[PATCH 0/2] added a Group, fixed some text
by David Smith
1) "Disable Unused Interfaces" is now a Group
2) cleaned up some of the text in ipv6.xml and wireless.xml
David Smith (2):
turned a Rule into a Group
slight text modifications
RHEL6/input/system/network/ipv6.xml | 4 ++--
RHEL6/input/system/network/network.xml | 20 +++++++++-----------
RHEL6/input/system/network/wireless.xml | 4 ++--
3 files changed, 13 insertions(+), 15 deletions(-)
11 years, 2 months
PAM files ending in "-ac"
by Kenneth Stailey
Hi,
I was looking at
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rh...
and it says to change PAM files that end in "-ac" but the rule is that
the autoconf program can re-write (clobber) PAM files that end in
"-ac" and if you want to avoid that you copy the "-ac" file to a new
name such as one that ends in "-local" and then reset the symbolic
link from pointing to the "-ac" file to pointing at you "-local" file.
Can the documentation be updated to reflect this?
Thanks,
Ken
11 years, 2 months
[PATCH] Fix reverse logic of two ssh_config tests
by Kenneth Stailey
The tests should ensure the options are disabled but the logic was reversed.
The tests also allowed zero whitespace where sshd would not.
Signed-off-by: Kenneth Stailey <kstailey.lists(a)gmail.com>
---
RHEL6/input/checks/sshd_no_user_envset.xml | 2 +-
RHEL6/input/checks/sshd_permitemptypasswords_no.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml
index a68d872..985395e 100644
--- a/RHEL6/input/checks/sshd_no_user_envset.xml
+++ b/RHEL6/input/checks/sshd_no_user_envset.xml
@@ -28,7 +28,7 @@
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]*yes\s*$</ind:pattern>
+ <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]+[Nn][Oo]\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml
index 29545b6..3795e4b 100644
--- a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml
+++ b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml
@@ -28,7 +28,7 @@
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]*yes\s*$</ind:pattern>
+ <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]+[Nn][Oo]\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.8.1.1
11 years, 2 months
[PATCH] Increase ASLR Level
by Kenneth Stailey
All,
Sorry I've been away for a while, things have been very busy here.
My system fails the ASLR sysctl test because is more secure than the test requires.
The test checks that the ASLR control is set to "1" while setting it to "2"
randomizes more of the system's memory.
See Linux documentation file Documentation/sysctl/kernel.txt
http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482
Thanks,
Kenneth Stailey (1):
Please Randomize Heap Space too
RHEL6/input/checks/templates/sysctl_values.csv | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
1.8.1.1
11 years, 2 months
[PATCH] Speling errror corection.
by Christopher Anderson
Corrected several misspelled words including acknowledgement, aleart, anauthorized, appliations, apropriate, atlernate, circumstatnces, commmand, communciations, Compatiblity, complinace, contigency, crptographic, defintion, defniition, DEPRECTATED, desginated, destication, dissemenates, dissiminates, distinquish, distrubution, documente, employes, enabeld, Enteprise, existance, existince, feasable, fillowing, freqency, frequencyof, furtuer, Iincluding, implimentation, informaiton, informatin, informatio, invenotires, labelling, locahost, locatioin, logio, magnitue, maintaenance, maitaining, mannger, mechanicsms, miscellanous, occures, oeprational, operaitonal, organizaiton, organizatin, organizationk, organizatoin, organiztion, organzation, organziation, origanization, permissios, personel, premissions, proceedure, produciton, prolicies, protocal, renameat, Reposition, Repostiory, reqirement, resynchronization, reuqirements, securiy, seleted, seperate, strenght, superceded, superceeded, timout, toorganization, traning, trhough, uathorization, untrested, writeable, plus a few misspellings of or references to Red Hat.
Chris
Christopher Anderson (1):
Corrected a few speling errrors.
JBossEAP5/eap5-ocil.xml | 10 +-
RHEL6/README | 2 +-
RHEL6/input/auxiliary/nist_support.xml | 2 +-
RHEL6/input/auxiliary/transition_notes.xml | 18 ++--
.../input/checks/audit_rules_dac_modification.xml | 2 +-
.../file_permissions_httpd_server_conf_files.xml | 2 +-
.../checks/file_permissions_ldap_server_files.xml | 2 +-
.../checks/gconf_gnome_screensaver_idle_delay.xml | 2 +-
.../ldap_server_config_bdb_file_security.xml | 2 +-
.../ldap_server_config_directory_file_security.xml | 2 +-
RHEL6/input/checks/mount_option_dev_shm_noexec.xml | 2 +-
RHEL6/input/checks/mount_option_dev_shm_nosuid.xml | 2 +-
RHEL6/input/checks/mount_option_tmp_noexec.xml | 2 +-
RHEL6/input/checks/mount_option_tmp_nosuid.xml | 2 +-
...mail_relay_smtp_auth_for_untrusted_networks.xml | 2 +-
RHEL6/input/checks/rpm_verify_hashes.xml | 2 +-
RHEL6/input/checks/sshd_idle_timeout.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 6 +-
RHEL6/input/services/ldap.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 4 +-
RHEL6/input/system/permissions/partitions.xml | 10 +-
RHEL6/input/system/software/updating.xml | 2 +-
RHEL6/references/cce-rhel5.xml | 18 ++--
RHEL6/references/disa-cci-list.xml | 114 ++++++++++-----------
RHEL6/references/disa-os-srg-v1r1.xml | 4 +-
RHEL6/references/disa-stig-rhel5-v1r0.6-oval.xml | 14 +--
.../disa-stig-rhel5-v1r0.6-xccdf-manual.xml | 26 ++---
RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf.xml | 6 +-
RHEL6/references/usgcb-rhel5desktop-oval.xml | 16 +--
RHEL6/references/usgcb-rhel5desktop-xccdf.xml | 26 ++---
30 files changed, 153 insertions(+), 153 deletions(-)
--
1.7.11.7
11 years, 2 months
[PATCH 0/5] various fixes
by David Smith
1 - fixed a number of typos (found by FSO)
2 - began preparing content for CCE submission
David Smith (5):
text fixes from DISA FSO
tag escape fix
turned a group into a rule
removed a rule
began adding CCE elements to build table of needed CCEs
RHEL6/input/services/http.xml | 3 ---
RHEL6/input/services/printing.xml | 2 +-
RHEL6/input/system/accounts/banners.xml | 20 +++++++++++---------
RHEL6/input/system/accounts/pam.xml | 9 ++++++---
RHEL6/input/system/accounts/physical.xml | 2 +-
.../system/accounts/restrictions/root_logins.xml | 2 +-
RHEL6/input/system/auditing.xml | 8 +++++++-
RHEL6/input/system/network/iptables.xml | 4 ++--
RHEL6/input/system/network/ipv6.xml | 4 ++++
RHEL6/input/system/network/network.xml | 8 ++++----
RHEL6/input/system/permissions/files.xml | 4 ++--
RHEL6/input/system/software/integrity.xml | 2 ++
RHEL6/transforms/shorthand2xccdf.xslt | 4 ++--
13 files changed, 43 insertions(+), 29 deletions(-)
11 years, 2 months