>From f886bdf2942ff7da5ca18ecff02e063e1337aafb Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 15 Sep 2013 19:05:08 -0400 Subject: [PATCH 16/22] [ticket 393] Updated securetty_root_login_console_only - Updated XCCDF/OVAL namings - filename ->filepath - Added remediation TESTING: [root@SSG-RHEL6 checks]# ./testcheck.py securetty_root_login_console_only.xml Evaluating with OVAL tempfile : /tmp/securetty_root_login_console_onlyPRqW61.xml Writing results to : /tmp/securetty_root_login_console_onlyPRqW61.xml-results Definition oval:scap-security-guide.testing:def:202: false Evaluation done. [root@SSG-RHEL6 checks]# bash ../fixes/bash/securetty_root_login_console_only.sh [root@SSG-RHEL6 checks]# ./testcheck.py securetty_root_login_console_only.xml Evaluating with OVAL tempfile : /tmp/securetty_root_login_console_onlyCh84Vl.xml Writing results to : /tmp/securetty_root_login_console_onlyCh84Vl.xml-results Definition oval:scap-security-guide.testing:def:202: true Evaluation done. --- RHEL6/input/auxiliary/transition_notes.xml | 4 +- RHEL6/input/checks/file_permissions_unowned.xml | 38 -------------------- RHEL6/input/checks/no_files_unowned_by_user.xml | 38 ++++++++++++++++++++ .../checks/securetty_root_login_console_only.xml | 3 +- .../bash/securetty_root_login_console_only.sh | 1 + RHEL6/input/profiles/CS2.xml | 4 +- RHEL6/input/profiles/common.xml | 4 +- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 6 ++-- RHEL6/input/profiles/nist-CL-IL-AL.xml | 4 +- RHEL6/input/profiles/stig-rhel6-server.xml | 2 +- RHEL6/input/profiles/test.xml | 2 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 +- .../system/accounts/restrictions/root_logins.xml | 2 +- 13 files changed, 56 insertions(+), 56 deletions(-) delete mode 100644 RHEL6/input/checks/file_permissions_unowned.xml create mode 100644 RHEL6/input/checks/no_files_unowned_by_user.xml create mode 100644 RHEL6/input/fixes/bash/securetty_root_login_console_only.sh diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml index d4d4cba..f2e18dd 100644 --- a/RHEL6/input/auxiliary/transition_notes.xml +++ b/RHEL6/input/auxiliary/transition_notes.xml @@ -5,7 +5,7 @@ This is covered in RHEL 6 content -This is covered in RHEL 6 content +This is covered in RHEL 6 content This is not covered in RHEL 6 content @@ -1560,7 +1560,7 @@ rule=no_hashes_outside_shadow manual=no Check does exist in the RHEL6 prose, it can be automated and the OVAL for it does exist. -rule=configure_auditd_space_left_action manual=no +rule=auditd_data_retention_space_left_action manual=no diff --git a/RHEL6/input/checks/file_permissions_unowned.xml b/RHEL6/input/checks/file_permissions_unowned.xml deleted file mode 100644 index 5fc8afc..0000000 --- a/RHEL6/input/checks/file_permissions_unowned.xml +++ /dev/null @@ -1,38 +0,0 @@ - - - - Find files unowned by a user - - Red Hat Enterprise Linux 6 - - All files should be owned by a - user - - - - - - - - This will enumerate all files on local - partitions - - - - - - 0 - - - - / - .* - - diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml b/RHEL6/input/checks/no_files_unowned_by_user.xml new file mode 100644 index 0000000..5fc8afc --- /dev/null +++ b/RHEL6/input/checks/no_files_unowned_by_user.xml @@ -0,0 +1,38 @@ + + + + Find files unowned by a user + + Red Hat Enterprise Linux 6 + + All files should be owned by a + user + + + + + + + + This will enumerate all files on local + partitions + + + + + + 0 + + + + / + .* + + diff --git a/RHEL6/input/checks/securetty_root_login_console_only.xml b/RHEL6/input/checks/securetty_root_login_console_only.xml index 7a686ec..5b0e378 100644 --- a/RHEL6/input/checks/securetty_root_login_console_only.xml +++ b/RHEL6/input/checks/securetty_root_login_console_only.xml @@ -20,8 +20,7 @@ - /etc - securetty + /etc/securetty ^vc/[0-9]+$ 1 diff --git a/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh b/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh new file mode 100644 index 0000000..2d1dd44 --- /dev/null +++ b/RHEL6/input/fixes/bash/securetty_root_login_console_only.sh @@ -0,0 +1 @@ +sed -i '/^vc\//d' /etc/securetty diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 84329b4..57651e7 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -145,7 +145,7 @@ - @@ -174,7 +174,7 @@ - diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index dc6cd10..6c6aa07 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -16,8 +16,8 @@ - + diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index d50a06d..afe5f47 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -61,7 +61,7 @@ + @@ -71,7 +71,7 @@ + - @@ -267,7 +267,7 @@ assurance." + diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml index 2058cdf..2e95ec9 100644 --- a/RHEL6/input/profiles/stig-rhel6-server.xml +++ b/RHEL6/input/profiles/stig-rhel6-server.xml @@ -36,7 +36,7 @@ + - diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index fd2c857..246931c 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -61,7 +61,7 @@ + @@ -116,7 +116,7 @@ + diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index 1f2a840..0701ddb 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -54,7 +54,7 @@ and FISMA Moderate systems. - + Restrict Virtual Console Root Logins To restrict root logins through the (deprecated) virtual console devices, -- 1.7.1