Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/checks/iptables_ldap_enabled.xml | 68 ------
.../ldap_server_config_bdb_file_security.xml | 22 --
.../ldap_server_config_certificate_files.xml | 242 --------------------
.../ldap_server_config_directory_file_security.xml | 22 --
RHEL6/input/checks/ldap_server_config_logging.xml | 115 ---------
.../input/checks/ldap_server_config_olcaccess.xml | 56 -----
.../input/checks/ldap_server_config_olcrootpw.xml | 32 ---
.../ldap_server_config_olcsecurity_simple_bind.xml | 31 ---
.../checks/ldap_server_config_olcsecurity_tls.xml | 31 ---
.../input/checks/ldap_server_config_olcsuffix.xml | 31 ---
.../ldap_server_config_olctlsciphersuite.xml | 36 ---
RHEL6/input/profiles/manual_audits.xml | 39 ---
12 files changed, 0 insertions(+), 725 deletions(-)
delete mode 100644 RHEL6/input/checks/iptables_ldap_enabled.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_bdb_file_security.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_certificate_files.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_directory_file_security.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_logging.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olcaccess.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olcrootpw.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olcsecurity_tls.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olcsuffix.xml
delete mode 100644 RHEL6/input/checks/ldap_server_config_olctlsciphersuite.xml
delete mode 100644 RHEL6/input/profiles/manual_audits.xml
diff --git a/RHEL6/input/checks/iptables_ldap_enabled.xml
b/RHEL6/input/checks/iptables_ldap_enabled.xml
deleted file mode 100644
index b95a01d..0000000
--- a/RHEL6/input/checks/iptables_ldap_enabled.xml
+++ /dev/null
@@ -1,68 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="iptables_ldap_enabled" version="1">
- <metadata>
- <title>If LDAP is installed, the firewall should allow or reject access to
the
- ldap service.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If LDAP is installed, the firewall should allow or reject access
to
- the ldap service.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Test ipv4 389 Accept"
test_ref="test_20144" />
- <criterion comment="Test ipv6 389 Accept"
test_ref="test_20145" />
- <criterion comment="Test ipv4 636 Accept"
test_ref="test_20146" />
- <criterion comment="Test ipv6 636 Accept"
test_ref="test_20147" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 389 access over
ipv4"
- id="test_20144" version="1">
- <ind:object object_ref="obj_20144" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 389 access over ipv4"
- id="obj_20144" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -s
(?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j
ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 389 access over
ipv6"
- id="test_20145" version="1">
- <ind:object object_ref="obj_20145" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 389 access over ipv6"
- id="obj_20145" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -s
(?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 389 -j
ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 636 access over
ipv4"
- id="test_20146" version="1">
- <ind:object object_ref="obj_20146" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 636 access over ipv4"
- id="obj_20146" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -s
(?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j
ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 636 access over
ipv6"
- id="test_20147" version="1">
- <ind:object object_ref="obj_20147" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 636 access over ipv6"
- id="obj_20147" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -s
(?:\d{1,3}\.){3}\d{1,3}/\d{1,2} -m state --state NEW -p tcp --dport 636 -j
ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_bdb_file_security.xml
b/RHEL6/input/checks/ldap_server_config_bdb_file_security.xml
deleted file mode 100644
index 240c57c..0000000
--- a/RHEL6/input/checks/ldap_server_config_bdb_file_security.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_bdb_file_security" version="1">
- <metadata>
- <title>LDAP Configuration File Security</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Configuration files should be secured such that unauthorized
- users cannot access or change them.</description>
- </metadata>
- <criteria comment="Test file user/group ownership and permissions"
- operator="AND">
- <extend_definition comment="Test group ownership of ldap configuration
files"
- definition_ref="file_groupowner_ldap_server_bdb" />
- <extend_definition comment="Test ownership of ldap configuration
files"
- definition_ref="file_owner_ldap_server_bdb" />
- <extend_definition comment="Test permissions of ldap configuration
files"
- definition_ref="file_permissions_ldap_server_bdb" />
- </criteria>
- </definition>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_certificate_files.xml
b/RHEL6/input/checks/ldap_server_config_certificate_files.xml
deleted file mode 100644
index 6916e59..0000000
--- a/RHEL6/input/checks/ldap_server_config_certificate_files.xml
+++ /dev/null
@@ -1,242 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_certificate_files" version="1">
- <metadata>
- <title>Protect LDAP Certificate Files.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Protect LDAP certificate files.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Test key file ownership"
test_ref="test_ldap_server_config_certificate_files_key_owner" />
- <criterion comment="Test key file group ownership"
test_ref="test_ldap_server_config_certificate_files_key_gowner" />
- <criterion comment="Test key file permissions"
test_ref="test_ldap_server_config_certificate_files_key_perm" />
- <criterion comment="Test cert file ownership"
test_ref="test_ldap_server_config_certificate_files_cert_owner" />
- <criterion comment="Test cert file group ownership"
test_ref="test_ldap_server_config_certificate_files_cert_gowner" />
