[PATCH] Update bootloader password to use --encrypted instead of --md5
by Joe Nall
In https://access.redhat.com/knowledge/solutions/68828
Redhat says:
Select a password and then generate a hash from it by running:
# grub-crypt --sha-512
Insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-crypt as the value of password-hash)
password --encrypted password-hash
It should look like below.
default=0
timeout=5
password --encrypted password-hash
splashimage=(hd0,0)/grub/splash.xpm.gz
Verify the permissions on /etc/grub.conf (which is a symlink to ../boot/grub/grub.conf):
# chown root:root /etc/grub.conf
# chmod 600 /etc/grub.conf
grub-crypt utility is now shipped with three types of password encryption.
--md5 Use MD5 to encrypt the password
--sha-256 Use SHA-256 to encrypt the password
--sha-512 Use SHA-512 to encrypt the password (default)
Signed-off-by: Joe Nall <joe(a)nall.com>
---
rhel6/src/input/checks/bootloader_password.xml | 2 +-
rhel6/src/input/system/accounts/physical.xml | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/rhel6/src/input/checks/bootloader_password.xml b/rhel6/src/input/checks/bootloader_password.xml
index 8074097..ceff1b7 100644
--- a/rhel6/src/input/checks/bootloader_password.xml
+++ b/rhel6/src/input/checks/bootloader_password.xml
@@ -18,7 +18,7 @@
<ind:textfilecontent54_object id="object_bootloader_password" version="1">
<ind:path>/etc</ind:path>
<ind:filename>grub.conf</ind:filename>
- <ind:pattern operation="pattern match">password[\s]+--md5[\s]+.*</ind:pattern>
+ <ind:pattern operation="pattern match">password[\s]+--encrypted[\s]+.*</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/input/system/accounts/physical.xml
index 5c3a488..a8db13b 100644
--- a/rhel6/src/input/system/accounts/physical.xml
+++ b/rhel6/src/input/system/accounts/physical.xml
@@ -70,11 +70,11 @@ this file.
<description>The grub boot loader should have password protection
enabled to protect boot-time settings.
To do so, select a password and then generate a hash from it by running:
-<pre># grub-md5-crypt</pre>
+<pre># grub-crypt --sha-512</pre>
Insert the following line into <tt>/etc/grub.conf</tt> immediately
-after the header comments. (Use the output from <tt>grub-md5-crypt</tt> as the
+after the header comments. (Use the output from <tt>grub-crypt</tt> as the
value of <b>password-hash</b>):
-<pre>password --md5 <b>password-hash</b></pre>
+<pre>password --encrypted <b>password-hash</b></pre>
</description>
<rationale>
Password protection on the boot loader configuration ensures that
--
1.7.1
11 years, 6 months
[PATCH 0/3] support for Values in login.defs settings
by Jeffrey Blank
This addresses multiple issues with OVAL checks and
XCCDF content not supporting Values to adjust their
requirements for settings in /etc/login.defs.
Some remaining issues exist, such as the prose not being
quite good yet, and I believe we will also break apart the
OVAL check for minimum length to separately cover the
settings in login.defs and pam_cracklib. But not today.
Jeffrey Blank (3):
updated OVAL checks which inspect login.defs to support Values
(variables)
updated refine-value names for password items, removed
defunct/commented profile items
updated guidance to permit adjustment of password warning period,
min/max age, length * also added to test profile, for your
testing pleasure
.../checks/accounts_maximum_age_login_defs.xml | 26 ++++++---
.../checks/accounts_minimum_age_login_defs.xml | 31 +++++++----
.../checks/accounts_password_minlen_login_defs.xml | 17 +++----
.../accounts_password_warn_age_login_defs.xml | 32 +++++++-----
rhel6/src/input/profiles/common.xml | 29 ++---------
rhel6/src/input/profiles/test.xml | 17 ++++++
.../accounts/restrictions/password_expiration.xml | 56 +++++++++++++-------
7 files changed, 121 insertions(+), 87 deletions(-)
11 years, 6 months
[PATCH] openswan prose fixups
by Jeffrey Blank
Also, moved Rule into desktop profile.
Jeffrey Blank (1):
prose fixups for openswan * moved from common to desktop Profile
* providing VPN tunnel availability for mobile devices was
original rationale for inclusion in a Profile
rhel6/src/input/profiles/common.xml | 1 -
rhel6/src/input/profiles/desktop.xml | 1 +
rhel6/src/input/system/network/ipsec.xml | 21 +++++++++++++++------
3 files changed, 16 insertions(+), 7 deletions(-)
11 years, 6 months
[PATCH] updates for wireless networking prose
by Jeffrey Blank
Also, introduced line breaks to some Rules. You don't have to use vim,
but let's be nice to those of us that are.
