>From 8fa5bda4a5e636f91ed5626a1bad2fae69e41120 Mon Sep 17 00:00:00 2001 From: Michael McConachie Date: Tue, 25 Sep 2012 16:09:59 -0400 Subject: [PATCH] OCIL clause tags added to 6 files in the /input dir --- RHEL6/input/services/obsolete.xml | 2 +- RHEL6/input/system/accounts/restrictions/password_storage.xml | 6 +++--- RHEL6/input/system/accounts/restrictions/root_logins.xml | 6 +++--- RHEL6/input/system/selinux.xml | 8 ++++---- RHEL6/input/system/software/disk_partitioning.xml | 4 +--- RHEL6/input/system/software/updating.xml | 8 ++++---- 6 files changed, 16 insertions(+), 18 deletions(-) diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 9484265..eaf853c 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -182,7 +182,7 @@ location:
# rm /etc/hosts.equiv
$ rm ~/.rhosts
- + The existence of the file /etc/hosts.equiv or a file named .rhosts inside a user home directory indicates the presence of an Rsh trust relationship. diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index b030ad4..415bfd2 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -24,7 +24,7 @@ into the account without authentication. Remove any instances of the nullok< option in /etc/pam.d/system-auth-ac to prevent logins with empty passwords. - + To verify that null passwords cannot be used, run the following command:
# grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac
If this produces any output, it may be possible to log into accounts @@ -49,7 +49,7 @@ instead of an x), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely. - + To check that no password hashes are stored in /etc/passwd, run the following command:
# awk -F: '($2 != "x") {print}' /etc/passwd
@@ -74,7 +74,7 @@ directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any .netrc files should be removed. - + To check the system for the existence of any .netrc files, run the following command:
# find / -name .netrc
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index f08b702..fee9a54 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -47,7 +47,7 @@ vc/3 vc/4 -To check for these entries from the command prompt, issue the +To check for these entries from the command prompt, issue the following command:
# grep ^vc/[0-9] /etc/securetty
If any values are returned, you need to remove them by manipulating the file. @@ -73,7 +73,7 @@ ensure lines of this form do not appear in /etc/securetty: ttyS1 -To check for these entries from the command prompt, +To check for these entries from the command prompt, issue the following command:
# grep ^ttyS/[0-9] /etc/securetty
If any values are returned, you need to remove them by manipulating @@ -109,7 +109,7 @@ than root. -If any account SYSACCT has a login shell, +If any account SYSACCT has a login shell, disable it with the command:
# usermod -s /sbin/nologin SYSACCT
The RHEL6 default is /sbin/nologin, but any command which will diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 3d68315..b2c660d 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -89,7 +89,7 @@ and to protect the boot process. Remove any instances of selinux=0 from the kernel arguments in that file to prevent SELinux from being being disabled at boot. - + Inspect /etc/grub.conf for any instances of selinux=0 in the kernel boot arguments. Presences of selinux=0 indicates that SELinux is disabled at boot time. @@ -111,7 +111,7 @@ system boot time. In the file /etc/selinux/config, add or correct the line SELINUX=enforcing to configure the system to boot into enforcing mode. - + Check the file /etc/selinux/config and ensure the following line appears:
SELINUX=enforcing
@@ -137,7 +137,7 @@ Other policies, such as mls, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases. - + Check the file /etc/selinux/config and ensure the following line appears:
SELINUXTYPE=targeted
@@ -232,7 +232,7 @@ or allow privileges that the daemon does not require. Device files are used for communication with important system resources. SELinux contexts should exist for these. By checking for unlabeled_t file contexts, we can determine if the system is optimally configured. -To check for unlabeled device files, run the following command in +To check for unlabeled device files, run the following command in the directory that you want to check the SELinux contexts:
# ls -Z | grep unlabeled_t
It should produce no output in a well-configured system.
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml index 1c4d260..e678d61 100644 --- a/RHEL6/input/system/software/disk_partitioning.xml +++ b/RHEL6/input/system/software/disk_partitioning.xml @@ -31,9 +31,7 @@ The /tmp directory is a world-writable directory used for temporary file storage. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM. - - - + The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 99b6520..0ec2f32 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -28,7 +28,7 @@ Run the following command to install the Red Hat GPG key, of which Red Hat uses to sign. To ensure that the GPG Key is isntalled, run:
# rhn_register
-To ensure that the GPG Key is isntalled, run: +To ensure that the GPG Key is isntalled, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return the string:
gpg(Red Hat, Inc. (release key <security@redhat.com>)
@@ -54,7 +54,7 @@ them, ensure that the following line appears in /etc/yum.conf in the [main] section:
gpgcheck=1
- + To determine whether yum is configured to use gpgcheck, inspect /etc/yum.conf and ensure that the following appears in the [main] section: @@ -79,7 +79,7 @@ protects against malicious tampering. any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0
- + To determine whether yum has been configured to disable gpgcheck for any repos, inspect all files in /etc/yum.repos.d and ensure that the following does not appear in any @@ -105,7 +105,7 @@ need to be updated: To actually install these updates, run:
# yum update
- + After running the update command, invoking the update command again can be used to determine success of the updates. If nothing is returned, the update was successful. -- 1.7.11.4