From shawn at redhat.com Thu Aug 20 11:32:51 2015 Content-Type: multipart/mixed; boundary="===============4204841655029928515==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 11/13] DISA FSO provided copy editing of RHEL6/input/services/nfs.xml Date: Fri, 16 Nov 2012 18:16:01 -0500 Message-ID: <50A6C931.4050404@redhat.com> In-Reply-To: 20121116225508.GA5802@mail.corp.redhat.com --===============4204841655029928515== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/16/12 5:55 PM, Shawn Wells wrote: > > 0011-DISA-FSO-provided-copy-editing-of-RHEL6-input-servic.patch > > > From 264bee24b0e6efe8eab509258cbec205bf6ff6ff Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Fri, 16 Nov 2012 07:34:55 -0500 > Subject: [PATCH 11/13] DISA FSO provided copy editing of RHEL6/input/serv= ices/nfs.xml > > --- > RHEL6/input/services/nfs.xml | 10 +++++----- > 1 files changed, 5 insertions(+), 5 deletions(-) > > diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml > index fa0af28..c67abd0 100644 > --- a/RHEL6/input/services/nfs.xml > +++ b/RHEL6/input/services/nfs.xml > @@ -69,7 +69,7 @@ this service should be disabled. > > Disable netfs if Possible > To determine if any network filesystems handled by netfs a= re > -currently mounted on the system execute the following command: > +currently mounted on the system execute the following command. >
# mount -t nfs,nfs4,smbfs,cifs,ncpfs
> If the command did not return any output then disable netfs. >
> @@ -109,7 +109,7 @@ NFSv2, NIS (see Section 3.2.4 for information about N= IS, which is not > recommended), or any third-party or custom RPC-based program. If none o= f these > programs are in use, however, rpcbind should be disabled to improve sys= tem > security. In order to get more information about whether rpcbind may be > -disabled on a given host, query rpcbind using the command: > +disabled on a given host, query rpcbind using the following command. >
# rpcinfo -p
> If the only services listed are portmapper and status, it is safe to di= sable > rpcbind. If other services are listed and your site is not running NFS = or NIS, > @@ -344,7 +344,7 @@ server. > > > > -To verify that the nodev option is configured for all NFS mount= s, run the following command: > +To verify the nodev option is configured for all NFS mounts, ru= n the following command. >
