From shawn at redhat.com Thu Aug 20 11:32:51 2015 Content-Type: multipart/mixed; boundary="===============1356681272266564141==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 03/13] DISA FSO Date: Fri, 16 Nov 2012 17:58:24 -0500 Message-ID: <50A6C510.7000300@redhat.com> In-Reply-To: 20121116225417.GA5752@mail.corp.redhat.com --===============1356681272266564141== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/16/12 5:54 PM, Shawn Wells wrote: > > 0003-DISA-FSO-Copy-editing-of-Avahi-section.patch > > > From 2a61a559641866602df30eb638f31ae0b149b87e Mon Sep 17 00:00:00 2001 > From: Shawn Wells > Date: Fri, 16 Nov 2012 06:55:58 -0500 > Subject: [PATCH 03/13] DISA FSO: Copy editing of Avahi section > DISA FSO provided copy editing of the Avahi section > > --- > RHEL6/input/services/avahi.xml | 12 ++++++------ > 1 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.= xml > index c4112b7..af7dd1c 100644 > --- a/RHEL6/input/services/avahi.xml > +++ b/RHEL6/input/services/avahi.xml > @@ -50,9 +50,9 @@http://www.avahi.org for more detailed information abou= t the configuration optio > Serve Avahi Only via Required Protocol > > If you are using only IPv4, edit /etc/avahi/avahi-daemon.conf = and ensure > -the following line exists in the [server] section: > +the following line exists in the [server] section. >
use-ipv6=3Dno
> -Similarly, if you are using only IPv6, disable IPv4 sockets with the lin= e: > +Similarly, if you are using only IPv6, disable IPv4 sockets with the lin= e. >
use-ipv4=3Dno
>
> > @@ -83,7 +83,7 @@ are not permitted. > Prevent Other Programs from Using Avahi's Port > > To prevent other mDNS stacks from running, edit /etc/avahi/avahi-da= emon.conf > -and ensure the following line appears in the [server] section: > +and ensure the following line appears in the [server] section. >
disallow-other-stacks=3Dyes
>
> > @@ -98,7 +98,7 @@ that port on the system. > Disable Avahi Publishing > > To prevent other mDNS stacks from running, edit /etc/avahi/avahi-da= emon.conf > -and ensure the following line appears in the [server] section: > +and ensure the following line appears in the [server] section. >
disallow-other-stacks=3Dyes
>
> > @@ -116,10 +116,10 @@ If it is necessary to publish some information to t= he network, it should not be > by any extraneous information, or by information supplied by a non-trus= ted source > on the system. > Prevent user applications from using Avahi to publish services by addin= g or > -correcting the following line in the [publish] section: > +correcting the following line in the [publish] section. >
disable-user-service-publishing=3Dyes
> Implement as many of the following lines as possible, to restrict the i= nformation > -published by Avahi: > +published by Avahi. >
publish-addresses=3Dno
>   publish-hinfo=3Dno
>   publish-workstation=3Dno
> -- 1.7.1

Ack

(note these patches were created by FSO, not myself. I only posted =

publicly.)

--===============1356681272266564141==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"

PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9
IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4
Ij5PbiAxMS8xNi8xMiA1OjU0IFBNLCBTaGF3biBXZWxscyB3cm90ZTo8YnI+CiAgICA8L2Rpdj4K
ICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDoyMDEyMTExNjIyNTQxNy5HQTU3NTJAbWFpbC5jb3Jw
LnJlZGhhdC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNl
dCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjxsZWdlbmQKICAgICAgICAgIGNsYXNzPSJt
aW1lQXR0YWNobWVudEhlYWRlck5hbWUiPjAwMDMtRElTQS1GU08tQ29weS1lZGl0aW5nLW9mLUF2
YWhpLXNlY3Rpb24ucGF0Y2g8L2xlZ2VuZD48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxk
aXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGljYWwtcXVvdGU9InRy
dWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNpemU6IDEy
cHg7IgogICAgICAgIGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgPHByZSB3cmFwPSIiPkZyb20g
MmE2MWE1NTk2NDE4NjY2MDJkZjMwZWI2MzhmMzFhZTBiMTQ5Yjg3ZSBNb24gU2VwIDE3IDAwOjAw
OjAwIDIwMDEKRnJvbTogU2hhd24gV2VsbHMgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFz
cz0ibW96LXR4dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSI+
Jmx0O3NoYXduQHJlZGhhdC5jb20mZ3Q7PC9hPgpEYXRlOiBGcmksIDE2IE5vdiAyMDEyIDA2OjU1
OjU4IC0wNTAwClN1YmplY3Q6IFtQQVRDSCAwMy8xM10gRElTQSBGU086IENvcHkgZWRpdGluZyBv
ZiBBdmFoaSBzZWN0aW9uCiBESVNBIEZTTyBwcm92aWRlZCBjb3B5IGVkaXRpbmcgb2YgdGhlIEF2
YWhpIHNlY3Rpb24KCi0tLQogUkhFTDYvaW5wdXQvc2VydmljZXMvYXZhaGkueG1sIHwgICAxMiAr
KysrKystLS0tLS0KIDEgZmlsZXMgY2hhbmdlZCwgNiBpbnNlcnRpb25zKCspLCA2IGRlbGV0aW9u
cygtKQoKZGlmZiAtLWdpdCBhL1JIRUw2L2lucHV0L3NlcnZpY2VzL2F2YWhpLnhtbCBiL1JIRUw2
L2lucHV0L3NlcnZpY2VzL2F2YWhpLnhtbAppbmRleCBjNDExMmI3Li5hZjdkZDFjIDEwMDY0NAot
LS0gYS9SSEVMNi9pbnB1dC9zZXJ2aWNlcy9hdmFoaS54bWwKKysrIGIvUkhFTDYvaW5wdXQvc2Vy
dmljZXMvYXZhaGkueG1sCkBAIC01MCw5ICs1MCw5IEBAIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1
ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cDovL3d3dy5hdmFoaS5v
cmciPmh0dHA6Ly93d3cuYXZhaGkub3JnPC9hPiBmb3IgbW9yZSBkZXRhaWxlZCBpbmZvcm1hdGlv
biBhYm91dCB0aGUgY29uZmlndXJhdGlvbiBvcHRpbwogJmx0O3RpdGxlJmd0O1NlcnZlIEF2YWhp
IE9ubHkgdmlhIFJlcXVpcmVkIFByb3RvY29sJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlv
biZndDsKIElmIHlvdSBhcmUgdXNpbmcgb25seSBJUHY0LCBlZGl0ICZsdDt0dCZndDsvZXRjL2F2
YWhpL2F2YWhpLWRhZW1vbi5jb25mJmx0Oy90dCZndDsgYW5kIGVuc3VyZQotdGhlIGZvbGxvd2lu
ZyBsaW5lIGV4aXN0cyBpbiB0aGUgJmx0O3R0Jmd0O1tzZXJ2ZXJdJmx0Oy90dCZndDsgc2VjdGlv
bjoKK3RoZSBmb2xsb3dpbmcgbGluZSBleGlzdHMgaW4gdGhlICZsdDt0dCZndDtbc2VydmVyXSZs
dDsvdHQmZ3Q7IHNlY3Rpb24uCiAmbHQ7cHJlJmd0O3VzZS1pcHY2PW5vJmx0Oy9wcmUmZ3Q7Ci1T
aW1pbGFybHksIGlmIHlvdSBhcmUgdXNpbmcgb25seSBJUHY2LCBkaXNhYmxlIElQdjQgc29ja2V0
cyB3aXRoIHRoZSBsaW5lOgorU2ltaWxhcmx5LCBpZiB5b3UgYXJlIHVzaW5nIG9ubHkgSVB2Niwg
ZGlzYWJsZSBJUHY0IHNvY2tldHMgd2l0aCB0aGUgbGluZS4KICZsdDtwcmUmZ3Q7dXNlLWlwdjQ9