Jeffrey Blank (1):
brought WiFi prose into the present day * removed disabling WiFi
from common Profile, added to server Profile * also added many
line breaks
rhel6/src/input/profiles/common.xml | 1 -
rhel6/src/input/profiles/server.xml | 1 +
rhel6/src/input/system/network/network.xml | 36 +++++++++++++++++-----
rhel6/src/input/system/network/wireless.xml | 43 +++++++++++++++++---------
4 files changed, 56 insertions(+), 25 deletions(-)
11 years, 6 months
periodical XCCDF test scans
by Petr Lautrbach
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello everybody,
We periodically run XCCDF evaluation of sce-community-content [1] and
I'd like to inform you that we also included scap-security-guide XCCDF
into our automated test system [2].
Tests are run on RHEL-6.3 virtual system installed from kickstart
similar to USCGB kickstart. If you add <fix>
remediations to your content, we can merge them into used kickstart and
reinstall system.
We use oscap tool from openscap package in version 0.8.2 (built from git
sources). This tool validates input content,
evaluates XCCDF and also validates output data. If there is no problem
in the scan, columns '# pass', '# failed' and '# other'
are filled with values based on result in results.xml, link "full
report" refers to report.html made by oscap
and "git revision" link refers to git web frontend used with used git
revision. If there is any problem during scan,
"full report" refers to oscap log.
[1] https://fedorahosted.org/sce-community-content/wiki/Results
[2]
https://fedorahosted.org/sce-community-content/raw-attachment/wiki/Result...
Regards,
Petr
- --
Petr Lautrbach <plautrba(a)redhat.com>, Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPv3wjAAoJEGOorUuYLENza8oP/2vawoytYQlVGv29KE51nfF/
2mbbEjOkQ+lBc1EILXxEk+2BMxBRCQtFWgzqT0XadWj4IvAZEjOKUNCzDshlciqv
CC1X3sMoCgH2etLZRng11Ej6YKHmp4ikwjzRUWfnUrDNcMU8rCJkOFCfS+zOrx4Q
mDO/oCWjpIWv4cyGF/Jr63lUubtaybx1PQIMq32lzaKSLlALsuuAt+9AdkAEdHA1
dUU+m0YKxXiOV5VSPtRueoXdrh7Xt4qTwhUYb93PGUIUvM3xsD6FqneFgIhWuP3t
A3wBg+JuRt3e5QDWSv7aQkVL18OZDXEq4YaO/A6ADSurXeC5dXamFVAtLimJzV3x
GU679Y/sN1sMj71jotSlfjGs+YmyFDIiPvo7XQYyLdyyfN32yP6uVGY5i/LiuGZk
mEjiO+bBNkOPA5OFb9Di88bsT84xa9buzx8etpGYx64B6oJxuyWUnW1TrRmZKC4m
5FacoCiPtSvDSIJ5y9Wa2DuO38wX+vW+tyZ5KVfAwfYXuFYCbwxRQjho7bsYsSoo
9K+lHSq0JZh5DSQgiOJDW+CkwJ5AyPiXL3BMEcuhuxVBlj+LjXGIC3i4VL6CmQXN
USN83Ze6UaYLStuu5nC8Q5cpdK2Yb3rSYMe4BwJ7k7CjhJX48IgsX/GxXmicEHVL
TqmnmdsHfeegXaWkf3Vc
=UE5K
-----END PGP SIGNATURE-----
11 years, 6 months
How do I track these warnings down?
by Joe Nall
oscap xccdf generate guide --profile allrules output/rhel6-xccdf.xml > output/rhel6-guide.html
WARNING: Processing an unresolved XCCDF document. This may have unexpected results.
xmlwf input/checks/*.xml
transforms/combinechecks.py input/checks > output/rhel6-oval.xml
Duplicate ID, which will not be added: var_removable_partition
Duplicate ID, which will not be added: var_removable_partition
Duplicate ID, which will not be added: var_ssh_config_directory
Duplicate ID, which will not be added: state_uid_root
Duplicate ID, which will not be added: object_etc_skel_files
Duplicate ID, which will not be added: var_samba_private_directory
joe
11 years, 6 months
Howdy
by Patrick Rutledge
Hello all. I am new to the list. My name is Patrick Rutledge, I am a Sr. Consultant at Red Hat.
I have been working closely in the federal space for the last 7+ years so I am somewhat in tune with their security needs and focus. Recently I spent almost a year working on a project in which I deployed a hardened version of ESXi using a modified distribution containing a special kickstart and other OS tweaks in order to have it easily deployed overseas to comply with DISA STIGs. Before that I was working for 7 years at a government customer where I was deeply involved with the scanning and hardening of Unix and Linux systems. Another security related interest I have is high bandwidth one way data transfers, in which I hope to start an open source project on soon.
Im ramping up right now with SCAP and hope to be able to provide a RHEL+KVM solution as my first attempt. In doing so, I will also spend some time looking at the current RHEL configurations to fill in any missing pieces.
I look forward to working with you all on this project!