$ mount  | grep nfs
> All NFS mounts should show the nodev setting in parentheses. >
> @@ -361,7 +361,7 @@ should not present device files to users. > > > > -To verify that the nosuid option is configured for all NFS moun= ts, run the following command: > +To verify the nosuid option is configured for all NFS mounts, r= un the following command. >
$ mount  | grep nfs
> All NFS mounts should show the nosuid setting in parentheses. >
> @@ -484,7 +484,7 @@ Remove any instances of the > insecure_locks option from the file /etc/exports. > > > -To verify that insecure file locking has been disabled, run the followin= g command: > +To verify insecure file locking has been disabled, run the following com= mand. >
# grep insecure_locks /etc/exports
>
> Allowing insecure file locking could allow for sensitive dat= a to be > -- 1.7.1 Ack (note these patches were created by FSO, not myself. I only posted = publicly.) --===============4204841655029928515== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMS8xNi8xMiA1OjU1IFBNLCBTaGF3biBXZWxscyB3cm90ZTo8YnI+CiAgICA8L2Rpdj4K ICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDoyMDEyMTExNjIyNTUwOC5HQTU4MDJAbWFpbC5jb3Jw LnJlZGhhdC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNl dCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjxsZWdlbmQKICAgICAgICAgIGNsYXNzPSJt aW1lQXR0YWNobWVudEhlYWRlck5hbWUiPjAwMTEtRElTQS1GU08tcHJvdmlkZWQtY29weS1lZGl0 aW5nLW9mLVJIRUw2LWlucHV0LXNlcnZpYy5wYXRjaDwvbGVnZW5kPjwvZmllbGRzZXQ+CiAgICAg IDxicj4KICAgICAgPGRpdiBjbGFzcz0ibW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBo aWNhbC1xdW90ZT0idHJ1ZSIKICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7 IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgbGFuZz0ieC13ZXN0ZXJuIj4KICAgICAgICA8cHJl IHdyYXA9IiI+RnJvbSAyNjRiZWUyNGIwZTZlZmU4ZWFiNTA5MjU4Y2JlYzIwNWJmNmZmNmZmIE1v biBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBTaGF3biBXZWxscyA8YSBtb3otZG8tbm90LXNl bmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpzaGF3 bkByZWRoYXQuY29tIj4mbHQ7c2hhd25AcmVkaGF0LmNvbSZndDs8L2E+CkRhdGU6IEZyaSwgMTYg Tm92IDIwMTIgMDc6MzQ6NTUgLTA1MDAKU3ViamVjdDogW1BBVENIIDExLzEzXSBESVNBIEZTTyBw cm92aWRlZCBjb3B5IGVkaXRpbmcgb2YgUkhFTDYvaW5wdXQvc2VydmljZXMvbmZzLnhtbAoKLS0t