From shawn at redhat.com Thu Aug 20 11:32:53 2015 Content-Type: multipart/mixed; boundary="===============4119710555367573019==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml Date: Mon, 03 Dec 2012 18:55:59 -0500 Message-ID: <50BD3C0F.7070704@redhat.com> In-Reply-To: 20121203235431.GA18246@mail.corp.redhat.com --===============4119710555367573019== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 12/3/12 6:54 PM, Shawn Wells wrote: > In support of ticket 163 > https://fedorahosted.org/scap-security-guide/ticket/163 > > 0001-DISA-FSO-requested-updates-to-RHEL6-input-system-sof.patch > > > From 43c14d9a5474491d7241f105b496dafadf813403 Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Mon, 3 Dec 2012 20:51:52 -0500 > Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/softwar= e/updating.xml > DISA FSO requested updates to RHEL6/input/system/software/updating.xml > Thank you FSO for the copy editing! > > --- > RHEL6/input/system/software/updating.xml | 22 +++++++++++----------- > 1 files changed, 11 insertions(+), 11 deletions(-) > > diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/syste= m/software/updating.xml > index 4ed4123..9bb8611 100644 > --- a/RHEL6/input/system/software/updating.xml > +++ b/RHEL6/input/system/software/updating.xml > @@ -21,20 +21,20 @@ for this reason, their use is strongly encouraged. > > Ensure Red Hat GPG Key Installed > > -To ensure that the system can cryptographically verify base software > +To ensure the system can cryptographically verify base software > packages come from Red Hat (and to connect to the Red Hat Network to > receive them if desired), the Red Hat GPG key must properly be installe= d. > -To ensure that the GPG key is installed, run: > +To ensure the GPG key is installed, run: >
# rhn_register
>
> > -To ensure that the GPG key is installed, run: > +To ensure the GPG key is installed, run: >
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
> -The command should return the string: > +The command should return the string below: >
gpg(Red Hat, Inc. (release key <security(a)redhat.com>)
>
> > -This key is necessary to cryptographically verify that packages > +This key is necessary to cryptographically verify packages > are from Red Hat. > > > @@ -48,16 +48,16 @@ are from Red Hat. > ensure they have configured an update source! --> > > Ensure gpgcheck Enabled In Main Yum Configuration > -The gpgcheck option should be used to ensure that > +The gpgcheck option should be used to ensure > checking of an RPM package's signature always occurs prior to its > installation. To configure yum to check package signatures before insta= lling > -them, ensure that the following line appears in /etc/yum.conf in > +them, ensure the following line appears in /etc/yum.conf in > the [main] section: >