Thanks,
pat
11 years, 6 months
netfs test
by Joe Nall
In order to pass the netfs test, I had to
chkconfig --level 0123456 netfs off
instead of just
chkconfig --del netfs
because
<unix:runlevel_state comment="not configured to start" id="state_service_netfs_off" version="1">
<unix:start datatype="boolean">false</unix:start>
<unix:kill datatype="boolean">true</unix:kill>
checks that there is a kill script at every level instead of just testing for not starting. Is just testing
<unix:runlevel_state comment="not configured to start" id="state_service_netfs_off" version="1">
<unix:start datatype="boolean">false</unix:start>
at every init level sufficient?
joe
11 years, 6 months
[PATCH 1/1] The sysctl_values.csv has values that don't match the text. For example allowing source redirects.
by Joe Nall
---
.../sysctl_net_ipv4_conf_all_accept_redirects.xml | 10 +++++-----
...ysctl_net_ipv4_conf_all_accept_source_route.xml | 10 +++++-----
.../sysctl_net_ipv4_conf_all_secure_redirects.xml | 10 +++++-----
.../sysctl_net_ipv4_conf_all_send_redirects.xml | 10 +++++-----
...sctl_net_ipv4_conf_default_accept_redirects.xml | 10 +++++-----
...l_net_ipv4_conf_default_accept_source_route.xml | 10 +++++-----
...sctl_net_ipv4_conf_default_secure_redirects.xml | 10 +++++-----
...sysctl_net_ipv4_conf_default_send_redirects.xml | 10 +++++-----
...sctl_net_ipv6_conf_default_accept_redirects.xml | 14 ++++++--------
rhel6/src/input/checks/templates/sysctl_values.csv | 18 +++++++++---------
10 files changed, 55 insertions(+), 57 deletions(-)
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
index a11a8bd..eb21415 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4217-6" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
index 2753ef6..94f8766 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_source_route" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_source_route" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4236-6" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
index 2e48ff9..5ddfeec 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_all_secure_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.all.secure_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-3472-8" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
index 8df01ac..8beb66f 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_all_send_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.all.send_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4155-8" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_send_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
index 9c942a2..f14f6f2 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4186-3" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
index ce3f564..4c45bca 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_source_route" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_source_route" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4091-5" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
index 2e604ac..bf829cd 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_default_secure_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.default.secure_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-3339-9" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
index b0784d9..a4594e8 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv4_conf_default_send_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv4.conf.default.send_redirects" Check</title>
@@ -6,15 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4151-7" source="CCE" />
- <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
</metadata>
<criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" />
</unix:sysctl_test>
@@ -24,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_send_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
index ce710b9..7978ba7 100644
--- a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
+++ b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
@@ -1,4 +1,5 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_redirects" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_redirects" Check</title>
@@ -6,17 +7,14 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4365-3" source="CCE" />
- <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "1".</description>
- <!-- generated by create_sysctl_checks.py -->
+ <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
</metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
+ <criteria>
+ <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" />
</unix:sysctl_test>
@@ -26,6 +24,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/rhel6/src/input/checks/templates/sysctl_values.csv b/rhel6/src/input/checks/templates/sysctl_values.csv
index 549e847..75e2c6a 100644
--- a/rhel6/src/input/checks/templates/sysctl_values.csv
+++ b/rhel6/src/input/checks/templates/sysctl_values.csv
@@ -1,19 +1,19 @@
kernel.exec-shield,1,4168-1
kernel.randomize_va_space,1,4146-7
-net.ipv4.conf.all.accept_redirects,1,4217-6
-net.ipv4.conf.all.accept_source_route,1,4236-6
+net.ipv4.conf.all.accept_redirects,0,4217-6
+net.ipv4.conf.all.accept_source_route,0,4236-6
net.ipv4.conf.all.log_martians,1,4320-8
net.ipv4.conf.all.rp_filter,1,4080-8
-net.ipv4.conf.all.secure_redirects,1,3472-8
-net.ipv4.conf.all.send_redirects,1,4155-8
-net.ipv4.conf.default.accept_redirects,1,4186-3
-net.ipv4.conf.default.accept_source_route,1,4091-5
+net.ipv4.conf.all.secure_redirects,0,3472-8
+net.ipv4.conf.all.send_redirects,0,4155-8
+net.ipv4.conf.default.accept_redirects,0,4186-3
+net.ipv4.conf.default.accept_source_route,0,4091-5
net.ipv4.conf.default.rp_filter,1,3840-6
-net.ipv4.conf.default.secure_redirects,1,3339-9
-net.ipv4.conf.default.send_redirects,1,4151-7
+net.ipv4.conf.default.secure_redirects,0,3339-9
+net.ipv4.conf.default.send_redirects,0,4151-7
net.ipv4.icmp_echo_ignore_broadcasts,1,3644-2
net.ipv4.icmp_ignore_bogus_error_responses,1,4133-5
net.ipv4.ip_forward,0,3561-8
net.ipv4.tcp_syncookies,1,4265-5
net.ipv6.conf.all.disable_ipv6,1,4298-6
-net.ipv6.conf.default.accept_redirects,1,4365-3
+net.ipv6.conf.default.accept_redirects,0,4365-3
--
1.7.1
11 years, 6 months