From stuart.green at doccentrics.com Thu Aug 20 11:34:41 2015 Content-Type: multipart/mixed; boundary="===============5822404195809285431==" MIME-Version: 1.0 From: Stuart Green To: scap-security-guide at lists.fedorahosted.org Subject: telnet section Date: Wed, 31 Jul 2013 16:15:42 +0100 Message-ID: <51F92A1E.2010103@doccentrics.com> --===============5822404195809285431== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Greetings All, New to this list! I think I might have found an issue with the SSG policy content. Summary: If you do not have telnet installed on the system it causes = Rule ID: disable_telnet_service to fail. In no place in this rule does it consider that telnet might not be = installed at all, so it fails (rather than errors, or even better does a = check as a precursor to see if its installed at all and if not passes!) grep 'id=3D"oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml Disable telnet Service The telnet service can be disabled with = the following command: # chkconfig telnet off AC-17(8) CM-7 IA-5(1)(c) 68 1436 197 877 888 DS 20121026 The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks. CCE-26836-7 To check that the telnet service is = disabled in system boot configuration, run the following command: # chkconfig telnet = --list Output should indicate the telnet service = has either not been installed, or has been disabled at all runlevels, as shown in the example below: # chkconfig telnet --list telnet 0:off 1:off 2:off 3:off = 4:off 5:off 6:off Run the following command to verify telnet = is disabled through current runtime configuration: # service telnet status If the service is disabled the command will return the following = output: telnet is stopped Cheers, Stu --===============5822404195809285431==-- From peake at hipkllc.com Thu Aug 20 11:34:41 2015 Content-Type: multipart/mixed; boundary="===============7118542446710334250==" MIME-Version: 1.0 From: Brian Peake To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 11:22:55 -0400 Message-ID: <20130731112255.fu62r65iekog0s8k@webmail.hipkllc.com> In-Reply-To: 51F92A1E.2010103@doccentrics.com --===============7118542446710334250== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Welcome to the list :-) There is a ticket for this that Sawn Wells entered for me. = See=C2=A0https://fedorahosted.org/scap-security-guide/ticket/409 https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-May/00333= 0.html R/ BP On Wed, 31 Jul 2013 16:15:42 +0100, Stuart Green = wrote: Greetings All, > > New to this list! > > I think I might have found an issue with the SSG policy content. = > > Summary: If you do not have telnet installed on the system it causes = > Rule ID: disable_telnet_service to fail. = > > > > In no place in this rule does it consider that telnet might not be = > installed at all, so it fails (rather than errors, or even better = > does a check as a precursor to see if its installed at all and if not = > passes!) > > > grep 'id=3D"oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml > version=3D"1" check_existence=3D"all_exist" check=3D"all" comment=3D"Disa= ble = > Telnet Service"> > check_existence=3D"all_exist" check=3D"all" result=3D"false"/> > > > > Disable telnet Service > xml:lang=3D"en-US"> > > The telnet service can be disabled with = > the following command: > > # chkconfig telnet off > > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-r= ev3-final.pdf">AC-17(8) > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-r= ev3-final.pdf">CM-7 > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-r= ev3-final.pdf">IA-5(1)(c) > href=3D"http://iase.disa.mil/cci/index.html">68 > href=3D"http://iase.disa.mil/cci/index.html">1436 > href=3D"http://iase.disa.mil/cci/index.html">197 > href=3D"http://iase.disa.mil/cci/index.html">877 > href=3D"http://iase.disa.mil/cci/index.html">888 > href=3D"test_attestation"> > DS > 20121026 > > > xml:lang=3D"en-US"> > > The telnet protocol uses unencrypted network communication, which > means that data from the login session, including passwords and > all other information transmitted during the session, can be > stolen by eavesdroppers on the network. The telnet protocol is also > subject to man-in-the-middle attacks. = > > > > CCE-26836-7 > system=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5"> > href=3D"ssg-rhel6-oval.xml"/> > > > > value-id=3D"conditional_clause"/> > > > To check that the telnet service is = > disabled in system boot configuration, run the following command: > # chkconfig telnet = > --list > Output should indicate the telnet = > service has either not been installed, > or has been disabled at all