CiBSSEVMNi9pbnB1dC9zZXJ2aWNlcy9uZnMueG1sIHwgICAxMCArKysrKy0tLS0tCiAxIGZpbGVz IGNoYW5nZWQsIDUgaW5zZXJ0aW9ucygrKSwgNSBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9S SEVMNi9pbnB1dC9zZXJ2aWNlcy9uZnMueG1sIGIvUkhFTDYvaW5wdXQvc2VydmljZXMvbmZzLnht bAppbmRleCBmYTBhZjI4Li5jNjdhYmQwIDEwMDY0NAotLS0gYS9SSEVMNi9pbnB1dC9zZXJ2aWNl cy9uZnMueG1sCisrKyBiL1JIRUw2L2lucHV0L3NlcnZpY2VzL25mcy54bWwKQEAgLTY5LDcgKzY5 LDcgQEAgdGhpcyBzZXJ2aWNlIHNob3VsZCBiZSBkaXNhYmxlZC4KICZsdDtHcm91cCBpZD0iZGlz YWJsaW5nX25ldGZzIiZndDsKICZsdDt0aXRsZSZndDtEaXNhYmxlIG5ldGZzIGlmIFBvc3NpYmxl Jmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDtUbyBkZXRlcm1pbmUgaWYgYW55IG5l dHdvcmsgZmlsZXN5c3RlbXMgaGFuZGxlZCBieSBuZXRmcyBhcmUKLWN1cnJlbnRseSBtb3VudGVk IG9uIHRoZSBzeXN0ZW0gZXhlY3V0ZSB0aGUgZm9sbG93aW5nIGNvbW1hbmQ6CitjdXJyZW50bHkg bW91bnRlZCBvbiB0aGUgc3lzdGVtIGV4ZWN1dGUgdGhlIGZvbGxvd2luZyBjb21tYW5kLgogJmx0 O3ByZSZndDsjIG1vdW50IC10IG5mcyxuZnM0LHNtYmZzLGNpZnMsbmNwZnMmbHQ7L3ByZSZndDsK IElmIHRoZSBjb21tYW5kIGRpZCBub3QgcmV0dXJuIGFueSBvdXRwdXQgdGhlbiBkaXNhYmxlIG5l dGZzLgogJmx0Oy9kZXNjcmlwdGlvbiZndDsKQEAgLTEwOSw3ICsxMDksNyBAQCBORlN2MiwgTklT IChzZWUgU2VjdGlvbiAzLjIuNCBmb3IgaW5mb3JtYXRpb24gYWJvdXQgTklTLCB3aGljaCBpcyBu b3QKIHJlY29tbWVuZGVkKSwgb3IgYW55IHRoaXJkLXBhcnR5IG9yIGN1c3RvbSBSUEMtYmFzZWQg cHJvZ3JhbS4gSWYgbm9uZSBvZiB0aGVzZQogcHJvZ3JhbXMgYXJlIGluIHVzZSwgaG93ZXZlciwg cnBjYmluZCBzaG91bGQgYmUgZGlzYWJsZWQgdG8gaW1wcm92ZSBzeXN0ZW0KIHNlY3VyaXR5LiAg SW4gb3JkZXIgdG8gZ2V0IG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgd2hldGhlciBycGNiaW5kIG1h eSBiZQotZGlzYWJsZWQgb24gYSBnaXZlbiBob3N0LCBxdWVyeSBycGNiaW5kIHVzaW5nIHRoZSBj b21tYW5kOgorZGlzYWJsZWQgb24gYSBnaXZlbiBob3N0LCBxdWVyeSBycGNiaW5kIHVzaW5nIHRo ZSBmb2xsb3dpbmcgY29tbWFuZC4KICZsdDtwcmUmZ3Q7IyBycGNpbmZvIC1wJmx0Oy9wcmUmZ3Q7 CiBJZiB0aGUgb25seSBzZXJ2aWNlcyBsaXN0ZWQgYXJlIHBvcnRtYXBwZXIgYW5kIHN0YXR1cywg aXQgaXMgc2FmZSB0byBkaXNhYmxlCiBycGNiaW5kLiBJZiBvdGhlciBzZXJ2aWNlcyBhcmUgbGlz dGVkIGFuZCB5b3VyIHNpdGUgaXMgbm90IHJ1bm5pbmcgTkZTIG9yIE5JUywKQEAgLTM0NCw3ICsz NDQsNyBAQCBzZXJ2ZXIuJmx0Oy9kZXNjcmlwdGlvbiZndDsKICZsdDttb3VudC1kZXNjLW1hY3Jv IG9wdGlvbj0ibm9kZXYiIHBhcnQ9ImFueSBORlMgbW91bnRzIiAvJmd0OwogJmx0Oy9kZXNjcmlw dGlvbiZndDsKICZsdDtvY2lsIGNsYXVzZT0idGhlIHNldHRpbmcgZG9lcyBub3Qgc2hvdyImZ3Q7 Ci1UbyB2ZXJpZnkgdGhhdCB0aGUgJmx0O3R0Jmd0O25vZGV2Jmx0Oy90dCZndDsgb3B0aW9uIGlz