I've gone ahead and pushed for you and resolved the conflicts that
inevitably began to occur in the interim.
On 12/21/2012 11:08 AM, Jeffrey Blank wrote:
Please push. Seeing this is great, since it addresses a
longstanding
problem.
A few corrections are still in order, however. A CCE should refer to
exactly one configuration "knob". This granularity is very important.
It is also very important to understand this concept; the idea is that
by referring to a CCE you are able to unambiguously communicate a
particular configuration setting. (Ignore what you will be actually
setting it to; the point is to be clear about what it is you're
adjusting).
In the project, we will want to attach (at most) one CCE to each Rule.
(Not every Rule will have a CCE, but no Rule should have more than one.
And no Groups should have a CCE.) In the current content, there are
multiple CCEs attached to some Rules or Groups. Please reassign these
to precise Rules, or delete them.
There are also some CCEs (such as one about having a dedicated web
server) that should not be assigned to Rules. CCEs should refer to
particular technical settings on the system. We'll want to delete any
that are not referring to a particular technical setting on the system.
On 12/21/2012 12:48 AM, Michele Newman wrote:
> ---
> RHEL6/input/services/avahi.xml | 2 +-
> RHEL6/input/services/base.xml | 20 +++---
> RHEL6/input/services/cron.xml | 10 ++--
> RHEL6/input/services/dhcp.xml | 30 +++++-----
> RHEL6/input/services/dns.xml | 14 ++--
> RHEL6/input/services/ftp.xml | 20 +++---
> RHEL6/input/services/http.xml | 58 +++++++++---------
> RHEL6/input/services/imap.xml | 16 +++---
> RHEL6/input/services/ldap.xml | 36 ++++++------
> RHEL6/input/services/mail.xml | 4 +-
> RHEL6/input/services/nfs.xml | 32 +++++-----
> RHEL6/input/services/ntp.xml | 4 +-
> RHEL6/input/services/obsolete.xml | 24 ++++----
> RHEL6/input/services/printing.xml | 8 +-
> RHEL6/input/services/smb.xml | 6 +-
> RHEL6/input/services/snmp.xml | 6 +-
> RHEL6/input/services/squid.xml | 4 +-
> RHEL6/input/services/ssh.xml | 28 ++++----
> RHEL6/input/services/xorg.xml | 4 +-
> RHEL6/input/system/accounts/banners.xml | 6 +-
> RHEL6/input/system/accounts/pam.xml | 22 ++++----
> RHEL6/input/system/accounts/physical.xml | 22 ++++----
> .../accounts/restrictions/password_expiration.xml | 8 +-
> .../accounts/restrictions/password_storage.xml | 4 +-
> .../system/accounts/restrictions/root_logins.xml | 8 +-
> RHEL6/input/system/accounts/session.xml | 14 ++--
> RHEL6/input/system/auditing.xml | 64 ++++++++++----------
> RHEL6/input/system/logging.xml | 24 ++++----
> RHEL6/input/system/network/iptables.xml | 12 ++--
> RHEL6/input/system/network/ipv6.xml | 22 ++++----
> RHEL6/input/system/network/kernel.xml | 30 +++++-----
> RHEL6/input/system/network/network.xml | 4 +-
> RHEL6/input/system/network/uncommon.xml | 8 +-
> RHEL6/input/system/network/wireless.xml | 10 ++--
> RHEL6/input/system/permissions/execution.xml | 14 ++--
> RHEL6/input/system/permissions/files.xml | 38 ++++++------
> RHEL6/input/system/permissions/mounting.xml | 30 +++++-----
> RHEL6/input/system/permissions/partitions.xml | 22 ++++----
> RHEL6/input/system/selinux.xml | 12 ++--
> RHEL6/input/system/software/disk_partitioning.xml | 10 ++--
> RHEL6/input/system/software/integrity.xml | 4 +-
> RHEL6/input/system/software/updating.xml | 6 +-
> 42 files changed, 360 insertions(+), 360 deletions(-)
>
> diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
> index af7dd1c..f7ad4c9 100644
> --- a/RHEL6/input/services/avahi.xml
> +++ b/RHEL6/input/services/avahi.xml
> @@ -27,7 +27,7 @@ port, it is subject to network attacks. Its functionality
> is convenient but is only appropriate if the local network
> can be trusted.
> </rationale>
> -<ident cce="4365-3" />
> +<ident cce="27087-6" />
> <oval id="service_avahi-daemon_disabled" />
> <ref nist="CM-6, CM-7" disa="366"/>
> </Rule>
> diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
> index 74b3a11..6c040fa 100644
> --- a/RHEL6/input/services/base.xml
> +++ b/RHEL6/input/services/base.xml
> @@ -38,7 +38,7 @@ programs.
> such as laptops or desktops. For other systems, such as servers, it may permit
> accidental or trivially achievable denial of service situations and disabling
> it is appropriate.</rationale>
> -<ident cce="4298-6" />
> +<ident cce="27061-1" />
> <oval id="service_acpid_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -127,7 +127,7 @@ provides benefit. Traditionally this has included laptops (to
enhance battery li
> but may also apply to server or desktop environments where conserving power is
> highly desirable or necessary.
> </rationale>
> -<ident cce="4051-9" />
> +<ident cce="26973-8" />
> <oval id="service_cpuspeed_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -147,7 +147,7 @@ deals with removable media or devices.
> that use removable media or devices, but can be disabled for systems
> that do not require these.
> </rationale>
> -<ident cce="4364-6" />
> +<ident cce="27086-8" />
> <oval id="service_haldaemon_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -163,7 +163,7 @@ multiple processors.
> <ocil><service-disable-check-macro service="irqbalance"
/></ocil>
> <rationale>In an environment with multiple processors (now common), the
irqbalance service
> provides potential speedups for handling interrupt requests.</rationale>
> -<ident cce="4123-6" />
> +<ident cce="26990-2" />
> <oval id="service_irqbalance_enabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -178,7 +178,7 @@ crash, which can load information from the crashed kernel for
analysis.
> <ocil><service-disable-check-macro service="kdump"
/></ocil>
> <rationale>Unless the system is used for kernel development or testing, there
> is little need to run the kdump service.</rationale>
> -<ident cce="3425-6" />
> +<ident cce="26850-8" />
> <oval id="service_kdump_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -212,7 +212,7 @@ RAID setups do not use this service).
> <ocil><service-disable-check-macro service="mdmonitor"
/></ocil>
> <rationale>If software RAID monitoring is not required (and it is uncommon),
> there is no need to run the service.</rationale>
> -<ident cce="3854-7" />
> +<ident cce="27193-2" />
> <oval id="service_mdmonitor_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -233,7 +233,7 @@ it could be a target for attack. However, disabling D-Bus is
likely to be
> impractical for any system which needs to provide
> a graphical login session.
> </rationale>
> -<ident cce="3822-4" />
> +<ident cce="26913-4" />
> <oval id="service_messagebus_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -347,7 +347,7 @@ package selection is selected during installation. The qpidd
service listens
> for network connections which increases the attack surface of the system. If
> the system is not intended to receive AMQP traffic then the
<tt>qpidd</tt>
> service is not needed and should be disabled or removed.</rationale>
> -<ident cce="3854-7" />
> +<ident cce="26928-2" />
> <oval id="service_qpidd_disabled" />
> <ref nist="CM-6, CM-7" disa="382" />
> </Rule>
> @@ -407,7 +407,7 @@ RHN server or satellite and managed as such.
> system security, management by a system outside the enterprise enclave is not
> desirable for some environments. However, if the system is being managed by RHN or
> RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on.
</rationale>
> -<ident cce="3416-5" />
> +<ident cce="26846-6" />
> <oval id="service_rhnsd_disabled" />
> <ref nist="CM-6, CM-7" disa="382" />
> <tested by="DS" on="20121024"/>
> @@ -467,7 +467,7 @@ relay an appropriate warning.
> service due to failing hardware. Nevertheless, if it is not needed or the
> system's drives are not SMART-capable (such as solid state drives), it can be
> disabled.</rationale>
> -<ident cce="3455-3" />
> +<ident cce="26853-2" />
> <oval id="service_smartd_disabled" />
> <ref nist="CM-6, CM-7" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
> index a365de8..d9dce38 100644
> --- a/RHEL6/input/services/cron.xml
> +++ b/RHEL6/input/services/cron.xml
> @@ -17,7 +17,7 @@ maintenance tasks, such as notifying root of system activity.
> <rationale>Due to its usage for maintenance and security-supporting tasks,
> enabling the cron daemon is essential.
> </rationale>
> -<ident cce="4324-0" />
> +<ident cce="27070-2" />
> <oval id="service_crond_enabled" />
> <ref nist="CM-6, CM-7" />
> <tested by="DS" on="20121024"/>
> @@ -45,7 +45,7 @@ attack surface for an intruder.</description>
> <description>The system crontab /etc/crontab should be owned by the root user.
This
> file is provided for backwards compatibility by the RPM package crontabs and it
> will be read by the crond service. RHEL6 will not add jobs to it by
default.</description>
> -<ident cce="3851-3" />
> +<ident cce="26923-3" />
> <oval id="file_user_owner_etc_crontab" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -55,7 +55,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by
default.</de
> <description>The file /etc/crontab should be owned by the root group. This
> file is provided for backwards compatibility by the RPM package crontabs and it
> will be read by the crond service. RHEL6 will not add jobs to it by
default.</description>
> -<ident cce="3626-9" />
> +<ident cce="26876-3" />
> <oval id="file_group_owner_etc_crontab" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -65,7 +65,7 @@ will be read by the crond service. RHEL6 will not add jobs to it by
default.</de
> <description>The file /etc/crontab should be mode 600. This
> file is provided for backwards compatibility by the RPM package crontabs and it
> will be read by the crond service. RHEL6 will not add jobs to it by
default.</description>
> -<ident cce="4388-5" />
> +<ident cce="27102-3" />
> <oval id="file_mode_etc_crontab" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -122,7 +122,7 @@ access to these files should be disabled.</description>
> Many of the periodic or delayed execution features of the at
> daemon can be provided through the cron daemon instead.
> </rationale>
> -<ident cce="14466-7" />
> +<ident cce="26548-8" />
> <oval id="service_atd_disabled" />
> <ref nist="CM-6, CM-7" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
> index 7cf381b..c464cab 100644
> --- a/RHEL6/input/services/dhcp.xml
> +++ b/RHEL6/input/services/dhcp.xml
> @@ -45,7 +45,7 @@ Unmanaged or unintentionally activated DHCP servers may provide
faulty informati
> to clients, interfering with the operation of a legitimate site
> DHCP server if there is one.
> </rationale>
> -<ident cce="4336-4" />
> +<ident cce="27074-4" />
> <oval id="service_dhcpd_disabled" />
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="DS" on="20121024"/>
> @@ -62,7 +62,7 @@ the dhcp package can be uninstalled.
> Removing the DHCP server ensures that it cannot be easily or
> accidentally reactivated and disrupt network operation.
> </rationale>
> -<ident cce="4464-4" />
> +<ident cce="27120-5" />
> <oval id="package_dhcpd_removed" />
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="DS" on="20121024"/>
> @@ -100,7 +100,7 @@ the DHCP server will attempt to act as a Dynamic DNS client. As
long as the DNS
> server itself is correctly configured to reject DDNS attempts, an incorrect
> ddns-update-style setting on the client is harmless (but should be fixed as a
> best practice).</warning>
> -<ident cce="4257-2" />
> +<ident cce="27049-6" />
> <!--<oval id="dhcp_server_disable_ddns" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -115,7 +115,7 @@ that it does not consider the lease offered by the server to be
valid. By
> issuing many DHCPDECLINE messages, a malicious client can exhaust the DHCP
> server's pool of IP addresses, causing the DHCP server to forget old address
> allocations.</rationale>
> -<ident cce="4403-2" />
> +<ident cce="27106-4" />
> <!--<oval id="dhcp_server_deny_decline" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -130,7 +130,7 @@ support for the bootp protocol by adding or correcting the global
option.
> for this simpler protocol is not needed, it should be disabled to remove attack
> vectors against the DHCP server.
> </rationale>
> -<ident cce="4345-5" />
> +<ident cce="27077-7" />
> <!--<oval id="dhcp_server_deny_bootp" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -159,13 +159,13 @@ to request much of the above information from the DHCP server.
In particular,
> domain-name, domain-name-servers, and routers are configured via DHCP. These
> settings are typically necessary for proper network functionality, but are also
> usually static across machines at a given site.</warning>
> -<!--<ident cce="3724-2" />
> -<ident cce="4243-2" />
> -<ident cce="4389-3" />
> -<ident cce="3913-1" />
> -<ident cce="4169-9" />
> -<ident cce="4318-2" />
> -<ident cce="4319-0" />-->
> +<!--<ident cce="26897-9" />
> +<ident cce="27042-1" />
> +<ident cce="27103-1" />
> +<ident cce="26943-1" />
> +<ident cce="27008-2" />
> +<ident cce="27064-5" />
> +<ident cce="27065-2" />-->
> <!--<oval id="dhcp_server_minimize_served_info" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Group>
> @@ -180,7 +180,7 @@ reported by the dhcpd process.</description>
> <rationale>By default, dhcpd logs notices to the daemon facility. Sending all
> daemon messages to a dedicated log file is part of the syslog configuration
> outlined in the Logging and Auditing section</rationale>
> -<ident cce="3733-3" />
> +<ident cce="26898-7" />
> <!--<oval id="dhcp_server_configure_logging" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -229,7 +229,7 @@ DHCP relies on trusting the local network. If the local network
is not trusted,
> then it should not be used. However, the automatic configuration provided by
> DHCP is commonly used and the alternative, manual configuration, presents an
> unacceptable burden in many circumstances.</rationale>
> -<ident cce="4191-3" />
> +<ident cce="27021-5" />
> <oval id="sysconfig_networking_bootproto_ifcfg" />
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="DS" on="20121024"/>
> @@ -287,7 +287,7 @@ protocol is not in use. It is necessary to supersede settings for
unused
> services so that they cannot be set by a hostile DHCP server. If an option is
> set to an empty string, dhclient will typically not attempt to configure the
> service.</warning>
> -<!--<ident cce="4464-4" /> -->
> +<!--<ident cce="27120-5" /> -->
> <!--<oval id="dhcp_client_restrict_options" /> -->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Group>
> diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
> index 0bdaa8e..23412e3 100644
> --- a/RHEL6/input/services/dns.xml
> +++ b/RHEL6/input/services/dns.xml
> @@ -26,7 +26,7 @@ nameservers.
> All network services involve some risk of compromise due to
> implementation flaws and should be disabled if possible.
> </rationale>
> -<ident cce="3578-2" />
> +<ident cce="26873-0" />
> <oval id="service_named_disabled" />
> <ref nist="CM-6, CM-7" disa="366"/>
> </Rule>
> @@ -42,7 +42,7 @@ implementation flaws and should be disabled if possible.
> If there is no need to make DNS server software available,
> removing it provides a safeguard against its activation.
> </rationale>
> -<ident cce="4219-2" />
> +<ident cce="27030-6" />
> <oval id="package_bind_removed" />
> <ref nist="CM-6, CM-7" disa="366"/>
> </Rule>
> @@ -61,7 +61,7 @@ attacks on nameservers more difficult.</description>
> a high-risk service which must frequently be made available to the entire
> Internet, it is strongly recommended that no other services be offered by
> machines which act as organizational DNS servers.</description>
> -<!--<ident cce="4219-2" />-->
> +<!--<ident cce="27030-6" />-->
> <!--<oval id="dns_server_dedicated" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Group>
> @@ -97,9 +97,9 @@ configuration file. That is, when this guide recommends editing
> <tt>/etc/named.conf</tt>, you should instead edit
> <tt>/var/named/chroot/etc/named.conf</tt>.
> </warning>
> -<ident cce="3985-9" />
> -<ident cce="4487-5" />
> -<ident cce="4258-0" />
> +<ident cce="26957-1" />
> +<ident cce="27127-0" />
> +<ident cce="26961-3" />
> <!--<oval id="dns_server_chroot" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -327,7 +327,7 @@ updates must be allowed, IP-based ACLs are insufficient
protection, since they
> are easily spoofed. Instead, use TSIG keys (see the previous section for an
> example), and consider using the update-policy directive to restrict changes to
> only the precise type of change needed.</rationale>
> -<ident cce="4399-2" />
> +<ident cce="27105-6" />
> <!--<oval id="dns_server_disable_dynamic_updates" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
> index fc60df1..4594415 100644
> --- a/RHEL6/input/services/ftp.xml
> +++ b/RHEL6/input/services/ftp.xml
> @@ -28,7 +28,7 @@ of attack, and should be disabled if not needed.
> Furthermore, the FTP protocol is unencrypted and creates
> a risk of compromising sensitive information.
> </rationale>
> -<ident cce="3919-8" />
> +<ident cce="26948-0" />
> <oval id="service_vsftpd_disabled" />
> <ref nist="CM-6, CM-7" disa="1436"/>
> </Rule>
> @@ -45,7 +45,7 @@ a risk of compromising sensitive information.
