[RFC] Some Considerations for Kernel Module Checks
by Mike Palmiotto
There was some discussion a while back about the proper method for doing
kernel module checking. (see:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-August/...)
The OVAL checks for disabling kernel modules are currently checking for
`install [module] /bin/true`.
I'm sure there is a reason for doing this as opposed to `install
[module] /bin/false`. Just a shot in the dark: we want the install to
fail and return as if a failure is expected? Would it make more sense
to run /bin/false, as the actual install is failing to install?
Additionally, it seems the checks are using a mixture of `install
[module] /bin/true` and `alias [module] off`. Should these be made
uniform, or is there a reason for the variation in method?
Any and all insight is greatly appreciated.
Thanks,
--Mike
10 years, 10 months
[PATCH] NIST reference fixes
by David Smith
added and/or modified several NIST security control references
David Smith (1):
added/changed NIST 800-53 references
RHEL6/input/system/accounts/banners.xml | 2 +-
RHEL6/input/system/auditing.xml | 33 +++++++++++---------
RHEL6/input/system/selinux.xml | 8 ++--
RHEL6/input/system/software/disk_partitioning.xml | 2 +-
RHEL6/input/system/software/integrity.xml | 10 +++---
RHEL6/input/system/software/updating.xml | 6 ++--
6 files changed, 32 insertions(+), 29 deletions(-)
10 years, 11 months
[PATCH 0/2] fixes to banner and refs
by Jeffrey Blank
Per FSO feedback.
Jeffrey Blank (2):
CCI ref fixup
banner language fixup
RHEL6/input/auxiliary/srg_support.xml | 2 +-
RHEL6/input/services/ssh.xml | 8 ++++----
RHEL6/input/system/accounts/banners.xml | 14 +++++++-------
3 files changed, 12 insertions(+), 12 deletions(-)
10 years, 11 months
[PATCH] Replaced all RHEL 5 CCE numbers with new CCE numbers. Left the TODO alones for now.
by Michele Newman
---
RHEL6/input/services/avahi.xml | 2 +-
RHEL6/input/services/base.xml | 20 +++---
RHEL6/input/services/cron.xml | 10 ++--
RHEL6/input/services/dhcp.xml | 30 +++++-----
RHEL6/input/services/dns.xml | 14 ++--
RHEL6/input/services/ftp.xml | 20 +++---
RHEL6/input/services/http.xml | 58 +++++++++---------
RHEL6/input/services/imap.xml | 16 +++---
RHEL6/input/services/ldap.xml | 36 ++++++------
RHEL6/input/services/mail.xml | 4 +-
RHEL6/input/services/nfs.xml | 32 +++++-----
RHEL6/input/services/ntp.xml | 4 +-
RHEL6/input/services/obsolete.xml | 24 ++++----
RHEL6/input/services/printing.xml | 8 +-
RHEL6/input/services/smb.xml | 6 +-
RHEL6/input/services/snmp.xml | 6 +-
RHEL6/input/services/squid.xml | 4 +-
RHEL6/input/services/ssh.xml | 28 ++++----
RHEL6/input/services/xorg.xml | 4 +-
RHEL6/input/system/accounts/banners.xml | 6 +-
RHEL6/input/system/accounts/pam.xml | 22 ++++----
RHEL6/input/system/accounts/physical.xml | 22 ++++----
.../accounts/restrictions/password_expiration.xml | 8 +-
.../accounts/restrictions/password_storage.xml | 4 +-
.../system/accounts/restrictions/root_logins.xml | 8 +-
RHEL6/input/system/accounts/session.xml | 14 ++--
RHEL6/input/system/auditing.xml | 64 ++++++++++----------
RHEL6/input/system/logging.xml | 24 ++++----
RHEL6/input/system/network/iptables.xml | 12 ++--
RHEL6/input/system/network/ipv6.xml | 22 ++++----
RHEL6/input/system/network/kernel.xml | 30 +++++-----
RHEL6/input/system/network/network.xml | 4 +-
RHEL6/input/system/network/uncommon.xml | 8 +-
RHEL6/input/system/network/wireless.xml | 10 ++--
RHEL6/input/system/permissions/execution.xml | 14 ++--
RHEL6/input/system/permissions/files.xml | 38 ++++++------
RHEL6/input/system/permissions/mounting.xml | 30 +++++-----
RHEL6/input/system/permissions/partitions.xml | 22 ++++----
RHEL6/input/system/selinux.xml | 12 ++--
RHEL6/input/system/software/disk_partitioning.xml | 10 ++--
RHEL6/input/system/software/integrity.xml | 4 +-
RHEL6/input/system/software/updating.xml | 6 +-
42 files changed, 360 insertions(+), 360 deletions(-)
diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
index af7dd1c..f7ad4c9 100644
--- a/RHEL6/input/services/avahi.xml
+++ b/RHEL6/input/services/avahi.xml
@@ -27,7 +27,7 @@ port, it is subject to network attacks. Its functionality
is convenient but is only appropriate if the local network
can be trusted.
</rationale>
-<ident cce="4365-3" />
+<ident cce="27087-6" />
<oval id="service_avahi-daemon_disabled" />
<ref nist="CM-6, CM-7" disa="366"/>
</Rule>
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 74b3a11..6c040fa 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -38,7 +38,7 @@ programs.
such as laptops or desktops. For other systems, such as servers, it may permit
accidental or trivially achievable denial of service situations and disabling
it is appropriate.</rationale>
-<ident cce="4298-6" />
+<ident cce="27061-1" />
<oval id="service_acpid_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -127,7 +127,7 @@ provides benefit. Traditionally this has included laptops (to enhance battery li
but may also apply to server or desktop environments where conserving power is
highly desirable or necessary.
</rationale>
-<ident cce="4051-9" />
+<ident cce="26973-8" />
<oval id="service_cpuspeed_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -147,7 +147,7 @@ deals with removable media or devices.
that use removable media or devices, but can be disabled for systems
that do not require these.
</rationale>
-<ident cce="4364-6" />
+<ident cce="27086-8" />
<oval id="service_haldaemon_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -163,7 +163,7 @@ multiple processors.
<ocil><service-disable-check-macro service="irqbalance" /></ocil>
<rationale>In an environment with multiple processors (now common), the irqbalance service
provides potential speedups for handling interrupt requests.</rationale>
-<ident cce="4123-6" />
+<ident cce="26990-2" />
<oval id="service_irqbalance_enabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -178,7 +178,7 @@ crash, which can load information from the crashed kernel for analysis.
<ocil><service-disable-check-macro service="kdump" /></ocil>
<rationale>Unless the system is used for kernel development or testing, there
is little need to run the kdump service.</rationale>
-<ident cce="3425-6" />
+<ident cce="26850-8" />
<oval id="service_kdump_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -212,7 +212,7 @@ RAID setups do not use this service).
<ocil><service-disable-check-macro service="mdmonitor" /></ocil>
<rationale>If software RAID monitoring is not required (and it is uncommon),
there is no need to run the service.</rationale>
-<ident cce="3854-7" />
+<ident cce="27193-2" />
<oval id="service_mdmonitor_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -233,7 +233,7 @@ it could be a target for attack. However, disabling D-Bus is likely to be
impractical for any system which needs to provide
a graphical login session.
</rationale>
-<ident cce="3822-4" />
+<ident cce="26913-4" />
<oval id="service_messagebus_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -347,7 +347,7 @@ package selection is selected during installation. The qpidd service listens
for network connections which increases the attack surface of the system. If
the system is not intended to receive AMQP traffic then the <tt>qpidd</tt>
service is not needed and should be disabled or removed.</rationale>
-<ident cce="3854-7" />
+<ident cce="26928-2" />
<oval id="service_qpidd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
</Rule>
@@ -407,7 +407,7 @@ RHN server or satellite and managed as such.
system security, management by a system outside the enterprise enclave is not
desirable for some environments. However, if the system is being managed by RHN or
RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale>
-<ident cce="3416-5" />
+<ident cce="26846-6" />
<oval id="service_rhnsd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
<tested by="DS" on="20121024"/>
@@ -467,7 +467,7 @@ relay an appropriate warning.
service due to failing hardware. Nevertheless, if it is not needed or the
system's drives are not SMART-capable (such as solid state drives), it can be
disabled.</rationale>
-<ident cce="3455-3" />
+<ident cce="26853-2" />
<oval id="service_smartd_disabled" />
<ref nist="CM-6, CM-7" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index a365de8..d9dce38 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -17,7 +17,7 @@ maintenance tasks, such as notifying root of system activity.
<rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.
</rationale>
-<ident cce="4324-0" />
+<ident cce="27070-2" />
<oval id="service_crond_enabled" />
<ref nist="CM-6, CM-7" />
<tested by="DS" on="20121024"/>
@@ -45,7 +45,7 @@ attack surface for an intruder.</description>
<description>The system crontab /etc/crontab should be owned by the root user. This
file is provided for backwards compatibility by the RPM package crontabs and it
will be read by the crond service. RHEL6 will not add jobs to it by default.</description>
-<ident cce="3851-3" />
+<ident cce="26923-3" />
<oval id="file_user_owner_etc_crontab" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -55,7 +55,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by default.</de
<description>The file /etc/crontab should be owned by the root group. This
file is provided for backwards compatibility by the RPM package crontabs and it
will be read by the crond service. RHEL6 will not add jobs to it by default.</description>
-<ident cce="3626-9" />
+<ident cce="26876-3" />
<oval id="file_group_owner_etc_crontab" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -65,7 +65,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by default.</de
<description>The file /etc/crontab should be mode 600. This
file is provided for backwards compatibility by the RPM package crontabs and it
will be read by the crond service. RHEL6 will not add jobs to it by default.</description>
-<ident cce="4388-5" />
+<ident cce="27102-3" />
<oval id="file_mode_etc_crontab" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -122,7 +122,7 @@ access to these files should be disabled.</description>
Many of the periodic or delayed execution features of the at
daemon can be provided through the cron daemon instead.
</rationale>
-<ident cce="14466-7" />
+<ident cce="26548-8" />
<oval id="service_atd_disabled" />
<ref nist="CM-6, CM-7" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 7cf381b..c464cab 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -45,7 +45,7 @@ Unmanaged or unintentionally activated DHCP servers may provide faulty informati
to clients, interfering with the operation of a legitimate site
DHCP server if there is one.
</rationale>
-<ident cce="4336-4" />
+<ident cce="27074-4" />
<oval id="service_dhcpd_disabled" />
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="DS" on="20121024"/>
@@ -62,7 +62,7 @@ the dhcp package can be uninstalled.
Removing the DHCP server ensures that it cannot be easily or
accidentally reactivated and disrupt network operation.
</rationale>
-<ident cce="4464-4" />
+<ident cce="27120-5" />
<oval id="package_dhcpd_removed" />
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="DS" on="20121024"/>
@@ -100,7 +100,7 @@ the DHCP server will attempt to act as a Dynamic DNS client. As long as the DNS
server itself is correctly configured to reject DDNS attempts, an incorrect
ddns-update-style setting on the client is harmless (but should be fixed as a
best practice).</warning>
-<ident cce="4257-2" />
+<ident cce="27049-6" />
<!--<oval id="dhcp_server_disable_ddns" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -115,7 +115,7 @@ that it does not consider the lease offered by the server to be valid. By
issuing many DHCPDECLINE messages, a malicious client can exhaust the DHCP
server's pool of IP addresses, causing the DHCP server to forget old address
allocations.</rationale>
-<ident cce="4403-2" />
+<ident cce="27106-4" />
<!--<oval id="dhcp_server_deny_decline" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -130,7 +130,7 @@ support for the bootp protocol by adding or correcting the global option.
for this simpler protocol is not needed, it should be disabled to remove attack
vectors against the DHCP server.
</rationale>
-<ident cce="4345-5" />
+<ident cce="27077-7" />
<!--<oval id="dhcp_server_deny_bootp" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -159,13 +159,13 @@ to request much of the above information from the DHCP server. In particular,
domain-name, domain-name-servers, and routers are configured via DHCP. These
settings are typically necessary for proper network functionality, but are also
usually static across machines at a given site.</warning>
-<!--<ident cce="3724-2" />
-<ident cce="4243-2" />
-<ident cce="4389-3" />
-<ident cce="3913-1" />
-<ident cce="4169-9" />
-<ident cce="4318-2" />
-<ident cce="4319-0" />-->
+<!--<ident cce="26897-9" />
+<ident cce="27042-1" />
+<ident cce="27103-1" />
+<ident cce="26943-1" />
+<ident cce="27008-2" />
+<ident cce="27064-5" />
+<ident cce="27065-2" />-->
<!--<oval id="dhcp_server_minimize_served_info" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Group>
@@ -180,7 +180,7 @@ reported by the dhcpd process.</description>
<rationale>By default, dhcpd logs notices to the daemon facility. Sending all
daemon messages to a dedicated log file is part of the syslog configuration
outlined in the Logging and Auditing section</rationale>
-<ident cce="3733-3" />
+<ident cce="26898-7" />
<!--<oval id="dhcp_server_configure_logging" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -229,7 +229,7 @@ DHCP relies on trusting the local network. If the local network is not trusted,
then it should not be used. However, the automatic configuration provided by
DHCP is commonly used and the alternative, manual configuration, presents an
unacceptable burden in many circumstances.</rationale>
-<ident cce="4191-3" />
+<ident cce="27021-5" />
<oval id="sysconfig_networking_bootproto_ifcfg" />
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="DS" on="20121024"/>
@@ -287,7 +287,7 @@ protocol is not in use. It is necessary to supersede settings for unused
services so that they cannot be set by a hostile DHCP server. If an option is
set to an empty string, dhclient will typically not attempt to configure the
service.</warning>
-<!--<ident cce="4464-4" /> -->
+<!--<ident cce="27120-5" /> -->
<!--<oval id="dhcp_client_restrict_options" /> -->
<!--<ref nist="CM-6, CM-7" /> -->
</Group>
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 0bdaa8e..23412e3 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -26,7 +26,7 @@ nameservers.
