>From 253d7ed477d222461495bbf19a1568e9210594c2 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 25 Dec 2012 17:01:10 -0500 Subject: [PATCH 08/17] Removed AC-4 mappings Removed numberous AC-4 mappings. AC-4 calls for the IS to *enforce* flow control (e.g. turn on iptables, selinux) but does not give configuration guidance. This is enabled in later controls. --- RHEL6/input/services/avahi.xml | 8 ++++---- RHEL6/input/services/ldap.xml | 4 ++-- RHEL6/input/services/mail.xml | 3 +-- RHEL6/input/system/network/iptables.xml | 18 +++++++++--------- RHEL6/input/system/selinux.xml | 6 +++--- 5 files changed, 19 insertions(+), 20 deletions(-) diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml index f7ad4c9..fcfb8ec 100644 --- a/RHEL6/input/services/avahi.xml +++ b/RHEL6/input/services/avahi.xml @@ -75,7 +75,7 @@ properly-configured router or firewall should not allow mDNS packets into the local network at all, this option provides another check to ensure they are not permitted. - + @@ -90,7 +90,7 @@ and ensure the following line appears in the [server] section. This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. - + @@ -105,7 +105,7 @@ and ensure the following line appears in the [server] section. This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. - + @@ -135,7 +135,7 @@ disable-publishing. Alternatively, these can be used to restrict the types of published information in the event that some information must be published. - + diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml index 5246370..f8ef293 100644 --- a/RHEL6/input/services/ldap.xml +++ b/RHEL6/input/services/ldap.xml @@ -344,7 +344,7 @@ be able to change data without an explicit access statement. - + @@ -377,7 +377,7 @@ by connecting to the primary port and issuing the STARTTLS command. - + diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml index 2e2fe35..cd545b7 100644 --- a/RHEL6/input/services/mail.xml +++ b/RHEL6/input/services/mail.xml @@ -128,7 +128,6 @@ escalation or denial of service attacks which might compromise the mail service. ensure that only system administrators are allowed shell access to the MTA host. - @@ -141,7 +140,7 @@ that access, while keeping other ports on the server in their default protected - + diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index 141705d..755c51d 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -1,5 +1,5 @@ -Iptables and Ip6tables +IPTables and Ip6tables A host-based firewall called Netfilter is included as part of the Linux kernel distributed with the system. It is activated by default. This firewall is controlled by the program @@ -59,7 +59,7 @@ capability for IPv6 and ICMPv6. - + @@ -75,7 +75,7 @@ capability for IPv4 and ICMP. - + @@ -112,7 +112,7 @@ changes to the firewall configuration because it re-writes the saved configuration file. -Set Default Iptables Policy for Incoming Packets +Set Default IPTables Policy for Incoming Packets To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in @@ -130,11 +130,11 @@ any packets which are not explicitly permitted should not be accepted. - + -Set Default Iptables Policy for Forwarded Packets +Set Default IPTables Policy for Forwarded Packets To set the default policy to DROP (instead of ACCEPT) for the built-in FORWARD chain which processes packets that will be forwarded from one interface to another, @@ -153,7 +153,7 @@ The output should be similar to the following:
# grep ":FORWARD" /etc/sysconfig/iptables
 :FORWARD DROP [0:0
- +
@@ -174,7 +174,7 @@ If you are going to statically configure the machine's address, it should ignore could add another IPv6 address to the interface or alter important network settings:
-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
- + Restricting other ICMPv6 message types in /etc/sysconfig/ip6tables is not recommended because the operation- of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types. @@ -226,7 +226,7 @@ The following rule will log all traffic originating from a site-local address, w - +
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index d01d89f..a409ae7 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -122,7 +122,7 @@ privileges. - + @@ -148,7 +148,7 @@ targeted for exploitation, such as network or system services. - + @@ -167,7 +167,7 @@ file context is applied to files. This allows automatic correction of file contexts created by some programs. - + -- 1.7.1