From jlieskov at redhat.com Thu Aug 20 11:37:11 2015 Content-Type: multipart/mixed; boundary="===============4808263681891981183==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [RHEL/6] Start using package_rsh_removed OVAL check [RHEL/7] Define new XCCDF rule package_rsh_removed [shared] Move the RHEL-6 specific check to be shared one Date: Mon, 02 Jun 2014 04:54:13 -0400 Message-ID: <1835333146.24366608.1401699253457.JavaMail.zimbra@redhat.com> In-Reply-To: 53893B2C.9060907@redhat.com --===============4808263681891981183== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Saturday, May 31, 2014 4:15:08 AM > Subject: Re: [PATCH] [RHEL/6] Start using package_rsh_removed OVAL check = [RHEL/7] Define new XCCDF rule > package_rsh_removed [shared] Move the RHEL-6 specific check to be shared = one > = > = > On 5/30/14, 7:16 AM, Jan Lieskovsky wrote: > = > = > = > Proposed patch adds (previously missing) package_rsh_removed XCCDF refere= nce > to > already existing OVAL check with same name. Also defines the same XCCDF r= ule > for > RHEL-7. Yet moves the original RHEL-6 specific package_rsh_removed OVAL c= heck > to > be shared one. > = > Change has been tested on RHEL/6 & RHEL/7, rpms build correctly, underlyi= ng > rule > seems to work as expected (on both products). > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > 0001-RHEL-6-Start-using-package_rsh_removed-OVAL-check.patch > From d83bf8ee28da32bdf93af66cb2a9e578ddcbd889 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky Date: Fri, 30 May 2014 13:07= :42 > +0200 > Subject: [PATCH] [RHEL/6] Start using package_rsh_removed OVAL check [RHE= L/7] > Define new XCCDF rule package_rsh_removed [shared] Move the RHEL-6 speci= fic > check to be shared one > = > Signed-off-by: Jan Lieskovsky --- > RHEL/6/input/checks/package_rsh_removed.xml | 27 +----------------------= ---- > RHEL/6/input/services/obsolete.xml | 4 +++- > RHEL/7/input/checks/package_rsh_removed.xml | 1 + > RHEL/7/input/services/obsolete.xml | 17 +++++++++++++++++ > shared/oval/package_rsh_removed.xml | 27 +++++++++++++++++++++++= ++++ > 5 files changed, 49 insertions(+), 27 deletions(-) > mode change 100644 =3D> 120000 RHEL/6/input/checks/package_rsh_removed.x= ml > create mode 120000 RHEL/7/input/checks/package_rsh_removed.xml > create mode 100644 shared/oval/package_rsh_removed.xml > = > diff --git a/RHEL/6/input/checks/package_rsh_removed.xml > b/RHEL/6/input/checks/package_rsh_removed.xml > deleted file mode 100644 > index 11ae275..0000000 > --- a/RHEL/6/input/checks/package_rsh_removed.xml > +++ /dev/null > @@ -1,26 +0,0 @@ > - > - > - - version=3D"1"> > - > - Package rsh Removed > - > - Red Hat Enterprise Linux 6 > - > - The RPM package rsh should be removed. > - ref_url=3D"test_attestation"/> > - > - > - - test_ref=3D"test_package_rsh_removed" /> > - > - > - - id=3D"test_package_rsh_removed" version=3D"1" > - comment=3D"package rsh is removed"> > - > - > - > - rsh > - > - > diff --git a/RHEL/6/input/checks/package_rsh_removed.xml > b/RHEL/6/input/checks/package_rsh_removed.xml > new file mode 120000 > index 0000000..3b94a20 > --- /dev/null > +++ b/RHEL/6/input/checks/package_rsh_removed.xml > @@ -0,0 +1 @@ > +../../../../shared/oval/package_rsh_removed.xml > \ No newline at end of file > diff --git a/RHEL/6/input/services/obsolete.xml > b/RHEL/6/input/services/obsolete.xml > index ee980d4..c2e5b15 100644 > --- a/RHEL/6/input/services/obsolete.xml > +++ b/RHEL/6/input/services/obsolete.xml > @@ -186,7 +186,7 @@ stolen by eavesdroppers on the network. > > = > > -Remove rsh > +Uninstal rsh Package > The rsh package contains the client commands > for the rsh services > > @@ -198,6 +198,8 @@ their credentials. Note that removing the rsh > package removes > the clients for rsh,rcp, and rlogin. > > > + > + > > = > > diff --git a/RHEL/7/input/checks/package_rsh_removed.xml > b/RHEL/7/input/checks/package_rsh_removed.xml > new file mode 120000 > index 0000000..3b94a20 > --- /dev/null > +++ b/RHEL/7/input/checks/package_rsh_removed.xml > @@ -0,0 +1 @@ > +../../../../shared/oval/package_rsh_removed.xml > \ No newline at end of file > diff --git a/RHEL/7/input/services/obsolete.xml > b/RHEL/7/input/services/obsolete.xml > index 84ced10..888162d 100644 > --- a/RHEL/7/input/services/obsolete.xml > +++ b/RHEL/7/input/services/obsolete.xml > @@ -170,6 +170,23 @@ stolen by eavesdroppers on the network. > > > = > + > +Uninstal rsh Package > +The rsh package contains the client commands > +for the rsh services > + > +These legacy clients contain numerous security exposures and = have > +been replaced with the more secure SSH package. Even if the server is > removed, > +it is best to ensure the clients are also removed to prevent users from > +inadvertently attempting to use these commands and therefore exposing > +their credentials. Note that removing the rsh package removes > +the clients for rsh,rcp, and rlogin. > + > + > + > + > + > + > > Disable rlogin Service > The rlogin service, which is available with > diff --git a/shared/oval/package_rsh_removed.xml > b/shared/oval/package_rsh_removed.xml > new file mode 100644 > index 0000000..9f739ef > --- /dev/null > +++ b/shared/oval/package_rsh_removed.xml > @@ -0,0 +1,27 @@ > + > + > + + version=3D"1"> > + > + Package rsh Removed > + > + Red Hat Enterprise Linux 6 > + Red Hat Enterprise Linux 7 > + > + The RPM package rsh should be removed. > + > + > + > + + test_ref=3D"test_package_rsh_removed" /> > + > + > + + id=3D"test_package_rsh_removed" version=3D"1" > + comment=3D"package rsh is removed"> > + > + > + > + rsh > + > + > -- > 1.8.3.1 > = > ack Thanks, pushed. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============4808263681891981183==--