All network services involve some risk of compromise due to
implementation flaws and should be disabled if possible.
</rationale>
-<ident cce="3578-2" />
+<ident cce="26873-0" />
<oval id="service_named_disabled" />
<ref nist="CM-6, CM-7" disa="366"/>
</Rule>
@@ -42,7 +42,7 @@ implementation flaws and should be disabled if possible.
If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.
</rationale>
-<ident cce="4219-2" />
+<ident cce="27030-6" />
<oval id="package_bind_removed" />
<ref nist="CM-6, CM-7" disa="366"/>
</Rule>
@@ -61,7 +61,7 @@ attacks on nameservers more difficult.</description>
a high-risk service which must frequently be made available to the entire
Internet, it is strongly recommended that no other services be offered by
machines which act as organizational DNS servers.</description>
-<!--<ident cce="4219-2" />-->
+<!--<ident cce="27030-6" />-->
<!--<oval id="dns_server_dedicated" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Group>
@@ -97,9 +97,9 @@ configuration file. That is, when this guide recommends editing
<tt>/etc/named.conf</tt>, you should instead edit
<tt>/var/named/chroot/etc/named.conf</tt>.
</warning>
-<ident cce="3985-9" />
-<ident cce="4487-5" />
-<ident cce="4258-0" />
+<ident cce="26957-1" />
+<ident cce="27127-0" />
+<ident cce="26961-3" />
<!--<oval id="dns_server_chroot" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -327,7 +327,7 @@ updates must be allowed, IP-based ACLs are insufficient protection, since they
are easily spoofed. Instead, use TSIG keys (see the previous section for an
example), and consider using the update-policy directive to restrict changes to
only the precise type of change needed.</rationale>
-<ident cce="4399-2" />
+<ident cce="27105-6" />
<!--<oval id="dns_server_disable_dynamic_updates" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index fc60df1..4594415 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -28,7 +28,7 @@ of attack, and should be disabled if not needed.
Furthermore, the FTP protocol is unencrypted and creates
a risk of compromising sensitive information.
</rationale>
-<ident cce="3919-8" />
+<ident cce="26948-0" />
<oval id="service_vsftpd_disabled" />
<ref nist="CM-6, CM-7" disa="1436"/>
</Rule>
@@ -45,7 +45,7 @@ a risk of compromising sensitive information.
Removing the vsftpd package decreases the risk of its
accidental activation.
</rationale>
-<ident cce="14881-7" />
+<ident cce="26687-4" />
<oval id="package_vsftpd_removed" />
<ref nist="CM-6, CM-7" disa="1436"/>
</Rule>
@@ -62,7 +62,7 @@ accidental activation.
</description>
<rationale>After RHEL 2.1, Red Hat switched from distributing wu-ftpd with RHEL to distributing vsftpd. For security
and for consistency with future Red Hat releases, the use of vsftpd is recommended.</rationale>
-<ident cce="14881-7" />
+<ident cce="27187-4" />
<oval id="package_vsftpd_installed" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -98,7 +98,7 @@ If the <i>server_args</i>line is missing or does not include the vsftpd configur
<rationale>The modifications above ensure that all commands sent to the ftp server are logged using the verbose vsftpd log
format. The default vsftpd log file is /var/log/vsftpd.log.</rationale>
<warning category="general">If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log</warning>
-<ident cce="4549-2" />
+<ident cce="27142-9" />
<!--<oval id="ftp_log_transactions" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -110,7 +110,7 @@ by default. Add or correct the following configuration options.
<pre>banner_file=/etc/issue</pre>
</description>
<rationale>This setting will cause the system greeting banner to be used for FTP connections as well.</rationale>
-<ident cce="4554-2" />
+<ident cce="27145-2" />
<ref disa="48" />
<!--<oval id="ftp_present_banner" />-->
<!--<ref nist="CM-6, CM-7" /> -->
@@ -138,7 +138,7 @@ using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration fil
If non-anonymous FTP logins are necessary, follow the guidance in the remainder of this section to secure
these logins as much as possible.</description>
<rationale>The use of non-anonymous FTP logins is strongly discouraged. Since SSH clients and servers are widely available, and since SSH provides support for a transfer mode which resembles FTP in user interface, there is no good reason to allow password-based FTP access. </rationale>
-<ident cce="4443-8" />
+<ident cce="27115-5" />
<!--<oval id="ftp_restrict_to_anon" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -156,7 +156,7 @@ If anonymous access is also required, add the anonymous usernames to <tt>/etc/vs
ftp</pre>
</description>
<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a list of users who were not allowed to access the system via ftp. It was used to prevent system users such as the root user from logging in via the insecure ftp protocol. However, when the configuration option userlist deny=NO is set, vsftpd interprets ftpusers as the set of users who are allowed to login via ftp. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous ftp access can be limited to legacy users who have been explicitly identified.</rationale>
-<!--<ident cce="4443-8" />-->
+<!--<ident cce="27115-5" />-->
<!--<oval id="ftp_limit_users" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Group>
@@ -174,7 +174,7 @@ as much as possible.</description>
common to have a need to allow unauthenticated users to place files on the FTP server. If this must be done, it
is necessary to ensure that files cannot be uploaded and downloaded from the same directory.
</rationale>
-<ident cce="4461-0" />
+<ident cce="27117-1" />
<!--<oval id="ftp_disable_uploads" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -185,7 +185,7 @@ is necessary to ensure that files cannot be uploaded and downloaded from the sam
be used to verify that this directory is on its own partition.</description>
<rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent
these users from filling a disk used by other services.</rationale>
-<!--<ident cce="4443-8" />-->
+<!--<ident cce="27115-5" />-->
<!--<oval id="ftp_home_partition" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -204,7 +204,7 @@ FTP is an older protocol which is not very compatible with firewalls. During the
and server negotiate an arbitrary port to be used for data transfer. The ip conntrack ftp module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
FTP server to operate on a machine which is running a firewall.</rationale>
-<!--<ident cce="4443-8" />-->
+<!--<ident cce="27115-5" />-->
<!--<oval id="ftp_configure_firewall" />-->
<!--<ref nist="CM-6, CM-7" /> -->
</Group>
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
index e484b12..893ffec 100644
--- a/RHEL6/input/services/http.xml
+++ b/RHEL6/input/services/http.xml
@@ -34,7 +34,7 @@ and removed from the system.
Running web server software provides a network-based avenue
of attack, and should be disabled if not needed.
</rationale>
-<ident cce="4338-0" />
+<ident cce="27075-1" />
<oval id="service_httpd_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -51,7 +51,7 @@ of attack, and should be disabled if not needed.
If there is no need to make the web server software available,
removing it provides a safeguard against its activation.
</rationale>
-<ident cce="4514-6" />
+<ident cce="27133-8" />
<oval id="package_httpd_removed" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -70,7 +70,7 @@ package group during the system installation process. The Web Server package
group includes many packages which are likely extraneous, while the
command-line method installs only the required <tt>httpd</tt> package itself.
</description>
-<!--<ident cce="4346-3" />-->
+<!--<ident cce="27078-5" />-->
<!--<oval id="package_httpd_installed" />-->
<!--<ref nist="CM-6, CM-7" />-->
@@ -119,7 +119,7 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
Information disclosed to clients about the configuration of the web server and system could be used
to plan an attack on the given system. This information disclosure should be restricted to a minimum.
</rationale>
-<ident cce="4474-3" />
+<ident cce="27123-9" />
<oval id="httpd_servertokens_prod" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -137,7 +137,7 @@ Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
Information disclosed to clients about the configuration of the web server and system could be used
to plan an attack on the given system. This information disclosure should be restricted to a minimum.
</rationale>
-<ident cce="3756-4" />
+<ident cce="26900-1" />
<oval id="httpd_serversignature_off" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -214,7 +214,7 @@ If the above functionality is unnecessary, comment out the related module:
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>-->
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_basic_authentication" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Group>
@@ -230,7 +230,7 @@ If this functionality is unnecessary, comment out the related module:
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_digest_authentication" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -248,7 +248,7 @@ unnecessary, comment out the related module:
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_mod_rewrite" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -266,7 +266,7 @@ If LDAP is to be used, SSL encryption should be used as well.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_ldap_support" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -287,7 +287,7 @@ supplied data should be encoded to prevent cross-site scripting vulnerabilities.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_server_side_includes" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -303,7 +303,7 @@ is likely extraneous. If its functionality is unnecessary, comment out the relat
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_mime_magic" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -324,7 +324,7 @@ server that is DAV enabled should be protected by access controls.
Minimizing the number of loadable modules available to the web server, reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_webdav" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -344,7 +344,7 @@ configuration.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_server_activity_status" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -363,7 +363,7 @@ an access control list to restrict access to the information.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_server_configuration_display" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -380,7 +380,7 @@ This functionality weakens server security by making site enumeration easier.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_url_correction" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -405,7 +405,7 @@ are a security risk. <tt>mod_proxy_balancer</tt> enables load balancing, but req
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_proxy_support" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -426,7 +426,7 @@ If caching is required, it should not be enabled for any limited-access content.
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_cache_support" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -452,7 +452,7 @@ CGI scripts to run as a specified user/group instead of as the server's user/gro
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_cgi_support" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -480,7 +480,7 @@ are not using these directives), comment out the associated module:
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</description>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_optional_components" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Group>
@@ -506,7 +506,7 @@ the possibility of unwanted or malicious configuration files to be automatically
part of the server's running configuration.
<!--</rationale>-->
</description>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_minimize_config_files_included" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Group>
@@ -537,7 +537,7 @@ The <tt>httpd</tt> root directory should always have the most restrictive config
The Web Server's root directory content should be protected from unauthorized access
by web clients.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_restrict_root_directory" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -563,7 +563,7 @@ Ensure that this policy is adhered to by altering the related section of the con
Access to the web server's directory hierarchy could allow access to unauthorized files
by web clients. Following symbolic links could also allow such access.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_restrict_web_directory" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -580,7 +580,7 @@ should be used to deny access by default, allowing access only where necessary.
Directories accessible from a web client should be configured with the least amount of
access possible in order to avoid unauthorized access to restricted content or server information.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_restrict_critical_directories" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -607,7 +607,7 @@ are limited to the WebDAV protocol.
Minimizing the number of available methods to the web client reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<!--<oval id="httpd_limit_available_methods" />-->
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -647,7 +647,7 @@ Install the <tt>mod_ssl</tt> module:
content is transmitted in plain text which could be passively monitored and accessed by
unauthorized parties.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<oval id="package_mod_ssl_installed" />
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -678,7 +678,7 @@ Install the <tt>security</tt> module:
enabling the administrator to implement content access policies and filters at the
application layer.
</rationale>
-<!--<ident cce="3756-4" />-->
+<!--<ident cce="26900-1" />-->
<oval id="package_mod_security_installed" />
<!--<ref nist="CM-6, CM-7" />-->
</Rule>
@@ -771,7 +771,7 @@ This is its default setting.
Access to the web server's log files may allow an unauthorized user or attacker
to access information about the web server or alter the server's log files.
</rationale>
-<ident cce="4574-0" />
+<ident cce="27150-2" />
<oval id="dir_perms_var_log_httpd" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -786,7 +786,7 @@ Set permissions on the web server configuration directory to 750:
Access to the web server's configuration files may allow an unauthorized user or attacker
to access information about the web server or alter the server's configuration files.
</rationale>
-<!-- <ident cce="4574-0" /> -->
+<!-- <ident cce="27150-2" /> -->
<oval id="dir_perms_etc_httpd_conf" />
<!-- <ref nist="CM-6, CM-7" /> -->
</Rule>
@@ -801,7 +801,7 @@ Set permissions on the web server configuration files to 640:
Access to the web server's configuration files may allow an unauthorized user or attacker
to access information about the web server or to alter the server's configuration files.
</rationale>
-<ident cce="4386-9" />
+<ident cce="27099-1" />
<oval id="file_permissions_httpd_server_conf_files" />
<ref nist="CM-6, CM-7" />
</Rule>
diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
index 0e7b6f6..ea75dd0 100644
--- a/RHEL6/input/services/imap.xml
+++ b/RHEL6/input/services/imap.xml
@@ -24,7 +24,7 @@ POP3 server, the dovecot software should be disabled and removed.
Running an IMAP or POP3 server provides a network-based
avenue of attack, and should be disabled if not needed.
</rationale>
-<ident cce="3847-1" />
+<ident cce="26922-5" />
<oval id="service_dovecot_disabled" />
</Rule>
@@ -41,7 +41,7 @@ with the following command.
If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation.
</rationale>
-<ident cce="4239-0" />
+<ident cce="27039-7" />
<oval id="package_dovecot_removed" />
</Rule>
@@ -74,10 +74,10 @@ client to use the STARTTLS command before authenticating.
Configuring Dovecot to only support the protocols the protocols needed by
your site reduces the risk of an attacker using one of the unused protocols
to base an attack.</rationale>
-<ident cce="4384-4" />
-<ident cce="3887-7" />
-<ident cce="4530-2" />
-<ident cce="4547-6" />
+<ident cce="27097-5" />
+<ident cce="26933-2" />
+<ident cce="27135-3" />
+<ident cce="27140-3" />
<!-- <oval id="dovecot_support_necessary_protocols" /> -->
</Rule>
@@ -106,7 +106,7 @@ protecting user credentials, mail as it is downloaded, and clients may use
SSL certificates to authenticate the server, preventing another system from
impersonating the server.
</rationale>
-<!-- <ident cce="4239-0" /> -->
+<!-- <ident cce="27039-7" /> -->
<oval id="dovecot_enable_ssl" />
</Rule>
@@ -163,7 +163,7 @@ or correct the following line.
Using plain text authentication to the mail server could allow an
attacker access to credentials by monitoring network traffic.