runlevels, as shown in the example below: > # chkconfig telnet --list > telnet 0:off 1:off 2:off 3:off = > 4:off 5:off 6:off > > > Run the following command to verify = > telnet is disabled through current runtime = > configuration: > > # service telnet status > > If the service is disabled the command will return the following out= put: > > telnet is stopped > > > > > > > Cheers, > Stu > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > --===============7118542446710334250==-- From stuart.green at doccentrics.com Thu Aug 20 11:34:41 2015 Content-Type: multipart/mixed; boundary="===============6631390456808988661==" MIME-Version: 1.0 From: Stuart Green To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 16:31:27 +0100 Message-ID: <51F92DCF.4080400@doccentrics.com> In-Reply-To: 20130731112255.fu62r65iekog0s8k@webmail.hipkllc.com --===============6631390456808988661== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ah-ha!! Thanks, I was looking for the buglist actually and couldn't find it! Glad to be aboard :) Stu > Welcome to the list :-) > > There is a ticket for this that Sawn Wells entered for me. = > See https://fedorahosted.org/scap-security-guide/ticket/409 > > https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-May/003= 330.html = > > > R/ BP > > On Wed, 31 Jul 2013 16:15:42 +0100, Stuart Green = > wrote: > Greetings All, >> >> New to this list! >> >> I think I might have found an issue with the SSG policy content. >> Summary: If you do not have telnet installed on the system it causes = >> Rule ID: disable_telnet_service to fail. >> >> >> In no place in this rule does it consider that telnet might not be = >> installed at all, so it fails (rather than errors, or even better = >> does a check as a precursor to see if its installed at all and if not = >> passes!) >> >> >> grep 'id=3D"oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml >> > version=3D"1" check_existence=3D"all_exist" check=3D"all" comment=3D"Dis= able = >> Telnet Service"> >> > check_existence=3D"all_exist" check=3D"all" result=3D"false"/> >> >> >> > severity=3D"high"> >> Disable telnet Service >> > xml:lang=3D"en-US"> >> >> The telnet service can be disabled with = >> the following command: >> >> # chkconfig telnet off >> >> > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-= rev3-final.pdf">AC-17(8) >> > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-= rev3-final.pdf">CM-7 >> > href=3D"http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-= rev3-final.pdf">IA-5(1)(c) >> > href=3D"http://iase.disa.mil/cci/index.html">68 >> > href=3D"http://iase.disa.mil/cci/index.html">1436 >> > href=3D"http://iase.disa.mil/cci/index.html">197 >> > href=3D"http://iase.disa.mil/cci/index.html">877 >> > href=3D"http://iase.disa.mil/cci/index.html">888 >> > href=3D"test_attestation"> >> DS >> 20121026 >> >> >> > xml:lang=3D"en-US"> >> >> The telnet protocol uses unencrypted network communication, which >> means that data from the login session, including passwords and >> all other information transmitted during the session, can be >> stolen by eavesdroppers on the network. The telnet protocol is also >> subject to man-in-the-middle attacks. >> >> >> CCE-26836-7 >> > system=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5"> >> > href=3D"ssg-rhel6-oval.xml"/> >> >> >> >> > value-id=3D"conditional_clause"/> >> >> >> To check that the telnet service is = >> disabled in system boot configuration, run the following command: >> # chkconfig telnet = >> --list >> Output should indicate the telnet = >> service has either not been installed, >> or has been disabled at all runlevels, as shown in the example = >> below: >> # chkconfig telnet --list >> telnet 0:off 1:off 2:off 3:off = >> 4:off 5:off 6:off >> >> >> Run the following command to verify = >> telnet is disabled through current runtime = >> configuration: >> >> # service telnet status >> >> If the service is disabled the command will return the following = >> output: >> >> telnet is stopped >> >> >> >> >> >> >> Cheers, >> Stu >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> >> > > --===============6631390456808988661==-- From shawn at redhat.com Thu Aug 20 11:34:41 2015 Content-Type: multipart/mixed; boundary="===============4698927832557789745==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 13:36:31 -0400 Message-ID: <51F94B1F.2090108@redhat.com> In-Reply-To: 51F92DCF.4080400@doccentrics.com --===============4698927832557789745== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/31/13 11:31 AM, Stuart Green wrote: > > Ah-ha!! Thanks, I was looking for the buglist actually and couldn't = > find it! > > > Glad to be aboard :) = Hm. Perhaps this whole thing can be simplified. Right now we have two checks: - package_telnet-server_removed.xml - service_telnetd_disabled.xml They seem redundant, and I'm failing to find reasons against just = deleting service_telnetd_disabled. There's no way telnet can be enabled = if the package isn't installed, right? Is there a reason to continue maintaining both checks? --===============4698927832557789745==-- From PEAKE at HIPKLLC.COM Thu Aug 20 11:34:42 2015 Content-Type: multipart/mixed; boundary="===============7500955508236738581==" MIME-Version: 1.0 From: Brian Peake To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 14:24:06 -0400 Message-ID: In-Reply-To: 51F94B1F.2090108@redhat.com --===============7500955508236738581== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/31/13 1:36 PM, "Shawn Wells" wrote: >On 7/31/13 11:31 AM, Stuart Green wrote: >> >> Ah-ha!! Thanks, I was looking for the buglist actually and couldn't >> find it! >> >> >> Glad to be aboard :) > > >Hm. Perhaps this whole thing can be simplified. > >Right now we have two checks: > - package_telnet-server_removed.xml > - service_telnetd_disabled.xml > >They seem redundant, and I'm failing to find reasons against just >deleting service_telnetd_disabled. There's no way telnet can be enabled >if the package isn't installed, right? > >Is there a reason to continue maintaining both checks? Shawn, I don't think so. I believe there are other checks that have the same redundancy also=C2=8A R/ Brian --===============7500955508236738581==-- From agilmore2 at gmail.com Thu Aug 20 11:34:42 2015 Content-Type: multipart/mixed; boundary="===============9137214706596639710==" MIME-Version: 1.0 From: Andrew Gilmore To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 14:39:13 -0600 Message-ID: In-Reply-To: 51F92A1E.2010103@doccentrics.com --===============9137214706596639710== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Right, I recently pushed a fix for this bug, it just hasn't made the current build yet. Good catch though, false positives stink. Andrew On Wed, Jul 31, 2013 at 9:15 AM, Stuart Green wrote: > Greetings All, > > New to this list! > > I think I might have found an issue with the SSG policy content. > > Summary: If you do not have telnet installed on the system it causes Rule > ID: disable_telnet_service to fail. > > > > In no place in this rule does it consider that telnet might not be > installed at all, so it fails (rather than errors, or even better does a > check as a precursor to see if its installed at all and if not passes!) > > > grep 'id=3D"oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml > check_existence=3D"all_exist" check=3D"all" comment=3D"Disable Telnet Ser= vice"> > check_existence=3D"all_exist" check=3D"all" result=3D"false"/> > > > > Disable telnet Service > " > xml:lang=3D"en-US"> > > The telnet service can be disabled with > the following command: > > # chkconfig telnet off > > publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf > ">**AC-17(8) > publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf > ">**CM-7 > publications/nistpubs/800-53-**Rev3/sp800-53-rev3-final.pdf > ">**IA-5(1)(c) > > ">68 > > ">1436 > > ">197 > > ">877 > > ">888 > " > href=3D"test_attestation"> > DS > 20121026 > > > " > xml:lang=3D"en-US"> > > The telnet protocol uses unencrypted network communication, which > means that data from the login session, including passwords and > all other information transmitted during the session, can be > stolen by eavesdroppers on the network. The telnet protocol is also > subject to man-in-the-middle attacks. > > > > **CCE-26836-7 > XMLSchema/oval-definitions-5 > "> > href=3D"ssg-rhel6-oval.xml"/> > > > > value-id=3D"conditional_clause"/**> > > "> > > To check that the telnet service is > disabled in system boot configuration, run the following command: > # chkconfig telnet > --list > Output should indicate the telnet service > has either not been installed, > or has been disabled at all runlevels, as shown in the example below: > # chkconfig telnet --list > telnet 0:off 1:off 2:off 3:off > 4:off 5:off 6:off > > > Run the following command to verify telnet > is disabled through current runtime configuration: > > # service telnet status > > If the service is disabled the command will return the following > output: > > telnet is stopped > > > > > > > Cheers, > Stu > > ______________________________**_________________ > scap-security-guide mailing list > scap-security-guide(a)lists.