> Removing the vsftpd package decreases the risk of its
> accidental activation.
> </rationale>
> -<ident cce="14881-7" />
> +<ident cce="26687-4" />
> <oval id="package_vsftpd_removed" />
> <ref nist="CM-6, CM-7" disa="1436"/>
> </Rule>
> @@ -62,7 +62,7 @@ accidental activation.
> </description>
> <rationale>After RHEL 2.1, Red Hat switched from distributing wu-ftpd with
RHEL to distributing vsftpd. For security
> and for consistency with future Red Hat releases, the use of vsftpd is
recommended.</rationale>
> -<ident cce="14881-7" />
> +<ident cce="27187-4" />
> <oval id="package_vsftpd_installed" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -98,7 +98,7 @@ If the <i>server_args</i>line is missing or does not
include the vsftpd configur
> <rationale>The modifications above ensure that all commands sent to the ftp
server are logged using the verbose vsftpd log
> format. The default vsftpd log file is /var/log/vsftpd.log.</rationale>
> <warning category="general">If verbose logging to vsftpd.log is
done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the
information about what files were downloaded is included in the information logged to
vsftpd.log</warning>
> -<ident cce="4549-2" />
> +<ident cce="27142-9" />
> <!--<oval id="ftp_log_transactions" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -110,7 +110,7 @@ by default. Add or correct the following configuration options.
> <pre>banner_file=/etc/issue</pre>
> </description>
> <rationale>This setting will cause the system greeting banner to be used for
FTP connections as well.</rationale>
> -<ident cce="4554-2" />
> +<ident cce="27145-2" />
> <ref disa="48" />
> <!--<oval id="ftp_present_banner" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> @@ -138,7 +138,7 @@ using a secure protocol like SCP/SFTP? If not, edit the vsftpd
configuration fil
> If non-anonymous FTP logins are necessary, follow the guidance in the remainder of
this section to secure
> these logins as much as possible.</description>
> <rationale>The use of non-anonymous FTP logins is strongly discouraged. Since
SSH clients and servers are widely available, and since SSH provides support for a
transfer mode which resembles FTP in user interface, there is no good reason to allow
password-based FTP access. </rationale>
> -<ident cce="4443-8" />
> +<ident cce="27115-5" />
> <!--<oval id="ftp_restrict_to_anon" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -156,7 +156,7 @@ If anonymous access is also required, add the anonymous usernames
to <tt>/etc/vs
> ftp</pre>
> </description>
> <rationale>Historically, the file <tt>/etc/ftpusers</tt> contained
a list of users who were not allowed to access the system via ftp. It was used to prevent
system users such as the root user from logging in via the insecure ftp protocol. However,
when the configuration option userlist deny=NO is set, vsftpd interprets ftpusers as the
set of users who are allowed to login via ftp. Since it should be possible for most users
to access their accounts via secure protocols, it is recommended that this setting be
used, so that non-anonymous ftp access can be limited to legacy users who have been
explicitly identified.</rationale>
> -<!--<ident cce="4443-8" />-->
> +<!--<ident cce="27115-5" />-->
> <!--<oval id="ftp_limit_users" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Group>
> @@ -174,7 +174,7 @@ as much as possible.</description>
> common to have a need to allow unauthenticated users to place files on the FTP
server. If this must be done, it
> is necessary to ensure that files cannot be uploaded and downloaded from the same
directory.
> </rationale>
> -<ident cce="4461-0" />
> +<ident cce="27117-1" />
> <!--<oval id="ftp_disable_uploads" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -185,7 +185,7 @@ is necessary to ensure that files cannot be uploaded and
downloaded from the sam
> be used to verify that this directory is on its own partition.</description>
> <rationale>If there is a mission-critical reason for anonymous users to upload
files, precautions must be taken to prevent
> these users from filling a disk used by other services.</rationale>
> -<!--<ident cce="4443-8" />-->
> +<!--<ident cce="27115-5" />-->
> <!--<oval id="ftp_home_partition" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -204,7 +204,7 @@ FTP is an older protocol which is not very compatible with
firewalls. During the
> and server negotiate an arbitrary port to be used for data transfer. The ip
conntrack ftp module is used by
> iptables to listen to that dialogue and allow connections to the data ports which
FTP negotiates. This allows an
> FTP server to operate on a machine which is running a firewall.</rationale>
> -<!--<ident cce="4443-8" />-->
> +<!--<ident cce="27115-5" />-->
> <!--<oval id="ftp_configure_firewall" />-->
> <!--<ref nist="CM-6, CM-7" /> -->
> </Group>
> diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
> index e484b12..893ffec 100644
> --- a/RHEL6/input/services/http.xml
> +++ b/RHEL6/input/services/http.xml
> @@ -34,7 +34,7 @@ and removed from the system.
> Running web server software provides a network-based avenue
> of attack, and should be disabled if not needed.
> </rationale>
> -<ident cce="4338-0" />
> +<ident cce="27075-1" />
> <oval id="service_httpd_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -51,7 +51,7 @@ of attack, and should be disabled if not needed.
> If there is no need to make the web server software available,
> removing it provides a safeguard against its activation.
> </rationale>
> -<ident cce="4514-6" />
> +<ident cce="27133-8" />
> <oval id="package_httpd_removed" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -70,7 +70,7 @@ package group during the system installation process. The Web
Server package
> group includes many packages which are likely extraneous, while the
> command-line method installs only the required <tt>httpd</tt> package
itself.
> </description>
> -<!--<ident cce="4346-3" />-->
> +<!--<ident cce="27078-5" />-->
> <!--<oval id="package_httpd_installed" />-->
> <!--<ref nist="CM-6, CM-7" />-->
>
> @@ -119,7 +119,7 @@ Add or correct the following directive in
<tt>/etc/httpd/conf/httpd.conf</tt>:
> Information disclosed to clients about the configuration of the web server and
system could be used
> to plan an attack on the given system. This information disclosure should be
restricted to a minimum.
> </rationale>
> -<ident cce="4474-3" />
> +<ident cce="27123-9" />
> <oval id="httpd_servertokens_prod" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -137,7 +137,7 @@ Add or correct the following directive in
<tt>/etc/httpd/conf/httpd.conf</tt>:
> Information disclosed to clients about the configuration of the web server and
system could be used
> to plan an attack on the given system. This information disclosure should be
restricted to a minimum.
> </rationale>
> -<ident cce="3756-4" />
> +<ident cce="26900-1" />
> <oval id="httpd_serversignature_off" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -214,7 +214,7 @@ If the above functionality is unnecessary, comment out the
related module:
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>-->
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_basic_authentication" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Group>
> @@ -230,7 +230,7 @@ If this functionality is unnecessary, comment out the related
module:
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_digest_authentication" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -248,7 +248,7 @@ unnecessary, comment out the related module:
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_mod_rewrite" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -266,7 +266,7 @@ If LDAP is to be used, SSL encryption should be used as well.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_ldap_support" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -287,7 +287,7 @@ supplied data should be encoded to prevent cross-site scripting
vulnerabilities.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_server_side_includes" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -303,7 +303,7 @@ is likely extraneous. If its functionality is unnecessary,
comment out the relat
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_mime_magic" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -324,7 +324,7 @@ server that is DAV enabled should be protected by access
controls.
> Minimizing the number of loadable modules available to the web server, reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_webdav" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -344,7 +344,7 @@ configuration.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_server_activity_status" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -363,7 +363,7 @@ an access control list to restrict access to the information.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_server_configuration_display" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -380,7 +380,7 @@ This functionality weakens server security by making site
enumeration easier.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_url_correction" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -405,7 +405,7 @@ are a security risk. <tt>mod_proxy_balancer</tt>
enables load balancing, but req
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_proxy_support" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -426,7 +426,7 @@ If caching is required, it should not be enabled for any
limited-access content.
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_cache_support" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -452,7 +452,7 @@ CGI scripts to run as a specified user/group instead of as the
server's user/gro
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_cgi_support" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -480,7 +480,7 @@ are not using these directives), comment out the associated
module:
> Minimizing the number of loadable modules available to the web server reduces risk
> by limiting the capabilities allowed by the web server.
> </description>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_optional_components" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Group>
> @@ -506,7 +506,7 @@ the possibility of unwanted or malicious configuration files to
be automatically
> part of the server's running configuration.
> <!--</rationale>-->
> </description>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_minimize_config_files_included" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Group>
> @@ -537,7 +537,7 @@ The <tt>httpd</tt> root directory should always have
the most restrictive config
> The Web Server's root directory content should be protected from unauthorized
access
> by web clients.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_restrict_root_directory" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -563,7 +563,7 @@ Ensure that this policy is adhered to by altering the related
section of the con
> Access to the web server's directory hierarchy could allow access to
unauthorized files
> by web clients. Following symbolic links could also allow such access.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_restrict_web_directory" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -580,7 +580,7 @@ should be used to deny access by default, allowing access only
where necessary.
> Directories accessible from a web client should be configured with the least amount
of
> access possible in order to avoid unauthorized access to restricted content or
server information.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_restrict_critical_directories" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -607,7 +607,7 @@ are limited to the WebDAV protocol.
> Minimizing the number of available methods to the web client reduces risk
> by limiting the capabilities allowed by the web server.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <!--<oval id="httpd_limit_available_methods" />-->
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -647,7 +647,7 @@ Install the <tt>mod_ssl</tt> module:
> content is transmitted in plain text which could be passively monitored and accessed
by
> unauthorized parties.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <oval id="package_mod_ssl_installed" />
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -678,7 +678,7 @@ Install the <tt>security</tt> module:
> enabling the administrator to implement content access policies and filters at the
> application layer.
> </rationale>
> -<!--<ident cce="3756-4" />-->
> +<!--<ident cce="26900-1" />-->
> <oval id="package_mod_security_installed" />
> <!--<ref nist="CM-6, CM-7" />-->
> </Rule>
> @@ -771,7 +771,7 @@ This is its default setting.
> Access to the web server's log files may allow an unauthorized user or attacker
> to access information about the web server or alter the server's log files.
> </rationale>
> -<ident cce="4574-0" />
> +<ident cce="27150-2" />
> <oval id="dir_perms_var_log_httpd" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -786,7 +786,7 @@ Set permissions on the web server configuration directory to
750:
> Access to the web server's configuration files may allow an unauthorized user or
attacker
> to access information about the web server or alter the server's configuration
files.
> </rationale>
> -<!-- <ident cce="4574-0" /> -->
> +<!-- <ident cce="27150-2" /> -->
> <oval id="dir_perms_etc_httpd_conf" />
> <!-- <ref nist="CM-6, CM-7" /> -->
> </Rule>
> @@ -801,7 +801,7 @@ Set permissions on the web server configuration files to 640:
> Access to the web server's configuration files may allow an unauthorized user or
attacker
> to access information about the web server or to alter the server's
configuration files.
> </rationale>
> -<ident cce="4386-9" />
> +<ident cce="27099-1" />
> <oval id="file_permissions_httpd_server_conf_files" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
> index 0e7b6f6..ea75dd0 100644
> --- a/RHEL6/input/services/imap.xml
> +++ b/RHEL6/input/services/imap.xml
> @@ -24,7 +24,7 @@ POP3 server, the dovecot software should be disabled and removed.
> Running an IMAP or POP3 server provides a network-based
> avenue of attack, and should be disabled if not needed.
> </rationale>
> -<ident cce="3847-1" />
> +<ident cce="26922-5" />
> <oval id="service_dovecot_disabled" />
> </Rule>
>
> @@ -41,7 +41,7 @@ with the following command.
> If there is no need to make the Dovecot software available,
> removing it provides a safeguard against its activation.
> </rationale>
> -<ident cce="4239-0" />
> +<ident cce="27039-7" />
> <oval id="package_dovecot_removed" />
> </Rule>
>
> @@ -74,10 +74,10 @@ client to use the STARTTLS command before authenticating.
> Configuring Dovecot to only support the protocols the protocols needed by
> your site reduces the risk of an attacker using one of the unused protocols
> to base an attack.</rationale>
> -<ident cce="4384-4" />
> -<ident cce="3887-7" />
> -<ident cce="4530-2" />
> -<ident cce="4547-6" />
> +<ident cce="27097-5" />
> +<ident cce="26933-2" />
> +<ident cce="27135-3" />
> +<ident cce="27140-3" />
> <!-- <oval id="dovecot_support_necessary_protocols" /> -->
> </Rule>
>
> @@ -106,7 +106,7 @@ protecting user credentials, mail as it is downloaded, and
clients may use
> SSL certificates to authenticate the server, preventing another system from
> impersonating the server.
> </rationale>
> -<!-- <ident cce="4239-0" /> -->
> +<!-- <ident cce="27039-7" /> -->
> <oval id="dovecot_enable_ssl" />
> </Rule>
>
> @@ -163,7 +163,7 @@ or correct the following line.
> Using plain text authentication to the mail server could allow an
> attacker access to credentials by monitoring network traffic.
> </rationale>
> -<ident cce="4552-6" />
> +<ident cce="27144-5" />
> <oval id="dovecot_disable_plaintext_auth" />
> </Rule>
>
> diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
> index 5295cdb..4f2d047 100644
> --- a/RHEL6/input/services/ldap.xml
> +++ b/RHEL6/input/services/ldap.xml
> @@ -40,7 +40,7 @@ To ensure LDAP is configured to use TLS for all transactions, run
the following
> not specified it will default to no. It should be set to start_tls rather
> than doing LDAP over SSL.</rationale>
> <ref disa="776,778,1453" />
> -<ident cce="14894-0" />
> +<ident cce="26690-8" />
> <oval id="ldap_client_start_tls" />
> <tested by="DS" on="20121024"/>
> </Rule>
> @@ -65,7 +65,7 @@ tls_checkpeer is configured (which is the default for openldap
versions 2.1 and
> up). These directives define the path to the trust certificates signed by the
> site CA.</rationale>
> <ref disa="776,778,1453" />
> -<ident cce="14894-0" />
> +<ident cce="27189-0" />
> <oval id="ldap_client_tls_cacertpath" />
> <tested by="DS" on="20121024"/>
> </Rule>
> @@ -99,7 +99,7 @@ The output should show the following.
> <pre>package openldap-servers is not installed</pre>
> </ocil>
> <rationale>Unnecessary packages should not be installed to decrease the attack
surface of the system.</rationale>
> -<ident cce="3501-4" />
> +<ident cce="26858-1" />
> <oval id="package_openldap-servers_removed" />
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="DS" on="20121024"/>
> @@ -118,7 +118,7 @@ where dc=example,dc=com is the same root you will use on the LDAP
clients.
> <br />
> These are basic LDAP configuration directives. The suffix parameter gives the root
name of all information served by this LDAP server, and should be some name related to
your domain. The rootdn parameter names LDAP's privileged user, who is allowed to read
or write all data managed by this LDAP server.
> </description>
> -<ident cce="3501-4" />
> +<ident cce="27191-6" />
> <oval id="ldap_server_config_olcsuffix" />
> <ref nist="AC-2, CM-7" />
> </Rule>
> @@ -191,18 +191,18 @@ that certificate is encrypted, and to the public certificate
file belonging to t
> for the key to be protected further, so that processes running as ldap could not
read it. If this were done, the
> LDAP server process would need to be restarted manually whenever the server
rebooted.
> </description>
> -<ident cce="4360-4" />
> -<ident cce="4378-6" />
> -<ident cce="4492-5" />
> -<ident cce="4263-0" />
> -<ident cce="3502-2" />
> -<ident cce="4449-5" />
> -<ident cce="4361-2" />
> -<ident cce="4427-1" />
> -<ident cce="4321-6" />
> -<ident cce="4339-8" />
> -<ident cce="4105-3" />
> -<ident cce="3718-4" />
> +<ident cce="27082-7" />
> +<ident cce="27096-7" />
> +<ident cce="27129-6" />
> +<ident cce="27051-2" />
> +<ident cce="26859-9" />
> +<ident cce="27116-3" />
> +<ident cce="27083-5" />
> +<ident cce="27111-4" />
> +<ident cce="27068-6" />
> +<ident cce="27076-9" />
> +<ident cce="26989-4" />
> +<ident cce="26895-3" />
> <oval id="ldap_server_config_certificate_files" />
> <ref nist="AC-6, CM-7, SC-11, SC-12, SC-13, SC-17" />
> </Rule>
> @@ -354,8 +354,8 @@ be able to change data without an explicit access statement.
> Some manual methods of inserting information into the LDAP database may leave these
files with incorrect
> permissions. This will prevent slapd from starting correctly.
> </description>
> -<ident cce="4484-2" />
> -<ident cce="4502-1" />
> +<ident cce="27125-4" />
> +<ident cce="27131-2" />
> <oval id="ldap_server_config_directory_file_security" />
> <ref nist="AC-6, CM-7" />
> </Rule>
> diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
> index b0f2bb8..2e2fe35 100644
> --- a/RHEL6/input/services/mail.xml
> +++ b/RHEL6/input/services/mail.xml
> @@ -36,7 +36,7 @@ recommended to leave this service enabled for local mail delivery.