</rationale>
-<ident cce="4552-6" />
+<ident cce="27144-5" />
<oval id="dovecot_disable_plaintext_auth" />
</Rule>
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 5295cdb..4f2d047 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -40,7 +40,7 @@ To ensure LDAP is configured to use TLS for all transactions, run the following
not specified it will default to no. It should be set to start_tls rather
than doing LDAP over SSL.</rationale>
<ref disa="776,778,1453" />
-<ident cce="14894-0" />
+<ident cce="26690-8" />
<oval id="ldap_client_start_tls" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -65,7 +65,7 @@ tls_checkpeer is configured (which is the default for openldap versions 2.1 and
up). These directives define the path to the trust certificates signed by the
site CA.</rationale>
<ref disa="776,778,1453" />
-<ident cce="14894-0" />
+<ident cce="27189-0" />
<oval id="ldap_client_tls_cacertpath" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -99,7 +99,7 @@ The output should show the following.
<pre>package openldap-servers is not installed</pre>
</ocil>
<rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale>
-<ident cce="3501-4" />
+<ident cce="26858-1" />
<oval id="package_openldap-servers_removed" />
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="DS" on="20121024"/>
@@ -118,7 +118,7 @@ where dc=example,dc=com is the same root you will use on the LDAP clients.
<br />
These are basic LDAP configuration directives. The suffix parameter gives the root name of all information served by this LDAP server, and should be some name related to your domain. The rootdn parameter names LDAP's privileged user, who is allowed to read or write all data managed by this LDAP server.
</description>
-<ident cce="3501-4" />
+<ident cce="27191-6" />
<oval id="ldap_server_config_olcsuffix" />
<ref nist="AC-2, CM-7" />
</Rule>
@@ -191,18 +191,18 @@ that certificate is encrypted, and to the public certificate file belonging to t
for the key to be protected further, so that processes running as ldap could not read it. If this were done, the
LDAP server process would need to be restarted manually whenever the server rebooted.
</description>
-<ident cce="4360-4" />
-<ident cce="4378-6" />
-<ident cce="4492-5" />
-<ident cce="4263-0" />
-<ident cce="3502-2" />
-<ident cce="4449-5" />
-<ident cce="4361-2" />
-<ident cce="4427-1" />
-<ident cce="4321-6" />
-<ident cce="4339-8" />
-<ident cce="4105-3" />
-<ident cce="3718-4" />
+<ident cce="27082-7" />
+<ident cce="27096-7" />
+<ident cce="27129-6" />
+<ident cce="27051-2" />
+<ident cce="26859-9" />
+<ident cce="27116-3" />
+<ident cce="27083-5" />
+<ident cce="27111-4" />
+<ident cce="27068-6" />
+<ident cce="27076-9" />
+<ident cce="26989-4" />
+<ident cce="26895-3" />
<oval id="ldap_server_config_certificate_files" />
<ref nist="AC-6, CM-7, SC-11, SC-12, SC-13, SC-17" />
</Rule>
@@ -354,8 +354,8 @@ be able to change data without an explicit access statement.
Some manual methods of inserting information into the LDAP database may leave these files with incorrect
permissions. This will prevent slapd from starting correctly.
</description>
-<ident cce="4484-2" />
-<ident cce="4502-1" />
+<ident cce="27125-4" />
+<ident cce="27131-2" />
<oval id="ldap_server_config_directory_file_security" />
<ref nist="AC-6, CM-7" />
</Rule>
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index b0f2bb8..2e2fe35 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -36,7 +36,7 @@ recommended to leave this service enabled for local mail delivery.
<rationale>Local mail delivery is essential to some system maintenance and
notification tasks.
</rationale>
-<ident cce="14068-1" />
+<ident cce="26325-1" />
<oval id="service_postfix_enabled" />
<ref nist="CM-6" />
<tested by="DS" on="20121024"/>
@@ -84,7 +84,7 @@ This ensures <tt>postfix</tt> accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack.
</rationale>
-<ident cce="15018-5" />
+<ident cce="26780-7" />
<oval id="postfix_network_listening_disabled" />
<ref nist="CM-7" disa="382"/>
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index c67abd0..f21d309 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -37,7 +37,7 @@ server. If the local machine is not configured to mount NFS filesystems then
this service should be disabled.
<service-disable-macro service="nfslock" />
</description>
-<ident cce="4396-8" />
+<ident cce="27104-9" />
<oval id="service_nfslock_disabled" />
</Rule>
@@ -50,7 +50,7 @@ client-side of RPCSEC GSS. If the system does not require secure RPC then this
service should be disabled.
<service-disable-macro service="rpcgssd" />
</description>
-<ident cce="3535-2" />
+<ident cce="26864-9" />
<oval id="service_rpcgssd_disabled" />
</Rule>
@@ -61,7 +61,7 @@ and GID numbers on NFSv4 mounts. If NFS is not in use on the local system then
this service should be disabled.
<service-disable-macro service="rpcidmapd" />
</description>
-<ident cce="3568-3" />
+<ident cce="26870-6" />
<oval id="service_rpcidmapd_disabled" />
</Rule>
</Group>
@@ -82,7 +82,7 @@ system somewhat against accidental or malicious changes to <tt>/etc/fstab</tt>
and against flaws in the netfs script itself.
<service-disable-macro service="netfs" />
</description>
-<ident cce="4533-6" />
+<ident cce="27137-9" />
<oval id="service_netfs_disabled" />
</Rule>
</Group>
@@ -212,7 +212,7 @@ your network.
Restrict service to always use a given port, so that firewalling can be done
effectively.
</rationale>
-<ident cce="4559-1" />
+<ident cce="27149-4" />
<oval id="nfs_fixed_lockd_tcp_port" />
</Rule>
@@ -229,7 +229,7 @@ your network.
<rationale>
Restrict service to always use a given port, so that firewalling can be done effectively.
</rationale>
-<ident cce="4310-9" />
+<ident cce="27063-7" />
<oval id="nfs_fixed_lockd_udp_port" />
</Rule>
@@ -244,7 +244,7 @@ Where <tt>statd-port</tt> is a port which is not used by any other service on yo
<rationale>
Restrict service to always use a given port, so that firewalling can be done effectively.
</rationale>
-<ident cce="3667-3" />
+<ident cce="26889-6" />
<oval id="nfs_fixed_statd_port" />
</Rule>
@@ -259,7 +259,7 @@ Where <tt>mountd-port</tt> is a port which is not used by any other service on y
<rationale>
Restrict service to always use a given port, so that firewalling can be done effectively.
</rationale>
-<ident cce="4438-8" />
+<ident cce="27114-8" />
<oval id="nfs_fixed_mountd_port" />
</Rule>
@@ -300,7 +300,7 @@ If properly configured, the output should look like:
<pre>nfs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre>
</ocil>
<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
-<ident cce="4473-5" />
+<ident cce="27199-9" />
<oval id="service_nfs_disabled" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -317,8 +317,8 @@ RPC then this service should be disabled.
<service-disable-check-macro service="rpcsvcgssd" />
</ocil>
<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
-<ident cce="4473-5" />
-<ident cce="4491-7" />
+<ident cce="27122-1" />
+<ident cce="27128-8" />
<oval id="service_rpcsvcgssd_disabled" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -350,7 +350,7 @@ All NFS mounts should show the <tt>nodev</tt> setting in parentheses.
</ocil>
<rationale>Legitimate device files should only exist in the /dev directory. NFS mounts
should not present device files to users.</rationale>
-<ident cce="4368-7" />
+<ident cce="27090-0" />
<oval id="mount_option_nodev_remote_filesystems" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -367,7 +367,7 @@ All NFS mounts should show the <tt>nosuid</tt> setting in parentheses.
</ocil>
<rationale>NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables
should be installed to their default location on the local filesystem.</rationale>
-<ident cce="4024-6" />
+<ident cce="26972-0" />
<oval id="mount_option_nosuid_remote_filesystems" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -450,7 +450,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>no_root_squ
</description>
<rationale>If the NFS server allows root access to local file systems from remote hosts, this
access could be used to compromise the system.</rationale>
-<ident cce="4544-3" />
+<ident cce="27138-7" />
<oval id="TO:DO" />
</Rule>
@@ -466,7 +466,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure</t
<rationale>Allowing client requests to be made from ports higher than 1024 could allow a unprivileged
user to initiate an NFS connection. If the unprivileged user account has been compromised, an
attacker could gain access to data on the NFS server.</rationale>
-<ident cce="4465-1" />
+<ident cce="27121-3" />
<oval id="TO:DO" />
</Rule>
@@ -490,7 +490,7 @@ To verify insecure file locking has been disabled, run the following command.
<rationale>Allowing insecure file locking could allow for sensitive data to be
viewed or edited by an unauthorized user.
</rationale>
-<ident cce="TO:DO" />
+<ident cce="27167-6" />
<oval id="TO:DO" />
<ref disa="764" />
</Rule>
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index 606ad67..3ab4f58 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -45,7 +45,7 @@ a client (and synchronize only its own clock) or it is also acting as an NTP
server to other systems. Synchronizing time is essential for authentication
services such as Kerberos, but it is also important for maintaining accurate
logs and auditing possible security breaches.</rationale>
-<ident cce="4376-0" />
+<ident cce="27093-4" />
<oval id="service_ntpd_enabled" />
<ref disa="160" />
<tested by="DS" on="20121024"/>
@@ -72,7 +72,7 @@ server <i>ntpserver</i></pre>
to collate system logs from multiple sources or correlate computer events with
real time events. Using a trusted NTP server provided by your organization is
recommended.</rationale>
-<ident cce="4385-1" />
+<ident cce="27098-3" />
<oval id="ntp_remote_server" />
<ref disa="160" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index c7b4431..3ed4dcc 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -36,7 +36,7 @@ which is no longer necessary for commonly-used network services. Disabling
it ensures that these uncommon services are not running, and also prevents
attacks against xinetd itself.
</rationale>
-<ident cce="4252-3" />
+<ident cce="27046-2" />
<oval id="service_xinetd_disabled" />
<ref disa="305"/>
<tested by="DS" on="20121026"/>
@@ -52,7 +52,7 @@ attacks against xinetd itself.
Removing the <tt>xinetd</tt> package decreases the risk of the
xinetd service's accidental (or intentional) activation.
</rationale>
-<ident cce="4164-0" />
+<ident cce="27005-8" />
<oval id="package_xinetd_removed" />
<ref disa="305"/>
<tested by="DS" on="20121026"/>
@@ -79,7 +79,7 @@ all other information transmitted during the session, can be
stolen by eavesdroppers on the network. The telnet protocol is also
subject to man-in-the-middle attacks.
</rationale>
-<ident cce="3390-2" />
+<ident cce="26836-7" />
<oval id="service_telnetd_disabled" />
<ref disa="68,1436,197,877,888" />
<tested by="DS" on="20121026"/>
@@ -95,7 +95,7 @@ the following command:
Removing the <tt>telnet-server</tt> package decreases the risk of the
telnet service's accidental (or intentional) activation.
</rationale>
-<ident cce="4330-7" />
+<ident cce="27073-6" />
<oval id="package_telnet-server_removed" />
<ref disa="305,381"/>
<tested by="DS" on="20121026"/>
@@ -122,7 +122,7 @@ network services. Removing it
decreases the risk of those services' accidental (or intentional)
activation.
</rationale>
-<ident cce="4308-3" />
+<ident cce="27062-9" />
<oval id="package_rsh-server_removed" />
<ref disa="305,381"/>
<tested by="DS" on="20121026"/>
@@ -141,7 +141,7 @@ means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
-<ident cce="undefined" />
+<ident cce="27208-8" />
<oval id="service_rexec_disabled" />
<ref disa="68,1436"/>
<tested by="DS" on="20121026"/>
@@ -160,7 +160,7 @@ means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
-<ident cce="4141-8" />
+<ident cce="26994-4" />
<oval id="service_rsh_disabled" />
<ref disa="68,1436" />
<tested by="DS" on="20121026"/>
@@ -179,7 +179,7 @@ means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
-<ident cce="3537-8" />
+<ident cce="26865-6" />
<oval id="service_rlogin_disabled" />
<ref disa="1436" />
<tested by="DS" on="20121026"/>
@@ -228,7 +228,7 @@ the following command:
<rationale>Removing the <tt>ypserv</tt> package decreases the risk of the
accidental (or intentional) activation of NIS or NIS+ services.
</rationale>
-<ident cce="4348-9" />
+<ident cce="27079-3" />
<oval id="package_ypserv_removed" />
<ref disa="305,381"/>
<tested by="DS" on="20121026"/>
@@ -245,7 +245,7 @@ a NIS or NIS+ domain, should be disabled.
Disabling the <tt>ypbind</tt> service ensures the system is not acting
as a client in a NIS or NIS+ domain.
</rationale>
-<ident cce="3705-1" />
+<ident cce="26894-6" />
<oval id="service_ypbind_disabled" />
<ref disa="305"/>
<tested by="DS" on="20121026"/>
@@ -273,7 +273,7 @@ found.</description>
Disabling the <tt>tftp</tt> service ensures the system is not acting
as a tftp server, which does not provide encryption or authentication.
</rationale>
-<ident cce="4273-9" />
+<ident cce="27055-3" />
<oval id="service_tftp_disabled" />
<ref disa="1436" />
<tested by="DS" on="20121026"/>
@@ -291,7 +291,7 @@ as a tftp server, which does not provide encryption or authentication.
Removing the <tt>tftp-server</tt> package decreases the risk of the
accidental (or intentional) activation of tftp services.
</rationale>
-<ident cce="3916-4" />
+<ident cce="26946-4" />
<oval id="package_tftp-server_removed" />
<ref disa="305"/>
<tested by="DS" on="20121026"/>
diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml
index 2247dfc..21e1339 100644
--- a/RHEL6/input/services/printing.xml
+++ b/RHEL6/input/services/printing.xml
@@ -16,7 +16,7 @@ homepage and more detailed documentation are available at http://www.cups.org.
<ocil><service-disable-check-macro service="cups" /></ocil>
<rationale>Turn off unneeded services to reduce attack surface.
</rationale>
-<ident cce="3755-6" />
+<ident cce="26899-5" />
<oval id="service_cups_disabled" />
<ref nist="CM-7" />
</Rule>
@@ -32,7 +32,7 @@ homepage and more detailed documentation are available at http://www.cups.org.
port are not allowed. If the print server does need to be accessed this
exception should be added to the firewall configuration.
