 1000 blocks on the disk if they are available, but the quota itself does not guarantee that 1000 blocks are available.

In most VMS timesharing systems, it is usually practical to assign quotas that total more than the number of blocks that physically exist on the disk. This is because a typical user needs his full quota only for a day or two out of a month or quarter, and can get by with (for instance) half his quota the rest of the time.

Thus, "over-allocating" allows users who are good citizens and who have varying disk requirements to share a disk economically. To guarantee every user an exact number of blocks is possible by limiting the total quotas to the physical size of the disk, but that usually means buying more disks than are justified by the total number of blocks actually in use.

On the other hand, it is appropriate to set up some disks without quotas. A disk that is used for temporary work space by the SORT utility is a good example: the files vary widely in size and user but are deleted promptly after use.

The purpose of this test is to ensure that quotas are enabled or disabled on each disk as planned, and that they have not reached a state in which a single user could fill the disk to a dangerous level and thus limit access by other users.

Disk quota tests will not be applied to the RRD40 or RRD50 CDROM disk drive, since disk quota is not meaningful for a read-only device.

If disk availability is critical on some disks at your site, you might wish to set a lower limit than the default percentage (90) for COULDFILL, such as 75, but this means that you will receive violation reports more frequently. Note that this is only effective when quotas are enabled, so you should also use the TRUE setting for REQUIRED.

If quotas should not be enabled on some of your disks, you should change the PROHIBITED setting to TRUE and the REQUIRED setting to FALSE for those disks.

If you do not wish to monitor quota settings at all, set both PROHIBITED and REQUIRED to FALSE. selector

Limits

Exemptions

Giving any user (for instance, SYSTEM) unlimited quota on their default login disk opens the window for such an attack if the user is enabled to receive mail messages. If there is a true need for a user to have unlimited quota on their default login disk, receipt of mail should be disabled for the username. 

Ensure that protections on all Rdb/VMS files fall within the restrictions set by policy. Rdb/VMS files in this context are all of those with the following file types:

• .RDB
• .SNP

Violation reports

Description

Rdb/VMS files are normally protected to allow only SYSTEM access, so that even the owner of the database must use DBMS access methods.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

By default, a minimum of 0 percent of users must have access and a maximum of 1 percent of users may have READ, WRITE and CONTROL access, and a maximum of 0 percent of users may have other forms of access. Customizing Rdb/VMS access is normally granted only through access control lists within the database, so there should be no need to customize the default limits for this element. selector Limits for constraints PERCENTLO and PERCENTHI can take a selector consisting of a VMS file access type: READ, WRITE, EXECUTE, DELETE or CONTROL. If no selector is specified, customization commands apply to all possible selector values.

Limits

Exemptions

Ensure that use of Volume Shadowing conforms to local policy.

Violation reports

Description

Shadowing levels are encoded as "number of shadow set members" where 1 means a single member shadow set and 0 means a disk not in a shadow set.

To limit the use of Volume Shadowing set limits DATAMAX and SYSTEMMAX to the smallest number of shadow set members permitted for any disk volume. Then add exemptions for disk volumes allowed to have a higher number of shadow set members. selector

Limits

Exemptions

Ensure that use of protected subsystems conforms to local policy.

Violation reports

Description

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all images which have been designated as part of a protected subsystem.

The test for the NOFILE constraint within this facility determines whether any image has a subsystem ACE within its Access Control List.

The tests for the PROHIBITED and REQUIRED constraints within this facility determines whether mounting of disks conforms to policy regarding protected subsystems.

Limit NOFILE can be used to prohibit individual files (for which no exemption has been entered from having a subsystem ACE within its Access Control List.

Limit CHECKSUM can be used to require individual files which have a subsystem ACE within their Access Control List to also have an exemptions within the (DISK, CHECKSUM) element. selector

Limits

Exemptions

Ensure system command procedures are valid.

Violation reports

Description

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files in the SYS$SYSROOT:[*...] tree with a file type of .COM.

Limits

Exemptions