- <criterion comment="Test cert file permissions"
test_ref="test_ldap_server_config_certificate_files_cert_perm" />
- <criterion comment="Test pki directory ownership"
test_ref="test_ldap_server_config_certificate_files_pki_owner" />
- <criterion comment="Test pki directory group ownership"
test_ref="test_ldap_server_config_certificate_files_pki_gowner" />
- <criterion comment="Test pki directory permissions"
test_ref="test_ldap_server_config_certificate_files_pki_perm" />
- <criterion comment="Test CA cert ownership"
test_ref="test_ldap_server_config_certificate_files_cacert_owner" />
- <criterion comment="Test CA cert group ownership"
test_ref="test_ldap_server_config_certificate_files_cacert_gowner" />
- <criterion comment="Test CA cert permissions"
test_ref="test_ldap_server_config_certificate_files_cacert_perm" />
- </criteria>
- </definition>
-
-
- <!--start key file-->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of private key file"
- id="test_ldap_server_config_certificate_files_key_owner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_key_owner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_key_owner" />
- </unix:file_test>
- <unix:file_state id="state_ldap_server_config_certificate_files_key_owner"
version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/serverkey.pem"
id="obj_ldap_server_config_certificate_files_key_owner"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of private key file"
- id="test_ldap_server_config_certificate_files_key_gowner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_key_gowner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_key_gowner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_key_gowner"
version="1">
- <unix:group_id datatype="int">55</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/serverkey.pem"
id="obj_ldap_server_config_certificate_files_key_gowner"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of private key file"
- id="test_ldap_server_config_certificate_files_key_perm"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_key_perm" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_key_perm" />
- </unix:file_test>
- <unix:file_state id="state_ldap_server_config_certificate_files_key_perm"
version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/serverkey.pem"
- id="obj_ldap_server_config_certificate_files_key_perm"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
- <!--end key file -->
-
- <!--start cert file-->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of cert file"
- id="test_ldap_server_config_certificate_files_cert_owner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cert_owner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cert_owner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_cert_owner"
version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/servercert.pem"
id="obj_ldap_server_config_certificate_files_cert_owner"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of cert file"
- id="test_ldap_server_config_certificate_files_cert_gowner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cert_gowner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cert_gowner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_cert_gowner"
version="1">
- <unix:group_id datatype="int">55</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/servercert.pem"
id="obj_ldap_server_config_certificate_files_cert_gowner"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of cert file"
- id="test_ldap_server_config_certificate_files_cert_perm"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cert_perm" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cert_perm" />
- </unix:file_test>
- <unix:file_state id="state_ldap_server_config_certificate_files_cert_perm"
version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/servercert.pem"
- id="obj_ldap_server_config_certificate_files_cert_perm"
version="1">
- <unix:path>/etc/pki/tls/ldap</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
- <!-- end cert file -->
-
-
- <!-- start pki directory -->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of the pki directory"
- id="test_ldap_server_config_certificate_files_pki_owner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_pki_owner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_pki_owner" />
- </unix:file_test>
- <unix:file_state id="state_ldap_server_config_certificate_files_pki_owner"
version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/"
id="obj_ldap_server_config_certificate_files_pki_owner"
version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>ldap</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of the pki directory"
- id="test_ldap_server_config_certificate_files_pki_gowner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_pki_gowner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_pki_gowner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_pki_gowner"
version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/"
id="obj_ldap_server_config_certificate_files_pki_gowner"
version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>ldap</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of the pki directory"
- id="test_ldap_server_config_certificate_files_pki_perm"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_pki_perm" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_pki_perm" />
- </unix:file_test>
- <unix:file_state id="state_ldap_server_config_certificate_files_pki_perm"
version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">true</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">true</unix:gexec>
- <unix:oread datatype="boolean">true</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">true</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/ldap/"
- id="obj_ldap_server_config_certificate_files_pki_perm"
version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>ldap</unix:filename>
- </unix:file_object>
- <!-- end pki directory -->
-