</rationale>
-<ident cce="3649-1" />
+<ident cce="26884-7" />
<!-- Need to invert this check <oval id="iptables_cupsd_disabled" /> -->
<ref nist="CM-7" />
</Rule>
@@ -57,7 +57,7 @@ the CUPS print service, can be configured to listen to these broadcasts and add
and configure these printers for immediate use. By disabling this browsing
capability, the machine will no longer generate or receive such broadcasts.
</rationale>
-<ident cce="4420-6" />
+<ident cce="27108-0" />
<oval id="cups_disable_browsing" />
</Rule>
@@ -80,7 +80,7 @@ broadcasts, or remote users will still be able to see the locally configured
printers, even if they cannot actually print to them. To limit print serving to
a particular set of users, use the Policy directive.
</rationale>
-<ident cce="4407-3" />
+<ident cce="27107-2" />
<oval id="cups_disable_printserver" />
<ref nist="TODO:NIST" />
</Rule>
diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
index 60bfe54..c844e8b 100644
--- a/RHEL6/input/services/smb.xml
+++ b/RHEL6/input/services/smb.xml
@@ -32,7 +32,7 @@ sharing functionality.
Running a Samba server provides a network-based avenue of attack, and
should be disabled if not needed.
</rationale>
-<ident cce="4551-8" />
+<ident cce="27143-7" />
<oval id="service_smb_disabled" />
<ref disa="1436" />
</Rule>
@@ -201,7 +201,7 @@ Packet signing can prevent
man-in-the-middle attacks which modify SMB packets in
transit.
</rationale>
-<ident cce="14075-6" />
+<ident cce="26328-5" />
<oval id="smb_client_signing_smb_conf" />
</Rule>
@@ -226,7 +226,7 @@ The output should show either <tt>krb5i</tt> or <tt>ntlmv2i</tt> in use.
Packet signing can prevent man-in-the-middle
attacks which modify SMB packets in transit.
</rationale>
-<ident cce="15029-2" />
+<ident cce="26792-2" />
<oval id="mount_option_smb_client_signing" />
</Rule>
diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml
index df8b2cf..567abe3 100644
--- a/RHEL6/input/services/snmp.xml
+++ b/RHEL6/input/services/snmp.xml
@@ -26,7 +26,7 @@ installed and activated, the software should be disabled and removed.
Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed.
</rationale>
-<ident cce="3765-5" />
+<ident cce="26906-8" />
<oval id="service_snmpd_disabled" />
</Rule>
@@ -43,7 +43,7 @@ If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.
</rationale>
-<ident cce="14081-4" />
+<ident cce="26332-7" />
<oval id="package_net-snmp_removed" />
</Rule>
@@ -66,7 +66,7 @@ stations</li>
<li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li>
<li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul>
</description>
-<!--<ident cce="14081-4" /> -->
+<!--<ident cce="26332-7" /> -->
<!--<oval id="snmp_configure_server" /> -->
<Rule id="snmpd_use_newer_protocol" severity="medium">
diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml
index 7aa01cb..388c0e9 100644
--- a/RHEL6/input/services/squid.xml
+++ b/RHEL6/input/services/squid.xml
@@ -27,7 +27,7 @@ and removed.
Running proxy server software provides a network-based avenue
of attack, and should be removed if not needed.
</rationale>
-<ident cce="4556-7" />
+<ident cce="27146-0" />
<oval id="service_squid_disabled" />
</Rule>
@@ -43,7 +43,7 @@ of attack, and should be removed if not needed.
If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation.
</rationale>
-<ident cce="4076-6" />
+<ident cce="26977-9" />
<oval id="package_squid_removed" />
</Rule>
</Group>
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 30890b3..4851b82 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -26,7 +26,7 @@ However, if it can be disabled, do so.
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.
</description>
-<ident cce="4268-9" />
+<ident cce="27054-6" />
<oval id="service_sshd_disabled" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -47,7 +47,7 @@ remote access.
If inbound SSH connections are not expected, disallowing access to the SSH port will
avoid possible exploitation of the port by an attacker.
</rationale>
-<ident cce="4295-2" />
+<ident cce="27060-3" />
<oval id="iptables_sshd_disabled" />
</Rule>
@@ -78,7 +78,7 @@ SSH protocol version 1 suffers from design flaws that
result in security vulnerabilities and
should not be used.
</rationale>
-<ident cce="4325-7" />
+<ident cce="27072-8" />
<oval id="sshd_protocol_2" />
<ref disa="776,774,1436" />
<tested by="DS" on="20121024"/>
@@ -97,7 +97,7 @@ Where <tt>USER1</tt> and <tt>USER2</tt> are valid user names.
Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system.
</rationale>
-<!-- <ident cce="4325-7" /> -->
+<!-- <ident cce="27072-8" /> -->
<!-- <oval id="sshd_limit_user_access" /> -->
</Rule>
@@ -167,7 +167,7 @@ Causing idle users to be automatically logged out
guards against compromises one system leading trivially
to compromises on another.
</rationale>
-<ident cce="3845-5" />
+<ident cce="26919-1" />
<oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
<ref disa="879,1133"/>
<tested by="DS" on="20121024"/>
@@ -191,7 +191,7 @@ If properly configured, output should be:
This ensures a user login will be terminated as soon as the <tt>ClientAliveCountMax</tt>
is reached.
</rationale>
-<ident cce="14061-6" />
+<ident cce="26282-4" />
<oval id="sshd_clientalivecountmax" />
<ref disa="879,1133"/>
<tested by="DS" on="20121024"/>
@@ -215,7 +215,7 @@ following line in <tt>/etc/ssh/sshd_config</tt>:
SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.
</rationale>
-<ident cce="4475-0" />
+<ident cce="27124-7" />
<oval id="sshd_rsh_emulation_disabled" />
<ref disa="765,766"/>
</Rule>
@@ -240,7 +240,7 @@ following line:
SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.
</rationale>
-<ident cce="4370-3" />
+<ident cce="27091-8" />
<oval id="sshd_hostbasedauthentication" />
<ref disa="765,766"/>
<tested by="DS" on="20121024"/>
@@ -262,7 +262,7 @@ Permitting direct root login reduces auditable information about who ran
privileged commands on the system
and also allows direct attack attempts on root's password.
</rationale>
-<ident cce="4387-7" />
+<ident cce="27100-7" />
<oval id="sshd_permitrootlogin_no" />
<ref disa="770" />
<tested by="DS" on="20121024"/>
@@ -285,7 +285,7 @@ Configuring this setting for the SSH daemon provides additional assurance that
remote login via SSH will require a password,
even in the event of misconfiguration elsewhere.
</rationale>
-<ident cce="3660-8" />
+<ident cce="26887-0" />
<oval id="sshd_permitemptypasswords_no" />
<ref disa="765,766"/>
<tested by="DS" on="20121024"/>
@@ -309,7 +309,7 @@ reinforces policy awareness during the logon process. Alternatively,
systems whose ownership should not be obvious
should ensure usage of a banner that does not provide easy attribution.
</rationale>
-<ident cce="4431-3" />
+<ident cce="27112-2" />
<oval id="sshd_banner_set" />
<ref disa="48" />
<tested by="DS" on="20121024"/>
@@ -333,7 +333,7 @@ If properly configured, output should be:
SSH environment options potentially allow users to bypass
access restriction in some configurations.
</rationale>
-<ident cce="4422-2" />
+<ident cce="27201-3" />
<oval id="sshd_no_user_envset" />
<ref disa="1414" />
<tested by="DS" on="20121024"/>
@@ -358,7 +358,7 @@ The output should contain only those ciphers which are FIPS-approved.
Approved algorithms should impart some level of confidence in their
implementation. These are also required for compliance.
</rationale>
-<ident cce="14491-5" />
+<ident cce="26555-3" />
<oval id="sshd_use_approved_ciphers" />
<ref disa="803,1144,1145,1146" />
<tested by="DS" on="20121024"/>
@@ -382,7 +382,7 @@ and replace it with:
<rationale>
Restricting SSH access to only trusted network segments reduces exposure of the SSH
server to attacks from unauthorized networks.</rationale>
-<!-- <ident cce="14491-5" /> -->
+<!-- <ident cce="26555-3" /> -->
<!-- <oval id="sshd_strengthen_firewall" /> -->
</Group>
diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
index 7ee53e8..c2dbbe1 100644
--- a/RHEL6/input/services/xorg.xml
+++ b/RHEL6/input/services/xorg.xml
@@ -27,7 +27,7 @@ The output should show the following:
<pre>id:3:initdefault:</pre>
</ocil>
<rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
-<ident cce="4462-8" />
+<ident cce="27119-7" />
<oval id="xwindows_runlevel_setting" />
<ref disa="366" />
<tested by="DS" on="20121025"/>
@@ -48,7 +48,7 @@ The output should be:
<pre>package xorg-x11-server-common is not installed</pre>
</ocil>
<rationale>Unnecessary packages should not be installed to decrease the attack surface of the system.</rationale>
-<ident cce="4422-2" />
+<ident cce="27198-1" />
<oval id="package_xorg-x11-server-common_removed" />
<ref disa="366" />
<tested by="DS" on="20121025"/>
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
index 782cfb4..6464c4d 100644
--- a/RHEL6/input/system/accounts/banners.xml
+++ b/RHEL6/input/system/accounts/banners.xml
@@ -77,7 +77,7 @@ run the following command:
Although unlikely to dissuade a serious attacker, the warning message
reinforces policy awareness during the logon process.
</rationale>
-<ident cce="4060-0" />
+<ident cce="26974-6" />
<oval id="banner_etc_issue" value="login_banner_text"/>
<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" />
<tested by="DS" on="20121026"/>
@@ -114,7 +114,7 @@ If properly configured, the <tt>default</tt> value should be <tt>true</tt>.
Although unlikely to dissuade a serious attacker, the warning message
reinforces policy awareness during the logon process.
</rationale>
-<ident cce="4188-9" />
+<ident cce="27195-7" />
<oval id="banner_gui_enabled" />
<ref nist="AC-3, CM-6, AC-8" disa="48,50" />
</Rule>
@@ -142,7 +142,7 @@ If properly configured, the proper banner text will appear within this schema.
Although unlikely to dissuade a serious attacker, the warning message
reinforces policy awareness during the logon process.
</rationale>
-<ident cce="4188-9" />
+<ident cce="27017-3" />
<oval id="banner_gui_text_set" value="login_banner_text" />
<ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" />
</Rule>
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 95b21c1..3e893a9 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -195,7 +195,7 @@ requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module.
</rationale>
-<ident cce="15054-0" />
+<ident cce="26795-5" />
<oval id="accounts_password_pam_cracklib_retry" value="var_password_pam_cracklib_retry"/>
<ref nist="IA-5" disa="1092" />
<tested by="DS" on="20121024"/>
@@ -238,7 +238,7 @@ This would appear as <tt>dcredit=-1</tt>.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.
</rationale>
-<ident cce="14113-5" />
+<ident cce="26374-9" />
<oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/>
<ref nist="IA-5,194" disa="194"/>
<tested by="DS" on="20121024"/>
@@ -263,7 +263,7 @@ This would appear as <tt>ucredit=-1</tt>.
Requiring a minimum number of uppercase characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
-<ident cce="14672-0" />
+<ident cce="26601-5" />
<oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/>
<ref nist="IA-5" disa="192" />
<tested by="DS" on="20121024"/>
@@ -288,7 +288,7 @@ This would appear as <tt>ocredit=-1</tt>.
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
-<ident cce="14122-6" />
+<ident cce="26409-3" />
<oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
<ref nist="IA-5" disa="1619" />
<tested by="DS" on="20121024"/>
@@ -313,7 +313,7 @@ This would appear as <tt>lcredit=-1</tt>.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
-<ident cce="14712-4" />
+<ident cce="26631-2" />
<oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/>
<ref nist="IA-5" disa="193" />
<tested by="DS" on="20121024"/>
@@ -339,7 +339,7 @@ Requiring a minimum number of different characters during password changes ensur
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.
</rationale>
-<ident cce="14701-7" />
+<ident cce="26615-5" />
<oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/>
<ref nist="IA-5" disa="195"/>
<tested by="DS" on="20121024"/>
@@ -386,7 +386,7 @@ The output should show <tt>deny=3</tt>.
Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks.
</rationale>
-<ident cce="3410-8" />
+<ident cce="26844-1" />
<oval id="accounts_passwords_pam_faillock_deny" value="var_accounts_passwords_pam_faillock_deny"/>
<ref nist="AC-7, CM-6" disa="1452,44,47" />
</Rule>
@@ -408,7 +408,7 @@ The output should show the following at the end of the line:
<rationale>
Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
</rationale>
-<ident cce="14939-3" />
+<ident cce="26741-9" />
<oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
<ref nist="IA-5" disa="200" />
<tested by="DS" on="20121024"/>
@@ -442,7 +442,7 @@ ensure that the <tt>pam_unix.so</tt> module includes the argument
<rationale>
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
-<!-- <ident cce="14063-2" /> -->
+<!-- <ident cce="26303-8" /> -->
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ref nist="IA-5" disa="803"/>
<tested by="DS" on="20121024"/>
@@ -462,7 +462,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following line appears:
<rationale>
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
-<!-- <ident cce="14063-2" /> -->
+<!-- <ident cce="26303-8" /> -->
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ref nist="IA-5" disa="803"/>
<tested by="DS" on="20121024"/>
@@ -484,7 +484,7 @@ in the <tt>[default]</tt> section:
<rationale>
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
-<!-- <ident cce="14063-2" /> -->
+<!-- <ident cce="26303-8" /> -->
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ref nist="IA-5" disa="803"/>
<tested by="DS" on="20121026"/>
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 05f54e7..e914c6a 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -33,7 +33,7 @@ or modification of the file.
<rationale>
Only root should be able to modify important boot parameters.