gpgcheck=3D1
>
> > To determine whether yum is configured to use gpgcheck, > -inspect /etc/yum.conf and ensure that the following appears in = the > +inspect /etc/yum.conf and ensure the following appears in the > [main] section: >
gpgcheck=3D1
> A value of 1 indicates that gpgcheck is enabled. Abse= nce of a > @@ -77,20 +77,20 @@ protects against malicious tampering. > = > > Ensure gpgcheck Enabled For All Yum Package Repositories > -To ensure that signature checking is not disabled for > +To ensure signature checking is not disabled for > any repos, remove any lines from files in /etc/yum.repos.d of = the form: >
gpgcheck=3D0
>
> > To determine whether yum has been configured to disable > gpgcheck for any repos, inspect all files in > -/etc/yum.repos.d and ensure that the following does not appear = in any > +/etc/yum.repos.d and ensure the following does not appear in any > sections: >
gpgcheck=3D0
> A value of 0 indicates that gpgcheck has been disable= d for that repo. >
> > -Ensuring that all packages' cryptographic signatures are valid prior to > +Ensuring all packages' cryptographic signatures are valid prior to > installation ensures the provenance of the software and > protects against malicious tampering. > > -- 1.7.1 Ack and pushed -- = Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn(a)redhat.com (c) 443.534.0130 --===============4119710555367573019== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMi8zLzEyIDY6NTQgUE0sIFNoYXduIFdlbGxzIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjIwMTIxMjAzMjM1NDMxLkdBMTgyNDZAbWFpbC5jb3Jw LnJlZGhhdC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4 dC1wbGFpbiIgd3JhcD0idHJ1ZSIgZ3JhcGhpY2FsLXF1b3RlPSJ0cnVlIgogICAgICAgIHN0eWxl PSJmb250LWZhbWlseTogLW1vei1maXhlZDsgZm9udC1zaXplOiAxMnB4OyIKICAgICAgICBsYW5n PSJ4LXdlc3Rlcm4iPgogICAgICAgIDxwcmUgd3JhcD0iIj5JbiBzdXBwb3J0IG9mIHRpY2tldCAx NjMKPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0 IiBocmVmPSJodHRwczovL2ZlZG9yYWhvc3RlZC5vcmcvc2NhcC1zZWN1cml0eS1ndWlkZS90aWNr ZXQvMTYzIj5odHRwczovL2ZlZG9yYWhvc3RlZC5vcmcvc2NhcC1zZWN1cml0eS1ndWlkZS90aWNr ZXQvMTYzPC9hPgo8L3ByZT4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0 IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PGxlZ2VuZAogICAgICAgICAgY2xhc3M9Im1p bWVBdHRhY2htZW50SGVhZGVyTmFtZSI+MDAwMS1ESVNBLUZTTy1yZXF1ZXN0ZWQtdXBkYXRlcy10 by1SSEVMNi1pbnB1dC1zeXN0ZW0tc29mLnBhdGNoPC9sZWdlbmQ+PC9maWVsZHNldD4KICAgICAg PGJyPgogICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4dC1wbGFpbiIgd3JhcD0idHJ1ZSIgZ3JhcGhp Y2FsLXF1b3RlPSJ0cnVlIgogICAgICAgIHN0eWxlPSJmb250LWZhbWlseTogLW1vei1maXhlZDsg Zm9udC1zaXplOiAxMnB4OyIKICAgICAgICBsYW5nPSJ4LXdlc3Rlcm4iPgogICAgICAgIDxwcmUg d3JhcD0iIj5Gcm9tIDQzYzE0ZDlhNTQ3NDQ5MWQ3MjQxZjEwNWI0OTZkYWZhZGY4MTM0MDMgTW9u IFNlcCAxNyAwMDowMDowMCAyMDAxCkZyb206IFNoYXduIFdlbGxzIDxhIG1vei1kby1ub3Qtc2Vu ZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOnNoYXdu QHJlZGhhdC5jb20iPiZsdDtzaGF3bkByZWRoYXQuY29tJmd0OzwvYT4KRGF0ZTogTW9uLCAzIERl YyAyMDEyIDIwOjUxOjUyIC0wNTAwClN1YmplY3Q6IFtQQVRDSF0gRElTQSBGU08gcmVxdWVzdGVk IHVwZGF0ZXMgdG8gUkhFTDYvaW5wdXQvc3lzdGVtL3NvZnR3YXJlL3VwZGF0aW5nLnhtbAogRElT QSBGU08gcmVxdWVzdGVkIHVwZGF0ZXMgdG8gUkhFTDYvaW5wdXQvc3lzdGVtL3NvZnR3YXJlL3Vw ZGF0aW5nLnhtbAogVGhhbmsgeW91IEZTTyBmb3IgdGhlIGNvcHkgZWRpdGluZyEKCi0tLQogUkhF TDYvaW5wdXQvc3lzdGVtL3NvZnR3YXJlL3VwZGF0aW5nLnhtbCB8ICAgMjIgKysrKysrKysrKyst LS0tLS0tLS0tLQogMSBmaWxlcyBjaGFuZ2VkLCAxMSBpbnNlcnRpb25zKCspLCAxMSBkZWxldGlv bnMoLSkKCmRpZmYgLS1naXQgYS9SSEVMNi9pbnB1dC9zeXN0ZW0vc29mdHdhcmUvdXBkYXRpbmcu eG1sIGIvUkhFTDYvaW5wdXQvc3lzdGVtL3NvZnR3YXJlL3VwZGF0aW5nLnhtbAppbmRleCA0ZWQ0 MTIzLi45YmI4NjExIDEwMDY0NAotLS0gYS9SSEVMNi9pbnB1dC9zeXN0ZW0vc29mdHdhcmUvdXBk YXRpbmcueG1sCisrKyBiL1JIRUw2L2lucHV0L3N5c3RlbS9zb2Z0d2FyZS91cGRhdGluZy54bWwK QEAgLTIxLDIwICsyMSwyMCBAQCBmb3IgdGhpcyByZWFzb24sIHRoZWlyIHVzZSBpcyBzdHJvbmds eSBlbmNvdXJhZ2VkLgogJmx0O1J1bGUgaWQ9ImVuc3VyZV9yZWRoYXRfZ3Bna2V5X2luc3RhbGxl ZCIgc2V2ZXJpdHk9ImhpZ2giJmd0OwogJmx0O3RpdGxlJmd0O0Vuc3VyZSBSZWQgSGF0IEdQRyBL ZXkgSW5zdGFsbGVkJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDsKLVRvIGVuc3Vy ZSB0aGF0IHRoZSBzeXN0ZW0gY2FuIGNyeXB0b2dyYXBoaWNhbGx5IHZlcmlmeSBiYXNlIHNvZnR3 YXJlCitUbyBlbnN1cmUgdGhlIHN5c3RlbSBjYW4gY3J5cHRvZ3JhcGhpY2FsbHkgdmVyaWZ5IGJh c2Ugc29mdHdhcmUKIHBhY2thZ2VzIGNvbWUgZnJvbSBSZWQgSGF0IChhbmQgdG8gY29ubmVjdCB0 byB0aGUgUmVkIEhhdCBOZXR3b3JrIHRvCiByZWNlaXZlIHRoZW0gaWYgZGVzaXJlZCksIHRoZSBS ZWQgSGF0IEdQRyBrZXkgbXVzdCBwcm9wZXJseSBiZSBpbnN0YWxsZWQuICAKLVRvIGVuc3VyZSB0 aGF0IHRoZSBHUEcga2V5IGlzIGluc3RhbGxlZCwgcnVuOgorVG8gZW5zdXJlIHRoZSBHUEcga2V5 IGlzIGluc3RhbGxlZCwgcnVuOgogJmx0O3ByZSZndDsjIHJobl9yZWdpc3RlciZsdDsvcHJlJmd0 OwogJmx0Oy9kZXNjcmlwdGlvbiZndDsKICZsdDtvY2lsIGNsYXVzZT0idGhlIFJlZCBIYXQgR1BH