This is not quite a practical strategy for us. We will recommend (and
even write some Rules for removal of) some software which presents an
attack surface such as network services, but scope explodes if we
seriously attempt to configure all potentially installed software.
On Wed, Aug 28, 2013 at 12:57 PM, Hopkins, Robert J CTR BXPP, BXPP
I'm not sure about the OSCAP results but if X is installed then
you should secure it. Someone could accidentally set run level 5 or just do a startx and
fire it up means any vulnerabilities and/or weaknesses would then be exposed. If X is not
installed, you can probably mark it N/A.
[mailto:email@example.com] On Behalf Of leam hall
Sent: Wednesday, August 28, 2013 12:04
Subject: Various False Positives?
Just ran oscap with the xml files available on the website (Benchmark version 0.9). Here
are the issues that seem to be false positives. Prefix everything with
"RHEL-06-000". These are all marked as fail but the server meets the STIG.
9 rhnsd can be on if configured to Satellite server or similar
98 No ipv6 installed
169 stime // Also, the STIG is wrong. There is no x86_64 stime syscall
184-196, 200 chmod, chown, etc...
206-211 No telnet installed or turned on
240 /etc/ssh/sshd_config Banner
271 If there are no removable partitions this is not a finding.
278 If the file permissions are more restrictive then it is not a finding.
324 No X running
346 Finding reported on umask 022
348 No vsftp installed, thus no file.
Am I confused in thinking a system in run level 3 should net need to worry about X/Gnome
Mind on a Mission <http://leamhall.blogspot.com/>
scap-security-guide mailing list