[PATCH 1/1] Corrected Dovecot content and OVAL checks for version 2 relevancy.
by Willy Santos
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
.../checks/dovecot_disable_plaintext_auth.xml | 4 +-
rhel6/src/input/checks/dovecot_enable_ssl.xml | 28 ++++
.../checks/dovecot_login_process_per_conn_yes.xml | 28 ----
.../dovecot_mail_drop_priv_before_exec_yes.xml | 28 ----
rhel6/src/input/services/imap.xml | 130
++++++++------------
5 files changed, 81 insertions(+), 137 deletions(-)
create mode 100644 rhel6/src/input/checks/dovecot_enable_ssl.xml
delete mode 100644
rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
delete mode 100644
rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
diff --git a/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
index ecc4795..e755ce4 100644
--- a/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
+++ b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
@@ -20,8 +20,8 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_dovecot_disable_plaintext_auth"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>dovecot.conf</ind:filename>
+ <ind:path>/etc/dovecot/conf.d</ind:path>
+ <ind:filename>10-auth.conf</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
diff --git a/rhel6/src/input/checks/dovecot_enable_ssl.xml
b/rhel6/src/input/checks/dovecot_enable_ssl.xml
new file mode 100644
index 0000000..8a9c62c
--- /dev/null
+++ b/rhel6/src/input/checks/dovecot_enable_ssl.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <definition class="compliance"
+ id="dovecot_enable_ssl" version="1">
+ <metadata>
+ <title>Enable SSL in Dovecot</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <!-- <reference ref_id="CCE:TODO" source="CCE" /> -->
+ <description>SSL capabilities should be enabled for the mail
server.</description>
+ </metadata>
+ <criteria comment="Enable SSL in Dovecot">
+ <criterion test_ref="test_dovecot_enable_ssl" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Tests the value of the ssl[\s]*(<:nocomment:>*)
setting in the /etc/dovecot.conf file"
+ id="test_dovecot_enable_ssl" version="1">
+ <ind:object object_ref="obj_dovecot_enable_ssl" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_dovecot_enable_ssl"
+ version="1">
+ <ind:path>/etc/dovecot/conf.d</ind:path>
+ <ind:filename>10-ssl.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]*ssl[\s]*=[\s]*yes\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git
a/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
b/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
deleted file mode 100644
index d1569ea..0000000
--- a/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="dovecot_login_process_per_conn_yes" version="1">
- <metadata>
- <title>Enable login_process_per_connection in Dovecot</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="CCE-4410-7" source="CCE" />
- <description>login_process_per_connection should be
enabled.</description>
- </metadata>
- <criteria comment="Enable login_process_per_connection in Dovecot">
- <criterion test_ref="test_dovecot_login_process_per_conn_yes" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Tests the value of the
login_process_per_connection[\s]*(<:nocomment:>*) setting in the
/etc/dovecot.conf file"
- id="test_dovecot_login_process_per_conn_yes" version="1">
- <ind:object object_ref="obj_dovecot_login_process_per_conn_yes" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_dovecot_login_process_per_conn_yes"
- version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>dovecot.conf</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*login_process_per_connection[\s]*=[\s]*yes\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git
a/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
b/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
deleted file mode 100644
index edb721a..0000000
--- a/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="dovecot_mail_drop_priv_before_exec_yes" version="1">
- <metadata>
- <title>Enable login_process_per_connection in Dovecot</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="CCE-4410-7" source="CCE" />
- <description>login_process_per_connection should be
enabled.</description>
- </metadata>
- <criteria comment="Enable login_process_per_connection in Dovecot">
- <criterion test_ref="test_dovecot_mail_drop_priv_before_exec_yes" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Tests the value of the
mail_drop_priv_before_exec[\s]*(<:nocomment:>*) setting in the
/etc/dovecot.conf file"
- id="test_dovecot_mail_drop_priv_before_exec_yes" version="1">
- <ind:object object_ref="obj_dovecot_mail_drop_priv_before_exec_yes" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_dovecot_mail_drop_priv_before_exec_yes"
- version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>dovecot.conf</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*mail_drop_priv_before_exec[\s]*=[\s]*yes\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/rhel6/src/input/services/imap.xml
b/rhel6/src/input/services/imap.xml
index cb6c644..96a43a9 100644
--- a/rhel6/src/input/services/imap.xml
+++ b/rhel6/src/input/services/imap.xml
@@ -53,7 +53,7 @@ the recommendations below.
