Download simp-4.2.- PDF - Read the Docs

SIMP Documentation, Release 0-0
Control ID
Table 4.3 – continued from previous page
Control Name
Control Family
AC-16(4)
Security Attributes (Control
Enhancement)
Access Control
AC-16(5)
Security Attributes (Control
Enhancement)
Remote Access
Access Control
AC-17(1)
Remote Access (Control
Enhancement)
Access Control
AC-17(2)
Remote Access (Control
Enhancement)
Access Control
AC-17(3)
Remote Access (Control
Enhancement)
Remote Access (Control
Enhancement)
Access Control
AC-17
AC-17(4)
4.5. Security Concepts Appendices
Access Control
SIMP
Implementation
Method
SeLinux user, role, type,
and level are the security
attributes that are associated with each object with
SELinux enabled in SIMP.
By default, external connections are not allowed
with the exception of SSH.
This is documented in the
SIMP user manual. Implementations have the ability to override this with the
understanding that puppet
controls Iptables.
The extent of monitoring remote connections is done
by auditd and syslog. The
contents of the remote session is not logged. The
keystrokes of users with sudosh shells are all logged.
Remote access is limited to
SSH. SSH (openssh on centos/rhel) provides both confidentiality and integrity of
the remote session.
This control is enforced via
other access control mechanisms already covered in
800-53.
Namely, AC-6.
By default, SSH in SIMP
will allow anyone to connect. Once identification
and authentication is performed, access control to
privileged commands is enforced as usual.
Continued on next page
139