> <rationale>Local mail delivery is essential to some system maintenance and
> notification tasks.
> </rationale>
> -<ident cce="14068-1" />
> +<ident cce="26325-1" />
> <oval id="service_postfix_enabled" />
> <ref nist="CM-6" />
> <tested by="DS" on="20121024"/>
> @@ -84,7 +84,7 @@ This ensures <tt>postfix</tt> accepts mail messages
> (such as cron job reports) from the local system only,
> and not from the network, which protects it from network attack.
> </rationale>
> -<ident cce="15018-5" />
> +<ident cce="26780-7" />
> <oval id="postfix_network_listening_disabled" />
> <ref nist="CM-7" disa="382"/>
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
> index c67abd0..f21d309 100644
> --- a/RHEL6/input/services/nfs.xml
> +++ b/RHEL6/input/services/nfs.xml
> @@ -37,7 +37,7 @@ server. If the local machine is not configured to mount NFS
filesystems then
> this service should be disabled.
> <service-disable-macro service="nfslock" />
> </description>
> -<ident cce="4396-8" />
> +<ident cce="27104-9" />
> <oval id="service_nfslock_disabled" />
> </Rule>
>
> @@ -50,7 +50,7 @@ client-side of RPCSEC GSS. If the system does not require secure
RPC then this
> service should be disabled.
> <service-disable-macro service="rpcgssd" />
> </description>
> -<ident cce="3535-2" />
> +<ident cce="26864-9" />
> <oval id="service_rpcgssd_disabled" />
> </Rule>
>
> @@ -61,7 +61,7 @@ and GID numbers on NFSv4 mounts. If NFS is not in use on the local
system then
> this service should be disabled.
> <service-disable-macro service="rpcidmapd" />
> </description>
> -<ident cce="3568-3" />
> +<ident cce="26870-6" />
> <oval id="service_rpcidmapd_disabled" />
> </Rule>
> </Group>
> @@ -82,7 +82,7 @@ system somewhat against accidental or malicious changes to
<tt>/etc/fstab</tt>
> and against flaws in the netfs script itself.
> <service-disable-macro service="netfs" />
> </description>
> -<ident cce="4533-6" />
> +<ident cce="27137-9" />
> <oval id="service_netfs_disabled" />
> </Rule>
> </Group>
> @@ -212,7 +212,7 @@ your network.
> Restrict service to always use a given port, so that firewalling can be done
> effectively.
> </rationale>
> -<ident cce="4559-1" />
> +<ident cce="27149-4" />
> <oval id="nfs_fixed_lockd_tcp_port" />
> </Rule>
>
> @@ -229,7 +229,7 @@ your network.
> <rationale>
> Restrict service to always use a given port, so that firewalling can be done
effectively.
> </rationale>
> -<ident cce="4310-9" />
> +<ident cce="27063-7" />
> <oval id="nfs_fixed_lockd_udp_port" />
> </Rule>
>
> @@ -244,7 +244,7 @@ Where <tt>statd-port</tt> is a port which is not used
by any other service on yo
> <rationale>
> Restrict service to always use a given port, so that firewalling can be done
effectively.
> </rationale>
> -<ident cce="3667-3" />
> +<ident cce="26889-6" />
> <oval id="nfs_fixed_statd_port" />
> </Rule>
>
> @@ -259,7 +259,7 @@ Where <tt>mountd-port</tt> is a port which is not
used by any other service on y
> <rationale>
> Restrict service to always use a given port, so that firewalling can be done
effectively.
> </rationale>
> -<ident cce="4438-8" />
> +<ident cce="27114-8" />
> <oval id="nfs_fixed_mountd_port" />
> </Rule>
>
> @@ -300,7 +300,7 @@ If properly configured, the output should look like:
> <pre>nfs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre>
> </ocil>
> <rationale>Unnecessary services should be disabled to decrease the attack
surface of the system.</rationale>
> -<ident cce="4473-5" />
> +<ident cce="27199-9" />
> <oval id="service_nfs_disabled" />
> <tested by="DS" on="20121025"/>
> </Rule>
> @@ -317,8 +317,8 @@ RPC then this service should be disabled.
> <service-disable-check-macro service="rpcsvcgssd" />
> </ocil>
> <rationale>Unnecessary services should be disabled to decrease the attack
surface of the system.</rationale>
> -<ident cce="4473-5" />
> -<ident cce="4491-7" />
> +<ident cce="27122-1" />
> +<ident cce="27128-8" />
> <oval id="service_rpcsvcgssd_disabled" />
> <tested by="DS" on="20121025"/>
> </Rule>
> @@ -350,7 +350,7 @@ All NFS mounts should show the <tt>nodev</tt> setting
in parentheses.
> </ocil>
> <rationale>Legitimate device files should only exist in the /dev directory.
NFS mounts
> should not present device files to users.</rationale>
> -<ident cce="4368-7" />
> +<ident cce="27090-0" />
> <oval id="mount_option_nodev_remote_filesystems" />
> <tested by="DS" on="20121025"/>
> </Rule>
> @@ -367,7 +367,7 @@ All NFS mounts should show the <tt>nosuid</tt>
setting in parentheses.
> </ocil>
> <rationale>NFS mounts should not present suid binaries to users. Only
vendor-supplied suid executables
> should be installed to their default location on the local
filesystem.</rationale>
> -<ident cce="4024-6" />
> +<ident cce="26972-0" />
> <oval id="mount_option_nosuid_remote_filesystems" />
> <tested by="DS" on="20121025"/>
> </Rule>
> @@ -450,7 +450,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains
the option <tt>no_root_squ
> </description>
> <rationale>If the NFS server allows root access to local file systems from
remote hosts, this
> access could be used to compromise the system.</rationale>
> -<ident cce="4544-3" />
> +<ident cce="27138-7" />
> <oval id="TO:DO" />
> </Rule>
>
> @@ -466,7 +466,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains
the option <tt>insecure</t
> <rationale>Allowing client requests to be made from ports higher than 1024
could allow a unprivileged
> user to initiate an NFS connection. If the unprivileged user account has been
compromised, an
> attacker could gain access to data on the NFS server.</rationale>
> -<ident cce="4465-1" />
> +<ident cce="27121-3" />
> <oval id="TO:DO" />
> </Rule>
>
> @@ -490,7 +490,7 @@ To verify insecure file locking has been disabled, run the
following command.
> <rationale>Allowing insecure file locking could allow for sensitive data to
be
> viewed or edited by an unauthorized user.
> </rationale>
> -<ident cce="TO:DO" />
> +<ident cce="27167-6" />
> <oval id="TO:DO" />
> <ref disa="764" />
> </Rule>
> diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
> index 606ad67..3ab4f58 100644
> --- a/RHEL6/input/services/ntp.xml
> +++ b/RHEL6/input/services/ntp.xml
> @@ -45,7 +45,7 @@ a client (and synchronize only its own clock) or it is also acting
as an NTP
> server to other systems. Synchronizing time is essential for authentication
> services such as Kerberos, but it is also important for maintaining accurate
> logs and auditing possible security breaches.</rationale>
> -<ident cce="4376-0" />
> +<ident cce="27093-4" />
> <oval id="service_ntpd_enabled" />
> <ref disa="160" />
> <tested by="DS" on="20121024"/>
> @@ -72,7 +72,7 @@ server <i>ntpserver</i></pre>
> to collate system logs from multiple sources or correlate computer events with
> real time events. Using a trusted NTP server provided by your organization is
> recommended.</rationale>
> -<ident cce="4385-1" />
> +<ident cce="27098-3" />
> <oval id="ntp_remote_server" />
> <ref disa="160" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
> index c7b4431..3ed4dcc 100644
> --- a/RHEL6/input/services/obsolete.xml
> +++ b/RHEL6/input/services/obsolete.xml
> @@ -36,7 +36,7 @@ which is no longer necessary for commonly-used network services.
Disabling
> it ensures that these uncommon services are not running, and also prevents
> attacks against xinetd itself.
> </rationale>
> -<ident cce="4252-3" />
> +<ident cce="27046-2" />
> <oval id="service_xinetd_disabled" />
> <ref disa="305"/>
> <tested by="DS" on="20121026"/>
> @@ -52,7 +52,7 @@ attacks against xinetd itself.
> Removing the <tt>xinetd</tt> package decreases the risk of the
> xinetd service's accidental (or intentional) activation.
> </rationale>
> -<ident cce="4164-0" />
> +<ident cce="27005-8" />
> <oval id="package_xinetd_removed" />
> <ref disa="305"/>
> <tested by="DS" on="20121026"/>
> @@ -79,7 +79,7 @@ all other information transmitted during the session, can be
> stolen by eavesdroppers on the network. The telnet protocol is also
> subject to man-in-the-middle attacks.
> </rationale>
> -<ident cce="3390-2" />
> +<ident cce="26836-7" />
> <oval id="service_telnetd_disabled" />
> <ref disa="68,1436,197,877,888" />
> <tested by="DS" on="20121026"/>
> @@ -95,7 +95,7 @@ the following command:
> Removing the <tt>telnet-server</tt> package decreases the risk of the
> telnet service's accidental (or intentional) activation.
> </rationale>
> -<ident cce="4330-7" />
> +<ident cce="27073-6" />
> <oval id="package_telnet-server_removed" />
> <ref disa="305,381"/>
> <tested by="DS" on="20121026"/>
> @@ -122,7 +122,7 @@ network services. Removing it
> decreases the risk of those services' accidental (or intentional)
> activation.
> </rationale>
> -<ident cce="4308-3" />
> +<ident cce="27062-9" />
> <oval id="package_rsh-server_removed" />
> <ref disa="305,381"/>
> <tested by="DS" on="20121026"/>
> @@ -141,7 +141,7 @@ means that data from the login session, including passwords and
> all other information transmitted during the session, can be
> stolen by eavesdroppers on the network.
> </rationale>
> -<ident cce="undefined" />
> +<ident cce="27208-8" />
> <oval id="service_rexec_disabled" />
> <ref disa="68,1436"/>
> <tested by="DS" on="20121026"/>
> @@ -160,7 +160,7 @@ means that data from the login session, including passwords and
> all other information transmitted during the session, can be
> stolen by eavesdroppers on the network.
> </rationale>
> -<ident cce="4141-8" />
> +<ident cce="26994-4" />
> <oval id="service_rsh_disabled" />
> <ref disa="68,1436" />
> <tested by="DS" on="20121026"/>
> @@ -179,7 +179,7 @@ means that data from the login session, including passwords and
> all other information transmitted during the session, can be
> stolen by eavesdroppers on the network.
> </rationale>
> -<ident cce="3537-8" />
> +<ident cce="26865-6" />
> <oval id="service_rlogin_disabled" />
> <ref disa="1436" />
> <tested by="DS" on="20121026"/>
> @@ -228,7 +228,7 @@ the following command:
> <rationale>Removing the <tt>ypserv</tt> package decreases the risk
of the
> accidental (or intentional) activation of NIS or NIS+ services.
> </rationale>
> -<ident cce="4348-9" />
> +<ident cce="27079-3" />
> <oval id="package_ypserv_removed" />
> <ref disa="305,381"/>
> <tested by="DS" on="20121026"/>
> @@ -245,7 +245,7 @@ a NIS or NIS+ domain, should be disabled.
> Disabling the <tt>ypbind</tt> service ensures the system is not acting
> as a client in a NIS or NIS+ domain.
> </rationale>
> -<ident cce="3705-1" />
> +<ident cce="26894-6" />
> <oval id="service_ypbind_disabled" />
> <ref disa="305"/>
> <tested by="DS" on="20121026"/>
> @@ -273,7 +273,7 @@ found.</description>
> Disabling the <tt>tftp</tt> service ensures the system is not acting
> as a tftp server, which does not provide encryption or authentication.
> </rationale>
> -<ident cce="4273-9" />
> +<ident cce="27055-3" />
> <oval id="service_tftp_disabled" />
> <ref disa="1436" />
> <tested by="DS" on="20121026"/>
> @@ -291,7 +291,7 @@ as a tftp server, which does not provide encryption or
authentication.
> Removing the <tt>tftp-server</tt> package decreases the risk of the
> accidental (or intentional) activation of tftp services.
> </rationale>
> -<ident cce="3916-4" />
> +<ident cce="26946-4" />
> <oval id="package_tftp-server_removed" />
> <ref disa="305"/>
> <tested by="DS" on="20121026"/>
> diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml
> index 2247dfc..21e1339 100644
> --- a/RHEL6/input/services/printing.xml
> +++ b/RHEL6/input/services/printing.xml
> @@ -16,7 +16,7 @@ homepage and more detailed documentation are available at
http://www.cups.org.
> <ocil><service-disable-check-macro service="cups"
/></ocil>
> <rationale>Turn off unneeded services to reduce attack surface.
> </rationale>
> -<ident cce="3755-6" />
> +<ident cce="26899-5" />
> <oval id="service_cups_disabled" />
> <ref nist="CM-7" />
> </Rule>
> @@ -32,7 +32,7 @@ homepage and more detailed documentation are available at
http://www.cups.org.
> port are not allowed. If the print server does need to be accessed this
> exception should be added to the firewall configuration.
> </rationale>
> -<ident cce="3649-1" />
> +<ident cce="26884-7" />
> <!-- Need to invert this check <oval id="iptables_cupsd_disabled"
/> -->
> <ref nist="CM-7" />
> </Rule>
> @@ -57,7 +57,7 @@ the CUPS print service, can be configured to listen to these
broadcasts and add
> and configure these printers for immediate use. By disabling this browsing
> capability, the machine will no longer generate or receive such broadcasts.
> </rationale>
> -<ident cce="4420-6" />
> +<ident cce="27108-0" />
> <oval id="cups_disable_browsing" />
> </Rule>
>
> @@ -80,7 +80,7 @@ broadcasts, or remote users will still be able to see the locally
configured
> printers, even if they cannot actually print to them. To limit print serving to
> a particular set of users, use the Policy directive.
> </rationale>
> -<ident cce="4407-3" />
> +<ident cce="27107-2" />
> <oval id="cups_disable_printserver" />
> <ref nist="TODO:NIST" />
> </Rule>
> diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
> index 60bfe54..c844e8b 100644
> --- a/RHEL6/input/services/smb.xml
> +++ b/RHEL6/input/services/smb.xml
> @@ -32,7 +32,7 @@ sharing functionality.
> Running a Samba server provides a network-based avenue of attack, and
> should be disabled if not needed.
> </rationale>
> -<ident cce="4551-8" />
> +<ident cce="27143-7" />
> <oval id="service_smb_disabled" />
> <ref disa="1436" />
> </Rule>
> @@ -201,7 +201,7 @@ Packet signing can prevent
> man-in-the-middle attacks which modify SMB packets in
> transit.
> </rationale>
> -<ident cce="14075-6" />
> +<ident cce="26328-5" />
> <oval id="smb_client_signing_smb_conf" />
> </Rule>
>
> @@ -226,7 +226,7 @@ The output should show either <tt>krb5i</tt> or
<tt>ntlmv2i</tt> in use.
> Packet signing can prevent man-in-the-middle
> attacks which modify SMB packets in transit.
> </rationale>
> -<ident cce="15029-2" />
> +<ident cce="26792-2" />
> <oval id="mount_option_smb_client_signing" />
> </Rule>
>
> diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml
> index df8b2cf..567abe3 100644
> --- a/RHEL6/input/services/snmp.xml
> +++ b/RHEL6/input/services/snmp.xml
> @@ -26,7 +26,7 @@ installed and activated, the software should be disabled and
removed.
> Running SNMP software provides a network-based avenue of attack, and
> should be disabled if not needed.
> </rationale>
> -<ident cce="3765-5" />
> +<ident cce="26906-8" />
> <oval id="service_snmpd_disabled" />
> </Rule>
>
> @@ -43,7 +43,7 @@ If there is no need to run SNMP server software,
> removing the package provides a safeguard against its
> activation.
> </rationale>
> -<ident cce="14081-4" />
> +<ident cce="26332-7" />
> <oval id="package_net-snmp_removed" />
> </Rule>
>
> @@ -66,7 +66,7 @@ stations</li>
> <li>ensure that permissions on the <tt>snmpd.conf</tt>
configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more
restrictive</li>
> <li>ensure that any MIB files' permissions are also 640 or more
restrictive</li></ul>
> </description>
> -<!--<ident cce="14081-4" /> -->
> +<!--<ident cce="26332-7" /> -->
> <!--<oval id="snmp_configure_server" /> -->
>
> <Rule id="snmpd_use_newer_protocol" severity="medium">
> diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml
> index 7aa01cb..388c0e9 100644
> --- a/RHEL6/input/services/squid.xml
> +++ b/RHEL6/input/services/squid.xml
> @@ -27,7 +27,7 @@ and removed.
> Running proxy server software provides a network-based avenue
> of attack, and should be removed if not needed.
> </rationale>
> -<ident cce="4556-7" />
> +<ident cce="27146-0" />
> <oval id="service_squid_disabled" />
> </Rule>
>
> @@ -43,7 +43,7 @@ of attack, and should be removed if not needed.