IEtleSBpc24ndCBpbnN0YWxsZWQiJmd0OwotVG8gZW5zdXJlIHRoYXQgdGhlIEdQRyBrZXkgaXMg aW5zdGFsbGVkLCBydW46CitUbyBlbnN1cmUgdGhlIEdQRyBrZXkgaXMgaW5zdGFsbGVkLCBydW46 CiAmbHQ7cHJlJmd0OyQgcnBtIC1xIC0tcXVlcnlmb3JtYXQgIiV7U1VNTUFSWX1cbiIgZ3BnLXB1 YmtleSZsdDsvcHJlJmd0OwotVGhlIGNvbW1hbmQgc2hvdWxkIHJldHVybiB0aGUgc3RyaW5nOgor VGhlIGNvbW1hbmQgc2hvdWxkIHJldHVybiB0aGUgc3RyaW5nIGJlbG93OgogJmx0O3ByZSZndDtn cGcoUmVkIEhhdCwgSW5jLiAocmVsZWFzZSBrZXkgJmFtcDtsdDtzZWN1cml0eUByZWRoYXQuY29t JmFtcDtndDspJmx0Oy9wcmUmZ3Q7CiAmbHQ7L29jaWwmZ3Q7CiAmbHQ7cmF0aW9uYWxlJmd0Owot VGhpcyBrZXkgaXMgbmVjZXNzYXJ5IHRvIGNyeXB0b2dyYXBoaWNhbGx5IHZlcmlmeSB0aGF0IHBh Y2thZ2VzCitUaGlzIGtleSBpcyBuZWNlc3NhcnkgdG8gY3J5cHRvZ3JhcGhpY2FsbHkgdmVyaWZ5 IHBhY2thZ2VzCiBhcmUgZnJvbSBSZWQgSGF0LgogJmx0Oy9yYXRpb25hbGUmZ3Q7CiAmbHQ7aWRl bnQgY2NlPSIxNDQ0MC0yIi8mZ3Q7CkBAIC00OCwxNiArNDgsMTYgQEAgYXJlIGZyb20gUmVkIEhh dC4KICAgICAgZW5zdXJlIHRoZXkgaGF2ZSBjb25maWd1cmVkIGFuIHVwZGF0ZSBzb3VyY2UhIC0t Jmd0OwogJmx0O1J1bGUgaWQ9ImVuc3VyZV9ncGdjaGVja19nbG9iYWxseV9hY3RpdmF0ZWQiIHNl dmVyaXR5PSJoaWdoIiZndDsKICZsdDt0aXRsZSZndDtFbnN1cmUgZ3BnY2hlY2sgRW5hYmxlZCBJ biBNYWluIFl1bSBDb25maWd1cmF0aW9uJmx0Oy90aXRsZSZndDsKLSZsdDtkZXNjcmlwdGlvbiZn dDtUaGUgJmx0O3R0Jmd0O2dwZ2NoZWNrJmx0Oy90dCZndDsgb3B0aW9uIHNob3VsZCBiZSB1c2Vk IHRvIGVuc3VyZSB0aGF0CismbHQ7ZGVzY3JpcHRpb24mZ3Q7VGhlICZsdDt0dCZndDtncGdjaGVj ayZsdDsvdHQmZ3Q7IG9wdGlvbiBzaG91bGQgYmUgdXNlZCB0byBlbnN1cmUKIGNoZWNraW5nIG9m IGFuIFJQTSBwYWNrYWdlJ3Mgc2lnbmF0dXJlIGFsd2F5cyBvY2N1cnMgcHJpb3IgdG8gaXRzCiBp bnN0YWxsYXRpb24uIFRvIGNvbmZpZ3VyZSB5dW0gdG8gY2hlY2sgcGFja2FnZSBzaWduYXR1cmVz IGJlZm9yZSBpbnN0YWxsaW5nCi10aGVtLCBlbnN1cmUgdGhhdCB0aGUgZm9sbG93aW5nIGxpbmUg YXBwZWFycyBpbiAmbHQ7dHQmZ3Q7L2V0Yy95dW0uY29uZiZsdDsvdHQmZ3Q7IGluCit0aGVtLCBl bnN1cmUgdGhlIGZvbGxvd2luZyBsaW5lIGFwcGVhcnMgaW4gJmx0O3R0Jmd0Oy9ldGMveXVtLmNv bmYmbHQ7L3R0Jmd0OyBpbgogdGhlICZsdDt0dCZndDtbbWFpbl0mbHQ7L3R0Jmd0OyBzZWN0aW9u OgogJmx0O3ByZSZndDtncGdjaGVjaz0xJmx0Oy9wcmUmZ3Q7CiAmbHQ7L2Rlc2NyaXB0aW9uJmd0 OwogJmx0O29jaWwgY2xhdXNlPSJHUEcgY2hlY2tpbmcgaXNuJ3QgZW5hYmxlZCImZ3Q7CiBUbyBk ZXRlcm1pbmUgd2hldGhlciAmbHQ7dHQmZ3Q7eXVtJmx0Oy90dCZndDsgaXMgY29uZmlndXJlZCB0 byB1c2UgJmx0O3R0Jmd0O2dwZ2NoZWNrJmx0Oy90dCZndDssCi1pbnNwZWN0ICZsdDt0dCZndDsv ZXRjL3l1bS5jb25mJmx0Oy90dCZndDsgYW5kIGVuc3VyZSB0aGF0IHRoZSBmb2xsb3dpbmcgYXBw ZWFycyBpbiB0aGUKK2luc3BlY3QgJmx0O3R0Jmd0Oy9ldGMveXVtLmNvbmYmbHQ7L3R0Jmd0OyBh bmQgZW5zdXJlIHRoZSBmb2xsb3dpbmcgYXBwZWFycyBpbiB0aGUKICZsdDt0dCZndDtbbWFpbl0m bHQ7L3R0Jmd0OyBzZWN0aW9uOgogJmx0O3ByZSZndDtncGdjaGVjaz0xJmx0Oy9wcmUmZ3Q7CiBB