From blank at eclipse.ncsc.mil Thu Aug 20 11:32:39 2015 Content-Type: multipart/mixed; boundary="===============2155271505788419189==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] severity changes Date: Tue, 23 Oct 2012 12:36:20 -0400 Message-ID: <5086C784.2070405@eclipse.ncsc.mil> In-Reply-To: 1351003962-28253-2-git-send-email-dsmith@eclipse.ncsc.mil --===============2155271505788419189== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable We're supposed to meet with Michele about this today, but I guess this serves as an example. Please work on comprehensive proofreading instead. On 10/23/2012 10:52 AM, David Smith wrote: > = > Signed-off-by: David Smith > --- > RHEL6/input/system/network/iptables.xml | 8 ++++---- > RHEL6/input/system/selinux.xml | 6 +++--- > RHEL6/input/system/software/updating.xml | 8 ++++---- > 3 files changed, 11 insertions(+), 11 deletions(-) > = > diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system= /network/iptables.xml > index 1948224..bb97a11 100644 > --- a/RHEL6/input/system/network/iptables.xml > +++ b/RHEL6/input/system/network/iptables.xml > @@ -49,7 +49,7 @@ num target prot opt source destination > The ip6tables default rules are essentially the same. > = > = > - > + > Verify ip6tables Enabled > > > @@ -63,7 +63,7 @@ capability for IPv6 and ICMPv6. > > > = > - > + > Verify iptables Enabled > > > @@ -110,7 +110,7 @@ requirements. Otherwise, this program should not be u= sed to make > changes to the firewall configuration because it re-writes the > saved configuration file. > = > - > + > Set Default Iptables Policy for Incoming Packets > To set the default policy to DROP (instead of ACCEPT) for > the built-in INPUT chain which processes incoming packets, > @@ -131,7 +131,7 @@ accepted. > > > = > - > + > Set Default Iptables Policy for Forwarded Packets > To set the default policy to DROP (instead of ACCEPT) for > the built-in FORWARD chain which processes packets that will be forwarde= d from > diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.= xml > index 6e00f85..1592874 100644 > --- a/RHEL6/input/system/selinux.xml > +++ b/RHEL6/input/system/selinux.xml > @@ -82,7 +82,7 @@ and to protect the boot process. > mls > > = > - > + > Ensure SELinux Not Disabled in /etc/grub.conf > SELinux can be disabled at boot time by an argument in > /etc/grub.conf. > @@ -104,7 +104,7 @@ the chances that it will remain off during system ope= ration. > > > = > - > + > Ensure SELinux State is Enforcing > The SELinux state should be set to enforcing at > system boot time. In the file /etc/selinux/config, add or corr= ect the > @@ -208,7 +208,7 @@ which use category labelling. > > --> > = > - > + > Ensure No Daemons are Unconfined by SELinux > > Daemons for which the SELinux policy does not contain rules will inherit= the > diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/syste= m/software/updating.xml > index 30331e6..4ed4123 100644 > --- a/RHEL6/input/system/software/updating.xml > +++ b/RHEL6/input/system/software/updating.xml > @@ -18,7 +18,7 @@ for this reason, their use is strongly encouraged. > > > = > - > + > Ensure Red Hat GPG Key Installed > > To ensure that the system can cryptographically verify base software > @@ -46,7 +46,7 @@ are from Red Hat. > > - > + > Ensure gpgcheck Enabled In Main Yum Configuration > The gpgcheck option should be used to ensure that > checking of an RPM package's signature always occurs prior to its > @@ -75,7 +75,7 @@ protects against malicious tampering. > > > = > - > + > Ensure gpgcheck Enabled For All Yum Package Repositories > To ensure that signature checking is not disabled for > any repos, remove any lines from files in /etc/yum.repos.d of t= he form: > @@ -100,7 +100,7 @@ protects against malicious tampering. > > > = > - > + > Ensure Software Patches Installed > If the system is joined to the Red Hat Network, a Red Hat S= atellite Server, > or a yum server, run the following command to install updates: --===============2155271505788419189==--