> If there is no need to make the proxy server software available,
> removing it provides a safeguard against its activation.
> </rationale>
> -<ident cce="4076-6" />
> +<ident cce="26977-9" />
> <oval id="package_squid_removed" />
> </Rule>
> </Group>
> diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
> index 30890b3..4851b82 100644
> --- a/RHEL6/input/services/ssh.xml
> +++ b/RHEL6/input/services/ssh.xml
> @@ -26,7 +26,7 @@ However, if it can be disabled, do so.
> This is unusual, as SSH is a common method for encrypted and authenticated
> remote access.
> </description>
> -<ident cce="4268-9" />
> +<ident cce="27054-6" />
> <oval id="service_sshd_disabled" />
> <tested by="DS" on="20121024"/>
> </Rule>
> @@ -47,7 +47,7 @@ remote access.
> If inbound SSH connections are not expected, disallowing access to the SSH port will
> avoid possible exploitation of the port by an attacker.
> </rationale>
> -<ident cce="4295-2" />
> +<ident cce="27060-3" />
> <oval id="iptables_sshd_disabled" />
> </Rule>
>
> @@ -78,7 +78,7 @@ SSH protocol version 1 suffers from design flaws that
> result in security vulnerabilities and
> should not be used.
> </rationale>
> -<ident cce="4325-7" />
> +<ident cce="27072-8" />
> <oval id="sshd_protocol_2" />
> <ref disa="776,774,1436" />
> <tested by="DS" on="20121024"/>
> @@ -97,7 +97,7 @@ Where <tt>USER1</tt> and <tt>USER2</tt> are
valid user names.
> Specifying which accounts are allowed SSH access into the system reduces the
> possibility of unauthorized access to the system.
> </rationale>
> -<!-- <ident cce="4325-7" /> -->
> +<!-- <ident cce="27072-8" /> -->
> <!-- <oval id="sshd_limit_user_access" /> -->
> </Rule>
>
> @@ -167,7 +167,7 @@ Causing idle users to be automatically logged out
> guards against compromises one system leading trivially
> to compromises on another.
> </rationale>
> -<ident cce="3845-5" />
> +<ident cce="26919-1" />
> <oval id="sshd_idle_timeout"
value="sshd_idle_timeout_value"/>
> <ref disa="879,1133"/>
> <tested by="DS" on="20121024"/>
> @@ -191,7 +191,7 @@ If properly configured, output should be:
> This ensures a user login will be terminated as soon as the
<tt>ClientAliveCountMax</tt>
> is reached.
> </rationale>
> -<ident cce="14061-6" />
> +<ident cce="26282-4" />
> <oval id="sshd_clientalivecountmax" />
> <ref disa="879,1133"/>
> <tested by="DS" on="20121024"/>
> @@ -215,7 +215,7 @@ following line in <tt>/etc/ssh/sshd_config</tt>:
> SSH trust relationships mean a compromise on one host
> can allow an attacker to move trivially to other hosts.
> </rationale>
> -<ident cce="4475-0" />
> +<ident cce="27124-7" />
> <oval id="sshd_rsh_emulation_disabled" />
> <ref disa="765,766"/>
> </Rule>
> @@ -240,7 +240,7 @@ following line:
> SSH trust relationships mean a compromise on one host
> can allow an attacker to move trivially to other hosts.
> </rationale>
> -<ident cce="4370-3" />
> +<ident cce="27091-8" />
> <oval id="sshd_hostbasedauthentication" />
> <ref disa="765,766"/>
> <tested by="DS" on="20121024"/>
> @@ -262,7 +262,7 @@ Permitting direct root login reduces auditable information about
who ran
> privileged commands on the system
> and also allows direct attack attempts on root's password.
> </rationale>
> -<ident cce="4387-7" />
> +<ident cce="27100-7" />
> <oval id="sshd_permitrootlogin_no" />
> <ref disa="770" />
> <tested by="DS" on="20121024"/>
> @@ -285,7 +285,7 @@ Configuring this setting for the SSH daemon provides additional
assurance that
> remote login via SSH will require a password,
> even in the event of misconfiguration elsewhere.
> </rationale>
> -<ident cce="3660-8" />
> +<ident cce="26887-0" />
> <oval id="sshd_permitemptypasswords_no" />
> <ref disa="765,766"/>
> <tested by="DS" on="20121024"/>
> @@ -309,7 +309,7 @@ reinforces policy awareness during the logon process.
Alternatively,
> systems whose ownership should not be obvious
> should ensure usage of a banner that does not provide easy attribution.
> </rationale>
> -<ident cce="4431-3" />
> +<ident cce="27112-2" />
> <oval id="sshd_banner_set" />
> <ref disa="48" />
> <tested by="DS" on="20121024"/>
> @@ -333,7 +333,7 @@ If properly configured, output should be:
> SSH environment options potentially allow users to bypass
> access restriction in some configurations.
> </rationale>
> -<ident cce="4422-2" />
> +<ident cce="27201-3" />
> <oval id="sshd_no_user_envset" />
> <ref disa="1414" />
> <tested by="DS" on="20121024"/>
> @@ -358,7 +358,7 @@ The output should contain only those ciphers which are
FIPS-approved.
> Approved algorithms should impart some level of confidence in their
> implementation. These are also required for compliance.
> </rationale>
> -<ident cce="14491-5" />
> +<ident cce="26555-3" />
> <oval id="sshd_use_approved_ciphers" />
> <ref disa="803,1144,1145,1146" />
> <tested by="DS" on="20121024"/>
> @@ -382,7 +382,7 @@ and replace it with:
> <rationale>
> Restricting SSH access to only trusted network segments reduces exposure of the SSH
> server to attacks from unauthorized networks.</rationale>
> -<!-- <ident cce="14491-5" /> -->
> +<!-- <ident cce="26555-3" /> -->
> <!-- <oval id="sshd_strengthen_firewall" /> -->
> </Group>
>
> diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
> index 7ee53e8..c2dbbe1 100644
> --- a/RHEL6/input/services/xorg.xml
> +++ b/RHEL6/input/services/xorg.xml
> @@ -27,7 +27,7 @@ The output should show the following:
> <pre>id:3:initdefault:</pre>
> </ocil>
> <rationale>Unnecessary services should be disabled to decrease the attack
surface of the system.</rationale>
> -<ident cce="4462-8" />
> +<ident cce="27119-7" />
> <oval id="xwindows_runlevel_setting" />
> <ref disa="366" />
> <tested by="DS" on="20121025"/>
> @@ -48,7 +48,7 @@ The output should be:
> <pre>package xorg-x11-server-common is not installed</pre>
> </ocil>
> <rationale>Unnecessary packages should not be installed to decrease the attack
surface of the system.</rationale>
> -<ident cce="4422-2" />
> +<ident cce="27198-1" />
> <oval id="package_xorg-x11-server-common_removed" />
> <ref disa="366" />
> <tested by="DS" on="20121025"/>
> diff --git a/RHEL6/input/system/accounts/banners.xml
b/RHEL6/input/system/accounts/banners.xml
> index 782cfb4..6464c4d 100644
> --- a/RHEL6/input/system/accounts/banners.xml
> +++ b/RHEL6/input/system/accounts/banners.xml
> @@ -77,7 +77,7 @@ run the following command:
> Although unlikely to dissuade a serious attacker, the warning message
> reinforces policy awareness during the logon process.
> </rationale>
> -<ident cce="4060-0" />
> +<ident cce="26974-6" />
> <oval id="banner_etc_issue" value="login_banner_text"/>
> <ref nist="AC-3, CM-6, AC-8"
disa="48,1384,1385,1386,1387,1388" />
> <tested by="DS" on="20121026"/>
> @@ -114,7 +114,7 @@ If properly configured, the <tt>default</tt> value
should be <tt>true</tt>.
> Although unlikely to dissuade a serious attacker, the warning message
> reinforces policy awareness during the logon process.
> </rationale>
> -<ident cce="4188-9" />
> +<ident cce="27195-7" />
> <oval id="banner_gui_enabled" />
> <ref nist="AC-3, CM-6, AC-8" disa="48,50" />
> </Rule>
> @@ -142,7 +142,7 @@ If properly configured, the proper banner text will appear within
this schema.
> Although unlikely to dissuade a serious attacker, the warning message
> reinforces policy awareness during the logon process.
> </rationale>
> -<ident cce="4188-9" />
> +<ident cce="27017-3" />
> <oval id="banner_gui_text_set" value="login_banner_text"
/>
> <ref nist="AC-3, CM-6, AC-8"
disa="48,1384,1385,1386,1387,1388" />
> </Rule>
> diff --git a/RHEL6/input/system/accounts/pam.xml
b/RHEL6/input/system/accounts/pam.xml
> index 95b21c1..3e893a9 100644
> --- a/RHEL6/input/system/accounts/pam.xml
> +++ b/RHEL6/input/system/accounts/pam.xml
> @@ -195,7 +195,7 @@ requires some software, such as SSH, to re-connect. This can slow
down and
> draw additional attention to some types of password-guessing attacks. Note that
this
> is different from account lockout, which is provided by the pam_faillock module.
> </rationale>
> -<ident cce="15054-0" />
> +<ident cce="26795-5" />
> <oval id="accounts_password_pam_cracklib_retry"
value="var_password_pam_cracklib_retry"/>
> <ref nist="IA-5" disa="1092" />
> <tested by="DS" on="20121024"/>
> @@ -238,7 +238,7 @@ This would appear as <tt>dcredit=-1</tt>.
> Requiring digits makes password guessing attacks more difficult by ensuring a
larger
> search space.
> </rationale>
> -<ident cce="14113-5" />
> +<ident cce="26374-9" />
> <oval id="accounts_password_pam_cracklib_dcredit"
value="var_password_pam_cracklib_dcredit"/>
> <ref nist="IA-5,194" disa="194"/>
> <tested by="DS" on="20121024"/>
> @@ -263,7 +263,7 @@ This would appear as <tt>ucredit=-1</tt>.
> Requiring a minimum number of uppercase characters makes password guessing attacks
> more difficult by ensuring a larger search space.
> </rationale>
> -<ident cce="14672-0" />
> +<ident cce="26601-5" />
> <oval id="accounts_password_pam_cracklib_ucredit"
value="var_password_pam_cracklib_ucredit"/>
> <ref nist="IA-5" disa="192" />
> <tested by="DS" on="20121024"/>
> @@ -288,7 +288,7 @@ This would appear as <tt>ocredit=-1</tt>.
> Requiring a minimum number of special characters makes password guessing attacks
> more difficult by ensuring a larger search space.
> </rationale>
> -<ident cce="14122-6" />
> +<ident cce="26409-3" />
> <oval id="accounts_password_pam_cracklib_ocredit"
value="var_password_pam_cracklib_ocredit"/>
> <ref nist="IA-5" disa="1619" />
> <tested by="DS" on="20121024"/>
> @@ -313,7 +313,7 @@ This would appear as <tt>lcredit=-1</tt>.
> Requiring a minimum number of lowercase characters makes password guessing attacks
> more difficult by ensuring a larger search space.
> </rationale>
> -<ident cce="14712-4" />
> +<ident cce="26631-2" />
> <oval id="accounts_password_pam_cracklib_lcredit"
value="var_password_pam_cracklib_lcredit"/>
> <ref nist="IA-5" disa="193" />
> <tested by="DS" on="20121024"/>
> @@ -339,7 +339,7 @@ Requiring a minimum number of different characters during
password changes ensur
> newly changed passwords should not resemble previously compromised ones.
> Note that passwords which are changed on compromised systems will still be
compromised, however.
> </rationale>
> -<ident cce="14701-7" />
> +<ident cce="26615-5" />
> <oval id="accounts_password_pam_cracklib_difok"
value="var_password_pam_cracklib_difok"/>
> <ref nist="IA-5" disa="195"/>
> <tested by="DS" on="20121024"/>
> @@ -386,7 +386,7 @@ The output should show <tt>deny=3</tt>.
> Locking out user accounts after a number of incorrect attempts
> prevents direct password guessing attacks.
> </rationale>
> -<ident cce="3410-8" />
> +<ident cce="26844-1" />
> <oval id="accounts_passwords_pam_faillock_deny"
value="var_accounts_passwords_pam_faillock_deny"/>
> <ref nist="AC-7, CM-6" disa="1452,44,47" />
> </Rule>
> @@ -408,7 +408,7 @@ The output should show the following at the end of the line:
> <rationale>
> Preventing re-use of previous passwords helps ensure that a compromised password is
not re-used by a user.
> </rationale>
> -<ident cce="14939-3" />
> +<ident cce="26741-9" />
> <oval id="accounts_password_reuse_limit"
value="password_history_retain_number" />
> <ref nist="IA-5" disa="200" />
> <tested by="DS" on="20121024"/>
> @@ -442,7 +442,7 @@ ensure that the <tt>pam_unix.so</tt> module includes
the argument
> <rationale>
> Using a stronger hashing algorithm makes password cracking attacks more difficult.
> </rationale>
> -<!-- <ident cce="14063-2" /> -->
> +<!-- <ident cce="26303-8" /> -->
> <!-- <oval id="accounts_password_hashing_algorithm" /> -->
> <ref nist="IA-5" disa="803"/>
> <tested by="DS" on="20121024"/>
> @@ -462,7 +462,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the
following line appears:
> <rationale>
> Using a stronger hashing algorithm makes password cracking attacks more difficult.
> </rationale>
> -<!-- <ident cce="14063-2" /> -->
> +<!-- <ident cce="26303-8" /> -->
> <!-- <oval id="accounts_password_hashing_algorithm" /> -->
> <ref nist="IA-5" disa="803"/>
> <tested by="DS" on="20121024"/>
> @@ -484,7 +484,7 @@ in the <tt>[default]</tt> section:
> <rationale>
> Using a stronger hashing algorithm makes password cracking attacks more difficult.
> </rationale>
> -<!-- <ident cce="14063-2" /> -->
> +<!-- <ident cce="26303-8" /> -->
> <!-- <oval id="accounts_password_hashing_algorithm" /> -->
> <ref nist="IA-5" disa="803"/>
> <tested by="DS" on="20121026"/>
> diff --git a/RHEL6/input/system/accounts/physical.xml
b/RHEL6/input/system/accounts/physical.xml
> index 05f54e7..e914c6a 100644
> --- a/RHEL6/input/system/accounts/physical.xml
> +++ b/RHEL6/input/system/accounts/physical.xml
> @@ -33,7 +33,7 @@ or modification of the file.
> <rationale>
> Only root should be able to modify important boot parameters.
> </rationale>
> -<ident cce="4144-2" />
> +<ident cce="26995-1" />
> <oval id="file_user_owner_grub_conf" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -51,7 +51,7 @@ destruction or modification of the file.
> The <tt>root</tt> group is a highly-privileged group. Furthermore, the
group-owner of this
> file should not have any access privileges anyway.
> </rationale>
> -<ident cce="4197-0" />
> +<ident cce="27022-3" />
> <oval id="file_group_owner_grub_conf" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -68,7 +68,7 @@ is the default.
> Proper permissions ensure that only the root user can modify important boot
> parameters.
> </rationale>
> -<ident cce="3923-0" />
> +<ident cce="26949-8" />
> <oval id="file_permissions_grub_conf" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -97,7 +97,7 @@ users with physical access cannot trivially alter
> important bootloader settings. These include which kernel to use,
> and whether to enter single-user mode.
> </rationale>
> -<ident cce="3818-2" />
> +<ident cce="26911-8" />
> <oval id="bootloader_password" />
> <ref nist="CM-7, IA-5, AC-3" disa="213" />
> <tested by="DS" on="20121026"/>
> @@ -128,7 +128,7 @@ This prevents attackers with physical access from trivially
bypassing security
> on the machine and gaining root access. Such accesses are further prevented
> by configuring the bootloader password.
> </rationale>
> -<ident cce="4241-6" />
> +<ident cce="27040-5" />
> <oval id="singleuser_password" />
> <ref nist="AC-6, IA-5" disa="213" />
> <tested by="DS" on="20121024"/>
> @@ -185,7 +185,7 @@ Using interactive boot,
> the console user could disable auditing, firewalls, or other
> services, weakening system security.
> </rationale>
> -<ident cce="4245-7" />
> +<ident cce="27043-9" />
> <oval id="interactive_boot_disable" />
> <ref nist="CM-7, IA-4, SC-2" disa="213"/>
> <tested by="DS" on="20121024"/>
> @@ -263,7 +263,7 @@ Setting the idle delay controls when the
> screensaver will start, and can be combined with
> screen locking to prevent access from passersby.
> </rationale>
> -<ident cce="3315-9" />
> +<ident cce="26828-4" />
> <oval id="gconf_gnome_screensaver_idle_delay"
value="inactivity_timeout_value" />
> <ref nist="AC-3, CM-6, CM-7, AC-11" disa="57"/>
> </Rule>
> @@ -289,7 +289,7 @@ real-time screen display (such as network management products)
require the
> login session does not have administrator rights and the display station is located
in a
> controlled-access area.