bm8mbHQ7L3ByZSZndDsKICZsdDsvZGVzY3JpcHRpb24mZ3Q7CiAmbHQ7cmVmIG5pc3Q9IkNNLTYs
IENNLTciIC8mZ3Q7CkBAIC04Myw3ICs4Myw3IEBAIGFyZSBub3QgcGVybWl0dGVkLgogJmx0O3Rp
dGxlJmd0O1ByZXZlbnQgT3RoZXIgUHJvZ3JhbXMgZnJvbSBVc2luZyBBdmFoaSdzIFBvcnQmbHQ7
L3RpdGxlJmd0OwogJmx0O2Rlc2NyaXB0aW9uJmd0OwogVG8gcHJldmVudCBvdGhlciBtRE5TIHN0
YWNrcyBmcm9tIHJ1bm5pbmcsIGVkaXQgJmx0O3R0Jmd0Oy9ldGMvYXZhaGkvYXZhaGktZGFlbW9u
LmNvbmYmbHQ7L3R0Jmd0OwotYW5kIGVuc3VyZSB0aGUgZm9sbG93aW5nIGxpbmUgYXBwZWFycyBp
biB0aGUgJmx0O3R0Jmd0O1tzZXJ2ZXJdJmx0Oy90dCZndDsgc2VjdGlvbjoKK2FuZCBlbnN1cmUg
dGhlIGZvbGxvd2luZyBsaW5lIGFwcGVhcnMgaW4gdGhlICZsdDt0dCZndDtbc2VydmVyXSZsdDsv
dHQmZ3Q7IHNlY3Rpb24uCiAmbHQ7cHJlJmd0O2Rpc2FsbG93LW90aGVyLXN0YWNrcz15ZXMmbHQ7
L3ByZSZndDsKICZsdDsvZGVzY3JpcHRpb24mZ3Q7CiAmbHQ7cmF0aW9uYWxlJmd0OwpAQCAtOTgs
NyArOTgsNyBAQCB0aGF0IHBvcnQgb24gdGhlIHN5c3RlbS4KICZsdDt0aXRsZSZndDtEaXNhYmxl
IEF2YWhpIFB1Ymxpc2hpbmcmbHQ7L3RpdGxlJmd0OwogJmx0O2Rlc2NyaXB0aW9uJmd0OwogVG8g
cHJldmVudCBvdGhlciBtRE5TIHN0YWNrcyBmcm9tIHJ1bm5pbmcsIGVkaXQgJmx0O3R0Jmd0Oy9l
dGMvYXZhaGkvYXZhaGktZGFlbW9uLmNvbmYmbHQ7L3R0Jmd0OwotYW5kIGVuc3VyZSB0aGUgZm9s
bG93aW5nIGxpbmUgYXBwZWFycyBpbiB0aGUgJmx0O3R0Jmd0O1tzZXJ2ZXJdJmx0Oy90dCZndDsg
c2VjdGlvbjoKK2FuZCBlbnN1cmUgdGhlIGZvbGxvd2luZyBsaW5lIGFwcGVhcnMgaW4gdGhlICZs
dDt0dCZndDtbc2VydmVyXSZsdDsvdHQmZ3Q7IHNlY3Rpb24uCiAmbHQ7cHJlJmd0O2Rpc2FsbG93
LW90aGVyLXN0YWNrcz15ZXMmbHQ7L3ByZSZndDsKICZsdDsvZGVzY3JpcHRpb24mZ3Q7CiAmbHQ7
cmF0aW9uYWxlJmd0OwpAQCAtMTE2LDEwICsxMTYsMTAgQEAgSWYgaXQgaXMgbmVjZXNzYXJ5IHRv
IHB1Ymxpc2ggc29tZSBpbmZvcm1hdGlvbiB0byB0aGUgbmV0d29yaywgaXQgc2hvdWxkIG5vdCBi
ZQogYnkgYW55IGV4dHJhbmVvdXMgaW5mb3JtYXRpb24sIG9yIGJ5IGluZm9ybWF0aW9uIHN1cHBs
aWVkIGJ5IGEgbm9uLXRydXN0ZWQgc291cmNlCiBvbiB0aGUgc3lzdGVtLgogUHJldmVudCB1c2Vy
IGFwcGxpY2F0aW9ucyBmcm9tIHVzaW5nIEF2YWhpIHRvIHB1Ymxpc2ggc2VydmljZXMgYnkgYWRk
aW5nIG9yCi1jb3JyZWN0aW5nIHRoZSBmb2xsb3dpbmcgbGluZSBpbiB0aGUgJmx0O3R0Jmd0O1tw
dWJsaXNoXSZsdDsvdHQmZ3Q7IHNlY3Rpb246Citjb3JyZWN0aW5nIHRoZSBmb2xsb3dpbmcgbGlu
ZSBpbiB0aGUgJmx0O3R0Jmd0O1twdWJsaXNoXSZsdDsvdHQmZ3Q7IHNlY3Rpb24uCiAmbHQ7cHJl
Jmd0O2Rpc2FibGUtdXNlci1zZXJ2aWNlLXB1Ymxpc2hpbmc9eWVzJmx0Oy9wcmUmZ3Q7CiBJbXBs
ZW1lbnQgYXMgbWFueSBvZiB0aGUgZm9sbG93aW5nIGxpbmVzIGFzIHBvc3NpYmxlLCB0byByZXN0
cmljdCB0aGUgaW5mb3JtYXRpb24KLXB1Ymxpc2hlZCBieSBBdmFoaToKK3B1Ymxpc2hlZCBieSBB
dmFoaS4KICZsdDtwcmUmZ3Q7cHVibGlzaC1hZGRyZXNzZXM9bm8KIHB1Ymxpc2gtaGluZm89bm8K
IHB1Ymxpc2gtd29ya3N0YXRpb249bm8KPGRpdiBjbGFzcz0ibW96LXR4dC1zaWciPi0tIAoxLjcu
MQoKPC9kaXY+PC9wcmU+CiAgICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgog
ICAgQWNrPGJyPgogICAgPGJyPgogICAgKG5vdGUgdGhlc2UgcGF0Y2hlcyB3ZXJlIGNyZWF0ZWQg
YnkgRlNPLCBub3QgbXlzZWxmLiBJIG9ubHkgcG9zdGVkCiAgICBwdWJsaWNseS4pCiAgPC9ib2R5
Pgo8L2h0bWw+Cg==

--===============1356681272266564141==--