<title>Support Only the Necessary Protocols</title>
<description>Dovecot supports the IMAP and POP3 protocols, as well as
SSL-protected versions of those protocols. Configure the Dovecot
server -to support only the protocols needed by your site. Edit
<tt>/etc/dovecot.conf</tt>. +to support only the protocols needed by
your site. Edit <tt>/etc/dovecot/dovecot.conf</tt>. Add or correct the
following lines, replacing <tt>PROTOCOL</tt> with only the subset of
protocols (<tt>imap</tt>, <tt>imaps</tt>, <tt>pop3</tt>,
<tt>pop3s</tt>) required:
@@ -76,7 +76,7 @@ to base an attack.</rationale>
<!-- <oval id="dovecot_support_necessary_protocols" /> -->
</Rule>
-<Group id="dovecot_enable_ssl">
+<Group id="dovecot_enabling_ssl">
<title>Enable SSL Support</title>
<description>SSL should be used to encrypt network traffic between the
Dovecot server and its clients. Users must authenticate to the Dovecot
@@ -87,17 +87,33 @@ to authenticate the server, preventing another
system from impersonating
the server.
</description>
+<Rule id="dovecot_enable_ssl">
+<title>Enable the SSL flag in <tt>/etc/dovecot.conf</tt></title>
+<description>To allow clients to make encrypted connections the
<tt>ssl</tt>
+flag in Dovecot's configuration file needs to be set to <tt>yes</tt>.
+<br /><br />
+Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following line:
+<pre>ssl = yes</pre>
+</description>
+<rationale>
+SSL encrypt network traffic between the Dovecot server and its clients
+protecting user credentials, mail as it is downloaded, and clients may
use +SSL certificates to authenticate the server, preventing another
system from +impersonating the server.
+</rationale>
+<!-- <ident cce="4239-0" /> -->
+<oval id="dovecot_enable_ssl" />
+</Rule>
+
<Rule id="dovecot_configure_ssl_cert">
-<title>Configure Dovecot to Use the SSL Certificate</title>
-<description>These options tell Dovecot where to find the TLS
-configuration, allowing clients to make encrypted connections.
+<title>Configure Dovecot to Use the SSL Certificate file</title>
+<description>This option tell Dovecot where to find the the mail
+server's SSL Certificate.
<br /><br />
-Edit <tt>/etc/dovecot.conf</tt> and add or correct the following -lines
(ensuring they reference the appropriate files):
-<pre>ssl_cert_file = /etc/pki/tls/imap/servercert.pem
-ssl_key_file = /etc/pki/tls/imap/serverkey.pem
-ssl_ca_file = /etc/pki/tls/CA/cacert.pem
-</pre>
+Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following +line. The path below is the default path set by the Dovecot
installation. If +you are using a different path, ensure you reference
the appropriate file:
+<pre>ssl_cert = </etc/pki/dovecot/certs/dovecot.pem</pre>
</description>
<rationale>
SSL certificates are used by the client to authenticate the identity
@@ -106,14 +122,35 @@ Not using SSL to encrypt mail server traffic could
allow unauthorized
access to credentials and mail messages since they are sent in plain
text over the network.
</rationale>
-<!-- <ident cce="4239-0" /> -->
+<!-- <ident cce="CCD:TODO" /> -->
<!-- <oval id="dovecot_configure_ssl_cert" /> -->
</Rule>
+<Rule id="dovecot_configure_ssl_key">
+<title>Configure Dovecot to Use the SSL Key file</title>
+<description>This option tell Dovecot where to find the the mail
+server's SSL Key.
+<br /><br />
+Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following +line. The path below is the default path set by the Dovecot
installation. If +you are using a different path, ensure you reference
the appropriate file:
+<pre>ssl_key = </etc/pki/dovecot/private/dovecot.pem</pre>
+</description>
+<rationale>
+SSL certificates are used by the client to authenticate the identity
+of the server, as well as to encrypt credentials and message traffic.
+Not using SSL to encrypt mail server traffic could allow unauthorized
+access to credentials and mail messages since they are sent in plain
+text over the network.