> </rationale>
> -<ident cce="14604-3" />
> +<ident cce="26600-7" />
> <oval id="gconf_gnome_screensaver_idle_activation_enabled" />
> <ref nist="CM-6, CM-7" disa="57" />
> </Rule>
> @@ -314,7 +314,7 @@ Enabling the activation of the screen lock after an idle period
> ensures password entry will be required in order to
> access the system, preventing access by passersby.
> </rationale>
> -<ident cce="14023-6" />
> +<ident cce="26235-2" />
> <oval id="gconf_gnome_screensaver_lock_enabled" />
> <ref nist="AC-3, CM-6, CM-7, AC-11" disa="57" />
> </Rule>
> @@ -339,7 +339,7 @@ If properly configured, the output should be
<tt>blank-only</tt>
> Setting the screensaver mode to blank-only conceals the
> contents of the display from passersby.
> </rationale>
> -<ident cce="14735-5" />
> +<ident cce="26638-7" />
> <oval id="gconf_gnome_screensaver_mode_blank" />
> <ref nist="CM-6, CM-7" disa="60" />
> </Rule>
> @@ -371,7 +371,7 @@ The console can now be locked with the following key
combination:
> Installing <tt>screen</tt> ensures a console locking capability is
available
> for users who may need to suspend console logins.
> </rationale>
> -<ident cce="3910-7" />
> +<ident cce="26940-7" />
> <ref nist="CM-6, CM-7" disa="58" />
> <tested by="DS" on="20121026"/>
> </Rule>
> diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> index a4e3873..fd26a64 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
> @@ -101,7 +101,7 @@ search space. However, any security benefit from an onerous
requirement
> must be carefully weighed against usability problems, support costs, or
counterproductive
> behavior that may result.
> </rationale>
> -<ident cce="4154-1" />
> +<ident cce="27002-5" />
> <oval id="accounts_password_minlen_login_defs"
value="var_password_min_len"/>
> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/>
> <tested by="DS" on="20121026"/>
> @@ -128,7 +128,7 @@ Setting the minimum password age protects against
> users cycling back to a favorite password
> after satisfying the password reuse requirement.
> </rationale>
> -<ident cce="4180-6" />
> +<ident cce="27013-2" />
> <oval id="accounts_minimum_age_login_defs"
value="var_password_min_age"/>
> <ref nist="CM-6, IA-5" disa="198"/>
> <tested by="DS" on="20121026"/>
> @@ -156,7 +156,7 @@ periodically change their passwords. This could possibly
decrease
> the utility of a stolen password. Requiring shorter password lifetimes
> increases the risk of users writing down the password in a convenient
> location subject to physical compromise.</rationale>
> -<ident cce="4092-3" />
> +<ident cce="26985-2" />
> <oval id="accounts_maximum_age_login_defs"
value="var_password_max_age"/>
> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180,199" />
> <tested by="DS" on="20121026"/>
> @@ -182,7 +182,7 @@ The DoD requirement is 7.
> Setting the password warning age enables users to
> make the change at a practical time.
> </rationale>
> -<ident cce="4097-2" />
> +<ident cce="26988-6" />
> <oval id="accounts_password_warn_age_login_defs"
value="var_password_warn_age" />
> <ref nist="CM-6, CM-7, IA-5, AC-3" />
> <tested by="DS" on="20121026"/>
> diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml
b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> index 8222f67..21de2d2 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> @@ -36,7 +36,7 @@ run commands with the privileges of that account. Accounts with
> empty passwords should never be used in operational
> environments.
> </rationale>
> -<ident cce="4238-2" />
> +<ident cce="27038-9" />
> <oval id="accounts_pam_no_nullok" />
> <ref nist="AC-3, CM-6, IA-5" />
> <tested by="DS" on="20121024"/>
> @@ -62,7 +62,7 @@ The hashes for all user account passwords should be stored in
> the file <tt>/etc/shadow</tt> and never in
<tt>/etc/passwd</tt>,
> which is readable by all users.
> </rationale>
> -<ident cce="14300-8" />
> +<ident cce="26476-2" />
> <oval id="accounts_password_all_shadowed" />
> <ref nist="IA-5" disa="201" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml
b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> index 2d1ea24..35bac20 100644
> --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
> +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> @@ -57,7 +57,7 @@ Preventing direct root login to virtual console devices
> helps ensure accountability for actions taken on the system
> using the root account.
> </rationale>
> -<ident cce="3485-0" />
> +<ident cce="26855-7" />
> <oval id="securetty_root_login_console_only" />
> <ref nist="CM-6, CM-7" disa="770" />
> <tested by="DS" on="20121024"/>
> @@ -82,7 +82,7 @@ Preventing direct root login to serial port interfaces
> helps ensure accountability for actions taken on the systems
> using the root account.
> </rationale>
> -<ident cce="4256-4" />
> +<ident cce="27047-0" />
> <oval id="securetty_no_serial" />
> <ref nist="AC-3, AC-6" disa="770" />
> <tested by="DS" on="20121024"/>
> @@ -139,7 +139,7 @@ Do not perform the steps in this
> section on the root account. Doing so might cause the system to
> become inaccessible.
> </warning>
> -<ident cce="3987-5" />
> +<ident cce="26966-2" />
> <oval id="accounts_nologin_for_system" />
> <ref nist="AC-3, CM-6" disa="178" />
> <tested by="DS" on="20121024"/>
> @@ -165,7 +165,7 @@ guess a password for a privileged account. Proper configuration
of
> sudo is recommended to afford multiple system administrators
> access to root privileges in an accountable manner.
> </rationale>
> -<ident cce="4009-7" />
> +<ident cce="26971-2" />
> <oval id="accounts_no_uid_except_zero" />
> <ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/accounts/session.xml
b/RHEL6/input/system/accounts/session.xml
> index 09409b8..1958bb7 100644
> --- a/RHEL6/input/system/accounts/session.xml
> +++ b/RHEL6/input/system/accounts/session.xml
> @@ -87,7 +87,7 @@ These empty elements have the same effect as a single
<tt>.</tt> character.
> Including these entries increases the risk that root could
> execute code from an untrusted location.
> </rationale>
> -<ident cce="3301-9" />
> +<ident cce="26826-8" />
> <oval id="accounts_dangerous_path_for_root" />
> <ref nist="CM6, CM-7"/>
> </Rule>
> @@ -110,7 +110,7 @@ Such entries increase the risk that root could
> execute code provided by unprivileged users,
> and potentially malicious code.
> </rationale>
> -<ident cce="14957-5" />
> +<ident cce="26768-2" />
> <oval id="accounts_root_path_dirs_no_write" />
> <ref nist="CM6, CM-7"/>
> </Rule>
> @@ -145,7 +145,7 @@ to other users. If a subset of users need read access
> to one another's home directories, this can be provided using
> groups or ACLs.
> </rationale>
> -<ident cce="4090-7" />
> +<ident cce="26981-1" />
> <oval id="file_permissions_home_dirs" />
> <ref nist="AC-3, CM-6"/>
> </Rule>
> @@ -225,7 +225,7 @@ umask 077
> umask 077</pre>
> </ocil>
>
> -<ident cce="3844-8" />
> +<ident cce="26917-5" />
> <oval id="accounts_umask_bash_users"
value="umask_user_value"/>
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="swells" on="20120929"/>
> @@ -249,7 +249,7 @@ All output must show the value of <tt>umask</tt> set
to 077, as shown in the bel
> <pre># grep "umask" /etc/csh.cshrc
> umask 077</pre>
> </ocil>
> -<ident cce="4227-5" />
> +<ident cce="27034-8" />
> <oval id="accounts_umask_csh" value="umask_user_value"/>
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="swells" on="20120929"/>
> @@ -265,7 +265,7 @@ add or correct the <tt>umask</tt> setting in
<tt>/etc/profile</tt> to read as fo
> <rationale>The umask value influences the permissions assigned to files when
they are created.
> A misconfigured umask value could result in files with excessive permissions that
can be read and/or
> written to by unauthorized users.</rationale>
> -<ident cce="14847-8" />
> +<ident cce="26669-2" />
> <ocil clause="the above command returns no output, or if the umask is
configured incorrectly">
> Verify the <tt>umask</tt> setting is configured correctly in the
<tt>/etc/profile</tt> file by
> running the following command:
> @@ -297,7 +297,7 @@ All output must show the value of <tt>umask</tt> set
to 077, as shown in the bel
> <pre># grep "umask" /etc/login.defs
> umask 077</pre>
> </ocil>
> -<ident cce="14107-7" />
> +<ident cce="26371-5" />
> <oval id="accounts_umask_login_defs" value="umask_user_value"
/>
> <ref nist="CM-6, CM-7" disa="366"/>
> <tested by="swells" on="20120929" />
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index f823a89..f5e617a 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -91,7 +91,7 @@ disk.
> audit records generated by the kernel can be written to disk, or that appropriate
> actions will be taken if other obstacles exist.
> </rationale>
> -<ident cce="4292-9" />
> +<ident cce="27058-7" />
> <oval id="service_auditd_enabled" />
> <ref nist="CM-6, CM-7"
disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589"
/>
> <tested by="DS" on="20121024"/>
> @@ -116,7 +116,7 @@ takes care of enabling this for all processes which launch after
it
> does, adding the kernel argument ensures it is set for every
> process during boot.
> </rationale>
> -<ident cce="15026-8" />
> +<ident cce="26785-6" />
> <oval id="bootloader_audit_argument" />
> <ref nist="AU-2" disa="1464,130" />
> </Rule>
> @@ -489,7 +489,7 @@ desired, but is not required. See an example of multiple combined
syscalls:
> nefarious activities in log files, as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> to the system time should be audited.</rationale>
> -<ident cce="14051-7" />
> +<ident cce="26242-8" />
> <oval id="audit_rules_time_adjtimex" />
> <ref nist="AU-2(a)" />
> <ref disa="1487,169" />
> @@ -517,7 +517,7 @@ desired, but is not required. See an example of multiple combined
syscalls:
> nefarious activities in log files, as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> to the system time should be audited.</rationale>
> -<ident cce="14051-7" />
> +<ident cce="27203-9" />
> <oval id="audit_rules_time_settimeofday" />
> <ref nist="AU-2(a)" />
> <ref disa="1487,169" />
> @@ -543,7 +543,7 @@ See an example of multiple combined syscalls:
> nefarious activities in log files, as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> to the system time should be audited.</rationale>
> -<ident cce="14051-7" />
> +<ident cce="27169-2" />
> <oval id="audit_rules_time_stime" />
> <ref nist="AU-2(a)" />
> <ref disa="1487,169" />
> @@ -571,7 +571,7 @@ desired, but is not required. See an example of multiple combined
syscalls:
> nefarious activities in log files, as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> to the system time should be audited.</rationale>
> -<ident cce="14051-7" />
> +<ident cce="27170-0" />
> <oval id="audit_rules_time_clock_settime" />
> <ref nist="AU-2(a)" />
> <ref disa="1487,169" />
> @@ -596,7 +596,7 @@ If the system is configured to audit this activity, it will
return a line.
> nefarious activities in log files, as well as to confuse network services that
> are highly dependent upon an accurate system time (such as sshd). All changes
> to the system time should be audited.</rationale>
> -<ident cce="14051-7" />
> +<ident cce="27172-6" />
> <oval id="audit_rules_time_watch_localtime" />
> <ref nist="AU-2(a)" />
> <ref disa="1487,169" />
> @@ -625,7 +625,7 @@ each file specified (and with <tt>perm=wa</tt> for
each).
> will alert the system administrator(s) to any modifications. Any
> unexpected users, groups, or modifications should be investigated for
> legitimacy.</rationale>
> -<ident cce="14829-6" />
> +<ident cce="26664-3" />
> <oval id="audit_rules_usergroup_modification" />
> <ref nist="AU-2(a)"
disa="18,1403,1404,1405,1684,1683,1685,1686"/>
> </Rule>
> @@ -651,7 +651,7 @@ each file specified (and <tt>perm=wa</tt> should be
indicated for each).
> <rationale>The network environment should not be modified by anything other
> than administrator action. Any change to network parameters should be
> audited.</rationale>
> -<ident cce="14816-3" />
> +<ident cce="26648-6" />
> <oval id="audit_rules_networkconfig_modification" />
> <ref nist="AU-2(a)" />
> </Rule>
> @@ -706,7 +706,7 @@ configuration, a line should be returned (including
> <rationale>The system's mandatory access policy (SELinux) should not be
> arbitrarily changed by anything other than administrator action. All changes to
> MAC policy should be audited.</rationale>
> -<ident cce="14821-3" />
> +<ident cce="26657-7" />
> <oval id="audit_rules_mac_modification" />
> <ref nist="AU-2" />
> </Rule>
> @@ -766,7 +766,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="26280-8" />
> <oval id="audit_rules_dac_modification_chmod" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -794,7 +794,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27173-4" />
> <oval id="audit_rules_dac_modification_chown" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -822,7 +822,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27174-2" />
> <oval id="audit_rules_dac_modification_fchmod" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -850,7 +850,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27175-9" />
> <oval id="audit_rules_dac_modification_fchmodat" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -878,7 +878,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27177-5" />
> <oval id="audit_rules_dac_modification_fchown" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -906,7 +906,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27178-3" />
> <oval id="audit_rules_dac_modification_fchownat" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -934,7 +934,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27179-1" />
> <oval id="audit_rules_dac_modification_fremovexattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -962,7 +962,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27180-9" />
> <oval id="audit_rules_dac_modification_fsetxattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -990,7 +990,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27181-7" />
> <oval id="audit_rules_dac_modification_lchown" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1018,7 +1018,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27182-5" />
> <oval id="audit_rules_dac_modification_lremovexattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1046,7 +1046,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27183-3" />
> <oval id="audit_rules_dac_modification_lsetxattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1074,7 +1074,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27184-1" />
> <oval id="audit_rules_dac_modification_removexattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1102,7 +1102,7 @@ number of ways while still achieving the desired effect. Here
the system calls
> have been placed independent of other system calls. Grouping these system
> calls with others as identifying earlier in this guide is more efficient.
> </warning>
> -<ident cce="14058-2" />
> +<ident cce="27185-8" />
> <oval id="audit_rules_dac_modification_setxattr" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1119,7 +1119,7 @@ files involved in storing logon events, add the following to
<tt>/etc/audit/audi
> </description>
> <rationale>Manual editing of these files may indicate nefarious activity,
such
> as an attacker attempting to remove evidence of an intrusion.</rationale>
> -<ident cce="14904-7" />
> +<ident cce="26691-6" />
> <oval id="audit_rules_login_events" />
> <!--<ref nist="TODO" />-->
> </Rule>
> @@ -1136,7 +1136,7 @@ storing such process information, add the following to
> </description>
> <rationale>Manual editing of these files may indicate nefarious activity,
such
> as an attacker attempting to remove evidence of an intrusion.</rationale>
> -<ident cce="14679-5" />
> +<ident cce="26610-6" />
> <oval id="audit_rules_session_events" />
> <!--<ref nist="TODO" />-->
> </Rule>
> @@ -1159,7 +1159,7 @@ To verify that the audit system collects unauthorized file
accesses, run the fol
> </ocil>
> <rationale>Unsuccessful attempts to access files could be an indicator of
malicious activity on a system. Auditing
> these events could serve as evidence of potential system
compromise.</rationale>
> -<ident cce="14917-9" />
> +<ident cce="26712-0" />
> <oval id="audit_rules_unsuccessful_file_modification" />
> <ref nist="AU-2.1 (v),AU-2 d" disa="126" />
> </Rule>
> @@ -1187,7 +1187,7 @@ which attempt to subvert their normal role of providing some
necessary but
> limited capability. As such, motivation exists to monitor these programs for
> unusual activity.
> </rationale>
> -<ident cce="14296-8" />
> +<ident cce="26457-2" />
> <oval id="audit_rules_privileged_commands" />
> <ref nist="AU-2" disa="40" />
> <tested by="DS" on="20121024"/>
> @@ -1209,7 +1209,7 @@ To verify that auditing is configured for all media exportation
events, run the
> where classified information, Privacy Act information, and intellectual property
could be lost. An audit
> trail should be created each time a filesystem is mounted to help identify and guard
against information
> loss.</rationale>
> -<ident cce="14569-8" />
> +<ident cce="26573-6" />
> <oval id="audit_rules_media_export" />
> <ref nist="AU-2" disa="126"/>
> <tested by="DS" on="20121024"/>
> @@ -1233,7 +1233,7 @@ appropriate for your system:
> <rationale>Auditing file deletions will create an audit trail for files that
are removed
> from the system. The audit trail could aid in system troubleshooting, as well as,
detecting
> malicious processes that attempt to delete log files to conceal their
presence.</rationale>
> -<ident cce="14820-5" />
> +<ident cce="26651-0" />
> <oval id="audit_rules_file_deletion_events" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1251,7 +1251,7 @@ To verify that auditing is configured for system administrator
actions, run the
> </ocil>
> <rationale>The actions taken by system administrators should be audited to
keep a record
> of what was executed on the system, as well as, for accountability
purposes.</rationale>
> -<ident cce="14824-7" />
> +<ident cce="26662-7" />
> <oval id="audit_rules_sysadmin_actions" />
> <ref nist="AU-2" disa="126"/>
> <tested by="DS" on="20121024"/>
> @@ -1273,7 +1273,7 @@ to capture kernel module loading and unloading events, setting
ARCH to either b3
> <rationale>The addition/removal of kernel modules can be used to alter the
behavior of
> the kernel and potentially introduce malicious code into kernel space. It is
important
> to have an audit trail of modules that have been introduced into the
kernel.</rationale>
> -<ident cce="14688-6" />
> +<ident cce="26611-4" />
> <oval id="audit_rules_kernel_module_loading" />
> <ref nist="AU-2" disa="126"/>
> </Rule>
> @@ -1289,7 +1289,7 @@ audit rules.</description>
> well as malicious modification of the audit rules, although it may be
> problematic if legitimate changes are needed during system
> operation</rationale>
> -<ident cce="14692-8" />
> +<ident cce="26612-2" />
> <oval id="audit_rules_immutable" />
> <ref nist="AU-2" />
> </Rule>
> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
> index 514859d..9a490eb 100644
> --- a/RHEL6/input/system/logging.xml
> +++ b/RHEL6/input/system/logging.xml
> @@ -30,7 +30,7 @@ Rsyslog is installed by default.
