Re: [scap-security-guide] #186: False positive: set_sysctl_net_ipv4_conf_all_accept_redirects
by fedora-badges
#186: False positive: set_sysctl_net_ipv4_conf_all_accept_redirects
------------------------------+-------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: 0.5.0-InitialDraft
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------
Changes (by shawndwells):
* cc: scap-security-guide@… (added)
* resolution: => worksforme
* status: new => closed
Comment:
[root@rhel6 checks]# sysctl -a | grep net.ipv4.conf.all.accept_redirects
net.ipv4.conf.all.accept_redirects = 0
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_all_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_all_accept_redirectsZxHQrB.xml
Definition oval:scap-security-guide.testing:def:271: true
Evaluation done.
[root@rhel6 checks]# sysctl -w net.ipv4.conf.all.accept_redirects=1
net.ipv4.conf.all.accept_redirects = 1
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_all_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_all_accept_redirectsBo1lGd.xml
Definition oval:scap-security-guide.testing:def:271: false
Resolving as worksforme
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/186#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
Re: [scap-security-guide] #185: False positive: set_sysctl_net_ipv4_conf_all_accept_source_route
by fedora-badges
#185: False positive: set_sysctl_net_ipv4_conf_all_accept_source_route
------------------------------+-------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: 0.5.0-InitialDraft
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------
Changes (by shawndwells):
* status: new => closed
* cc: scap-security-guide@… (added)
* resolution: => worksforme
Comment:
[root@rhel6 checks]# sysctl -a | grep
net.ipv4.conf.all.accept_source_route
net.ipv4.conf.all.accept_source_route = 0
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_all_accept_source_route.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_all_accept_source_routesIkO41.xml
Definition oval:scap-security-guide.testing:def:267: true
Evaluation done.
[root@rhel6 checks]# sysctl -w net.ipv4.conf.all.accept_source_route=1
net.ipv4.conf.all.accept_source_route = 1
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_all_accept_source_route.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_all_accept_source_routeufky2n.xml
Definition oval:scap-security-guide.testing:def:267: false
Resolving as worksforme
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/185#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
Re: [scap-security-guide] #184: False positive: disable_sysctl_ipv4_ip_forward
by fedora-badges
#184: False positive: disable_sysctl_ipv4_ip_forward
------------------------------+-------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: 0.5.0-InitialDraft
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------
Changes (by shawndwells):
* cc: scap-security-guide@… (added)
* status: new => closed
* resolution: => worksforme
Comment:
[root@rhel6 checks]# ./testcheck.py sysctl_net_ipv4_ip_forward.xml
Evaluating with OVAL tempfile : /tmp/sysctl_net_ipv4_ip_forwardoFisDY.xml
Definition oval:scap-security-guide.testing:def:263: true
Evaluation done.
[root@rhel6 checks]# sysctl -a | grep ip.forward
net.ipv4.ip_forward = 0
[root@rhel6 checks]# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
[root@rhel6 checks]# ./testcheck.py sysctl_net_ipv4_ip_forward.xml
Evaluating with OVAL tempfile : /tmp/sysctl_net_ipv4_ip_forwardLl3e__.xml
Definition oval:scap-security-guide.testing:def:263: false
Resolving as worksforme
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/184#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
Re: [scap-security-guide] #183: False positive: disable_sysctl_ipv4_default_send_redirect
by fedora-badges
#183: False positive: disable_sysctl_ipv4_default_send_redirect
------------------------------+-------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: 0.5.0-InitialDraft
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------
Changes (by shawndwells):
* resolution: => worksforme
* cc: scap-security-guide@… (added)
* status: new => closed
Comment:
[root@rhel6 checks]# sysctl -a | grep net.ipv4.conf.default.send_redirects
net.ipv4.conf.default.send_redirects = 1
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_default_send_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_default_send_redirectsQ8TIEP.xml
Definition oval:scap-security-guide.testing:def:259: false
Evaluation done.
[root@rhel6 checks]# sysctl -w net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.default.send_redirects = 0
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv4_conf_default_send_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv4_conf_default_send_redirects7rJM3f.xml
Definition oval:scap-security-guide.testing:def:259: true
Evaluation done.
Resolving as worksforme
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/183#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
Re: [scap-security-guide] #173: False positive: service_saslauthd_disabled
by fedora-badges
#173: False positive: service_saslauthd_disabled
------------------------------+-------------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: I just did a git clone / HEAD
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------------
Changes (by shawndwells):
* status: new => closed
* resolution: => worksforme
* cc: scap-security-guide@… (added)
Comment:
# service saslauthd status
saslauthd is stopped
[shawn@rhel6 checks]$ ./testcheck.py service_saslauthd_disabled.xml
Evaluating with OVAL tempfile : /tmp/service_saslauthd_disabledxydXYY.xml
Definition oval:scap-security-guide.testing:def:229: false
Definition oval:scap-security-guide.testing:def:228: true
Evaluation done.
Final result is PASS. Resolving as worksforme.
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/173#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
Re: [scap-security-guide] #172: False positive: service_rdisk_disabled
by fedora-badges
#172: False positive: service_rdisk_disabled
------------------------------+-------------------------------------------
Reporter: Logan.Rodrian@… | Owner: mnewman23
Type: defect | Status: closed
Priority: major | Milestone: RHEL6 STIG OVAL Content
Component: OVAL content | Version: I just did a git clone / HEAD
Resolution: worksforme | Keywords:
Blocked By: | Blocking:
------------------------------+-------------------------------------------
Changes (by shawndwells):
* resolution: => worksforme
* cc: scap-security-guide@… (added)
* status: new => closed
Comment:
[root@rhel6 input]# service rdisc status
rdisc is stopped
[shawn@rhel6 checks]$ ./testcheck.py service_rdisc_disabled.xml
Evaluating with OVAL tempfile : /tmp/service_rdisc_disabledENundV.xml
Definition oval:scap-security-guide.testing:def:210: false
Definition oval:scap-security-guide.testing:def:209: true
Evaluation done.
Final result: true (aka, pass)
Resolving this as worksforme
--
Ticket URL: <https://fedorahosted.org/scap-security-guide/ticket/172#comment:1>
scap-security-guide <http://fedorahosted.org/scap-security-guide>
scap-security-guide
11 years
[PATCH] removal of Rule which does not apply to rsyslog
by Jeffrey Blank
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/system/logging.xml | 18 ------------------
1 files changed, 0 insertions(+), 18 deletions(-)
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index ffe05c0..1be663c 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -96,24 +96,6 @@ operator="equals" interactive="0">
<value selector="root">root</value>
</Value>
-<Rule id="rsyslog_logfiles_exist">
-<title>Ensure Log Files Exist</title>
-<description>
-The log files written by <tt>rsyslog</tt> are determined by the second part of each rule line in
-<tt>/etc/rsyslog.conf</tt>. These typically all appear in <tt>/var/log</tt>.
-For any log file <i>LOGFILE</i> referenced in <tt>/etc/rsyslog.conf</tt> which
-does not already exist the following commands will create it and apply proper
-permissions:
-<pre># touch <i>LOGFILE</i>
-# chown root:root <i>LOGFILE</i>
-# chmod 0600 <i>LOGFILE</i></pre>
-</description>
-<rationale>If a log file referenced by rsyslog does not exist, rsyslog
-will not create it and important log messages can be lost.
-</rationale>
-<ident cce="26818-5" />
-<ref nist="" />
-</Rule>
<Rule id="userowner_rsyslog_files" severity="medium">
<title>Ensure Log Files Are Owned By Appropriate User</title>
--
1.7.1
11 years