+</rationale>
+<!-- <ident cce="CCE:TODO" /> -->
+<!-- <oval id="dovecot_configure_ssl_key" /> -->
+</Rule>
+
<Rule id="dovecot_disable_plaintext_auth">
<title>Disable Plaintext Authentication</title>
<description>To prevent Dovecot from attempting plaintext
-authentication of clients, edit <tt>/etc/dovecot.conf</tt> and add
+authentication of clients, edit
<tt>/etc/dovecot/conf.d/10-auth.conf</tt> and add
or correct the following line:
<pre>disable_plaintext_auth = yes</pre>
</description>
@@ -125,72 +162,7 @@ attacker access to credentials by monitoring
network traffic.
<oval id="dovecot_disable_plaintext_auth" />
</Rule>
-</Group> <!-- <Group id="dovecot_enable_ssl" -->
-
-<Group id="dovecot_enable_code_flaw_protect">
-<title>Enable Dovecot Options to Protect Against Code Flaws</title>
-<description>IMAP and POP3 are remote authenticated protocols, meaning
that -the server must accept remote connections from anyone, but provide
substantial -services only to clients who have successfully
authenticated. To protect -against security problems, Dovecot splits
these functions into separate -server processes. The <tt>imap-login</tt>
and/or <tt>pop3-login</tt> -processes accept connections from
unauthenticated users, and only spawn -<tt>imap</tt> or <tt>pop3</tt>
processes on successful authentication.
-<br /><br />
-However, the <tt>imap-login</tt> and <tt>pop3-login</tt> processes
-themselves may contain vulnerabilities. Since each of these processes
-operates as a daemon, handling multiple sequential client connections
-from different users, bugs in the code could allow unauthenticated
users -to steal credential data. If the
<tt>login_process_per_connection</tt> option -is enabled, then a
separate <tt>imap-login</tt> or <tt>pop3-login</tt> -process is created
for each new connection, protecting against this class -of problems.
This option has an efficiency cost, but is strongly recommended.
-<br /><br />
-If the <tt>mail_drop_priv_before_exec</tt> option is on, the
<tt>imap-login</tt> -or <tt>pop3-login</tt> process will drop privileges
to the user’s ID after -authentication and before executing the
<tt>imap</tt> or <tt>pop3</tt> -process itself. Under some very limited
circumstances, this could protect -against privilege escalation by
authenticated users. However, if the -mail executable option is used to
run code before starting each user’s session, -it is important to drop
privileges to prevent the custom code from running as root.
-</description>
-
-<Rule id="dovecot_login_process_per_conn_yes">
-<title>login_process_per_connection set to yes</title>
-<description>Setting <tt>login_process_per_connection = yes</tt>, prevents
-possible bugs in the code from allowing unauthenticated users to steal
-credential data when handling multiple sequential client connections
-from different users by creating a separate <tt>imap-login</tt> or
-<tt>pop3-login</tt> process for each new connection.
-<br /><br />
-Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line:
-<pre>login_process_per_connection = yes</pre>
-</description>
-<rationale>
-This setting could protect against an attacker trying to exploit a bug in
-the dovecot code.</rationale>
-<ident cce="4410-7" />
-<oval id="dovecot_login_process_per_conn_yes" />
-</Rule>
-
-<Rule id="dovecot_mail_drop_priv_before_exec_yes">
-<title>mail_drop_priv_before_exec set to yes</title>
-<description>Setting <tt>mail_drop_priv_before_exec = yes</tt>, causes
-the <tt>imap-login</tt> or <tt>pop3-login</tt> process will drop
-privileges to the user’s ID after authentication and before executing
-the <tt>imap</tt> or <tt>pop3</tt> process itself.
-<br /><br />
-Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line:
-<pre>mail_drop_priv_before_exec = yes</pre>
-</description>
-<rationale>
-This setting could protect against privilege escalation by authenticated
-users.</rationale>
-<ident cce="4371-1" />
-<oval id="dovecot_mail_drop_priv_before_exec_yes" />
-</Rule>
-
-</Group> <!-- <Group id="dovecot_enable_code_flaw_protect"> -->
+</Group> <!-- <Group id="dovecot_enabing_ssl" -->
<Group id="dovecot_allow_imap_access">
<title>Allow IMAP Clients to Access the Server</title>
--
1.7.7.6
11 years, 10 months
[PATCH v2 0/2] M1 Incomplete Guidance - Tickets #23, 26
by Mike Palmiotto
Here are the revisions to previous patches for Tickets #23,26.