> The rsyslog package provides the rsyslog daemon, which provides
> system logging services.
> </rationale>
> -<ident cce="17742-8" />
> +<ident cce="26809-4" />
> <oval id="package_rsyslog_installed" />
> <ref nist="AU-2, AU-9, CM-6" disa="1311,1312"/>
> <tested by="DS" on="20121024"/>
> @@ -48,7 +48,7 @@ system logging services.
> <rationale>The <tt>rsyslog</tt> service must be running in order
to provide
> logging services, which are essential to system administration.
> </rationale>
> -<ident cce="17698-2" />
> +<ident cce="26807-8" />
> <oval id="service_rsyslog_enabled" />
> <ref nist="AU-12, CM-6" disa="1557,1312,1311" />
> <tested by="DS" on="20121024"/>
> @@ -111,7 +111,7 @@ permissions:
> <rationale>If a log file referenced by rsyslog does not exist, rsyslog
> will not create it and important log messages can be lost.
> </rationale>
> -<ident cce="18095-0" />
> +<ident cce="26818-5" />
> <ref nist="AC-3, CM-6" />
> </Rule>
>
> @@ -135,7 +135,7 @@ To see the owner of a given log file, run the following command:
> <rationale>The log files generated by rsyslog contain valuable information
regarding system
> configuration, user authentication, and other such information. Log files should be
> protected from unauthorized access.</rationale>
> -<ident cce="17857-4" />
> +<ident cce="26812-8" />
> <oval id="rsyslog_files_ownership" />
> <ref nist="AC-3, CM-6" disa="1314"/>
> <tested by="DS" on="20121024"/>
> @@ -161,7 +161,7 @@ To see the group-owner of a given log file, run the following
command:
> <rationale>The log files generated by rsyslog contain valuable information
regarding system
> configuration, user authentication, and other such information. Log files should be
> protected from unauthorized access.</rationale>
> -<ident cce="18240-2" />
> +<ident cce="26821-9" />
> <oval id="rsyslog_files_groupownership" />
> <ref nist="AC-3, CM-6" disa="1314"/>
> <tested by="DS" on="20121024"/>
> @@ -190,7 +190,7 @@ The permissions should be 600, or more restrictive.
> configuration. If the system log files are not protected unauthorized
> users could change the logged data, eliminating their forensic value.
> </rationale>
> -<ident cce="18095-0" />
> +<ident cce="27190-8" />
> <oval id="rsyslog_files_permissions" />
> <ref nist="AC-3, CM-6" disa="1314"/>
> <tested by="DS" on="20121024"/>
> @@ -260,7 +260,7 @@ system is compromised and its local logs are suspect. Forwarding
log messages
> to a remote loghost also provides system administrators with a centralized
> place to view the status of multiple hosts within the enterprise.
> </rationale>
> -<ident cce="17248-6" />
> +<ident cce="26801-1" />
> <oval id="rsyslog_remote_loghost" />
> <ref nist="AU-2, AU-9" disa="1348, 136" />
> </Rule>
> @@ -296,7 +296,7 @@ Any process which receives messages from the network incurs some
risk
> of receiving malicious messages. This risk can be eliminated for
> rsyslog by configuring it not to listen on the network.
> </rationale>
> -<ident cce="17639-6" />
> +<ident cce="26803-7" />
> <oval id="rsyslog_nolisten" />
> <ref nist="AU-2, AU-9" />
> </Rule>
> @@ -371,7 +371,7 @@ periodically in order to perform its log rotation
function.</description>
> <rationale>Log files that are not properly rotated run the risk of growing so
large
> that they fill up the /var/log partition. Valuable logging information could be
lost
> if the /var/log partition becomes full.</rationale>
> -<ident cce="4182-2" />
> +<ident cce="27194-0" />
> <ref nist="AU-2, AU-9, CM-6" disa="366"/>
> </Rule> -->
>
> @@ -386,7 +386,7 @@ if the /var/log partition becomes full.</rationale>
> <ocil>
> <service-enable-check-macro service="logrotate" />
> </ocil>
> -<ident cce="4182-2" />
> +<ident cce="27014-0" />
> <oval id="logrotate_rotate_all_files" />
> <ref nist="AU-2, AU-9, CM-6" disa="366" />
> </Rule>
> @@ -404,7 +404,7 @@ Is this machine the central log server? If so, edit the file
<tt>/etc/logwatch/c
> on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch
to report on all hosts, not just the one on which it
> is running.
> <pre> HostLimit = no </pre> </description>
> -<ident cce="4323-2" />
> +<ident cce="27197-3" />
> <oval id="logwatch_configured_hostlimit" />
> </Rule>
>
> @@ -415,7 +415,7 @@ If <tt>SplitHosts</tt> is set, Logwatch will separate
entries by hostname. This
> more usable. If it is not set, then Logwatch will not report which host generated a
given log entry, and that
> information is almost always necessary
> <pre> SplitHosts = yes </pre> </description>
> -<ident cce="4323-2" />
> +<ident cce="27069-4" />
> <oval id="logwatch_configured_splithosts" />
> </Rule>
>
> diff --git a/RHEL6/input/system/network/iptables.xml
b/RHEL6/input/system/network/iptables.xml
> index 30319ac..141705d 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -57,7 +57,7 @@ The <tt>ip6tables</tt> default rules are essentially
the same.</description>
> <rationale>The <tt>ip6tables</tt> service provides the
system's host-based firewalling
> capability for IPv6 and ICMPv6.
> </rationale>
> -<ident cce="4167-3" />
> +<ident cce="27006-6" />
> <oval id="service_ip6tables_enabled" />
> <ref nist="CM-6, CM-7"
disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414"/>
> <tested by="DS" on="20121024"/>
> @@ -73,7 +73,7 @@ capability for IPv6 and ICMPv6.
> The <tt>iptables</tt> service provides the system's host-based
firewalling
> capability for IPv4 and ICMP.
> </rationale>
> -<ident cce="4189-7" />
> +<ident cce="27018-1" />
> <oval id="service_iptables_enabled" />
> <ref nist="CM-6, CM-7"
disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414" />
> <tested by="DS" on="20121024"/>
> @@ -128,7 +128,7 @@ the applicable rules in the table are examined for a match.
Setting the
> default policy to <tt>DROP</tt> implements proper design for a firewall,
i.e.
> any packets which are not explicitly permitted should not be
> accepted.</rationale>
> -<ident cce="14264-6" />
> +<ident cce="26444-0" />
> <oval id="iptables_default_policy_drop" />
> <ref nist="AC-4, CM-6" disa="66,1109,1154,1414" />
> </Rule>
> @@ -152,7 +152,7 @@ accepted.</rationale>
> The output should be similar to the following:
> <pre># grep ":FORWARD" /etc/sysconfig/iptables
> :FORWARD DROP [0:0</pre></ocil>
> -<ident cce="14264-6" />
> +<ident cce="27186-6" />
> <ref nist="AC-4, CM-6" disa="1109" />
> </Rule>
>
> @@ -177,7 +177,7 @@ could add another IPv6 address to the interface or alter
important network setti
> <ref nist="AC-4, CM-6" />
> <rationale>Restricting other ICMPv6 message types in
<tt>/etc/sysconfig/ip6tables</tt> is not recommended because the operation-
> of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking
ICMPv6 types.</rationale>
> -<!--<ident cce="14264-6" />-->
> +<!--<ident cce="26444-0" />-->
> <!--<oval id="iptables_icmp_disabled" />-->
> </Group>
>
> @@ -224,7 +224,7 @@ If you are not expecting to see any IPv4 (or IPv4-compatible)
traffic on your ne
> The following rule will log all traffic originating from a site-local address, which
is deprecated address space:
> <pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS
TRAFFIC: "</pre>
> </description>
> -<!--<ident cce="14264-6" />-->
> +<!--<ident cce="26444-0" />-->
> <!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
> <ref nist="AC-4, AC-17, CM-6" />
> </Group>
> diff --git a/RHEL6/input/system/network/ipv6.xml
b/RHEL6/input/system/network/ipv6.xml
> index a82325d..8f26e56 100644
> --- a/RHEL6/input/system/network/ipv6.xml
> +++ b/RHEL6/input/system/network/ipv6.xml
> @@ -43,7 +43,7 @@ lines in all files in <tt>/etc/modprobe.d</tt> and the
deprecated
> Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
> the vulnerability to exploitation.
> </rationale>
> -<ident cce="CCE-3562-6" />
> +<ident cce="27153-6" />
> <oval id="kernel_module_ipv6_option_disabled" />
> <ref nist="CM-6, CM-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -136,7 +136,7 @@ operator="equals" interactive="0">
> <rationale>
> An illicit router advertisement message could result in a man-in-the-middle attack.
> </rationale>
> -<ident cce="CCE-4269-7" />
> +<ident cce="27164-3" />
> <oval id="sysctl_net_ipv6_conf_default_accept_ra" />
> <ref nist="CM-7" />
> </Rule>
> @@ -152,7 +152,7 @@ An illicit router advertisement message could result in a
man-in-the-middle atta
> <rationale>
> An illicit ICMP redirect message could result in a man-in-the-middle attack.
> </rationale>
> -<ident cce="CCE-4313-3" />
> +<ident cce="27166-8" />
> <oval id="sysctl_net_ipv6_conf_default_accept_redirects"
value="sysctl_net_ipv6_conf_default_accept_redirects_value" />
> <ref nist="CM-6, CM-7" disa="1551"/>
> </Rule>
> @@ -185,7 +185,7 @@ hardware over its lifetime using its traffic. If it is important
for a system's
> IP address to not trivially reveal its hardware address, this setting should be
> applied.
> </description>
> -<ident cce="CCE-3842-2" />
> +<ident cce="27154-4" />
> <oval id="network_ipv6_privacy_extensions" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -238,13 +238,13 @@ addresses can be assigned to each interface. The default is
16, but it should
> be set to exactly the number of statically configured global addresses
> required.
> </description>
> -<ident cce="CCE-4221-8" />
> -<ident cce="CCE-4137-6" />
> -<ident cce="CCE-4159-0" />
> -<ident cce="CCE-3895-0" />
> -<ident cce="CCE-4287-9" />
> -<ident cce="CCE-4058-4" />
> -<ident cce="CCE-4128-5" />
> +<ident cce="27163-5" />
> +<ident cce="27161-9" />
> +<ident cce="27162-7" />
> +<ident cce="27157-7" />
> +<ident cce="27165-0" />
> +<ident cce="27158-5" />
> +<ident cce="27160-1" />
> <oval id="network_ipv6_limit_requests" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> diff --git a/RHEL6/input/system/network/kernel.xml
b/RHEL6/input/system/network/kernel.xml
> index 50ebccd..08190ba 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -22,7 +22,7 @@ of network traffic.</description>
> <rationale>Sending ICMP redirects permits the system to instruct other
systems
> to update their routing information. The ability to send ICMP redirects is
> only appropriate for routers.</rationale>
> -<ident cce="4151-7" />
> +<ident cce="27001-7" />
> <oval id="sysctl_net_ipv4_conf_default_send_redirects" />
> <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -39,7 +39,7 @@ only appropriate for routers.</rationale>
> <rationale>Sending ICMP redirects permits the system to instruct other
systems
> to update their routing information. The ability to send ICMP redirects is
> only appropriate for routers.</rationale>
> -<ident cce="4155-8" />
> +<ident cce="27004-1" />
> <oval id="sysctl_net_ipv4_conf_all_send_redirects" />
> <ref nist="CM-6" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -56,7 +56,7 @@ only appropriate for routers.</rationale>
> <rationale>IP forwarding permits the kernel to forward packets from one
network
> interface to another. The ability to forward packets between two networks is
> only appropriate for routers.</rationale>
> -<ident cce="3561-8" />
> +<ident cce="26866-4" />
> <oval id="sysctl_net_ipv4_ip_forward" />
> <ref nist="AC-3, CM-6, CM-7, SC-5" disa="366"/>
> <tested by="DS" on="20121024"/>
> @@ -207,7 +207,7 @@ operator="equals" interactive="0">
> </ocil>
> <rationale>Accepting source-routed packets in the IPv4 protocol has few
legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> -<ident cce="4236-6" />
> +<ident cce="27037-1" />
> <oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
> <ref nist="CM-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -223,7 +223,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
> </ocil>
> <rationale>Accepting ICMP redirects has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> -<ident cce="4217-6" />
> +<ident cce="27027-2" />
> <oval id="sysctl_net_ipv4_conf_all_accept_redirects"
value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
> <ref nist="CM-7" disa="1503,1551"/>
> <tested by="DS" on="20121024"/>
> @@ -241,7 +241,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
> <rationale>Accepting "secure" ICMP redirects (from those gateways
listed as
> default gateways) has few legitimate uses. It should be disabled unless it is
> absolutely required.</rationale>
> -<ident cce="3472-8" />
> +<ident cce="26854-0" />
> <oval id="sysctl_net_ipv4_conf_all_secure_redirects"
value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
> <ref nist="CM-7, AC-4" disa="1503,1551"/>
> <tested by="DS" on="20121024"/>
> @@ -259,7 +259,7 @@ absolutely required.</rationale>
> as well as spoofed packets, source-routed packets, and redirects could be a
> sign of nefarious network activity. Logging these packets enables this activity
> to be detected.</rationale>
> -<ident cce="4320-8" />
> +<ident cce="27066-0" />
> <oval id="sysctl_net_ipv4_conf_all_log_martians"
value="sysctl_net_ipv4_conf_all_log_martians_value" />
> <ref nist="CM-7" disa="126"/>
> <tested by="DS" on="20121024"/>
> @@ -276,7 +276,7 @@ to be detected.</rationale>
> </ocil>
> <rationale>Accepting source-routed packets in the IPv4 protocol has few
legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> -<ident cce="4091-5" />
> +<ident cce="26983-7" />
> <oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
> <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -293,7 +293,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
> </ocil>
> <rationale>This feature of the IPv4 protocol has few legitimate
> uses. It should be disabled unless it is absolutely required.</rationale>
> -<ident cce="4186-3" />
> +<ident cce="27015-7" />
> <oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
> <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -311,7 +311,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
> <rationale>Accepting "secure" ICMP redirects (from those gateways
listed as
> default gateways) has few legitimate uses. It should be disabled unless it is
> absolutely required.</rationale>
> -<ident cce="3339-9" />
> +<ident cce="26831-8" />
> <oval id="sysctl_net_ipv4_conf_default_secure_redirects"
value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
> <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -329,7 +329,7 @@ absolutely required.</rationale>
> <rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
> addresses makes the system slightly more difficult to enumerate on the network.
> </rationale>
> -<ident cce="3644-2" />
> +<ident cce="26883-9" />
> <oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
> <ref nist="AC-3, CM-6, CM-7, SC-5" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -346,7 +346,7 @@ addresses makes the system slightly more difficult to enumerate
on the network.
> </ocil>
> <rationale>Ignoring bogus ICMP error responses reduces
> log size, although some activity would not be logged.</rationale>
> -<ident cce="4133-5" />
> +<ident cce="26993-6" />
> <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
> <ref nist="AC-3, CM-6, CM-7, SC-5" />
> <tested by="DS" on="20121024"/>
> @@ -367,7 +367,7 @@ verifying the initiator is attempting a valid connection and is
not a flood
> source. This feature is activated when a flood condition is detected, and
> enables the system to continue servicing valid connection requests.