</rationale>
-<ident cce="4144-2" />
+<ident cce="26995-1" />
<oval id="file_user_owner_grub_conf" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -51,7 +51,7 @@ destruction or modification of the file.
The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.
</rationale>
-<ident cce="4197-0" />
+<ident cce="27022-3" />
<oval id="file_group_owner_grub_conf" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -68,7 +68,7 @@ is the default.
Proper permissions ensure that only the root user can modify important boot
parameters.
</rationale>
-<ident cce="3923-0" />
+<ident cce="26949-8" />
<oval id="file_permissions_grub_conf" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -97,7 +97,7 @@ users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.
</rationale>
-<ident cce="3818-2" />
+<ident cce="26911-8" />
<oval id="bootloader_password" />
<ref nist="CM-7, IA-5, AC-3" disa="213" />
<tested by="DS" on="20121026"/>
@@ -128,7 +128,7 @@ This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.
</rationale>
-<ident cce="4241-6" />
+<ident cce="27040-5" />
<oval id="singleuser_password" />
<ref nist="AC-6, IA-5" disa="213" />
<tested by="DS" on="20121024"/>
@@ -185,7 +185,7 @@ Using interactive boot,
the console user could disable auditing, firewalls, or other
services, weakening system security.
</rationale>
-<ident cce="4245-7" />
+<ident cce="27043-9" />
<oval id="interactive_boot_disable" />
<ref nist="CM-7, IA-4, SC-2" disa="213"/>
<tested by="DS" on="20121024"/>
@@ -263,7 +263,7 @@ Setting the idle delay controls when the
screensaver will start, and can be combined with
screen locking to prevent access from passersby.
</rationale>
-<ident cce="3315-9" />
+<ident cce="26828-4" />
<oval id="gconf_gnome_screensaver_idle_delay" value="inactivity_timeout_value" />
<ref nist="AC-3, CM-6, CM-7, AC-11" disa="57"/>
</Rule>
@@ -289,7 +289,7 @@ real-time screen display (such as network management products) require the
login session does not have administrator rights and the display station is located in a
controlled-access area.
</rationale>
-<ident cce="14604-3" />
+<ident cce="26600-7" />
<oval id="gconf_gnome_screensaver_idle_activation_enabled" />
<ref nist="CM-6, CM-7" disa="57" />
</Rule>
@@ -314,7 +314,7 @@ Enabling the activation of the screen lock after an idle period
ensures password entry will be required in order to
access the system, preventing access by passersby.
</rationale>
-<ident cce="14023-6" />
+<ident cce="26235-2" />
<oval id="gconf_gnome_screensaver_lock_enabled" />
<ref nist="AC-3, CM-6, CM-7, AC-11" disa="57" />
</Rule>
@@ -339,7 +339,7 @@ If properly configured, the output should be <tt>blank-only</tt>
Setting the screensaver mode to blank-only conceals the
contents of the display from passersby.
</rationale>
-<ident cce="14735-5" />
+<ident cce="26638-7" />
<oval id="gconf_gnome_screensaver_mode_blank" />
<ref nist="CM-6, CM-7" disa="60" />
</Rule>
@@ -371,7 +371,7 @@ The console can now be locked with the following key combination:
Installing <tt>screen</tt> ensures a console locking capability is available
for users who may need to suspend console logins.
</rationale>
-<ident cce="3910-7" />
+<ident cce="26940-7" />
<ref nist="CM-6, CM-7" disa="58" />
<tested by="DS" on="20121026"/>
</Rule>
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index a4e3873..fd26a64 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -101,7 +101,7 @@ search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.
</rationale>
-<ident cce="4154-1" />
+<ident cce="27002-5" />
<oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
<ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/>
<tested by="DS" on="20121026"/>
@@ -128,7 +128,7 @@ Setting the minimum password age protects against
users cycling back to a favorite password
after satisfying the password reuse requirement.
</rationale>
-<ident cce="4180-6" />
+<ident cce="27013-2" />
<oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
<ref nist="CM-6, IA-5" disa="198"/>
<tested by="DS" on="20121026"/>
@@ -156,7 +156,7 @@ periodically change their passwords. This could possibly decrease
the utility of a stolen password. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
-<ident cce="4092-3" />
+<ident cce="26985-2" />
<oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
<ref nist="CM-6, CM-7, IA-5, AC-3" disa="180,199" />
<tested by="DS" on="20121026"/>
@@ -182,7 +182,7 @@ The DoD requirement is 7.
Setting the password warning age enables users to
make the change at a practical time.
</rationale>
-<ident cce="4097-2" />
+<ident cce="26988-6" />
<oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
<ref nist="CM-6, CM-7, IA-5, AC-3" />
<tested by="DS" on="20121026"/>
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index 8222f67..21de2d2 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -36,7 +36,7 @@ run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational
environments.
</rationale>
-<ident cce="4238-2" />
+<ident cce="27038-9" />
<oval id="accounts_pam_no_nullok" />
<ref nist="AC-3, CM-6, IA-5" />
<tested by="DS" on="20121024"/>
@@ -62,7 +62,7 @@ The hashes for all user account passwords should be stored in
the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
which is readable by all users.
</rationale>
-<ident cce="14300-8" />
+<ident cce="26476-2" />
<oval id="accounts_password_all_shadowed" />
<ref nist="IA-5" disa="201" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 2d1ea24..35bac20 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -57,7 +57,7 @@ Preventing direct root login to virtual console devices
helps ensure accountability for actions taken on the system
using the root account.
</rationale>
-<ident cce="3485-0" />
+<ident cce="26855-7" />
<oval id="securetty_root_login_console_only" />
<ref nist="CM-6, CM-7" disa="770" />
<tested by="DS" on="20121024"/>
@@ -82,7 +82,7 @@ Preventing direct root login to serial port interfaces
helps ensure accountability for actions taken on the systems
using the root account.
</rationale>
-<ident cce="4256-4" />
+<ident cce="27047-0" />
<oval id="securetty_no_serial" />
<ref nist="AC-3, AC-6" disa="770" />
<tested by="DS" on="20121024"/>
@@ -139,7 +139,7 @@ Do not perform the steps in this
section on the root account. Doing so might cause the system to
become inaccessible.
</warning>
-<ident cce="3987-5" />
+<ident cce="26966-2" />
<oval id="accounts_nologin_for_system" />
<ref nist="AC-3, CM-6" disa="178" />
<tested by="DS" on="20121024"/>
@@ -165,7 +165,7 @@ guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.
</rationale>
-<ident cce="4009-7" />
+<ident cce="26971-2" />
<oval id="accounts_no_uid_except_zero" />
<ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 09409b8..1958bb7 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -87,7 +87,7 @@ These empty elements have the same effect as a single <tt>.</tt> character.
Including these entries increases the risk that root could
execute code from an untrusted location.
</rationale>
-<ident cce="3301-9" />
+<ident cce="26826-8" />
<oval id="accounts_dangerous_path_for_root" />
<ref nist="CM6, CM-7"/>
</Rule>
@@ -110,7 +110,7 @@ Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code.
</rationale>
-<ident cce="14957-5" />
+<ident cce="26768-2" />
<oval id="accounts_root_path_dirs_no_write" />
<ref nist="CM6, CM-7"/>
</Rule>
@@ -145,7 +145,7 @@ to other users. If a subset of users need read access
to one another's home directories, this can be provided using
groups or ACLs.
</rationale>
-<ident cce="4090-7" />
+<ident cce="26981-1" />
<oval id="file_permissions_home_dirs" />
<ref nist="AC-3, CM-6"/>
</Rule>
@@ -225,7 +225,7 @@ umask 077
umask 077</pre>
</ocil>
-<ident cce="3844-8" />
+<ident cce="26917-5" />
<oval id="accounts_umask_bash_users" value="umask_user_value"/>
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="swells" on="20120929"/>
@@ -249,7 +249,7 @@ All output must show the value of <tt>umask</tt> set to 077, as shown in the bel
<pre># grep "umask" /etc/csh.cshrc
umask 077</pre>
</ocil>
-<ident cce="4227-5" />
+<ident cce="27034-8" />
<oval id="accounts_umask_csh" value="umask_user_value"/>
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="swells" on="20120929"/>
@@ -265,7 +265,7 @@ add or correct the <tt>umask</tt> setting in <tt>/etc/profile</tt> to read as fo
<rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and/or
written to by unauthorized users.</rationale>
-<ident cce="14847-8" />
+<ident cce="26669-2" />
<ocil clause="the above command returns no output, or if the umask is configured incorrectly">
Verify the <tt>umask</tt> setting is configured correctly in the <tt>/etc/profile</tt> file by
running the following command:
@@ -297,7 +297,7 @@ All output must show the value of <tt>umask</tt> set to 077, as shown in the bel
<pre># grep "umask" /etc/login.defs
umask 077</pre>
</ocil>
-<ident cce="14107-7" />
+<ident cce="26371-5" />
<oval id="accounts_umask_login_defs" value="umask_user_value" />
<ref nist="CM-6, CM-7" disa="366"/>
<tested by="swells" on="20120929" />
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index f823a89..f5e617a 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -91,7 +91,7 @@ disk.
audit records generated by the kernel can be written to disk, or that appropriate
actions will be taken if other obstacles exist.
</rationale>
-<ident cce="4292-9" />
+<ident cce="27058-7" />
<oval id="service_auditd_enabled" />
<ref nist="CM-6, CM-7" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
<tested by="DS" on="20121024"/>
@@ -116,7 +116,7 @@ takes care of enabling this for all processes which launch after it
does, adding the kernel argument ensures it is set for every
process during boot.
</rationale>
-<ident cce="15026-8" />
+<ident cce="26785-6" />
<oval id="bootloader_audit_argument" />
<ref nist="AU-2" disa="1464,130" />
</Rule>
@@ -489,7 +489,7 @@ desired, but is not required. See an example of multiple combined syscalls:
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
-<ident cce="14051-7" />
+<ident cce="26242-8" />
<oval id="audit_rules_time_adjtimex" />
<ref nist="AU-2(a)" />
<ref disa="1487,169" />
@@ -517,7 +517,7 @@ desired, but is not required. See an example of multiple combined syscalls:
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
-<ident cce="14051-7" />
+<ident cce="27203-9" />
<oval id="audit_rules_time_settimeofday" />
<ref nist="AU-2(a)" />
<ref disa="1487,169" />
@@ -543,7 +543,7 @@ See an example of multiple combined syscalls:
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
-<ident cce="14051-7" />
+<ident cce="27169-2" />
<oval id="audit_rules_time_stime" />
<ref nist="AU-2(a)" />
<ref disa="1487,169" />
@@ -571,7 +571,7 @@ desired, but is not required. See an example of multiple combined syscalls:
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
-<ident cce="14051-7" />
+<ident cce="27170-0" />
<oval id="audit_rules_time_clock_settime" />
<ref nist="AU-2(a)" />
<ref disa="1487,169" />
@@ -596,7 +596,7 @@ If the system is configured to audit this activity, it will return a line.
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
-<ident cce="14051-7" />
+<ident cce="27172-6" />
<oval id="audit_rules_time_watch_localtime" />
<ref nist="AU-2(a)" />
<ref disa="1487,169" />
@@ -625,7 +625,7 @@ each file specified (and with <tt>perm=wa</tt> for each).
will alert the system administrator(s) to any modifications. Any
unexpected users, groups, or modifications should be investigated for
legitimacy.</rationale>
-<ident cce="14829-6" />
+<ident cce="26664-3" />
<oval id="audit_rules_usergroup_modification" />
<ref nist="AU-2(a)" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
</Rule>
@@ -651,7 +651,7 @@ each file specified (and <tt>perm=wa</tt> should be indicated for each).
<rationale>The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</rationale>
-<ident cce="14816-3" />
+<ident cce="26648-6" />
<oval id="audit_rules_networkconfig_modification" />
<ref nist="AU-2(a)" />
</Rule>
@@ -706,7 +706,7 @@ configuration, a line should be returned (including
<rationale>The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
-<ident cce="14821-3" />
+<ident cce="26657-7" />
<oval id="audit_rules_mac_modification" />
<ref nist="AU-2" />
</Rule>
@@ -766,7 +766,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="26280-8" />
<oval id="audit_rules_dac_modification_chmod" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -794,7 +794,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27173-4" />
<oval id="audit_rules_dac_modification_chown" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -822,7 +822,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27174-2" />
<oval id="audit_rules_dac_modification_fchmod" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -850,7 +850,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27175-9" />
<oval id="audit_rules_dac_modification_fchmodat" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -878,7 +878,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27177-5" />
<oval id="audit_rules_dac_modification_fchown" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -906,7 +906,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27178-3" />
<oval id="audit_rules_dac_modification_fchownat" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -934,7 +934,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27179-1" />
<oval id="audit_rules_dac_modification_fremovexattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -962,7 +962,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27180-9" />
<oval id="audit_rules_dac_modification_fsetxattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -990,7 +990,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27181-7" />
<oval id="audit_rules_dac_modification_lchown" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1018,7 +1018,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27182-5" />
<oval id="audit_rules_dac_modification_lremovexattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1046,7 +1046,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27183-3" />
<oval id="audit_rules_dac_modification_lsetxattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1074,7 +1074,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27184-1" />
<oval id="audit_rules_dac_modification_removexattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1102,7 +1102,7 @@ number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
-<ident cce="14058-2" />
+<ident cce="27185-8" />
<oval id="audit_rules_dac_modification_setxattr" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1119,7 +1119,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
</description>
<rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
-<ident cce="14904-7" />
+<ident cce="26691-6" />
<oval id="audit_rules_login_events" />
<!--<ref nist="TODO" />-->
</Rule>
@@ -1136,7 +1136,7 @@ storing such process information, add the following to
</description>
<rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
-<ident cce="14679-5" />
+<ident cce="26610-6" />
<oval id="audit_rules_session_events" />
<!--<ref nist="TODO" />-->
</Rule>
@@ -1159,7 +1159,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
</ocil>
<rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
-<ident cce="14917-9" />
+<ident cce="26712-0" />
<oval id="audit_rules_unsuccessful_file_modification" />
<ref nist="AU-2.1 (v),AU-2 d" disa="126" />
</Rule>
@@ -1187,7 +1187,7 @@ which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.