-
- <!-- start ca cert -->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of the ca cert"
- id="test_ldap_server_config_certificate_files_cacert_owner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cacert_owner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cacert_owner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_cacert_owner"
version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem"
id="obj_ldap_server_config_certificate_files_cacert_owner"
version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of the ca cert file"
- id="test_ldap_server_config_certificate_files_cacert_gowner"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cacert_gowner" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cacert_gowner" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_cacert_gowner"
version="1">
- <unix:group_id datatype="int">55</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem"
id="obj_ldap_server_config_certificate_files_cacert_gowner"
version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of the ca cert file"
- id="test_ldap_server_config_certificate_files_cacert_perm"
version="1">
- <unix:object
object_ref="obj_ldap_server_config_certificate_files_cacert_perm" />
- <unix:state
state_ref="state_ldap_server_config_certificate_files_cacert_perm" />
- </unix:file_test>
- <unix:file_state
id="state_ldap_server_config_certificate_files_cacert_perm"
version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem"
- id="obj_ldap_server_config_certificate_files_cacert_perm"
version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
- <!-- end ca cert -->
-
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_directory_file_security.xml
b/RHEL6/input/checks/ldap_server_config_directory_file_security.xml
deleted file mode 100644
index c5b6e8f..0000000
--- a/RHEL6/input/checks/ldap_server_config_directory_file_security.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_directory_file_security" version="1">
- <metadata>
- <title>LDAP Configuration File Security</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Directory files should be secured such that unauthorized
- users cannot access or change them.</description>
- </metadata>
- <criteria comment="Test file user/group ownership and permissions"
- operator="AND">
- <extend_definition comment="Test group ownership of ldap directory
files"
- definition_ref="file_groupowner_ldap_server_files" />
- <extend_definition comment="Test ownership of ldap directory files"
- definition_ref="file_owner_ldap_server_files" />
- <extend_definition comment="Test permissions of ldap directory
files"
- definition_ref="file_permissions_ldap_server_files" />
- </criteria>
- </definition>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_logging.xml
b/RHEL6/input/checks/ldap_server_config_logging.xml
deleted file mode 100644
index 83543ea..0000000
--- a/RHEL6/input/checks/ldap_server_config_logging.xml
+++ /dev/null
@@ -1,115 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_logging" version="1">
- <metadata>
- <title>LDAP Should Log Relevant Events and Logs Shall Be
Protected.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>LDAP Should Log Relevant Events and Logs Shall Be
Protected.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Test log file ownership"
test_ref="test_20148" />
- <criterion comment="Test log file group ownership"
test_ref="test_20149" />
- <criterion comment="Test log file permissions"
test_ref="test_20150" />
- <criterion comment="Test logs set to go to log"
test_ref="test_20151" />
- <criterion comment="Test logs are set to rotate"
test_ref="test_20152" />
- <criterion comment="Test log auditing is sufficient"
test_ref="test_20153" />
- </criteria>
- </definition>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of ldap log file"
- id="test_20148" version="1">
- <unix:object object_ref="obj_20148" />
- <unix:state state_ref="state_20148" />
- </unix:file_test>
- <unix:file_state id="state_20148" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/var/log" id="obj_20148"
version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>ldap.log</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing /var/log/ldap.log group ownership"
- id="test_20149" version="1">
- <unix:object object_ref="obj_20149" />
- <unix:state state_ref="state_20149" />
- </unix:file_test>
- <unix:file_state id="state_20149" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/var/log" id="obj_20149"
version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>ldap.log</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing /var/log/ldap.log permissions"
- id="test_20150" version="1">
- <unix:object object_ref="obj_20150" />
- <unix:state state_ref="state_20150" />
- </unix:file_test>
- <unix:file_state id="state_20150" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">false</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/var/log/ldap.log"
- id="obj_20150" version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>ldap.log</unix:filename>
- </unix:file_object>
-
- <ind:textfilecontent54_test check="all"
check_existence="all_exist"
- comment="Direct ldap events to the ldap log"
- id="test_20151" version="1">
- <ind:object object_ref="obj_20151" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20151" version="1">
- <ind:path>/var/log</ind:path>
- <ind:filename>syslog.conf</ind:filename>
- <ind:pattern operation="pattern
match">^local4\.\*\s*\/var\/log\/ldap\.log$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
check_existence="all_exist"
- comment="Direct ldap events to the ldap log"
- id="test_20152" version="1">
- <ind:object object_ref="obj_20152" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20152" version="1">
- <ind:path>/etc/logrotate.d</ind:path>
- <ind:filename>syslog</ind:filename>
- <ind:pattern operation="pattern
match">/var\/log\/ldap\.log</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcLogLevel[\s]*:[\s]*(.*)$ expression in