> </rationale>
> -<ident cce="4265-5" />
> +<ident cce="27053-8" />
> <oval id="sysctl_net_ipv4_tcp_syncookies"
value="sysctl_net_ipv4_tcp_syncookies_value" />
> <ref nist="CM-6, CM-7" disa="1092, 1095" />
> <tested by="DS" on="20121024"/>
> @@ -386,7 +386,7 @@ that should not have been able to be received on the interface
they were
> received on. It should not be used on systems which are routers for
> complicated networks, but is helpful for end hosts and routers serving small
> networks.</rationale>
> -<ident cce="4080-8" />
> +<ident cce="26979-5" />
> <oval id="sysctl_net_ipv4_conf_all_rp_filter"
value="sysctl_net_ipv4_conf_all_rp_filter_value" />
> <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
> <tested by="DS" on="20121024"/>
> @@ -405,7 +405,7 @@ that should not have been able to be received on the interface
they were
> received on. It should not be used on systems which are routers for
> complicated networks, but is helpful for end hosts and routers serving small
> networks.</rationale>
> -<ident cce="3840-6" />
> +<ident cce="26915-9" />
> <oval id="sysctl_net_ipv4_conf_default_rp_filter"
value="sysctl_net_ipv4_conf_default_rp_filter_value" />
> <ref nist="AC-4, SC-5, SC-7" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/network/network.xml
b/RHEL6/input/system/network/network.xml
> index a1d306d..2c775e1 100644
> --- a/RHEL6/input/system/network/network.xml
> +++ b/RHEL6/input/system/network/network.xml
> @@ -47,7 +47,7 @@ scripts add entries to the system's routing table for these
addresses. Zeroconf
> address assignment commonly occurs when the system is configured to use DHCP
> but fails to receive an address assignment from the DHCP server.
> </rationale>
> -<ident cce="CCE-14054-1" />
> +<ident cce="27151-0" />
> <oval id="sysconfig_nozeroconf_yes" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -63,7 +63,7 @@ to determine if any interface is running in promiscuous mode:
> or wireshark) is likely to be using the interface and this should be
> investigated.
> </rationale>
> -<ident cce="CCE-15013-6" />
> +<ident cce="27152-8" />
> <oval id="network_sniffer_disabled" />
> <ref nist="CM-6, CM-7, MA-3" />
> </Rule>
> diff --git a/RHEL6/input/system/network/uncommon.xml
b/RHEL6/input/system/network/uncommon.xml
> index 8743268..9817bd2 100644
> --- a/RHEL6/input/system/network/uncommon.xml
> +++ b/RHEL6/input/system/network/uncommon.xml
> @@ -27,7 +27,7 @@ streaming media and telephony.
> Disabling DCCP protects
> the system against exploitation of any flaws in its implementation.
> </rationale>
> -<ident cce="14268-7" />
> +<ident cce="26448-1" />
> <oval id="kernel_module_dccp_disabled" />
> <ref nist="CM-6, CM-7" disa="382"/>
> <tested by="DS" on="20121024"/>
> @@ -50,7 +50,7 @@ within one connection.
> Disabling SCTP protects
> the system against exploitation of any flaws in its implementation.
> </rationale>
> -<ident cce="14132-5" />
> +<ident cce="26410-1" />
> <oval id="kernel_module_sctp_disabled" />
> <ref nist="CM-6, CM-7" disa="382"/>
> <tested by="DS" on="20121024"/>
> @@ -72,7 +72,7 @@ low-latency communications between nodes in a cluster.
> Disabling RDS protects
> the system against exploitation of any flaws in its implementation.
> </rationale>
> -<ident cce="14027-7" />
> +<ident cce="26239-4" />
> <oval id="kernel_module_rds_disabled" />
> <ref nist="CM-6, CM-7" disa="382"/>
> <tested by="DS" on="20121024"/>
> @@ -94,7 +94,7 @@ cluster.
> Disabling TIPC protects
> the system against exploitation of any flaws in its implementation.
> </rationale>
> -<ident cce="14911-2" />
> +<ident cce="26696-5" />
> <oval id="kernel_module_tipc_disabled" />
> <ref nist="CM-6, CM-7" disa="382"/>
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/network/wireless.xml
b/RHEL6/input/system/network/wireless.xml
> index 3246b17..fb07f39 100644
> --- a/RHEL6/input/system/network/wireless.xml
> +++ b/RHEL6/input/system/network/wireless.xml
> @@ -33,7 +33,7 @@ boot.</description>
> activation of the wireless interface, generally requiring administrators
> to reboot the system first.
> </rationale>
> -<ident cce="3628-5" />
> +<ident cce="26878-9" />
> <!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
> <ref nist="CM-7" disa="85" />
> </Rule>
> @@ -63,7 +63,7 @@ interface file from
<tt>/etc/sysconfig/network-scripts</tt>:
> launch network-based attacks against systems, including those against local LAN
> protocols which were not designed with security in mind.
> </rationale>
> -<ident cce="4276-2" />
> +<ident cce="27057-9" />
> <oval id="wireless_disable_interfaces" />
> <ref nist="CM-7" disa="85" />
> <tested by="DS" on="20121025"/>
> @@ -81,7 +81,7 @@ an administrator or malware to activate a wireless interface, by
introducing
> the need to install such a driver first.
> </rationale>
> <warning category="general">This command must also be repeated every
time the kernel is upgraded.</warning>
> -<ident cce="4170-7" />
> +<ident cce="27009-0" />
> <oval id="wireless_disable_drivers" />
> <ref nist="CM-7" disa="85" />
> </Rule>
> @@ -98,7 +98,7 @@ the need to install such a driver first.
> connections to Bluetooth devices, which entails some security risk.
> Nevertheless, variation in this risk decision may be expected due to the
> utility of Bluetooth connectivity and its limited range.</rationale>
> -<ident cce="4355-4" />
> +<ident cce="27081-9" />
> <oval id="service_bluetooth_disabled" />
> <ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
> <tested by="DS" on="20121025"/>
> @@ -120,7 +120,7 @@ install bluetooth /bin/true</pre>
> <rationale>If Bluetooth functionality must be disabled, preventing the kernel
> from loading the kernel module provides an additional safeguard against its
> activation.</rationale>
> -<ident cce="14948-4" />
> +<ident cce="26763-3" />
> <oval id="kernel_module_bluetooth_disabled" />
> <ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
> <tested by="DS" on="20121025"/>
> diff --git a/RHEL6/input/system/permissions/execution.xml
b/RHEL6/input/system/permissions/execution.xml
> index 03e1c44..f04432a 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -45,7 +45,7 @@ The output should show either <tt>022</tt> or
<tt>027</tt>.
> <rationale>The umask influences the permissions assigned to files created by
a
> process at run time. An unnecessarily permissive umask could result in files
> being created with insecure permissions.</rationale>
> -<ident cce="4220-0" />
> +<ident cce="27031-4" />
> <oval id="umask_for_daemons"
value="var_umask_for_daemons"/>
> <ref nist="AC-3, CM-6"/>
> </Rule>
> @@ -87,7 +87,7 @@ The output should be:
> <rationale>A core dump includes a memory image taken at the time the operating
system
> terminates an application. The memory image could contain sensitive data and is
generally useful
> only for developers trying to debug problems.</rationale>
> -<ident cce="4225-9" />
> +<ident cce="27033-0" />
> <oval id="core_dumps_limitsconf" />
> <ref nist="SC-5" />
> </Rule>
> @@ -102,7 +102,7 @@ sensitive data, as the program itself runs with greater
privileges than the
> user who initiated execution of the program. Disabling the ability for any
> setuid program to write a core file decreases the risk of unauthorized access
> of such data.</rationale>
> -<ident cce="4247-3" />
> +<ident cce="27044-7" />
> <oval id="core_dump_suid_progs_limits_conf" />
> <ref nist="SI-11" />
> </Rule>
> @@ -130,7 +130,7 @@ control where code can be executed, on a per-process basis. When
> the kernel places a process's memory regions such as the stack and
> heap higher than this address, the hardware prevents execution in that
> address range.</rationale>
> -<ident cce="4168-1" />
> +<ident cce="27007-4" />
> <oval id="sysctl_kernel_exec_shield" />
> <ref nist="CM-7" />
> <tested by="DS" on="20121024"/>
> @@ -146,7 +146,7 @@ into a process's address space during an attempt at
exploitation. Additionally,
> makes it more difficult for an attacker to know the location of existing code
> in order to re-purpose it using return oriented programming (ROP) techniques.
> </rationale>
> -<ident cce="4146-7" />
> +<ident cce="26999-3" />
> <oval id="sysctl_kernel_randomize_va_space" />
> <ref nist="AC-3, CM-6" />
> <tested by="DS" on="20121024"/>
> @@ -186,7 +186,7 @@ installed on older systems that do not support the XD or NX bit,
as
> this may prevent them from booting.</warning>
> <rationale>On 32-bit systems that support the XD or NX bit, the
vendor-supplied
> PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX)
support.</rationale>
> -<ident cce="4172-3" />
> +<ident cce="27010-8" />
> <ref nist="CM-7" />
> </Rule>
>
> @@ -198,7 +198,7 @@ under a Security section. Look for Execute Disable (XD) on
Intel-based systems a
> on AMD-based systems.</description>
> <rationale>Computers with the ability to prevent this type of code execution
frequently put an option in the BIOS that will
> allow users to turn the feature on or off at will.</rationale>
> -<ident cce="4177-2" />
> +<ident cce="27012-4" />
> <ref nist="CM-6" />
> </Rule>
>
> diff --git a/RHEL6/input/system/permissions/files.xml
b/RHEL6/input/system/permissions/files.xml
> index 8453eff..d9940aa 100644
> --- a/RHEL6/input/system/permissions/files.xml
> +++ b/RHEL6/input/system/permissions/files.xml
> @@ -26,7 +26,7 @@ system accounts and stores password hashes. Protection of this file
is
> critical for system security. Failure to give ownership of this file
> to root provides the designated owner with access to sensitive information
> which could weaken the system security posture.</rationale>
> -<ident cce="3918-0" />
> +<ident cce="26947-2" />
> <oval id="file_owner_etc_shadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -38,7 +38,7 @@ which could weaken the system security posture.</rationale>
> <ocil><filegroupowner-check-macro file="/etc/shadow"
group="root"/></ocil>
> <rationale>The <tt>/etc/shadow</tt> file stores password hashes.
Protection of this file is
> critical for system security.</rationale>
> -<ident cce="3988-3" />
> +<ident cce="26967-0" />
> <oval id="file_groupowner_etc_shadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -53,7 +53,7 @@ system accounts and stores password hashes. Protection of this file
is
> critical for system security. Failure to give ownership of this file
> to root provides the designated owner with access to sensitive information
> which could weaken the system security posture.</rationale>
> -<ident cce="4130-1" />
> +<ident cce="26992-8" />
> <oval id="file_permissions_etc_shadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -65,7 +65,7 @@ which could weaken the system security posture.</rationale>
> <ocil><fileowner-check-macro file="/etc/group"
owner="root"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information
regarding groups that are configured
> on the system. Protection of this file is important for system
security.</rationale>
> -<ident cce="3276-3" />
> +<ident cce="26822-7" />
> <oval id="file_owner_etc_group" />
> <ref nist="AC-3, CM-6"/>
> <tested by="DS" on="20121026"/>
> @@ -77,7 +77,7 @@ on the system. Protection of this file is important for system
security.</ration
> <ocil><filegroupowner-check-macro file="/etc/group"
group="root"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information
regarding groups that are configured
> on the system. Protection of this file is important for system
security.</rationale>
> -<ident cce="3883-6" />
> +<ident cce="26930-8" />
> <oval id="file_groupowner_etc_group" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -89,7 +89,7 @@ on the system. Protection of this file is important for system
security.</ration
> <ocil><fileowner-check-macro file="/etc/group"
perms="-rw-r--r--"/></ocil>
> <rationale>The <tt>/etc/group</tt> file contains information
regarding groups that are configured
> on the system. Protection of this file is important for system
security.</rationale>
> -<ident cce="3967-7" />
> +<ident cce="26954-8" />
> <oval id="file_permissions_etc_group" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -101,7 +101,7 @@ on the system. Protection of this file is important for system
security.</ration
> <ocil><fileowner-check-macro file="/etc/gshadow"
owner="root"/></ocil>
> <rationale>The <tt>/etc/gshadow</tt> file contains group password
hashes. Protection of this file
> is critical for system security.</rationale>
> -<ident cce="4210-1" />
> +<ident cce="27026-4" />
> <oval id="file_owner_etc_gshadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -113,7 +113,7 @@ is critical for system security.</rationale>
> <ocil><filegroupowner-check-macro file="/etc/gshadow"
group="root"/></ocil>
> <rationale>The <tt>/etc/gshadow</tt> file contains group password
hashes. Protection of this file
> is critical for system security.</rationale>
> -<ident cce="4064-2" />
> +<ident cce="26975-3" />
> <oval id="file_groupowner_etc_gshadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -125,7 +125,7 @@ is critical for system security.</rationale>
> <ocil><fileperms-check-macro file="/etc/gshadow"
perms="----------"/></ocil>
> <rationale>The /etc/gshadow file contains group password hashes. Protection of
this file
> is critical for system security.</rationale>
> -<ident cce="3932-1" />
> +<ident cce="26951-4" />
> <oval id="file_permissions_etc_gshadow" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -137,7 +137,7 @@ is critical for system security.</rationale>
> <ocil><fileowner-check-macro file="/etc/passwd"
owner="root"/></ocil>
> <rationale>The <tt>/etc/passwd</tt> contains information about the
users that are configured on
> the system. Protection of this file is critical for system
security.</rationale>
> -<ident cce="3958-6" />
> +<ident cce="26953-0" />
> <oval id="file_owner_etc_passwd" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -149,7 +149,7 @@ the system. Protection of this file is critical for system
security.</rationale>
> <ocil><filegroupowner-check-macro file="/etc/passwd"
group="root"/></ocil>
> <rationale>The <tt>/etc/passwd</tt> file contains information
about the users that are configured on
> the system. Protection of this file is critical for system
security.</rationale>
> -<ident cce="3495-9" />
> +<ident cce="26856-5" />
> <oval id="file_groupowner_etc_passwd" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -163,7 +163,7 @@ the system. Protection of this file is critical for system
security.</rationale>
> world the risk of its compromise is increased. The file contains the list of
> accounts on the system and associated information, and protection of this file
> is critical for system security.</rationale>
> -<ident cce="3566-7" />
> +<ident cce="26868-0" />
> <oval id="file_permissions_etc_passwd" />
> <ref nist="AC-3, CM-6" disa="225"/>
> <tested by="DS" on="20121026"/>
> @@ -330,7 +330,7 @@ or those designed to be temporary file repositories. The setting
is normally re
> used by the system, and by users for temporary file storage - such as /tmp -
> and for directories requiring global read/write access.
> </rationale>
> -<ident cce="3399-3" />
> +<ident cce="26840-9" />
> <oval id="dir_perms_world_writable_sticky_bits" />
> <ref nist="CM-6"/>
> <tested by="swells" on="20120929"/>
> @@ -354,7 +354,7 @@ user on the system. In almost all circumstances, files can be
> configured using a combination of user and group permissions to
> support whatever legitimate access is needed without the risk
> caused by world-writable files.</rationale>
> -<ident cce="3795-2" />
> +<ident cce="26910-0" />
> <ref nist="CM-6"/>
> </Rule>
>
> @@ -374,7 +374,7 @@ To find world-writable files, run the following command:
> the owner of the file. SGID files of uncertain provenance could allow for
> unprivileged users to elevate privileges. The presence of these files should be
> strictly controlled on the system.</rationale>
> -<ident cce="14970-8" />
> +<ident cce="26769-0" />
> <oval id="file_permissions_unauthorized_sgid" />
> <ref nist="CM-6"/>
> </Rule>
> @@ -395,7 +395,7 @@ To find world-writable files, run the following command:
> the owner of the file. SUID files of uncertain provenance could allow for
> unprivileged users to elevate privileges. The presence of these files should be
> strictly controlled on the system.</rationale>
> -<ident cce="14340-4" />
> +<ident cce="26497-8" />
> <oval id="file_permissions_unauthorized_suid" />
> <ref nist="AC-3, CM-6"/>
> </Rule>
> @@ -423,7 +423,7 @@ to a deleted account. The files should be repaired so they
> will not cause problems when accounts are created in the future,
> and the cause should be discovered and addressed.
> </rationale>
> -<ident cce="4223-4" />
> +<ident cce="27032-2" />
> <oval id="file_permissions_unowned" />
> <ref nist="AC-3, CM-6" disa="224"/>
> </Rule>
> @@ -450,7 +450,7 @@ to a deleted account. The files should be repaired so they
> will not cause problems when accounts are created in the future,
> and the cause should be discovered and addressed.
> </rationale>
> -<ident cce="3573-3" />
> +<ident cce="26872-2" />
> <oval id="file_permissions_ungroupowned" />
> <ref nist="AC-3, CM-6" disa="224"/>
> </Rule>
> @@ -476,7 +476,7 @@ undesirable because it allows the owner of that directory to
remove
> or replace any files that may be placed in the directory by other
> users.