**fedorahosted.org > https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide > --===============9137214706596639710== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+UmlnaHQsIEkgcmVjZW50bHkgcHVzaGVkIGEgZml4IGZvciB0aGlzIGJ1 ZywgaXQganVzdCBoYXNuJiMzOTt0IG1hZGUgdGhlIGN1cnJlbnQgYnVpbGQgeWV0LiBHb29kIGNh dGNoIHRob3VnaCwgZmFsc2UgcG9zaXRpdmVzIHN0aW5rLjxkaXY+PGJyPjwvZGl2PjxkaXY+QW5k cmV3PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48YnI+PGRpdiBjbGFz cz0iZ21haWxfcXVvdGUiPgoKT24gV2VkLCBKdWwgMzEsIDIwMTMgYXQgOToxNSBBTSwgU3R1YXJ0 IEdyZWVuIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnN0dWFydC5ncmVlbkBk b2NjZW50cmljcy5jb20iIHRhcmdldD0iX2JsYW5rIj5zdHVhcnQuZ3JlZW5AZG9jY2VudHJpY3Mu Y29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVv dGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtw YWRkaW5nLWxlZnQ6MWV4Ij4KCkdyZWV0aW5ncyBBbGwsPGJyPgo8YnI+Ck5ldyB0byB0aGlzIGxp c3QhPGJyPgo8YnI+CkkgdGhpbmsgSSBtaWdodCBoYXZlIGZvdW5kIGFuIGlzc3VlIHdpdGggdGhl IKBTU0cgcG9saWN5IGNvbnRlbnQuPGJyPgo8YnI+ClN1bW1hcnk6IKBJZiB5b3UgZG8gbm90IGhh dmUgdGVsbmV0IGluc3RhbGxlZCBvbiB0aGUgc3lzdGVtIGl0IGNhdXNlcyBSdWxlIElEOiBkaXNh YmxlX3RlbG5ldF9zZXJ2aWNlIHRvIGZhaWwuPGJyPgo8YnI+Cjxicj4KPGJyPgpJbiBubyBwbGFj ZSBpbiB0aGlzIHJ1bGUgZG9lcyBpdCBjb25zaWRlciB0aGF0IHRlbG5ldCBtaWdodCBub3QgYmUg aW5zdGFsbGVkIGF0IGFsbCwgc28gaXQgZmFpbHMgKHJhdGhlciB0aGFuIGVycm9ycywgb3IgZXZl biBiZXR0ZXIgZG9lcyBhIGNoZWNrIGFzIGEgcHJlY3Vyc29yIHRvIHNlZSBpZiBpdHMgaW5zdGFs bGVkIGF0IGFsbCBhbmQgaWYgbm90IHBhc3NlcyEpPGJyPgo8YnI+Cjxicj4KZ3JlcCAmIzM5O2lk PSZxdW90O292YWw6c3NnOnRzdDoyMzEmcXVvdDsmIzM5OyBzc2ctcmhlbDYtb3ZhbC54bWwucmVz dWx0LnhtbDxicj4KoCCgIKAgJmx0O2luZC1kZWY6dGV4dGZpbGVjb250ZW50NTRfPHU+PC91PnRl c3QgaWQ9JnF1b3Q7b3ZhbDpzc2c6dHN0OjIzMSZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsg Y2hlY2tfZXhpc3RlbmNlPSZxdW90O2FsbF9leGlzdCZxdW90OyBjaGVjaz0mcXVvdDthbGwmcXVv dDsgY29tbWVudD0mcXVvdDtEaXNhYmxlIFRlbG5ldCBTZXJ2aWNlJnF1b3Q7Jmd0Ozxicj4KoCCg IKAgoCAmbHQ7dGVzdCB0ZXN0X2lkPSZxdW90O292YWw6c3NnOnRzdDoyMzEmcXVvdDsgdmVyc2lv bj0mcXVvdDsxJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDthbGxfZXhpc3QmcXVvdDsgY2hl Y2s9JnF1b3Q7YWxsJnF1b3Q7IHJlc3VsdD0mcXVvdDtmYWxzZSZxdW90Oy8mZ3Q7PGJyPgo8YnI+ Cjxicj4KoCCgIKAgoCAmbHQ7UnVsZSBpZD0mcXVvdDtkaXNhYmxlX3RlbG5ldF9zZXJ2aWNlJnF1 b3Q7IHNlbGVjdGVkPSZxdW90O2ZhbHNlJnF1b3Q7IHNldmVyaXR5PSZxdW90O2hpZ2gmcXVvdDsm Z3Q7PGJyPgqgIKAgoCCgIKAgJmx0O3RpdGxlIHhtbDpsYW5nPSZxdW90O2VuLVVTJnF1b3Q7Jmd0 O0Rpc2FibGUgdGVsbmV0IFNlcnZpY2UmbHQ7L3RpdGxlJmd0Ozxicj4KoCCgIKAgoCCgICZsdDtk ZXNjcmlwdGlvbiB4bWxuczp4aHRtbD0mcXVvdDs8YSBocmVmPSJodHRwOi8vd3d3LnczLm9yZy8x OTk5L3hodG1sIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3d3dy53My48dT48L3U+b3JnLzE5OTkv eGh0bWw8L2E+JnF1b3Q7IHhtbDpsYW5nPSZxdW90O2VuLVVTJnF1b3Q7Jmd0Ozxicj4KPGJyPgqg IKAgVGhlICZsdDt4aHRtbDpjb2RlJmd0O3RlbG5ldCZsdDsveGh0bWw6PHU+PC91PmNvZGUmZ3Q7 IHNlcnZpY2UgY2FuIGJlIGRpc2FibGVkIHdpdGggdGhlIGZvbGxvd2luZyBjb21tYW5kOjxicj4K PGJyPgqgIKAgJmx0O3hodG1sOnByZSZndDsjIGNoa2NvbmZpZyB0ZWxuZXQgb2ZmJmx0Oy94aHRt bDpwcmUmZ3Q7PGJyPgqgIKAgoCCgIKAgJmx0Oy9kZXNjcmlwdGlvbiZndDs8YnI+CqAgoCCgIKAg oCAmbHQ7cmVmZXJlbmNlIGhyZWY9JnF1b3Q7PGEgaHJlZj0iaHR0cDovL2NzcmMubmlzdC5nb3Yv cHVibGljYXRpb25zL25pc3RwdWJzLzgwMC01My1SZXYzL3NwODAwLTUzLXJldjMtZmluYWwucGRm IiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2NzcmMubmlzdC5nb3YvPHU+PC91PnB1YmxpY2F0aW9u cy9uaXN0cHVicy84MDAtNTMtPHU+PC91PlJldjMvc3A4MDAtNTMtcmV2My1maW5hbC5wZGY8L2E+ JnF1b3Q7Jmd0Ozx1PjwvdT5BQy0xNyg4KSZsdDsvcmVmZXJlbmNlJmd0Ozxicj4KCgqgIKAgoCCg IKAgJmx0O3JlZmVyZW5jZSBocmVmPSZxdW90OzxhIGhyZWY9Imh0dHA6Ly9jc3JjLm5pc3QuZ292 L3B1YmxpY2F0aW9ucy9uaXN0cHVicy84MDAtNTMtUmV2My9zcDgwMC01My1yZXYzLWZpbmFsLnBk ZiIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9jc3JjLm5pc3QuZ292Lzx1PjwvdT5wdWJsaWNhdGlv bnMvbmlzdHB1YnMvODAwLTUzLTx1PjwvdT5SZXYzL3NwODAwLTUzLXJldjMtZmluYWwucGRmPC9h PiZxdW90OyZndDs8dT48L3U+Q00tNyZsdDsvcmVmZXJlbmNlJmd0Ozxicj4KCgqgIKAgoCCgIKAg Jmx0O3JlZmVyZW5jZSBocmVmPSZxdW90OzxhIGhyZWY9Imh0dHA6Ly9jc3JjLm5pc3QuZ292L3B1 YmxpY2F0aW9ucy9uaXN0cHVicy84MDAtNTMtUmV2My9zcDgwMC01My1yZXYzLWZpbmFsLnBkZiIg dGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9jc3JjLm5pc3QuZ292Lzx1PjwvdT5wdWJsaWNhdGlvbnMv bmlzdHB1YnMvODAwLTUzLTx1PjwvdT5SZXYzL3NwODAwLTUzLXJldjMtZmluYWwucGRmPC9hPiZx dW90OyZndDs8dT48L3U+SUEtNSgxKShjKSZsdDsvcmVmZXJlbmNlJmd0Ozxicj4KCgqgIKAgoCCg IKAgJmx0O3JlZmVyZW5jZSBocmVmPSZxdW90OzxhIGhyZWY9Imh0dHA6Ly9pYXNlLmRpc2EubWls L2NjaS9pbmRleC5odG1sIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2lhc2UuZGlzYS5taWwvPHU+ PC91PmNjaS9pbmRleC5odG1sPC9hPiZxdW90OyZndDs2OCZsdDsvcmVmZXJlbmNlJmd0Ozxicj4K oCCgIKAgoCCgICZsdDtyZWZlcmVuY2UgaHJlZj0mcXVvdDs8YSBocmVmPSJodHRwOi8vaWFzZS5k aXNhLm1pbC9jY2kvaW5kZXguaHRtbCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9pYXNlLmRpc2Eu bWlsLzx1PjwvdT5jY2kvaW5kZXguaHRtbDwvYT4mcXVvdDsmZ3Q7MTQzNiZsdDsvPHU+PC91PnJl ZmVyZW5jZSZndDs8YnI+CqAgoCCgIKAgoCAmbHQ7cmVmZXJlbmNlIGhyZWY9JnF1b3Q7PGEgaHJl