the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_20153" version="1">
- <ind:object object_ref="obj_20153" />
- <ind:state state_ref="state_20153" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20153"
- version="1">
- <ind:subexpression
operation="equals">stats2</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_20153"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcLogLevel[\s]*:[\s]*(.*)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olcaccess.xml
b/RHEL6/input/checks/ldap_server_config_olcaccess.xml
deleted file mode 100644
index d4a3b27..0000000
--- a/RHEL6/input/checks/ldap_server_config_olcaccess.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcaccess" version="1">
- <metadata>
- <title>Configure slapd to Protect Authentication Information</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Protect the user's password by allowing the user himself or
the LDAP administrators to change it, allowing the anonymous user to authenticate against
it, and allowing no other access.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Protect userpassword"
test_ref="test_ldap_server_config_olcaccess_userpassword" />
- <criterion comment="Protect shadowlastchange"
test_ref="test_ldap_server_config_olcaccess_shadowlastchange" />
- <criterion comment="Protect other attribs"
test_ref="test_ldap_server_config_olcaccess_other" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all"
check_existence="all_exist"
- comment="Restrict access to ldap passwords"
- id="test_ldap_server_config_olcaccess_userpassword"
version="1">
- <ind:object object_ref="obj_ldap_server_config_olcaccess_userpassword"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_ldap_server_config_olcaccess_userpassword" version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*db.ldif</ind:filename>
- <ind:pattern operation="pattern match">[\s]*olcAccess[\s]*:[\s]*to
attrs=.*userPassword.*[\n\s]*by self write[\n\s]*by
group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by anonymous
auth[\n\s]*by \* none</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
check_existence="all_exist"
- comment="Protect the user's password by allowing the user himself or the LDAP
administrators to change it, allowing the anonymous user to authenticate against it, and
allowing no other access"
- id="test_ldap_server_config_olcaccess_shadowlastchange"
version="1">
- <ind:object
object_ref="obj_ldap_server_config_olcaccess_shadowlastchange" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_ldap_server_config_olcaccess_shadowlastchange"
version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*db.ldif</ind:filename>
- <ind:pattern operation="pattern match">[\s]*olcAccess[\s]*:[\s]*to
attrs=.*shadowLastChange.*[\n\s]*by self write[\n\s]*by
group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by \*
read</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-
- <ind:textfilecontent54_test check="all"
check_existence="all_exist"
- comment="Allow anyone to read other information but only let admins change
it"
- id="test_ldap_server_config_olcaccess_other" version="1">
- <ind:object object_ref="obj_ldap_server_config_olcaccess_other" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_ldap_server_config_olcaccess_other"
version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*db.ldif</ind:filename>
- <ind:pattern operation="pattern match">[\s]*olcAccess[\s]*:[\s]*to
\*[\n\s]*by group\/groupOfUniqueNames\/uniqueMember=[\s]*"cn=.*" write[\n\s]*by
\* read</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olcrootpw.xml
b/RHEL6/input/checks/ldap_server_config_olcrootpw.xml
deleted file mode 100644
index cc50399..0000000
--- a/RHEL6/input/checks/ldap_server_config_olcrootpw.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcrootpw" version="1">
- <metadata>
- <title>Secure RootDN password</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If installed, LDAP server should be configured to protect the
RootDN password.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use a
non-default domain"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it
fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <!-- TODO:TEST ADD FILE PERM/OWNERSHIP TEST -->
- <criterion test_ref="test_20137" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcRootPW[\s]*:[\s]*\S*\{SSHA\}\S*
expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_20137" version="1">
- <ind:object object_ref="obj_20137" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20137"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcRootPW[\s]*:[\s]*\S*\{SSHA\}\S*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
b/RHEL6/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
deleted file mode 100644
index a639882..0000000
--- a/RHEL6/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcsecurity_simple_bind" version="1">
- <metadata>
- <title>LDAP Server Should Require Protected Binds</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If installed, LDAP server should require secure
binds.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use
strong encryption"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it
fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <criterion test_ref="test_ldap_server_config_olcsecurity_simple_bind"
/>
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*simple_bind=128.*
expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_ldap_server_config_olcsecurity_simple_bind"
version="1">
- <ind:object object_ref="obj_ldap_server_config_olcsecurity_simple_bind"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_ldap_server_config_olcsecurity_simple_bind"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcSecurity[\s]*:[\s]*\.*simple_bind=128.*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olcsecurity_tls.xml
b/RHEL6/input/checks/ldap_server_config_olcsecurity_tls.xml
deleted file mode 100644
index 8089bd3..0000000
--- a/RHEL6/input/checks/ldap_server_config_olcsecurity_tls.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcsecurity_tls" version="1">