</rationale>
-<ident cce="14296-8" />
+<ident cce="26457-2" />
<oval id="audit_rules_privileged_commands" />
<ref nist="AU-2" disa="40" />
<tested by="DS" on="20121024"/>
@@ -1209,7 +1209,7 @@ To verify that auditing is configured for all media exportation events, run the
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</rationale>
-<ident cce="14569-8" />
+<ident cce="26573-6" />
<oval id="audit_rules_media_export" />
<ref nist="AU-2" disa="126"/>
<tested by="DS" on="20121024"/>
@@ -1233,7 +1233,7 @@ appropriate for your system:
<rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
-<ident cce="14820-5" />
+<ident cce="26651-0" />
<oval id="audit_rules_file_deletion_events" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1251,7 +1251,7 @@ To verify that auditing is configured for system administrator actions, run the
</ocil>
<rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</rationale>
-<ident cce="14824-7" />
+<ident cce="26662-7" />
<oval id="audit_rules_sysadmin_actions" />
<ref nist="AU-2" disa="126"/>
<tested by="DS" on="20121024"/>
@@ -1273,7 +1273,7 @@ to capture kernel module loading and unloading events, setting ARCH to either b3
<rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
-<ident cce="14688-6" />
+<ident cce="26611-4" />
<oval id="audit_rules_kernel_module_loading" />
<ref nist="AU-2" disa="126"/>
</Rule>
@@ -1289,7 +1289,7 @@ audit rules.</description>
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation</rationale>
-<ident cce="14692-8" />
+<ident cce="26612-2" />
<oval id="audit_rules_immutable" />
<ref nist="AU-2" />
</Rule>
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index 514859d..9a490eb 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -30,7 +30,7 @@ Rsyslog is installed by default.
The rsyslog package provides the rsyslog daemon, which provides
system logging services.
</rationale>
-<ident cce="17742-8" />
+<ident cce="26809-4" />
<oval id="package_rsyslog_installed" />
<ref nist="AU-2, AU-9, CM-6" disa="1311,1312"/>
<tested by="DS" on="20121024"/>
@@ -48,7 +48,7 @@ system logging services.
<rationale>The <tt>rsyslog</tt> service must be running in order to provide
logging services, which are essential to system administration.
</rationale>
-<ident cce="17698-2" />
+<ident cce="26807-8" />
<oval id="service_rsyslog_enabled" />
<ref nist="AU-12, CM-6" disa="1557,1312,1311" />
<tested by="DS" on="20121024"/>
@@ -111,7 +111,7 @@ permissions:
<rationale>If a log file referenced by rsyslog does not exist, rsyslog
will not create it and important log messages can be lost.
</rationale>
-<ident cce="18095-0" />
+<ident cce="26818-5" />
<ref nist="AC-3, CM-6" />
</Rule>
@@ -135,7 +135,7 @@ To see the owner of a given log file, run the following command:
<rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
-<ident cce="17857-4" />
+<ident cce="26812-8" />
<oval id="rsyslog_files_ownership" />
<ref nist="AC-3, CM-6" disa="1314"/>
<tested by="DS" on="20121024"/>
@@ -161,7 +161,7 @@ To see the group-owner of a given log file, run the following command:
<rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
-<ident cce="18240-2" />
+<ident cce="26821-9" />
<oval id="rsyslog_files_groupownership" />
<ref nist="AC-3, CM-6" disa="1314"/>
<tested by="DS" on="20121024"/>
@@ -190,7 +190,7 @@ The permissions should be 600, or more restrictive.
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.
</rationale>
-<ident cce="18095-0" />
+<ident cce="27190-8" />
<oval id="rsyslog_files_permissions" />
<ref nist="AC-3, CM-6" disa="1314"/>
<tested by="DS" on="20121024"/>
@@ -260,7 +260,7 @@ system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.
</rationale>
-<ident cce="17248-6" />
+<ident cce="26801-1" />
<oval id="rsyslog_remote_loghost" />
<ref nist="AU-2, AU-9" disa="1348, 136" />
</Rule>
@@ -296,7 +296,7 @@ Any process which receives messages from the network incurs some risk
of receiving malicious messages. This risk can be eliminated for
rsyslog by configuring it not to listen on the network.
</rationale>
-<ident cce="17639-6" />
+<ident cce="26803-7" />
<oval id="rsyslog_nolisten" />
<ref nist="AU-2, AU-9" />
</Rule>
@@ -371,7 +371,7 @@ periodically in order to perform its log rotation function.</description>
<rationale>Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</rationale>
-<ident cce="4182-2" />
+<ident cce="27194-0" />
<ref nist="AU-2, AU-9, CM-6" disa="366"/>
</Rule> -->
@@ -386,7 +386,7 @@ if the /var/log partition becomes full.</rationale>
<ocil>
<service-enable-check-macro service="logrotate" />
</ocil>
-<ident cce="4182-2" />
+<ident cce="27014-0" />
<oval id="logrotate_rotate_all_files" />
<ref nist="AU-2, AU-9, CM-6" disa="366" />
</Rule>
@@ -404,7 +404,7 @@ Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/c
on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it
is running.
<pre> HostLimit = no </pre> </description>
-<ident cce="4323-2" />
+<ident cce="27197-3" />
<oval id="logwatch_configured_hostlimit" />
</Rule>
@@ -415,7 +415,7 @@ If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This
more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that
information is almost always necessary
<pre> SplitHosts = yes </pre> </description>
-<ident cce="4323-2" />
+<ident cce="27069-4" />
<oval id="logwatch_configured_splithosts" />
</Rule>
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 30319ac..141705d 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -57,7 +57,7 @@ The <tt>ip6tables</tt> default rules are essentially the same.</description>
<rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.
</rationale>
-<ident cce="4167-3" />
+<ident cce="27006-6" />
<oval id="service_ip6tables_enabled" />
<ref nist="CM-6, CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414"/>
<tested by="DS" on="20121024"/>
@@ -73,7 +73,7 @@ capability for IPv6 and ICMPv6.
The <tt>iptables</tt> service provides the system's host-based firewalling
capability for IPv4 and ICMP.
</rationale>
-<ident cce="4189-7" />
+<ident cce="27018-1" />
<oval id="service_iptables_enabled" />
<ref nist="CM-6, CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414" />
<tested by="DS" on="20121024"/>
@@ -128,7 +128,7 @@ the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
-<ident cce="14264-6" />
+<ident cce="26444-0" />
<oval id="iptables_default_policy_drop" />
<ref nist="AC-4, CM-6" disa="66,1109,1154,1414" />
</Rule>
@@ -152,7 +152,7 @@ accepted.</rationale>
The output should be similar to the following:
<pre># grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0</pre></ocil>
-<ident cce="14264-6" />
+<ident cce="27186-6" />
<ref nist="AC-4, CM-6" disa="1109" />
</Rule>
@@ -177,7 +177,7 @@ could add another IPv6 address to the interface or alter important network setti
<ref nist="AC-4, CM-6" />
<rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the operation-
of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
-<!--<ident cce="14264-6" />-->
+<!--<ident cce="26444-0" />-->
<!--<oval id="iptables_icmp_disabled" />-->
</Group>
@@ -224,7 +224,7 @@ If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your ne
The following rule will log all traffic originating from a site-local address, which is deprecated address space:
<pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</pre>
</description>
-<!--<ident cce="14264-6" />-->
+<!--<ident cce="26444-0" />-->
<!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
<ref nist="AC-4, AC-17, CM-6" />
</Group>
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index a82325d..8f26e56 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -43,7 +43,7 @@ lines in all files in <tt>/etc/modprobe.d</tt> and the deprecated
Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.
</rationale>
-<ident cce="CCE-3562-6" />
+<ident cce="27153-6" />
<oval id="kernel_module_ipv6_option_disabled" />
<ref nist="CM-6, CM-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -136,7 +136,7 @@ operator="equals" interactive="0">
<rationale>
An illicit router advertisement message could result in a man-in-the-middle attack.
</rationale>
-<ident cce="CCE-4269-7" />
+<ident cce="27164-3" />
<oval id="sysctl_net_ipv6_conf_default_accept_ra" />
<ref nist="CM-7" />
</Rule>
@@ -152,7 +152,7 @@ An illicit router advertisement message could result in a man-in-the-middle atta
<rationale>
An illicit ICMP redirect message could result in a man-in-the-middle attack.
</rationale>
-<ident cce="CCE-4313-3" />
+<ident cce="27166-8" />
<oval id="sysctl_net_ipv6_conf_default_accept_redirects" value="sysctl_net_ipv6_conf_default_accept_redirects_value" />
<ref nist="CM-6, CM-7" disa="1551"/>
</Rule>
@@ -185,7 +185,7 @@ hardware over its lifetime using its traffic. If it is important for a system's
IP address to not trivially reveal its hardware address, this setting should be
applied.
</description>
-<ident cce="CCE-3842-2" />
+<ident cce="27154-4" />
<oval id="network_ipv6_privacy_extensions" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -238,13 +238,13 @@ addresses can be assigned to each interface. The default is 16, but it should
be set to exactly the number of statically configured global addresses
required.
</description>
-<ident cce="CCE-4221-8" />
-<ident cce="CCE-4137-6" />
-<ident cce="CCE-4159-0" />
-<ident cce="CCE-3895-0" />
-<ident cce="CCE-4287-9" />
-<ident cce="CCE-4058-4" />
-<ident cce="CCE-4128-5" />
+<ident cce="27163-5" />
+<ident cce="27161-9" />
+<ident cce="27162-7" />
+<ident cce="27157-7" />
+<ident cce="27165-0" />
+<ident cce="27158-5" />
+<ident cce="27160-1" />
<oval id="network_ipv6_limit_requests" />
<ref nist="CM-6, CM-7" />
</Rule>
diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
index 50ebccd..08190ba 100644
--- a/RHEL6/input/system/network/kernel.xml
+++ b/RHEL6/input/system/network/kernel.xml
@@ -22,7 +22,7 @@ of network traffic.</description>
<rationale>Sending ICMP redirects permits the system to instruct other systems
to update their routing information. The ability to send ICMP redirects is
only appropriate for routers.</rationale>
-<ident cce="4151-7" />
+<ident cce="27001-7" />
<oval id="sysctl_net_ipv4_conf_default_send_redirects" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -39,7 +39,7 @@ only appropriate for routers.</rationale>
<rationale>Sending ICMP redirects permits the system to instruct other systems
to update their routing information. The ability to send ICMP redirects is
only appropriate for routers.</rationale>
-<ident cce="4155-8" />
+<ident cce="27004-1" />
<oval id="sysctl_net_ipv4_conf_all_send_redirects" />
<ref nist="CM-6" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -56,7 +56,7 @@ only appropriate for routers.</rationale>
<rationale>IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for routers.</rationale>
-<ident cce="3561-8" />
+<ident cce="26866-4" />
<oval id="sysctl_net_ipv4_ip_forward" />
<ref nist="AC-3, CM-6, CM-7, SC-5" disa="366"/>
<tested by="DS" on="20121024"/>
@@ -207,7 +207,7 @@ operator="equals" interactive="0">
</ocil>
<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
-<ident cce="4236-6" />
+<ident cce="27037-1" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="CM-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -223,7 +223,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
</ocil>
<rationale>Accepting ICMP redirects has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
-<ident cce="4217-6" />
+<ident cce="27027-2" />
<oval id="sysctl_net_ipv4_conf_all_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
<ref nist="CM-7" disa="1503,1551"/>
<tested by="DS" on="20121024"/>
@@ -241,7 +241,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
-<ident cce="3472-8" />
+<ident cce="26854-0" />
<oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
<ref nist="CM-7, AC-4" disa="1503,1551"/>
<tested by="DS" on="20121024"/>
@@ -259,7 +259,7 @@ absolutely required.</rationale>
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
-<ident cce="4320-8" />
+<ident cce="27066-0" />
<oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
<ref nist="CM-7" disa="126"/>
<tested by="DS" on="20121024"/>
@@ -276,7 +276,7 @@ to be detected.</rationale>
</ocil>
<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
-<ident cce="4091-5" />
+<ident cce="26983-7" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -293,7 +293,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
</ocil>
<rationale>This feature of the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
-<ident cce="4186-3" />
+<ident cce="27015-7" />
<oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -311,7 +311,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
-<ident cce="3339-9" />
+<ident cce="26831-8" />
<oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -329,7 +329,7 @@ absolutely required.</rationale>
<rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.
</rationale>
-<ident cce="3644-2" />
+<ident cce="26883-9" />
<oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -346,7 +346,7 @@ addresses makes the system slightly more difficult to enumerate on the network.
</ocil>
<rationale>Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</rationale>
-<ident cce="4133-5" />
+<ident cce="26993-6" />
<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
<tested by="DS" on="20121024"/>
@@ -367,7 +367,7 @@ verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.
</rationale>
-<ident cce="4265-5" />
+<ident cce="27053-8" />
<oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
<ref nist="CM-6, CM-7" disa="1092, 1095" />
<tested by="DS" on="20121024"/>
@@ -386,7 +386,7 @@ that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
-<ident cce="4080-8" />
+<ident cce="26979-5" />
<oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
@@ -405,7 +405,7 @@ that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
-<ident cce="3840-6" />
+<ident cce="26915-9" />
<oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/network/network.xml b/RHEL6/input/system/network/network.xml
index a1d306d..2c775e1 100644
--- a/RHEL6/input/system/network/network.xml
+++ b/RHEL6/input/system/network/network.xml
@@ -47,7 +47,7 @@ scripts add entries to the system's routing table for these addresses. Zeroconf
address assignment commonly occurs when the system is configured to use DHCP
but fails to receive an address assignment from the DHCP server.