IGNvbmZpZ3VyZWQgZm9yIGFsbCBORlMgbW91bnRzLCBydW4gdGhlIGZvbGxvd2luZyBjb21tYW5k OgorVG8gdmVyaWZ5IHRoZSAmbHQ7dHQmZ3Q7bm9kZXYmbHQ7L3R0Jmd0OyBvcHRpb24gaXMgY29u ZmlndXJlZCBmb3IgYWxsIE5GUyBtb3VudHMsIHJ1biB0aGUgZm9sbG93aW5nIGNvbW1hbmQuCiAm bHQ7cHJlJmd0OyQgbW91bnQgIHwgZ3JlcCBuZnMmbHQ7L3ByZSZndDsKIEFsbCBORlMgbW91bnRz IHNob3VsZCBzaG93IHRoZSAmbHQ7dHQmZ3Q7bm9kZXYmbHQ7L3R0Jmd0OyBzZXR0aW5nIGluIHBh cmVudGhlc2VzLgogJmx0Oy9vY2lsJmd0OwpAQCAtMzYxLDcgKzM2MSw3IEBAIHNob3VsZCBub3Qg cHJlc2VudCBkZXZpY2UgZmlsZXMgdG8gdXNlcnMuJmx0Oy9yYXRpb25hbGUmZ3Q7CiAmbHQ7bW91 bnQtZGVzYy1tYWNybyBvcHRpb249Im5vc3VpZCIgcGFydD0iYW55IE5GUyBtb3VudHMiIC8mZ3Q7 CiAmbHQ7L2Rlc2NyaXB0aW9uJmd0OwogJmx0O29jaWwgY2xhdXNlPSJ0aGUgc2V0dGluZyBkb2Vz IG5vdCBzaG93IiZndDsKLVRvIHZlcmlmeSB0aGF0IHRoZSAmbHQ7dHQmZ3Q7bm9zdWlkJmx0Oy90 dCZndDsgb3B0aW9uIGlzIGNvbmZpZ3VyZWQgZm9yIGFsbCBORlMgbW91bnRzLCBydW4gdGhlIGZv bGxvd2luZyBjb21tYW5kOgorVG8gdmVyaWZ5IHRoZSAmbHQ7dHQmZ3Q7bm9zdWlkJmx0Oy90dCZn dDsgb3B0aW9uIGlzIGNvbmZpZ3VyZWQgZm9yIGFsbCBORlMgbW91bnRzLCBydW4gdGhlIGZvbGxv d2luZyBjb21tYW5kLgogJmx0O3ByZSZndDskIG1vdW50ICB8IGdyZXAgbmZzJmx0Oy9wcmUmZ3Q7 CiBBbGwgTkZTIG1vdW50cyBzaG91bGQgc2hvdyB0aGUgJmx0O3R0Jmd0O25vc3VpZCZsdDsvdHQm Z3Q7IHNldHRpbmcgaW4gcGFyZW50aGVzZXMuCiAmbHQ7L29jaWwmZ3Q7CkBAIC00ODQsNyArNDg0 LDcgQEAgUmVtb3ZlIGFueSBpbnN0YW5jZXMgb2YgdGhlCiAmbHQ7dHQmZ3Q7aW5zZWN1cmVfbG9j a3MmbHQ7L3R0Jmd0OyBvcHRpb24gZnJvbSB0aGUgZmlsZSAmbHQ7dHQmZ3Q7L2V0Yy9leHBvcnRz Jmx0Oy90dCZndDsuCiAmbHQ7L2Rlc2NyaXB0aW9uJmd0OwogJmx0O29jaWwgY2xhdXNlPSJ0aGVy ZSBpcyBvdXRwdXQiJmd0OwotVG8gdmVyaWZ5IHRoYXQgaW5zZWN1cmUgZmlsZSBsb2NraW5nIGhh cyBiZWVuIGRpc2FibGVkLCBydW4gdGhlIGZvbGxvd2luZyBjb21tYW5kOgorVG8gdmVyaWZ5IGlu c2VjdXJlIGZpbGUgbG9ja2luZyBoYXMgYmVlbiBkaXNhYmxlZCwgcnVuIHRoZSBmb2xsb3dpbmcg Y29tbWFuZC4KICZsdDtwcmUmZ3Q7IyBncmVwIGluc2VjdXJlX2xvY2tzIC9ldGMvZXhwb3J0cyZs dDsvcHJlJmd0OwogJmx0Oy9vY2lsJmd0OwogJmx0O3JhdGlvbmFsZSZndDtBbGxvd2luZyBpbnNl Y3VyZSBmaWxlIGxvY2tpbmcgY291bGQgYWxsb3cgZm9yIHNlbnNpdGl2ZSBkYXRhIHRvIGJlCjxk aXYgY2xhc3M9Im1vei10eHQtc2lnIj4tLSAKMS43LjEKPC9kaXY+PC9wcmU+CiAgICAgIDwvZGl2 PgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgQWNrPGJyPgogICAgPGJyPgogICAgKG5v dGUgdGhlc2UgcGF0Y2hlcyB3ZXJlIGNyZWF0ZWQgYnkgRlNPLCBub3QgbXlzZWxmLiBJIG9ubHkg cG9zdGVkCiAgICBwdWJsaWNseS4pCiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============4204841655029928515==--