- <metadata>
- <title>LDAP Server Should Use TLS</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If installed, LDAP server should use TLS.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use
strong encryption"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it
fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <criterion test_ref="test_ldap_server_config_olcsecurity_tls" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*tls=128.* expression
in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_ldap_server_config_olcsecurity_tls" version="1">
- <ind:object object_ref="obj_ldap_server_config_olcsecurity_tls" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_ldap_server_config_olcsecurity_tls"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcSecurity[\s]*:[\s]*\.*tls=128.*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olcsuffix.xml
b/RHEL6/input/checks/ldap_server_config_olcsuffix.xml
deleted file mode 100644
index 3082fca..0000000
--- a/RHEL6/input/checks/ldap_server_config_olcsuffix.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcsuffix" version="1">
- <metadata>
- <title>LDAP Should Use A Non-default Domain</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If installed, LDAP server should be configured to use a
non-default domain.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use a
non-default domain"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it
fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <criterion test_ref="test_20136" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist"
- comment="Tests the value of the
^[\s]*olcSuffix[\s]*:[\s]*\S*(my-domain|example|test)\S* expression in the
/etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_20136" version="1">
- <ind:object object_ref="obj_20136" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20136"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcSuffix[\s]*:[\s]*\S*(my-domain|example|test)\S*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/ldap_server_config_olctlsciphersuite.xml
b/RHEL6/input/checks/ldap_server_config_olctlsciphersuite.xml
deleted file mode 100644
index fe0c52f..0000000
--- a/RHEL6/input/checks/ldap_server_config_olctlsciphersuite.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olctlsciphersuite" version="1">
- <metadata>
- <title>LDAP Server Should Use Strong Encryption</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If installed, LDAP server should be configured use strong
encryption.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use
strong encryption"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it
fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <criterion test_ref="test_20140" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcTLSCipherSuite[\s]*:[\s]*(.*)$ expression
in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_20140" version="1">
- <ind:object object_ref="obj_20140" />
- <ind:state state_ref="state_20140" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20140"
- version="1">
- <ind:subexpression
operation="equals">HIGH:MEDIUM:+SSLv2</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_20140"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern
match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*olcTLSCipherSuite[\s]*:[\s]*(.*)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/profiles/manual_audits.xml
b/RHEL6/input/profiles/manual_audits.xml
deleted file mode 100644
index e32dd23..0000000
--- a/RHEL6/input/profiles/manual_audits.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<Profile id="manual_audits"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
-<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
-<description>This profile contains items that require user interaction during
audit.</description>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
-<select idref="no_empty_passwords" selected="true"/>
-<select idref="no_uidzero_except_root" selected="true"/>
-<select idref="postfix_create_cert" selected="true"/>
-<select idref="postfix_install_ssl_cert" selected="true"/>
-<select idref="network_ssl_create_ca" selected="true" />
-<select idref="network_ssl_create_ssl_certs" selected="true"
/>
-<select idref="network_ssl_create_ssl_certs" selected="true"
/>
-<select idref="network_ssl_enable_client_support"
selected="true"/>
-<select idref="network_ssl_add_ca_firefox" selected="true"/>
-<select idref="network_ssl_add_ca_thunderbird"
selected="true"/>
-<select idref="network_ssl_add_ca_evolution" selected="true"/>
-<select idref="network_ssl_remove_certs" selected="true"/>
-<select idref="network_ipv6_static_address" selected="true"/>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="enable_gdm_login_banner" selected="true"/>
-<select idref="aide_build_database" selected="true"/>
-<select idref="wireless_disable_in_bios" selected="true"/>
-<select idref="deactivate_wireless_interfaces"
selected="true"/>
-<select idref="network_ipv6_default_gateway" selected="true"/>
-<select idref="no_files_unowned_by_user" selected="true"/>
-<select idref="no_files_unowned_by_group" selected="true"/>
-<select idref="world_writable_files_system_ownership"
selected="true"/>
-<select idref="aide_verify_integrity-manually"
selected="true"/>
-<select idref="ldap_server_config_olcsuffix" selected="true"/>
-<select idref="ldap_server_config_olcrootpw" selected="true"/>
-<select idref="ldap_server_config_olcaccess" selected="true"/>
-<select idref="iptables_ldap_enabled" selected="true"/>
-<select idref="ldap_server_config_certificate_files"
selected="true"/>
-<select idref="ldap_server_config_directory_domain"
selected="true"/>
-<select idref="ldap_server_config_directory_users_groups"
selected="true"/>
-<select idref="ldap_server_config_directory_accounts"
selected="true"/>
-<select idref="ldap_server_config_directory_groups"
selected="true"/>
-<select idref="ldap_server_config_directory_admin_group"
selected="true"/>
-</Profile>
--
1.7.1