</rationale>
-<ident cce="CCE-14054-1" />
+<ident cce="27151-0" />
<oval id="sysconfig_nozeroconf_yes" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -63,7 +63,7 @@ to determine if any interface is running in promiscuous mode:
or wireshark) is likely to be using the interface and this should be
investigated.
</rationale>
-<ident cce="CCE-15013-6" />
+<ident cce="27152-8" />
<oval id="network_sniffer_disabled" />
<ref nist="CM-6, CM-7, MA-3" />
</Rule>
diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
index 8743268..9817bd2 100644
--- a/RHEL6/input/system/network/uncommon.xml
+++ b/RHEL6/input/system/network/uncommon.xml
@@ -27,7 +27,7 @@ streaming media and telephony.
Disabling DCCP protects
the system against exploitation of any flaws in its implementation.
</rationale>
-<ident cce="14268-7" />
+<ident cce="26448-1" />
<oval id="kernel_module_dccp_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
<tested by="DS" on="20121024"/>
@@ -50,7 +50,7 @@ within one connection.
Disabling SCTP protects
the system against exploitation of any flaws in its implementation.
</rationale>
-<ident cce="14132-5" />
+<ident cce="26410-1" />
<oval id="kernel_module_sctp_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
<tested by="DS" on="20121024"/>
@@ -72,7 +72,7 @@ low-latency communications between nodes in a cluster.
Disabling RDS protects
the system against exploitation of any flaws in its implementation.
</rationale>
-<ident cce="14027-7" />
+<ident cce="26239-4" />
<oval id="kernel_module_rds_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
<tested by="DS" on="20121024"/>
@@ -94,7 +94,7 @@ cluster.
Disabling TIPC protects
the system against exploitation of any flaws in its implementation.
</rationale>
-<ident cce="14911-2" />
+<ident cce="26696-5" />
<oval id="kernel_module_tipc_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
index 3246b17..fb07f39 100644
--- a/RHEL6/input/system/network/wireless.xml
+++ b/RHEL6/input/system/network/wireless.xml
@@ -33,7 +33,7 @@ boot.</description>
activation of the wireless interface, generally requiring administrators
to reboot the system first.
</rationale>
-<ident cce="3628-5" />
+<ident cce="26878-9" />
<!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
<ref nist="CM-7" disa="85" />
</Rule>
@@ -63,7 +63,7 @@ interface file from <tt>/etc/sysconfig/network-scripts</tt>:
launch network-based attacks against systems, including those against local LAN
protocols which were not designed with security in mind.
</rationale>
-<ident cce="4276-2" />
+<ident cce="27057-9" />
<oval id="wireless_disable_interfaces" />
<ref nist="CM-7" disa="85" />
<tested by="DS" on="20121025"/>
@@ -81,7 +81,7 @@ an administrator or malware to activate a wireless interface, by introducing
the need to install such a driver first.
</rationale>
<warning category="general">This command must also be repeated every time the kernel is upgraded.</warning>
-<ident cce="4170-7" />
+<ident cce="27009-0" />
<oval id="wireless_disable_drivers" />
<ref nist="CM-7" disa="85" />
</Rule>
@@ -98,7 +98,7 @@ the need to install such a driver first.
connections to Bluetooth devices, which entails some security risk.
Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range.</rationale>
-<ident cce="4355-4" />
+<ident cce="27081-9" />
<oval id="service_bluetooth_disabled" />
<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
<tested by="DS" on="20121025"/>
@@ -120,7 +120,7 @@ install bluetooth /bin/true</pre>
<rationale>If Bluetooth functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</rationale>
-<ident cce="14948-4" />
+<ident cce="26763-3" />
<oval id="kernel_module_bluetooth_disabled" />
<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
<tested by="DS" on="20121025"/>
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 03e1c44..f04432a 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -45,7 +45,7 @@ The output should show either <tt>022</tt> or <tt>027</tt>.
<rationale>The umask influences the permissions assigned to files created by a
process at run time. An unnecessarily permissive umask could result in files
being created with insecure permissions.</rationale>
-<ident cce="4220-0" />
+<ident cce="27031-4" />
<oval id="umask_for_daemons" value="var_umask_for_daemons"/>
<ref nist="AC-3, CM-6"/>
</Rule>
@@ -87,7 +87,7 @@ The output should be:
<rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</rationale>
-<ident cce="4225-9" />
+<ident cce="27033-0" />
<oval id="core_dumps_limitsconf" />
<ref nist="SC-5" />
</Rule>
@@ -102,7 +102,7 @@ sensitive data, as the program itself runs with greater privileges than the
user who initiated execution of the program. Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data.</rationale>
-<ident cce="4247-3" />
+<ident cce="27044-7" />
<oval id="core_dump_suid_progs_limits_conf" />
<ref nist="SI-11" />
</Rule>
@@ -130,7 +130,7 @@ control where code can be executed, on a per-process basis. When
the kernel places a process's memory regions such as the stack and
heap higher than this address, the hardware prevents execution in that
address range.</rationale>
-<ident cce="4168-1" />
+<ident cce="27007-4" />
<oval id="sysctl_kernel_exec_shield" />
<ref nist="CM-7" />
<tested by="DS" on="20121024"/>
@@ -146,7 +146,7 @@ into a process's address space during an attempt at exploitation. Additionally,
makes it more difficult for an attacker to know the location of existing code
in order to re-purpose it using return oriented programming (ROP) techniques.
</rationale>
-<ident cce="4146-7" />
+<ident cce="26999-3" />
<oval id="sysctl_kernel_randomize_va_space" />
<ref nist="AC-3, CM-6" />
<tested by="DS" on="20121024"/>
@@ -186,7 +186,7 @@ installed on older systems that do not support the XD or NX bit, as
this may prevent them from booting.</warning>
<rationale>On 32-bit systems that support the XD or NX bit, the vendor-supplied
PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.</rationale>
-<ident cce="4172-3" />
+<ident cce="27010-8" />
<ref nist="CM-7" />
</Rule>
@@ -198,7 +198,7 @@ under a Security section. Look for Execute Disable (XD) on Intel-based systems a
on AMD-based systems.</description>
<rationale>Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
allow users to turn the feature on or off at will.</rationale>
-<ident cce="4177-2" />
+<ident cce="27012-4" />
<ref nist="CM-6" />
</Rule>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 8453eff..d9940aa 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -26,7 +26,7 @@ system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
-<ident cce="3918-0" />
+<ident cce="26947-2" />
<oval id="file_owner_etc_shadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -38,7 +38,7 @@ which could weaken the system security posture.</rationale>
<ocil><filegroupowner-check-macro file="/etc/shadow" group="root"/></ocil>
<rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
critical for system security.</rationale>
-<ident cce="3988-3" />
+<ident cce="26967-0" />
<oval id="file_groupowner_etc_shadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -53,7 +53,7 @@ system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
-<ident cce="4130-1" />
+<ident cce="26992-8" />
<oval id="file_permissions_etc_shadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -65,7 +65,7 @@ which could weaken the system security posture.</rationale>
<ocil><fileowner-check-macro file="/etc/group" owner="root"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
-<ident cce="3276-3" />
+<ident cce="26822-7" />
<oval id="file_owner_etc_group" />
<ref nist="AC-3, CM-6"/>
<tested by="DS" on="20121026"/>
@@ -77,7 +77,7 @@ on the system. Protection of this file is important for system security.</ration
<ocil><filegroupowner-check-macro file="/etc/group" group="root"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
-<ident cce="3883-6" />
+<ident cce="26930-8" />
<oval id="file_groupowner_etc_group" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -89,7 +89,7 @@ on the system. Protection of this file is important for system security.</ration
<ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
-<ident cce="3967-7" />
+<ident cce="26954-8" />
<oval id="file_permissions_etc_group" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -101,7 +101,7 @@ on the system. Protection of this file is important for system security.</ration
<ocil><fileowner-check-macro file="/etc/gshadow" owner="root"/></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
-<ident cce="4210-1" />
+<ident cce="27026-4" />
<oval id="file_owner_etc_gshadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -113,7 +113,7 @@ is critical for system security.</rationale>
<ocil><filegroupowner-check-macro file="/etc/gshadow" group="root"/></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
-<ident cce="4064-2" />
+<ident cce="26975-3" />
<oval id="file_groupowner_etc_gshadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -125,7 +125,7 @@ is critical for system security.</rationale>
<ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security.</rationale>
-<ident cce="3932-1" />
+<ident cce="26951-4" />
<oval id="file_permissions_etc_gshadow" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -137,7 +137,7 @@ is critical for system security.</rationale>
<ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil>
<rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
-<ident cce="3958-6" />
+<ident cce="26953-0" />
<oval id="file_owner_etc_passwd" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -149,7 +149,7 @@ the system. Protection of this file is critical for system security.</rationale>
<ocil><filegroupowner-check-macro file="/etc/passwd" group="root"/></ocil>
<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
-<ident cce="3495-9" />
+<ident cce="26856-5" />
<oval id="file_groupowner_etc_passwd" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -163,7 +163,7 @@ the system. Protection of this file is critical for system security.</rationale>
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</rationale>
-<ident cce="3566-7" />
+<ident cce="26868-0" />
<oval id="file_permissions_etc_passwd" />
<ref nist="AC-3, CM-6" disa="225"/>
<tested by="DS" on="20121026"/>
@@ -330,7 +330,7 @@ or those designed to be temporary file repositories. The setting is normally re
used by the system, and by users for temporary file storage - such as /tmp -
and for directories requiring global read/write access.
</rationale>
-<ident cce="3399-3" />
+<ident cce="26840-9" />
<oval id="dir_perms_world_writable_sticky_bits" />
<ref nist="CM-6"/>
<tested by="swells" on="20120929"/>
@@ -354,7 +354,7 @@ user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk
caused by world-writable files.</rationale>
-<ident cce="3795-2" />
+<ident cce="26910-0" />
<ref nist="CM-6"/>
</Rule>
@@ -374,7 +374,7 @@ To find world-writable files, run the following command:
the owner of the file. SGID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</rationale>
-<ident cce="14970-8" />
+<ident cce="26769-0" />
<oval id="file_permissions_unauthorized_sgid" />
<ref nist="CM-6"/>
</Rule>
@@ -395,7 +395,7 @@ To find world-writable files, run the following command:
the owner of the file. SUID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</rationale>
-<ident cce="14340-4" />
+<ident cce="26497-8" />
<oval id="file_permissions_unauthorized_suid" />
<ref nist="AC-3, CM-6"/>
</Rule>
@@ -423,7 +423,7 @@ to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.
</rationale>
-<ident cce="4223-4" />
+<ident cce="27032-2" />
<oval id="file_permissions_unowned" />
<ref nist="AC-3, CM-6" disa="224"/>
</Rule>
@@ -450,7 +450,7 @@ to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.
</rationale>
-<ident cce="3573-3" />
+<ident cce="26872-2" />
<oval id="file_permissions_ungroupowned" />
<ref nist="AC-3, CM-6" disa="224"/>
</Rule>
@@ -476,7 +476,7 @@ undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.
</rationale>
-<ident cce="14794-2" />
+<ident cce="26642-9" />
<oval id="dir_perms_world_writable_system_owned" />
<ref nist="AC-3, CM-6"/>
<tested by="swells" on="20120929"/>
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 5c60da7..c1b0618 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -34,7 +34,7 @@ and xdm. If this user is the first to log into the physical console
variety of devices normally belong to root. Administrative privileges should be
limited for non-root users. Review the man page for <tt>pam_console</tt> for
more information</rationale>
-<ident cce="3685-5" />
+<ident cce="27192-4" />
<oval id="console_device_restrict_access_desktop" />
<ref nist="AC-6, CM-6, CM-7" />
</Rule>
@@ -53,7 +53,7 @@ and xdm. If this user is the first to log into the physical console
variety of devices normally belong to root. Administrative privileges should be
limited for non-root users. Review the man page for <tt>pam_console</tt> for
more information</rationale>
-<ident cce="3685-5" />
+<ident cce="26892-0" />
<oval id="console_device_restrict_access_server" />
<ref nist="AC-6, CM-6, CM-7" />
</Rule>
@@ -73,7 +73,7 @@ module, but will not prevent an administrator (or another program) from using th
<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized
software and other vulnerabilities. Support for these devices should be disabled and
the devices themselves should be tightly controlled.</rationale>
-<ident cce="4187-1" />
+<ident cce="27016-5" />
<oval id="kernel_module_usb-storage_disabled" />
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -95,7 +95,7 @@ will need to be repeated every time the kernel is updated.</description>
<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized
software and other vulnerabilities. Support for these devices should be disabled and
the devices themselves should be tightly controlled.</rationale>
-<ident cce="4006-3" />
+<ident cce="26970-4" />
<oval id="kernel_module_usb-storage_removed" />
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -114,7 +114,7 @@ mice, or printers. This guidance is inappropriate for systems which require USB
<rationale>Disabling the USB subsystem within the Linux kernel at system boot will also
disable USB storage devices if they are plugged into the system. Support for these devices
should be disabled and the devices themselves should be tightly controlled.</rationale>
-<ident cce="4173-1" />
+<ident cce="27011-6" />
<oval id="bootloader_nousb_argument" />
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -129,7 +129,7 @@ the section titled "Set BIOS Password" to prevent unauthorized configuration cha
<rationale>Booting a system from a USB device would allow an attacker to circumvent
any security measures offered by the native OS. Attackers could mount partitions and modify the
configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale>
-<ident cce="3944-6" />
+<ident cce="26952-2" />
<!-- <oval id="bios_disable_usb_boot" /> -->
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -157,7 +157,7 @@ If properly configured, the output should be the following:
<rationale>All filesystems that are required for the successful operation of the system
should be explicitly listed in /etc/fstab by and administrator. New filesystems should
not be arbitrarily introduced via the automounter.</rationale>
-<ident cce="4072-5" />
+<ident cce="26976-1" />
<oval id="service_autofs_disabled" />
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -186,7 +186,7 @@ policy. Disabling USB storage as described in the USB section will prevent the u
this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and
DVDs.