IHZhbHVlIG9mICZsdDt0dCZndDsxJmx0Oy90dCZndDsgaW5kaWNhdGVzIHRoYXQgJmx0O3R0Jmd0 O2dwZ2NoZWNrJmx0Oy90dCZndDsgaXMgZW5hYmxlZC4gQWJzZW5jZSBvZiBhCkBAIC03NywyMCAr NzcsMjAgQEAgcHJvdGVjdHMgYWdhaW5zdCBtYWxpY2lvdXMgdGFtcGVyaW5nLgogCiAmbHQ7UnVs ZSBpZD0iZW5zdXJlX2dwZ2NoZWNrX25ldmVyX2Rpc2FibGVkIiBzZXZlcml0eT0iaGlnaCImZ3Q7 CiAmbHQ7dGl0bGUmZ3Q7RW5zdXJlIGdwZ2NoZWNrIEVuYWJsZWQgRm9yIEFsbCBZdW0gUGFja2Fn ZSBSZXBvc2l0b3JpZXMmbHQ7L3RpdGxlJmd0OwotJmx0O2Rlc2NyaXB0aW9uJmd0O1RvIGVuc3Vy ZSB0aGF0IHNpZ25hdHVyZSBjaGVja2luZyBpcyBub3QgZGlzYWJsZWQgZm9yCismbHQ7ZGVzY3Jp cHRpb24mZ3Q7VG8gZW5zdXJlIHNpZ25hdHVyZSBjaGVja2luZyBpcyBub3QgZGlzYWJsZWQgZm9y CiBhbnkgcmVwb3MsIHJlbW92ZSBhbnkgbGluZXMgZnJvbSBmaWxlcyBpbiAmbHQ7dHQmZ3Q7L2V0 Yy95dW0ucmVwb3MuZCZsdDsvdHQmZ3Q7IG9mIHRoZSBmb3JtOgogJmx0O3ByZSZndDtncGdjaGVj az0wJmx0Oy9wcmUmZ3Q7CiAmbHQ7L2Rlc2NyaXB0aW9uJmd0OwogJmx0O29jaWwgY2xhdXNlPSJH UEcgY2hlY2tpbmcgaXMgZGlzYWJsZWQiJmd0OwogVG8gZGV0ZXJtaW5lIHdoZXRoZXIgJmx0O3R0 Jmd0O3l1bSZsdDsvdHQmZ3Q7IGhhcyBiZWVuIGNvbmZpZ3VyZWQgdG8gZGlzYWJsZQogJmx0O3R0 Jmd0O2dwZ2NoZWNrJmx0Oy90dCZndDsgZm9yIGFueSByZXBvcywgIGluc3BlY3QgYWxsIGZpbGVz IGluCi0mbHQ7dHQmZ3Q7L2V0Yy95dW0ucmVwb3MuZCZsdDsvdHQmZ3Q7IGFuZCBlbnN1cmUgdGhh dCB0aGUgZm9sbG93aW5nIGRvZXMgbm90IGFwcGVhciBpbiBhbnkKKyZsdDt0dCZndDsvZXRjL3l1 bS5yZXBvcy5kJmx0Oy90dCZndDsgYW5kIGVuc3VyZSB0aGUgZm9sbG93aW5nIGRvZXMgbm90IGFw cGVhciBpbiBhbnkKIHNlY3Rpb25zOgogJmx0O3ByZSZndDtncGdjaGVjaz0wJmx0Oy9wcmUmZ3Q7 CiBBIHZhbHVlIG9mICZsdDt0dCZndDswJmx0Oy90dCZndDsgaW5kaWNhdGVzIHRoYXQgJmx0O3R0 Jmd0O2dwZ2NoZWNrJmx0Oy90dCZndDsgaGFzIGJlZW4gZGlzYWJsZWQgZm9yIHRoYXQgcmVwby4g CiAmbHQ7L29jaWwmZ3Q7CiAmbHQ7cmF0aW9uYWxlJmd0OwotRW5zdXJpbmcgdGhhdCBhbGwgcGFj a2FnZXMnIGNyeXB0b2dyYXBoaWMgc2lnbmF0dXJlcyBhcmUgdmFsaWQgcHJpb3IgdG8KK0Vuc3Vy aW5nIGFsbCBwYWNrYWdlcycgY3J5cHRvZ3JhcGhpYyBzaWduYXR1cmVzIGFyZSB2YWxpZCBwcmlv ciB0bwogaW5zdGFsbGF0aW9uIGVuc3VyZXMgdGhlIHByb3ZlbmFuY2Ugb2YgdGhlIHNvZnR3YXJl IGFuZAogcHJvdGVjdHMgYWdhaW5zdCBtYWxpY2lvdXMgdGFtcGVyaW5nLgogJmx0Oy9yYXRpb25h bGUmZ3Q7CjxkaXYgY2xhc3M9Im1vei10eHQtc2lnIj4tLSAKMS43LjEKCjwvZGl2PjwvcHJlPgog ICAgICA8L2Rpdj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIEFjayBhbmQgcHVzaGVk PGJyPgogICAgPGJyPgogICAgPHByZSBjbGFzcz0ibW96LXNpZ25hdHVyZSIgY29scz0iNzIiPi0t IApTaGF3biBXZWxscwpUZWNobmljYWwgRGlyZWN0b3IsClUuUy4gSW50ZWxsaWdlbmNlIFByb2dy YW1zCihlKSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86 c2hhd25AcmVkaGF0LmNvbSI+c2hhd25AcmVkaGF0LmNvbTwvYT4KKGMpIDQ0My41MzQuMDEzMDwv cHJlPgogIDwvYm9keT4KPC9odG1sPgo= --===============4119710555367573019==--