Michael Palmiotto (1):
M1 Incomplete Guidance - Account and Access Control
Mike Palmiotto (1):
M1 Incomplete Guidance - Logging and Auditing
.../checks/accounts_disabled_after_expiration.xml | 24 ++++
...counts_login_shell_timeout_implemented_bash.xml | 45 ++++++++
...counts_login_shell_timeout_implemented_tcsh.xml | 25 +++++
.../input/checks/accounts_netrc_files_checked.xml | 25 +++++
.../accounts_user_dot_files_not_world_writable.xml | 33 ++++++
.../checks/audit_rules_logon_modification.xml | 34 ++++++
.../checks/audit_rules_session_modification.xml | 47 ++++++++
.../checks/libuser_login_defs_userdefaults.xml | 50 +++++++++
.../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++
.../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++
rhel6/src/input/profiles/common.xml | 42 +++++++-
rhel6/src/input/system/accounts/accounts.xml | 27 +++++
rhel6/src/input/system/accounts/pam.xml | 38 +++++++-
rhel6/src/input/system/accounts/physical.xml | 63 +++++++++++
.../system/accounts/restrictions/restrictions.xml | 114 ++++++++++++++++++++
rhel6/src/input/system/accounts/session.xml | 24 ++++
rhel6/src/input/system/auditing.xml | 77 +++++++++++++-
rhel6/src/input/system/logging.xml | 67 ++++++++++++
18 files changed, 873 insertions(+), 3 deletions(-)
create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
--
1.7.6.5
11 years, 10 months
[PATCH] transforms to handle CCIs as refs not idents
by Jeffrey Blank
This will require a quick change of the existing and significant CCIs as idents,
which I will coordinate with Willy and Shawn. Again, my goof on originally
keeping them as idents...
Jeffrey Blank (1):
changed major transforms to handle CCIs as references instead of
idents
rhel6/src/transforms/constants.xslt | 4 +-
rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++----------
rhel6/src/transforms/table-srgmap.xslt | 22 +++++++--
3 files changed, 68 insertions(+), 33 deletions(-)
11 years, 10 months
[PATCH] converted CCIs, fixed validation problems
by Jeffrey Blank
This may break some transforms (to tables) which might be expecting that all
references from a certain source are in a single reference element. Any other
transforms will be fixed up shortly.
As the XCCDF output should be as easy as possible to query, individual items
from a particular reference source now appear as separate reference elements.
XCCDF input/shorthand, on the other hand, should be as easy as possible
to use for data entry.
This patch also included some fixups needed to ensure validation. I
usually try to do a "make content; make validate" before committing.
Jeffrey Blank (1):
converted all CCIs from idents to refs * also adjusted transform
slightly, fixed other typos
rhel6/src/input/services/http.xml | 2 +-
rhel6/src/input/services/ssh.xml | 5 +--
rhel6/src/input/system/accounts/accounts.xml | 2 +-
rhel6/src/input/system/accounts/pam.xml | 15 ++------
.../accounts/restrictions/password_expiration.xml | 9 ++---
.../accounts/restrictions/password_storage.xml | 3 +-
rhel6/src/input/system/auditing.xml | 34 +++----------------
rhel6/src/input/system/network/iptables.xml | 10 ++----
.../input/system/software/disk_partitioning.xml | 11 +++---
rhel6/src/input/system/software/integrity.xml | 3 +-
rhel6/src/input/system/software/updating.xml | 6 +--
rhel6/src/transforms/shorthand2xccdf.xslt | 2 +-
12 files changed, 30 insertions(+), 72 deletions(-)
11 years, 10 months
[PATCH] httpd content, minor fixups
by Jeffrey Blank
This includes minor revisions to the last post of the httpd XCCDF content,
removing some trailing spaces and unicode junk.
Jeffrey Blank (1):
significant body of httpd guidance (XCCDF)
rhel6/src/input/services/http.xml | 789 +++++++++++++++++++++++++++++++++++++
1 files changed, 789 insertions(+), 0 deletions(-)
11 years, 10 months
[PATCH v2] M1 Incomplete Guidance - Proxy
by Mike Palmiotto
Prose and OVAL checks for Proxy.