</rationale>
-<ident cce="4231-7" />
+<ident cce="27035-5" />
<oval id="gconf_gnome_disable_automount" />
<ref nist="CM-6, CM-7" disa="1250,85" />
</Rule>
@@ -199,7 +199,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14089-7" />
+<ident cce="26340-0" />
<oval id="kernel_module_cramfs_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -212,7 +212,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14457-6" />
+<ident cce="26544-7" />
<oval id="kernel_module_freevxfs_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -225,7 +225,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14853-6" />
+<ident cce="26670-0" />
<oval id="kernel_module_jffs2_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -238,7 +238,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="15087-0" />
+<ident cce="26800-3" />
<oval id="kernel_module_hfs_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -251,7 +251,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14093-9" />
+<ident cce="26361-6" />
<oval id="kernel_module_hfsplus_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -264,7 +264,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14118-4" />
+<ident cce="26404-4" />
<oval id="kernel_module_squashfs_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -277,7 +277,7 @@ This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
-<ident cce="14871-8" />
+<ident cce="26677-5" />
<oval id="kernel_module_udf_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 8dd7720..10d4ea1 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -28,7 +28,7 @@ interpreted as character or block devices. The only legitimate location
for device files is the /dev directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set <tt>nodev</tt> on these filesystems.</rationale>
-<ident cce="4249-9" />
+<ident cce="27045-4" />
<oval id="mount_option_nodev_nonroot_local_partitions" />
<ref nist="CM-6, CM-7, AC-6"/>
</Rule>
@@ -46,7 +46,7 @@ jails built for system services.
located on the root partition. An exception to this is chroot jails, and it is
not advised to set <tt>nodev</tt> on partitions which contain their root
filesystems. </rationale>
-<ident cce="3522-0" />
+<ident cce="26860-7" />
<oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -69,7 +69,7 @@ To verify that binaries cannot be directly executed from removable media, run th
<pre># grep noexec /etc/fstab</pre>
The output should show <tt>noexec</tt> in use.
</ocil>
-<ident cce="4275-4" />
+<ident cce="27196-5" />
<oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
<ref nist="CM-7, MP-2" disa="87" />
</Rule>
@@ -87,7 +87,7 @@ files into the system via partitions mounted from removeable media.
<rationale>The presence of suid and sgid executables should be tightly controlled. Users
should not be able to execute suid or sgid binaries from partitions mounted off of
removable media.</rationale>
-<ident cce="4275-4" />
+<ident cce="27056-1" />
<oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -103,7 +103,7 @@ within temporary directories like <tt>/tmp</tt>.
</description>
<rationale>The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails.</rationale>
-<ident cce="14412-1" />
+<ident cce="26499-4" />
<oval id="mount_option_tmp_nodev" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -117,7 +117,7 @@ from being executed out of <tt>/tmp</tt>.
<rationale>Allowing users to execute binaries from world-writeable directories
such as <tt>/tmp</tt> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
-<ident cce="14927-8" />
+<ident cce="26720-3" />
<oval id="mount_option_tmp_noexec" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -131,7 +131,7 @@ should not be required in these world-writeable directories.
</description>
<rationale>The presence of suid and sgid executables should be tightly controlled. Users
should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
-<ident cce="14940-1" />
+<ident cce="26762-5" />
<oval id="mount_option_tmp_nosuid" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -146,7 +146,7 @@ within temporary directories like <tt>/dev/shm</tt>.
</description>
<rationale>The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails.</rationale>
-<ident cce="15007-8" />
+<ident cce="26778-1" />
<oval id="mount_option_dev_shm_nodev" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -161,7 +161,7 @@ from world-writeable temporary storage directories such as <tt>/dev/shm</tt>.
</description>
<rationale>Allowing users to execute binaries from world-writeable directories
such as /dev/shm can expose the system to potential compromise.</rationale>
-<ident cce="14703-3" />
+<ident cce="26622-1" />
<oval id="mount_option_dev_shm_noexec" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -175,7 +175,7 @@ be required in these world-writeable directories.
</description>
<rationale>The presence of suid and sgid executables should be tightly controlled. Users
should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
-<ident cce="14306-5" />
+<ident cce="26486-1" />
<oval id="mount_option_dev_shm_nosuid" />
<ref nist="CM-7, MP-2"/>
</Rule>
@@ -192,7 +192,7 @@ See the mount(8) man page for further explanation of bind mounting.
<rationale>Having multiple locations for temporary storage is not required. Unless absolutely
necessary to meet requirements, the storage location /var/tmp should be bind mounted to
/tmp and thus share the same protections.</rationale>
-<ident cce="14584-7" />
+<ident cce="26582-7" />
<oval id="mount_option_var_tmp_bind" />
<ref nist="CM-6"/>
</Rule>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 543f3a9..c1f85a8 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -98,7 +98,7 @@ Disabling a major host protection feature, such as SELinux, at boot time prevent
it from confining system services at boot time. Further, it increases
the chances that it will remain off during system operation.
</rationale>
-<ident cce="3977-6" />
+<ident cce="26956-3" />
<oval id="selinux_bootloader_notdisabled" />
<ref nist="AC-3, CM-6" disa="22,32"/>
<tested by="DS" on="20121024"/>
@@ -121,7 +121,7 @@ potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.
</rationale>
-<ident cce="3999-0" />
+<ident cce="26969-6" />
<oval id="selinux_mode" value="var_selinux_state_name"/>
<ref nist="CM-6, CM-7" disa="22,32,26"/>
<tested by="DS" on="20121024"/>
@@ -147,7 +147,7 @@ Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
</rationale>
-<ident cce="3624-4" />
+<ident cce="26875-5" />
<oval id="selinux_policytype" value="var_selinux_policy_name"/>
<ref nist="CM-6, CM-7" disa="22,32"/>
<tested by="DS" on="20121024"/>
@@ -166,7 +166,7 @@ security context.
<rationale>The <tt>restorecond</tt> service helps ensure that the default SELinux
file context is applied to files. This allows automatic correction
of file contexts created by some programs.</rationale>
-<ident cce="4129-3" />
+<ident cce="26991-0" />
<oval id="service_restorecond_enabled" />
<ref nist="AC-3, CM-6" />
</Rule>
@@ -201,7 +201,7 @@ which use category labelling.</description>
<Rule id="disable_mcstransd">
<title>Disable mcstrans Service</title>
<description>The MCS Translation Service (mcstrans) should be disabled.</description>
-<ident cce="3668-1" />
+<ident cce="26891-2" />
<oval id="service_mcstrans_disabled" />
<ref nist="CM-6, CM-7" />
</Rule>
@@ -242,7 +242,7 @@ It should produce no output in a well-configured system.</ocil>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
cannot properly restrict access to the device file.
</rationale>
-<ident cce="14991-4" />
+<ident cce="26774-0" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="CM-6, CM-7" disa="22,32"/>
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index 932e6e8..6af7172 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -37,7 +37,7 @@ The <tt>/tmp</tt> partition is used as temporary storage by many programs.
Placing <tt>/tmp</tt> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.
</rationale>
-<ident cce="14161-4"/>
+<ident cce="26435-8"/>
<oval id="mount_tmp_own_partition" />
<ref nist="CM-6" disa="1208"/>
<tested by="MM" on="20120928"/>
@@ -57,7 +57,7 @@ system services such as daemons or other programs which use it.
It is not uncommon for the <tt>/var</tt> directory to contain
world-writable directories, installed by other software packages.
</rationale>
-<ident cce="14777-7"/>
+<ident cce="26639-5"/>
<oval id="mount_var_own_partition" />
<ref nist="CM-6" disa="1208"/>
<tested by="MM" on="20120928"/>
@@ -76,7 +76,7 @@ Placing <tt>/var/log</tt> in its own partition
enables better separation between log files
and other files in <tt>/var/</tt>.
</rationale>
-<ident cce="14011-1" />
+<ident cce="26215-4" />
<oval id="mount_var_log_own_partition" />
<ref nist="CM-6, AU-9" disa="1208"/>
<tested by="MM" on="20120928"/>
@@ -98,7 +98,7 @@ and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.
</rationale>
-<ident cce="14171-3" />
+<ident cce="26436-6" />
<oval id="mount_var_log_audit_own_partition" />
<ref nist="CM-6, AU-9" disa="137,138,1208"/>
<tested by="MM" on="20120928"/>
@@ -119,7 +119,7 @@ Ensuring that <tt>/home</tt> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.
</rationale>
-<ident cce="14559-9" />
+<ident cce="26557-9" />
<oval id="mount_home_own_partition" />
<ref nist="CM-6" disa="1208"/>
<tested by="MM" on="20120928"/>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index bc96e7d..6104100 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -37,7 +37,7 @@ Install the AIDE package with the command:
<rationale>
The AIDE package must be installed if it is to be available for integrity checking.
</rationale>
-<ident cce="4209-3" />
+<ident cce="27024-9" />
<oval id="package_aide_installed" />
<ref nist="CM-6, CM-7, SC-28, SI-7" disa="1069"/>
<tested by="DS" on="20121024"/>
@@ -159,7 +159,7 @@ Permissions on system binaries and configuration files that are too generous
could allow an unauthorized user to gain privileges that they should not have.
The permissions set by the vendor should be maintained. Any deviations from
this baseline should be investigated.</rationale>
-<ident cce="14931-0" />
+<ident cce="26731-0" />
<oval id="rpm_verify_permissions" />
<ref nist="SI-7" disa="1493,1494,1495" />
</Rule>
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 2bd9fa4..1c26f58 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -36,7 +36,7 @@ The command should return the string below:
This key is necessary to cryptographically verify packages
are from Red Hat.
</rationale>
-<ident cce="14440-2"/>
+<ident cce="26506-6"/>
<oval id="package_red_hat_gpgkeys_installed" />
<ref nist="SI-2, SI-7, SC-13" disa="351"/>
<tested by="MM" on="20120928"/>
@@ -68,7 +68,7 @@ Ensuring the validity of packages' cryptographic signatures prior to
installation ensures the provenance of the software and
protects against malicious tampering.
</rationale>
-<ident cce="14914-6" />
+<ident cce="26709-6" />
<oval id="yum_gpgcheck_global_activation" />
<ref nist="SI-2" disa="352,663" />
<tested by="MM" on="20120928"/>
@@ -93,7 +93,7 @@ Ensuring all packages' cryptographic signatures are valid prior to
installation ensures the provenance of the software and
protects against malicious tampering.
</rationale>
-<ident cce="14813-0" />
+<ident cce="26647-8" />
<oval id="yum_gpgcheck_never_disabled" />
<ref nist="SI-2" disa="352,663"/>
<tested by="MM" on="20120928"/>
--
1.7.1
10 years, 11 months
[PATCH 0/2] improvements to account lockout Rules
by Jeffrey Blank
Thanks to DISA FSO for this patch.
Jeffrey Blank (2):
adding additional, granular account lockout Rules
adding additional lockout Rules to STIG profile
RHEL6/input/auxiliary/alt-titles-stig.xml | 6 ++
RHEL6/input/profiles/stig-rhel6-server.xml | 7 +++
RHEL6/input/system/accounts/pam.xml | 81 ++++++++++++++++++++++++++--
3 files changed, 89 insertions(+), 5 deletions(-)
10 years, 11 months
[PATCH 0/2] handling update process requirement, ref update
by Jeffrey Blank
Thanks to Michele for this patch; this helps with SRG-OS-000190
viewable in table-stig-rhel6-server-flat-srgs.html
Jeffrey Blank (2):
language requiring establishment of automatic/regular updates per SRG
adding ref to ip6tables to stay in sync with iptables
RHEL6/input/auxiliary/srg_support.xml | 17 +++++++++++++++++
RHEL6/input/system/network/iptables.xml | 2 +-
2 files changed, 18 insertions(+), 1 deletions(-)
10 years, 11 months
[PATCH 0/4] SRG reference fixups, new Rules for acct expiration
by Jeffrey Blank
This continues the effort to document how the guidance or
product satisfies (or does not satisfy) requirements from the OS SRG.
Thanks to DISA FSO for this feedback/patches.
Jeffrey Blank (4):
improved checks and text so that unlabeled devices are recursively
sought
added new Rule for temporary account expiration, also to stig profile
SRG mapping fixups per FSO, new alt-titles
minor wording tweaks to account expiration, for consistency
RHEL6/input/auxiliary/alt-titles-stig.xml | 5 +++-
RHEL6/input/auxiliary/srg_support.xml | 2 +-
.../checks/selinux_all_devicefiles_labeled.xml | 1 +
RHEL6/input/profiles/stig-rhel6-server.xml | 1 +
.../accounts/restrictions/account_expiration.xml | 29 ++++++++++++++++++-
RHEL6/input/system/network/iptables.xml | 2 +-
RHEL6/input/system/selinux.xml | 2 +-
7 files changed, 36 insertions(+), 6 deletions(-)
10 years, 11 months
[PATCH 0/2] punctuation fixes and changed rule text
by David Smith
Here we have a fix for Ticket #49, the guidance now calls for using the "screen" package
instead of "vlock" for console locking. References to installation of vlock were edited
to reflect the change - both in the applicable profiles and the alt-titles-stig file.
David Smith (2):
changed periods back to colons, where appropriate
changed rule to use "screen" instead of "vlock"
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/manual_remediation.xml | 2 +-
RHEL6/input/services/ldap.xml | 46 +++++++++++++-------------
RHEL6/input/services/mail.xml | 28 ++++++++--------
RHEL6/input/services/ntp.xml | 4 +-
RHEL6/input/services/obsolete.xml | 10 +++---
RHEL6/input/system/accounts/physical.xml | 28 +++++++---------
8 files changed, 59 insertions(+), 63 deletions(-)
10 years, 11 months
[PATCH] bugfix for dropped SRG rows
by Jeffrey Blank
This has already been pushed, as it's a bugfix.
Jeffrey Blank (1):
bugfix for dropping SRGs (lacking Rules which reference them) from
flat table output
RHEL6/transforms/shorthand2xccdf.xslt | 2 +-
RHEL6/transforms/table-srgmap.xslt | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
10 years, 11 months