Zj0iaHR0cDovL2lhc2UuZGlzYS5taWwvY2NpL2luZGV4Lmh0bWwiIHRhcmdldD0iX2JsYW5rIj5o dHRwOi8vaWFzZS5kaXNhLm1pbC88dT48L3U+Y2NpL2luZGV4Lmh0bWw8L2E+JnF1b3Q7Jmd0OzE5 NyZsdDsvPHU+PC91PnJlZmVyZW5jZSZndDs8YnI+CqAgoCCgIKAgoCAmbHQ7cmVmZXJlbmNlIGhy ZWY9JnF1b3Q7PGEgaHJlZj0iaHR0cDovL2lhc2UuZGlzYS5taWwvY2NpL2luZGV4Lmh0bWwiIHRh cmdldD0iX2JsYW5rIj5odHRwOi8vaWFzZS5kaXNhLm1pbC88dT48L3U+Y2NpL2luZGV4Lmh0bWw8 L2E+JnF1b3Q7Jmd0Ozg3NyZsdDsvPHU+PC91PnJlZmVyZW5jZSZndDs8YnI+CqAgoCCgIKAgoCAm bHQ7cmVmZXJlbmNlIGhyZWY9JnF1b3Q7PGEgaHJlZj0iaHR0cDovL2lhc2UuZGlzYS5taWwvY2Np L2luZGV4Lmh0bWwiIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vaWFzZS5kaXNhLm1pbC88dT48L3U+ Y2NpL2luZGV4Lmh0bWw8L2E+JnF1b3Q7Jmd0Ozg4OCZsdDsvPHU+PC91PnJlZmVyZW5jZSZndDs8 YnI+CqAgoCCgIKAgoCAmbHQ7cmVmZXJlbmNlIHhtbG5zOmRjPSZxdW90OzxhIGhyZWY9Imh0dHA6 Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3B1cmwu b3JnL2RjLzx1PjwvdT5lbGVtZW50cy8xLjEvPC9hPiZxdW90OyBocmVmPSZxdW90O3Rlc3RfYXR0 ZXN0YXRpb24mcXVvdDsmZ3Q7PGJyPgqgIKAgoCCgIKAgoCAmbHQ7ZGM6Y29udHJpYnV0b3ImZ3Q7 RFMmbHQ7L2RjOjx1PjwvdT5jb250cmlidXRvciZndDs8YnI+CqAgoCCgIKAgoCCgICZsdDtkYzpk YXRlJmd0OzIwMTIxMDI2Jmx0Oy9kYzpkYXRlJmd0Ozxicj4KoCCgIKAgoCCgICZsdDsvcmVmZXJl bmNlJmd0Ozxicj4KPGJyPgqgIKAgoCCgIKAgJmx0O3JhdGlvbmFsZSB4bWxuczp4aHRtbD0mcXVv dDs8YSBocmVmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiB0YXJnZXQ9Il9ibGFuayI+ aHR0cDovL3d3dy53My48dT48L3U+b3JnLzE5OTkveGh0bWw8L2E+JnF1b3Q7IHhtbDpsYW5nPSZx dW90O2VuLVVTJnF1b3Q7Jmd0Ozxicj4KPGJyPgpUaGUgdGVsbmV0IHByb3RvY29sIHVzZXMgdW5l bmNyeXB0ZWQgbmV0d29yayBjb21tdW5pY2F0aW9uLCB3aGljaDxicj4KbWVhbnMgdGhhdCBkYXRh IGZyb20gdGhlIGxvZ2luIHNlc3Npb24sIGluY2x1ZGluZyBwYXNzd29yZHMgYW5kPGJyPgphbGwg b3RoZXIgaW5mb3JtYXRpb24gdHJhbnNtaXR0ZWQgZHVyaW5nIHRoZSBzZXNzaW9uLCBjYW4gYmU8 YnI+CnN0b2xlbiBieSBlYXZlc2Ryb3BwZXJzIG9uIHRoZSBuZXR3b3JrLiBUaGUgdGVsbmV0IHBy b3RvY29sIGlzIGFsc288YnI+CnN1YmplY3QgdG8gbWFuLWluLXRoZS1taWRkbGUgYXR0YWNrcy48 YnI+Cjxicj4KJmx0Oy9yYXRpb25hbGUmZ3Q7PGJyPgo8YnI+CqAgoCCgIKAgoCAmbHQ7aWRlbnQg c3lzdGVtPSZxdW90OzxhIGhyZWY9Imh0dHA6Ly9jY2UubWl0cmUub3JnIiB0YXJnZXQ9Il9ibGFu ayI+aHR0cDovL2NjZS5taXRyZS5vcmc8L2E+JnF1b3Q7Jmd0Ozx1PjwvdT5DQ0UtMjY4MzYtNyZs dDsvaWRlbnQmZ3Q7PGJyPgqgIKAgoCCgIKAgJmx0O2NoZWNrIHN5c3RlbT0mcXVvdDs8YSBocmVm PSJodHRwOi8vb3ZhbC5taXRyZS5vcmcvWE1MU2NoZW1hL292YWwtZGVmaW5pdGlvbnMtNSIgdGFy Z2V0PSJfYmxhbmsiPmh0dHA6Ly9vdmFsLm1pdHJlLm9yZy88dT48L3U+WE1MU2NoZW1hL292YWwt ZGVmaW5pdGlvbnMtNTwvYT4mcXVvdDsmZ3Q7PGJyPgqgIKAgoCCgIKAgoCAmbHQ7Y2hlY2stY29u dGVudC1yZWYgbmFtZT0mcXVvdDtvdmFsOnNzZzpkZWY6MjMwJnF1b3Q7IGhyZWY9JnF1b3Q7c3Nn LXJoZWw2LW92YWwueG1sJnF1b3Q7LyZndDs8YnI+CqAgoCCgIKAgoCAmbHQ7L2NoZWNrJmd0Ozxi cj4KPGJyPgqgIKAgoCCgIKAgJmx0O2NoZWNrIHN5c3RlbT0mcXVvdDtvY2lsLXRyYW5zaXRpb25h bCZxdW90OyZndDs8YnI+CqAgoCCgIKAgoCCgICZsdDtjaGVjay1leHBvcnQgZXhwb3J0LW5hbWU9 JnF1b3Q7dGhlIHNlcnZpY2UgaXMgcnVubmluZyZxdW90OyB2YWx1ZS1pZD0mcXVvdDtjb25kaXRp b25hbF9jbGF1c2UmcXVvdDsvPHU+PC91PiZndDs8YnI+CqAgoCCgIKAgoCCgICZsdDtjaGVjay1j b250ZW50IHhtbG5zOnhodG1sPSZxdW90OzxhIGhyZWY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkv eGh0bWwiIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vd3d3LnczLjx1PjwvdT5vcmcvMTk5OS94aHRt bDwvYT4mcXVvdDsmZ3Q7PGJyPgo8YnI+CqAgoCBUbyBjaGVjayB0aGF0IHRoZSAmbHQ7eGh0bWw6 Y29kZSZndDt0ZWxuZXQmbHQ7L3hodG1sOjx1PjwvdT5jb2RlJmd0OyBzZXJ2aWNlIGlzIGRpc2Fi bGVkIGluIHN5c3RlbSBib290IGNvbmZpZ3VyYXRpb24sIHJ1biB0aGUgZm9sbG93aW5nIGNvbW1h bmQ6PGJyPgqgIKAgJmx0O3hodG1sOnByZSZndDsjIGNoa2NvbmZpZyAmbHQ7eGh0bWw6Y29kZSZn dDt0ZWxuZXQmbHQ7L3hodG1sOjx1PjwvdT5jb2RlJmd0OyAtLWxpc3QmbHQ7L3hodG1sOnByZSZn dDs8YnI+CqAgoCBPdXRwdXQgc2hvdWxkIGluZGljYXRlIHRoZSAmbHQ7eGh0bWw6Y29kZSZndDt0 ZWxuZXQmbHQ7L3hodG1sOjx1PjwvdT5jb2RlJmd0OyBzZXJ2aWNlIGhhcyBlaXRoZXIgbm90IGJl ZW4gaW5zdGFsbGVkLDxicj4KoCCgIG9yIGhhcyBiZWVuIGRpc2FibGVkIGF0IGFsbCBydW5sZXZl bHMsIGFzIHNob3duIGluIHRoZSBleGFtcGxlIGJlbG93Ojxicj4KoCCgICZsdDt4aHRtbDpwcmUm Z3Q7IyBjaGtjb25maWcgJmx0O3hodG1sOmNvZGUmZ3Q7dGVsbmV0Jmx0Oy94aHRtbDo8dT48L3U+ Y29kZSZndDsgLS1saXN0PGJyPgombHQ7eGh0bWw6Y29kZSZndDt0ZWxuZXQmbHQ7L3hodG1sOjx1 PjwvdT5jb2RlJmd0OyCgIKAgoCAwOm9mZiCgIDE6b2ZmIDI6b2ZmIKAgMzpvZmYgoCA0Om9mZiCg IDU6b2ZmIKAgNjpvZmYmbHQ7L3hodG1sOnByZSZndDs8YnI+Cjxicj4KPGJyPgqgIKAgUnVuIHRo ZSBmb2xsb3dpbmcgY29tbWFuZCB0byB2ZXJpZnkgJmx0O3hodG1sOmNvZGUmZ3Q7dGVsbmV0Jmx0 Oy94aHRtbDo8dT48L3U+Y29kZSZndDsgaXMgZGlzYWJsZWQgdGhyb3VnaCBjdXJyZW50IHJ1bnRp bWUgY29uZmlndXJhdGlvbjo8YnI+Cjxicj4KoCCgICZsdDt4aHRtbDpwcmUmZ3Q7IyBzZXJ2aWNl IHRlbG5ldCBzdGF0dXMmbHQ7L3hodG1sOnByZSZndDs8YnI+Cjxicj4KoCCgIElmIHRoZSBzZXJ2 aWNlIGlzIGRpc2FibGVkIHRoZSBjb21tYW5kIHdpbGwgcmV0dXJuIHRoZSBmb2xsb3dpbmcgb3V0 cHV0Ojxicj4KPGJyPgqgIKAgJmx0O3hodG1sOnByZSZndDt0ZWxuZXQgaXMgc3RvcHBlZCZsdDsv eGh0bWw6cHJlJmd0Ozxicj4KoCCgIKAgoCCgICZsdDsvY2hlY2stY29udGVudCZndDs8YnI+CqAg oCCgIKAgoCAmbHQ7L2NoZWNrJmd0Ozxicj4KoCCgIKAgoCAmbHQ7L1J1bGUmZ3Q7PGJyPgo8YnI+ Cjxicj4KPGJyPgpDaGVlcnMsPGJyPgpTdHU8YnI+Cjxicj4KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPHU+PC91Pl9fX19fX19fX19fX19fX19fPGJyPgpzY2FwLXNlY3VyaXR5LWd1aWRl IG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlz dHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuPHU+PC91PmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2xp c3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRl IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQuPHU+PC91Pm9yZy9t YWlsbWFuL2xpc3RpbmZvL3NjYXAtPHU+PC91PnNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPC9ibG9j a3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============9137214706596639710==-- From shawn at redhat.com Thu Aug 20 11:34:43 2015 Content-Type: multipart/mixed; boundary="===============6075181604401531250==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Wed, 31 Jul 2013 23:09:16 -0400 Message-ID: <51F9D15C.1080909@redhat.com> In-Reply-To: CE1ECDF4.7808%PEAKE@HIPKLLC.COM --===============6075181604401531250== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/31/13 2:24 PM, Brian Peake wrote: > On 7/31/13 1:36 PM, "Shawn Wells" wrote: > > >> >On 7/31/13 11:31 AM, Stuart Green wrote: >>> >> >>> >>Ah-ha!! Thanks, I was looking for the buglist actually and couldn't >>> >>find it! >>> >> >>> >> >>> >>Glad to be aboard:) >> > >> > >> >Hm. Perhaps this whole thing can be simplified. >> > >> >Right now we have two checks: >> > - package_telnet-server_removed.xml >> > - service_telnetd_disabled.xml >> > >> >They seem redundant, and I'm failing to find reasons against just >> >deleting service_telnetd_disabled. There's no way telnet can be enabled >> >if the package isn't installed, right? >> > >> >Is there a reason to continue maintaining both checks? > Shawn, > I don't think so. I believe there are other checks that have the same > redundancy also=C2=8A Everything in the 'Obsolete Services' can trivially be migrated away to = a 'uninstall' rule: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guid= e.html#item-obsolete These would be: - xinetd - telnet-server - rsh-server - ypserv - tftp-server I'd wager much of the 'Base Services' fall under this too: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guid= e.html#item-base - abrt - acpid - certmonger - cgconfig - cgred - cpuspeed - haldaemon - irqbalance - kdump - mdmonitor - messagebus - netconsole - ntpdate - oddjobd - portreserve - psacct - quota_nld - rdisc - rhnsd - rhsmcertd - saslauthd - smartd - sysstat Can anyone think of why we'd want to have checks for*both* uninstall and = disabled? --===============6075181604401531250== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiA3LzMxLzEzIDI6MjQgUE0sIEJyaWFuIFBlYWtlIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOkNFMUVDREY0Ljc4MDglMjVQRUFLRUBISVBLTExDLkNP TSIgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj5PbiA3LzMxLzEzIDE6MzYgUE0sICJT aGF3biBXZWxscyIgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5r LXJmYzIzOTZFIiBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSI+Jmx0O3NoYXduQHJlZGhh dC5jb20mZ3Q7PC9hPiB3cm90ZToKCgo8L3ByZT4KICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSIgc3R5bGU9ImNvbG9yOiAjMDAwMDAwOyI+CiAgICAgICAgPHByZSB3cmFwPSIiPjxzcGFuIGNs YXNzPSJtb3otdHh0LWNpdGV0YWdzIj4mZ3Q7PC9zcGFuPk9uIDcvMzEvMTMgMTE6MzEgQU0sIFN0 dWFydCBHcmVlbiB3cm90ZToKPC9wcmU+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIg c3R5bGU9ImNvbG9yOiAjMDAwMDAwOyI+CiAgICAgICAgICA8cHJlIHdyYXA9IiI+PHNwYW4gY2xh c3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDsmZ3Q7PC9zcGFuPgo8c3BhbiBjbGFzcz0ibW96LXR4 dC1jaXRldGFncyI+Jmd0OyZndDsgPC9zcGFuPkFoLWhhISEgVGhhbmtzLCBJIHdhcyBsb29raW5n IGZvciB0aGUgYnVnbGlzdCBhY3R1YWxseSBhbmQgY291bGRuJ3QKPHNwYW4gY2xhc3M9Im1vei10 eHQtY2l0ZXRhZ3MiPiZndDsmZ3Q7IDwvc3Bhbj5maW5kIGl0IQo8c3BhbiBjbGFzcz0ibW96LXR4 dC1jaXRldGFncyI+Jmd0OyZndDs8L3NwYW4+CjxzcGFuIGNsYXNzPSJtb3otdHh0LWNpdGV0YWdz Ij4mZ3Q7Jmd0Ozwvc3Bhbj4KPHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDsmZ3Q7 IDwvc3Bhbj5HbGFkIHRvIGJlIGFib2FyZCA8c3BhbiBjbGFzcz0ibW96LXNtaWxleS1zMSIgdGl0 bGU9IjopIj48c3Bhbj46KTwvc3Bhbj48L3NwYW4+CjwvcHJlPgogICAgICAgIDwvYmxvY2txdW90 ZT4KICAgICAgICA8cHJlIHdyYXA9IiI+PHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZn dDs8L3NwYW4+CjxzcGFuIGNsYXNzPSJtb3otdHh0LWNpdGV0YWdzIj4mZ3Q7PC9zcGFuPgo8c3Bh biBjbGFzcz0ibW96LXR4dC1jaXRldGFncyI+Jmd0Ozwvc3Bhbj5IbS4gUGVyaGFwcyB0aGlzIHdo b2xlIHRoaW5nIGNhbiBiZSBzaW1wbGlmaWVkLgo8c3BhbiBjbGFzcz0ibW96LXR4dC1jaXRldGFn cyI+Jmd0Ozwvc3Bhbj4KPHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDs8L3NwYW4+ UmlnaHQgbm93IHdlIGhhdmUgdHdvIGNoZWNrczoKPHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRh Z3MiPiZndDsgPC9zcGFuPiAgICAtIHBhY2thZ2VfdGVsbmV0LXNlcnZlcl9yZW1vdmVkLnhtbAo8 c3BhbiBjbGFzcz0ibW96LXR4dC1jaXRldGFncyI+Jmd0OyA8L3NwYW4+ICAgIC0gc2VydmljZV90 ZWxuZXRkX2Rpc2FibGVkLnhtbAo8c3BhbiBjbGFzcz0ibW96LXR4dC1jaXRldGFncyI+Jmd0Ozwv c3Bhbj4KPHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDs8L3NwYW4+VGhleSBzZWVt IHJlZHVuZGFudCwgYW5kIEknbSBmYWlsaW5nIHRvIGZpbmQgcmVhc29ucyBhZ2FpbnN0IGp1c3QK PHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDs8L3NwYW4+ZGVsZXRpbmcgc2Vydmlj ZV90ZWxuZXRkX2Rpc2FibGVkLiBUaGVyZSdzIG5vIHdheSB0ZWxuZXQgY2FuIGJlIGVuYWJsZWQK PHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZndDs8L3NwYW4+aWYgdGhlIHBhY2thZ2Ug aXNuJ3QgaW5zdGFsbGVkLCByaWdodD8KPHNwYW4gY2xhc3M9Im1vei10eHQtY2l0ZXRhZ3MiPiZn dDs8L3NwYW4+CjxzcGFuIGNsYXNzPSJtb3otdHh0LWNpdGV0YWdzIj4mZ3Q7PC9zcGFuPklzIHRo ZXJlIGEgcmVhc29uIHRvIGNvbnRpbnVlIG1haW50YWluaW5nIGJvdGggY2hlY2tzPwo8L3ByZT4K ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8cHJlIHdyYXA9IiI+U2hhd24sCkkgZG9uJ3QgdGhp bmsgc28uIEkgYmVsaWV2ZSB0aGVyZSBhcmUgb3RoZXIgY2hlY2tzIHRoYXQgaGF2ZSB0aGUgc2Ft ZQpyZWR1bmRhbmN5IGFsc2/CijwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAg PGJyPgogICAgRXZlcnl0aGluZyBpbiB0aGUgJ09ic29sZXRlIFNlcnZpY2VzJyBjYW4gdHJpdmlh bGx5IGJlIG1pZ3JhdGVkIGF3YXkKICAgIHRvIGEgJ3VuaW5zdGFsbCcgcnVsZTo8YnI+CjxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9wZW9wbGUucmVkaGF0LmNv bS9zd2VsbHMvc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9vdXRwdXQvcmhlbDYtZ3VpZGUuaHRt bCNpdGVtLW9ic29sZXRlIj5odHRwOi8vcGVvcGxlLnJlZGhhdC5jb20vc3dlbGxzL3NjYXAtc2Vj dXJpdHktZ3VpZGUvUkhFTDYvb3V0cHV0L3JoZWw2LWd1aWRlLmh0bWwjaXRlbS1vYnNvbGV0ZTwv YT48YnI+CiAgICA8YnI+CiAgICBUaGVzZSB3b3VsZCBiZTo8YnI+CiAgICDCoMKgwqAgLSB4aW5l dGQ8YnI+CiAgICDCoMKgwqAgLSB0ZWxuZXQtc2VydmVyPGJyPgogICAgwqDCoMKgIC0gcnNoLXNl cnZlcjxicj4KICAgIMKgwqDCoCAtIHlwc2Vydjxicj4KICAgIMKgwqDCoCAtIHRmdHAtc2VydmVy PGJyPgogICAgPGJyPgogICAgSSdkIHdhZ2VyIG11Y2ggb2YgdGhlICdCYXNlIFNlcnZpY2VzJyBm YWxsIHVuZGVyIHRoaXMgdG9vOjxicj4KPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0iaHR0cDovL3Blb3BsZS5yZWRoYXQuY29tL3N3ZWxscy9zY2FwLXNlY3VyaXR5LWd1aWRl L1JIRUw2L291dHB1dC9yaGVsNi1ndWlkZS5odG1sI2l0ZW0tYmFzZSI+aHR0cDovL3Blb3BsZS5y ZWRoYXQuY29tL3N3ZWxscy9zY2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2L291dHB1dC9yaGVsNi1n dWlkZS5odG1sI2l0ZW0tYmFzZTwvYT48YnI+CiAgICDCoMKgwqAgLSBhYnJ0PGJyPgogICAgwqDC oMKgIC0gYWNwaWQ8YnI+CiAgICDCoMKgwqAgLSBjZXJ0bW9uZ2VyPGJyPgogICAgwqDCoMKgIC0g Y2djb25maWc8YnI+CiAgICDCoMKgwqAgLSBjZ3JlZDxicj4KICAgIMKgwqDCoCAtIGNwdXNwZWVk PGJyPgogICAgwqDCoMKgIC0gaGFsZGFlbW9uPGJyPgogICAgwqDCoMKgIC0gaXJxYmFsYW5jZSA8 YnI+CiAgICDCoMKgwqAgLSBrZHVtcDxicj4KICAgIMKgwqDCoCAtIG1kbW9uaXRvcjxicj4KICAg IMKgwqDCoCAtIG1lc3NhZ2VidXM8YnI+CiAgICDCoMKgwqAgLSBuZXRjb25zb2xlPGJyPgogICAg wqDCoMKgIC0gbnRwZGF0ZTxicj4KICAgIMKgwqDCoCAtIG9kZGpvYmQ8YnI+CiAgICDCoMKgwqAg LSBwb3J0cmVzZXJ2ZTxicj4KICAgIMKgwqDCoCAtIHBzYWNjdDxicj4KICAgIMKgwqDCoCAtIHF1 b3RhX25sZDxicj4KICAgIMKgwqDCoCAtIHJkaXNjPGJyPgogICAgwqDCoMKgIC0gcmhuc2Q8YnI+ CiAgICDCoMKgwqAgLSByaHNtY2VydGQ8YnI+CiAgICDCoMKgwqAgLSBzYXNsYXV0aGQ8YnI+CiAg ICDCoMKgwqAgLSBzbWFydGQ8YnI+CiAgICDCoMKgwqAgLSBzeXNzdGF0PGJyPgogICAgPGJyPgog ICAgQ2FuIGFueW9uZSB0aGluayBvZiB3aHkgd2UnZCB3YW50IHRvIGhhdmUgY2hlY2tzIGZvcjxi PiBib3RoPC9iPgogICAgdW5pbnN0YWxsIGFuZCBkaXNhYmxlZD88YnI+CiAgPC9ib2R5Pgo8L2h0 bWw+Cg== --===============6075181604401531250==-- From isimluk at fedoraproject.org Thu Aug 20 11:34:43 2015 Content-Type: multipart/mixed; boundary="===============2757450116492062739==" MIME-Version: 1.0 From: =?utf-8?q?=C5=A0imon_Luka=C5=A1=C3=ADk_=3Cisimluk_at_fedoraproject=2Eorg?= =?utf-8?q?=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Thu, 01 Aug 2013 18:22:53 +0200 Message-ID: <51FA8B5D.30200@fedoraproject.org> In-Reply-To: 51F9D15C.1080909@redhat.com --===============2757450116492062739== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2013 05:09 AM, Shawn Wells wrote: > On 7/31/13 2:24 PM, Brian Peake wrote: >> On 7/31/13 1:36 PM, "Shawn Wells" wrote: >> >> >>> >On 7/31/13 11:31 AM, Stuart Green wrote: >>>> >> >>>> >> Ah-ha!! Thanks, I was looking for the buglist actually and couldn't >>>> >> find it! >>>> >> >>>> >> >>>> >> Glad to be aboard :) >>> > >>> > >>> >Hm. Perhaps this whole thing can be simplified. >>> > >>> >Right now we have two checks: >>> > - package_telnet-server_removed.xml >>> > - service_telnetd_disabled.xml >>> > >>> >They seem redundant, and I'm failing to find reasons against just >>> >deleting service_telnetd_disabled. There's no way telnet can be enabled >>> >if the package isn't installed, right? >>> > >>> >Is there a reason to continue maintaining both checks? >> Shawn, >> I don't think so. I believe there are other checks that have the same >> redundancy also=C2=8A > = > = > Everything in the 'Obsolete Services' can trivially be migrated away to > a 'uninstall' rule: > http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-gu= ide.html#item-obsolete > = > These would be: > - xinetd > - telnet-server > - rsh-server > - ypserv > - tftp-server > = > I'd wager much of the 'Base Services' fall under this too: > http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-gu= ide.html#item-base > - abrt > - acpid > - certmonger > - cgconfig > - cgred > - cpuspeed > - haldaemon > - irqbalance > - kdump > - mdmonitor > - messagebus > - netconsole > - ntpdate > - oddjobd > - portreserve > - psacct > - quota_nld > - rdisc > - rhnsd > - rhsmcertd > - saslauthd > - smartd > - sysstat > = > Can anyone think of why we'd want to have checks for*both* uninstall and > disabled? > = I can think of a case why you may want to have both checks (although I am not sure If the reason will be appealing enough for you). The SSG is the most comprehensive and mature source of SCAP guidance for Linux. As such, SSG might be often taken as a starting point to build a guidance in an organization (ACME Corp). There will never be policy which fits them all. And some of the organizations will need to amend SSG here-and-there. OpenSCAP recently introduced tailoring feature, which allows you to have Profile element outside the Benchmark. That way you can have stock (signed) guidance (SSG presumably) and keep your own modification separated. This also allows for easier rebases (update of the SSG rpm). And here is my take: There might be organization which will need to have a package (like acpid) installed (for some inevitable monthly use-case) but they would agree that it should not be run by deafult. Such organization could easily use tailoring feature to turn-off the `uninstall` check. -- = Simon Lukasik Security Technologies --===============2757450116492062739==-- From chad.m.truhn.ctr at navy.mil Thu Aug 20 11:34:43 2015 Content-Type: multipart/mixed; boundary="===============5011450777235113581==" MIME-Version: 1.0 From: Truhn, Chad M CTR NSWCDD, CXA30 To: scap-security-guide at lists.fedorahosted.org Subject: RE: telnet section Date: Thu, 01 Aug 2013 12:44:41 -0400 Message-ID: <3B19C5019D6E384EB6A8838D621D6FFF02612D30@naeanrfkez36v.nadsusea.nads.navy.mil> In-Reply-To: 51FA8B5D.30200@fedoraproject.org --===============5011450777235113581== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable > And here is my take: There might be organization which will need to have = a package (like acpid) installed (for some inevitable monthly use-case) but= they would agree that it should not be run by deafult. Such organization c= ould easily use tailoring feature to turn-off the `uninstall` check. +1 I tried to come up with a way of saying this earlier, but couldn't figure o= ut a good way. I do know that people do use these guides for some in-house= policy creation stuff. That being said - I don't know if I am convinced the good (rare cases like = this) outweighs the harm (false positives and redundancy to the masses). - Chad --===============5011450777235113581==-- From isimluk at fedoraproject.org Thu Aug 20 11:34:44 2015 Content-Type: multipart/mixed; boundary="===============5753406191125384290==" MIME-Version: 1.0 From: =?utf-8?q?=C5=A0imon_Luka=C5=A1=C3=ADk_=3Cisimluk_at_fedoraproject=2Eorg?= =?utf-8?q?=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: telnet section Date: Mon, 05 Aug 2013 13:41:58 +0200 Message-ID: <51FF8F86.8050802@fedoraproject.org> In-Reply-To: 3B19C5019D6E384EB6A8838D621D6FFF02612D30@naeanrfkez36v.nadsusea.nads.navy.mil --===============5753406191125384290== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2013 06:44 PM, Truhn, Chad M CTR NSWCDD, CXA30 wrote: >> And here is my take: There might be organization which will need to have= a package (like acpid) installed (for some inevitable monthly use-case) bu= t they would agree that it should not be run by deafult. Such organization = could easily use tailoring feature to turn-off the `uninstall` check. > = > +1 > = > I tried to come up with a way of saying this earlier, but couldn't figure= out a good way. I do know that people do use these guides for some in-hou= se policy creation stuff. > = > That being said - I don't know if I am convinced the good (rare cases lik= e this) outweighs the harm (false positives and redundancy to the masses). > = The false positives can be easily avoided: Add a criterion to the `disabled` definition. That will point out to the test of `uninstalled` test. > - Chad > = > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > = --===============5753406191125384290==--