Michael Palmiotto (1):
M1 Incomplete Guidance - Proxy
.../service_squid_acls_configured_filemaker.xml | 40 ++
.../checks/service_squid_acls_configured_ftp.xml | 40 ++
.../service_squid_acls_configured_gopher.xml | 40 ++
.../service_squid_acls_configured_gss_http.xml | 40 ++
.../service_squid_acls_configured_http-mgmt.xml | 40 ++
.../checks/service_squid_acls_configured_http.xml | 40 ++
.../checks/service_squid_acls_configured_https.xml | 40 ++
.../service_squid_acls_configured_localhost.xml | 30 ++
.../service_squid_acls_configured_multiling.xml | 40 ++
.../checks/service_squid_acls_configured_wais.xml | 40 ++
.../service_squid_authentication_configured.xml | 30 ++
...ervice_squid_default_insecure_forwarded_for.xml | 30 ++
.../service_squid_default_insecure_log_mime.xml | 30 ++
...id_default_insecure_suppress_version_string.xml | 30 ++
.../service_squid_default_insecure_underscore.xml | 30 ++
.../input/checks/service_squid_logs_forwarded.xml | 30 ++
.../checks/service_squid_privileges_lowered.xml | 70 +++
.../checks/squid_default_secure_cache_group.xml | 30 ++
.../checks/squid_default_secure_cache_user.xml | 30 ++
.../checks/squid_default_secure_hostnames.xml | 30 ++
.../input/checks/squid_default_secure_passive.xml | 30 ++
.../checks/squid_default_secure_reply_header.xml | 30 ++
.../checks/squid_default_secure_request_header.xml | 30 ++
.../input/checks/squid_default_secure_sanity.xml | 30 ++
.../squid_default_secured_ignore_unknown.xml | 30 ++
.../input/checks/system_proxy_access_allowed.xml | 30 ++
rhel6/src/input/profiles/common.xml | 39 ++-
rhel6/src/input/services/squid.xml | 536 ++++++++++++++++++++
28 files changed, 1476 insertions(+), 9 deletions(-)
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_filemaker.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_ftp.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_gopher.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_gss_http.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_http-mgmt.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_http.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_https.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_localhost.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_multiling.xml
create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_wais.xml
create mode 100644 rhel6/src/input/checks/service_squid_authentication_configured.xml
create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_forwarded_for.xml
create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_log_mime.xml
create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_suppress_version_string.xml
create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_underscore.xml
create mode 100644 rhel6/src/input/checks/service_squid_logs_forwarded.xml
create mode 100644 rhel6/src/input/checks/service_squid_privileges_lowered.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_cache_group.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_cache_user.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_hostnames.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_passive.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_reply_header.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_request_header.xml
create mode 100644 rhel6/src/input/checks/squid_default_secure_sanity.xml
create mode 100644 rhel6/src/input/checks/squid_default_secured_ignore_unknown.xml
create mode 100644 rhel6/src/input/checks/system_proxy_access_allowed.xml
--
1.7.6.5
11 years, 10 months
push now: deadline for CCIs as idents
by Jeffrey Blank
All CCIs (as idents) are hereby ACK'ed until today at noon.
(Push them at will.)
At that time some of the XSLT transforms will change. Any new CCIs
after that time will be expected to appear as references, and take a
form similar to (for fictional CCI-000123, CCI-000456):
<ref disa="123,456"/>
The new templates (in shorthand2xccdf.xslt) will expand these out into
proper, per-CCI reference tags in final XCCDF output. This will also
enable easier querying as Simon had mentioned.
I (or a willing volunteer) will then quickly translate all existing CCIs
(as idents) into this new format.
Again, I apologize for the initial goof, confusing idents and references...
Thanks,
Jeff
11 years, 10 months
Input requested - CCI-000880 - "non-local maintenance"
by Shawn Wells
CCI-000880 says:
"The operating system must audit non-local maintenance and diagnostic
sessions." and
"Non-local maintenance and diagnostic activities are those activities
conducted by individuals communicating through a network, either an
external network (e.g., the Internet) or an internal network, in order
to conduct system diagnostics.
For traceability of maintenance, logging events associated with a
non-local administrative access or diagnostic session must be performed."
What actions do we want to consider "maintenance and diagnostic"
commands/tools?
11 years, 10 months