> </rationale>
> -<ident cce="14794-2" />
> +<ident cce="26642-9" />
> <oval id="dir_perms_world_writable_system_owned" />
> <ref nist="AC-3, CM-6"/>
> <tested by="swells" on="20120929"/>
> diff --git a/RHEL6/input/system/permissions/mounting.xml
b/RHEL6/input/system/permissions/mounting.xml
> index 5c60da7..c1b0618 100644
> --- a/RHEL6/input/system/permissions/mounting.xml
> +++ b/RHEL6/input/system/permissions/mounting.xml
> @@ -34,7 +34,7 @@ and xdm. If this user is the first to log into the physical
console
> variety of devices normally belong to root. Administrative privileges should be
> limited for non-root users. Review the man page for <tt>pam_console</tt>
for
> more information</rationale>
> -<ident cce="3685-5" />
> +<ident cce="27192-4" />
> <oval id="console_device_restrict_access_desktop" />
> <ref nist="AC-6, CM-6, CM-7" />
> </Rule>
> @@ -53,7 +53,7 @@ and xdm. If this user is the first to log into the physical
console
> variety of devices normally belong to root. Administrative privileges should be
> limited for non-root users. Review the man page for <tt>pam_console</tt>
for
> more information</rationale>
> -<ident cce="3685-5" />
> +<ident cce="26892-0" />
> <oval id="console_device_restrict_access_server" />
> <ref nist="AC-6, CM-6, CM-7" />
> </Rule>
> @@ -73,7 +73,7 @@ module, but will not prevent an administrator (or another program)
from using th
> <rationale>USB storage devices such as thumb drives can be used to introduce
unauthorized
> software and other vulnerabilities. Support for these devices should be disabled
and
> the devices themselves should be tightly controlled.</rationale>
> -<ident cce="4187-1" />
> +<ident cce="27016-5" />
> <oval id="kernel_module_usb-storage_disabled" />
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -95,7 +95,7 @@ will need to be repeated every time the kernel is
updated.</description>
> <rationale>USB storage devices such as thumb drives can be used to introduce
unauthorized
> software and other vulnerabilities. Support for these devices should be disabled
and
> the devices themselves should be tightly controlled.</rationale>
> -<ident cce="4006-3" />
> +<ident cce="26970-4" />
> <oval id="kernel_module_usb-storage_removed" />
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -114,7 +114,7 @@ mice, or printers. This guidance is inappropriate for systems
which require USB
> <rationale>Disabling the USB subsystem within the Linux kernel at system boot
will also
> disable USB storage devices if they are plugged into the system. Support for these
devices
> should be disabled and the devices themselves should be tightly
controlled.</rationale>
> -<ident cce="4173-1" />
> +<ident cce="27011-6" />
> <oval id="bootloader_nousb_argument" />
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -129,7 +129,7 @@ the section titled "Set BIOS Password" to prevent
unauthorized configuration cha
> <rationale>Booting a system from a USB device would allow an attacker to
circumvent
> any security measures offered by the native OS. Attackers could mount partitions and
modify the
> configuration of the native OS. The BIOS should be configured to disallow booting
from USB media.</rationale>
> -<ident cce="3944-6" />
> +<ident cce="26952-2" />
> <!-- <oval id="bios_disable_usb_boot" /> -->
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -157,7 +157,7 @@ If properly configured, the output should be the following:
> <rationale>All filesystems that are required for the successful operation of
the system
> should be explicitly listed in /etc/fstab by and administrator. New filesystems
should
> not be arbitrarily introduced via the automounter.</rationale>
> -<ident cce="4072-5" />
> +<ident cce="26976-1" />
> <oval id="service_autofs_disabled" />
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -186,7 +186,7 @@ policy. Disabling USB storage as described in the USB section
will prevent the u
> this step should also be taken as an additional layer of protection to prevent
automatic mounting of CDs and
> DVDs.
> </rationale>
> -<ident cce="4231-7" />
> +<ident cce="27035-5" />
> <oval id="gconf_gnome_disable_automount" />
> <ref nist="CM-6, CM-7" disa="1250,85" />
> </Rule>
> @@ -199,7 +199,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14089-7" />
> +<ident cce="26340-0" />
> <oval id="kernel_module_cramfs_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -212,7 +212,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14457-6" />
> +<ident cce="26544-7" />
> <oval id="kernel_module_freevxfs_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -225,7 +225,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14853-6" />
> +<ident cce="26670-0" />
> <oval id="kernel_module_jffs2_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -238,7 +238,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="15087-0" />
> +<ident cce="26800-3" />
> <oval id="kernel_module_hfs_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -251,7 +251,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14093-9" />
> +<ident cce="26361-6" />
> <oval id="kernel_module_hfsplus_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -264,7 +264,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14118-4" />
> +<ident cce="26404-4" />
> <oval id="kernel_module_squashfs_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -277,7 +277,7 @@ This effectively prevents usage of this uncommon filesystem.
> </description>
> <rationale>Linux kernel modules which implement filesystems that are not
needed by the
> local system should be disabled.</rationale>
> -<ident cce="14871-8" />
> +<ident cce="26677-5" />
> <oval id="kernel_module_udf_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> diff --git a/RHEL6/input/system/permissions/partitions.xml
b/RHEL6/input/system/permissions/partitions.xml
> index 8dd7720..10d4ea1 100644
> --- a/RHEL6/input/system/permissions/partitions.xml
> +++ b/RHEL6/input/system/permissions/partitions.xml
> @@ -28,7 +28,7 @@ interpreted as character or block devices. The only legitimate
location
> for device files is the /dev directory located on the root partition.
> The only exception to this is chroot jails, for which it is not advised
> to set <tt>nodev</tt> on these filesystems.</rationale>
> -<ident cce="4249-9" />
> +<ident cce="27045-4" />
> <oval id="mount_option_nodev_nonroot_local_partitions" />
> <ref nist="CM-6, CM-7, AC-6"/>
> </Rule>
> @@ -46,7 +46,7 @@ jails built for system services.
> located on the root partition. An exception to this is chroot jails, and it is
> not advised to set <tt>nodev</tt> on partitions which contain their
root
> filesystems. </rationale>
> -<ident cce="3522-0" />
> +<ident cce="26860-7" />
> <oval id="mount_option_nodev_removable_partitions"
value="var_removable_partition" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -69,7 +69,7 @@ To verify that binaries cannot be directly executed from removable
media, run th
> <pre># grep noexec /etc/fstab</pre>
> The output should show <tt>noexec</tt> in use.
> </ocil>
> -<ident cce="4275-4" />
> +<ident cce="27196-5" />
> <oval id="mount_option_noexec_removable_partitions"
value="var_removable_partition" />
> <ref nist="CM-7, MP-2" disa="87" />
> </Rule>
> @@ -87,7 +87,7 @@ files into the system via partitions mounted from removeable
media.
> <rationale>The presence of suid and sgid executables should be tightly
controlled. Users
> should not be able to execute suid or sgid binaries from partitions mounted off of
> removable media.</rationale>
> -<ident cce="4275-4" />
> +<ident cce="27056-1" />
> <oval id="mount_option_noexec_removable_partitions"
value="var_removable_partition" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -103,7 +103,7 @@ within temporary directories like <tt>/tmp</tt>.
> </description>
> <rationale>The only legitimate location for device files is the /dev
directory
> located on the root partition. The only exception to this is chroot
jails.</rationale>
> -<ident cce="14412-1" />
> +<ident cce="26499-4" />
> <oval id="mount_option_tmp_nodev" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -117,7 +117,7 @@ from being executed out of <tt>/tmp</tt>.
> <rationale>Allowing users to execute binaries from world-writeable
directories
> such as <tt>/tmp</tt> should never be necessary in normal operation and
> can expose the system to potential compromise.</rationale>
> -<ident cce="14927-8" />
> +<ident cce="26720-3" />
> <oval id="mount_option_tmp_noexec" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -131,7 +131,7 @@ should not be required in these world-writeable directories.
> </description>
> <rationale>The presence of suid and sgid executables should be tightly
controlled. Users
> should not be able to execute suid or sgid binaries from temporary storage
partitions.</rationale>
> -<ident cce="14940-1" />
> +<ident cce="26762-5" />
> <oval id="mount_option_tmp_nosuid" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -146,7 +146,7 @@ within temporary directories like <tt>/dev/shm</tt>.
> </description>
> <rationale>The only legitimate location for device files is the /dev
directory
> located on the root partition. The only exception to this is chroot
jails.</rationale>
> -<ident cce="15007-8" />
> +<ident cce="26778-1" />
> <oval id="mount_option_dev_shm_nodev" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -161,7 +161,7 @@ from world-writeable temporary storage directories such as
<tt>/dev/shm</tt>.
> </description>
> <rationale>Allowing users to execute binaries from world-writeable
directories
> such as /dev/shm can expose the system to potential compromise.</rationale>
> -<ident cce="14703-3" />
> +<ident cce="26622-1" />
> <oval id="mount_option_dev_shm_noexec" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -175,7 +175,7 @@ be required in these world-writeable directories.
> </description>
> <rationale>The presence of suid and sgid executables should be tightly
controlled. Users
> should not be able to execute suid or sgid binaries from temporary storage
partitions.</rationale>
> -<ident cce="14306-5" />
> +<ident cce="26486-1" />
> <oval id="mount_option_dev_shm_nosuid" />
> <ref nist="CM-7, MP-2"/>
> </Rule>
> @@ -192,7 +192,7 @@ See the mount(8) man page for further explanation of bind
mounting.
> <rationale>Having multiple locations for temporary storage is not required.
Unless absolutely
> necessary to meet requirements, the storage location /var/tmp should be bind mounted
to
> /tmp and thus share the same protections.</rationale>
> -<ident cce="14584-7" />
> +<ident cce="26582-7" />
> <oval id="mount_option_var_tmp_bind" />
> <ref nist="CM-6"/>
> </Rule>
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 543f3a9..c1f85a8 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -98,7 +98,7 @@ Disabling a major host protection feature, such as SELinux, at boot
time prevent
> it from confining system services at boot time. Further, it increases
> the chances that it will remain off during system operation.
> </rationale>
> -<ident cce="3977-6" />
> +<ident cce="26956-3" />
> <oval id="selinux_bootloader_notdisabled" />
> <ref nist="AC-3, CM-6" disa="22,32"/>
> <tested by="DS" on="20121024"/>
> @@ -121,7 +121,7 @@ potentially compromised processes to the security policy, which
is designed to
> prevent them from causing damage to the system or further elevating their
> privileges.
> </rationale>
> -<ident cce="3999-0" />
> +<ident cce="26969-6" />
> <oval id="selinux_mode" value="var_selinux_state_name"/>
> <ref nist="CM-6, CM-7" disa="22,32,26"/>
> <tested by="DS" on="20121024"/>
> @@ -147,7 +147,7 @@ Setting the SELinux policy to <tt>targeted</tt> or a
more specialized policy
> ensures the system will confine processes that are likely to be
> targeted for exploitation, such as network or system services.
> </rationale>
> -<ident cce="3624-4" />
> +<ident cce="26875-5" />
> <oval id="selinux_policytype"
value="var_selinux_policy_name"/>
> <ref nist="CM-6, CM-7" disa="22,32"/>
> <tested by="DS" on="20121024"/>
> @@ -166,7 +166,7 @@ security context.
> <rationale>The <tt>restorecond</tt> service helps ensure that the
default SELinux
> file context is applied to files. This allows automatic correction
> of file contexts created by some programs.</rationale>
> -<ident cce="4129-3" />
> +<ident cce="26991-0" />
> <oval id="service_restorecond_enabled" />
> <ref nist="AC-3, CM-6" />
> </Rule>
> @@ -201,7 +201,7 @@ which use category labelling.</description>
> <Rule id="disable_mcstransd">
> <title>Disable mcstrans Service</title>
> <description>The MCS Translation Service (mcstrans) should be
disabled.</description>
> -<ident cce="3668-1" />
> +<ident cce="26891-2" />
> <oval id="service_mcstrans_disabled" />
> <ref nist="CM-6, CM-7" />
> </Rule>
> @@ -242,7 +242,7 @@ It should produce no output in a well-configured
system.</ocil>
> If a device file carries the SELinux type <tt>unlabeled_t</tt>, then
SELinux
> cannot properly restrict access to the device file.
> </rationale>
> -<ident cce="14991-4" />
> +<ident cce="26774-0" />
> <oval id="selinux_all_devicefiles_labeled" />
> <ref nist="CM-6, CM-7" disa="22,32"/>
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/software/disk_partitioning.xml
b/RHEL6/input/system/software/disk_partitioning.xml
> index 932e6e8..6af7172 100644
> --- a/RHEL6/input/system/software/disk_partitioning.xml
> +++ b/RHEL6/input/system/software/disk_partitioning.xml
> @@ -37,7 +37,7 @@ The <tt>/tmp</tt> partition is used as temporary
storage by many programs.
> Placing <tt>/tmp</tt> in its own partition enables the setting of more
> restrictive mount options, which can help protect programs which use it.
> </rationale>
> -<ident cce="14161-4"/>
> +<ident cce="26435-8"/>
> <oval id="mount_tmp_own_partition" />
> <ref nist="CM-6" disa="1208"/>
> <tested by="MM" on="20120928"/>
> @@ -57,7 +57,7 @@ system services such as daemons or other programs which use it.
> It is not uncommon for the <tt>/var</tt> directory to contain
> world-writable directories, installed by other software packages.
> </rationale>
> -<ident cce="14777-7"/>
> +<ident cce="26639-5"/>
> <oval id="mount_var_own_partition" />
> <ref nist="CM-6" disa="1208"/>
> <tested by="MM" on="20120928"/>
> @@ -76,7 +76,7 @@ Placing <tt>/var/log</tt> in its own partition
> enables better separation between log files
> and other files in <tt>/var/</tt>.
> </rationale>
> -<ident cce="14011-1" />
> +<ident cce="26215-4" />
> <oval id="mount_var_log_own_partition" />
> <ref nist="CM-6, AU-9" disa="1208"/>
> <tested by="MM" on="20120928"/>
> @@ -98,7 +98,7 @@ and other files, and helps ensure that
> auditing cannot be halted due to the partition running out
> of space.
> </rationale>
> -<ident cce="14171-3" />
> +<ident cce="26436-6" />
> <oval id="mount_var_log_audit_own_partition" />
> <ref nist="CM-6, AU-9" disa="137,138,1208"/>
> <tested by="MM" on="20120928"/>
> @@ -119,7 +119,7 @@ Ensuring that <tt>/home</tt> is mounted on its own
partition enables the
> setting of more restrictive mount options, and also helps ensure that
> users cannot trivially fill partitions used for log or audit data storage.
> </rationale>
> -<ident cce="14559-9" />
> +<ident cce="26557-9" />
> <oval id="mount_home_own_partition" />
> <ref nist="CM-6" disa="1208"/>
> <tested by="MM" on="20120928"/>
> diff --git a/RHEL6/input/system/software/integrity.xml
b/RHEL6/input/system/software/integrity.xml
> index bc96e7d..6104100 100644
> --- a/RHEL6/input/system/software/integrity.xml
> +++ b/RHEL6/input/system/software/integrity.xml
> @@ -37,7 +37,7 @@ Install the AIDE package with the command:
> <rationale>
> The AIDE package must be installed if it is to be available for integrity checking.
> </rationale>
> -<ident cce="4209-3" />
> +<ident cce="27024-9" />
> <oval id="package_aide_installed" />
> <ref nist="CM-6, CM-7, SC-28, SI-7" disa="1069"/>
> <tested by="DS" on="20121024"/>
> @@ -159,7 +159,7 @@ Permissions on system binaries and configuration files that are
too generous
> could allow an unauthorized user to gain privileges that they should not have.
> The permissions set by the vendor should be maintained. Any deviations from
> this baseline should be investigated.</rationale>
> -<ident cce="14931-0" />
> +<ident cce="26731-0" />
> <oval id="rpm_verify_permissions" />
> <ref nist="SI-7" disa="1493,1494,1495" />
> </Rule>
> diff --git a/RHEL6/input/system/software/updating.xml
b/RHEL6/input/system/software/updating.xml
> index 2bd9fa4..1c26f58 100644
> --- a/RHEL6/input/system/software/updating.xml
> +++ b/RHEL6/input/system/software/updating.xml
> @@ -36,7 +36,7 @@ The command should return the string below:
> This key is necessary to cryptographically verify packages
> are from Red Hat.
> </rationale>
> -<ident cce="14440-2"/>
> +<ident cce="26506-6"/>
> <oval id="package_red_hat_gpgkeys_installed" />
> <ref nist="SI-2, SI-7, SC-13" disa="351"/>
> <tested by="MM" on="20120928"/>
> @@ -68,7 +68,7 @@ Ensuring the validity of packages' cryptographic signatures
prior to
> installation ensures the provenance of the software and
> protects against malicious tampering.
> </rationale>
> -<ident cce="14914-6" />
> +<ident cce="26709-6" />
> <oval id="yum_gpgcheck_global_activation" />
> <ref nist="SI-2" disa="352,663" />
> <tested by="MM" on="20120928"/>
> @@ -93,7 +93,7 @@ Ensuring all packages' cryptographic signatures are valid prior
to
> installation ensures the provenance of the software and
> protects against malicious tampering.
> </rationale>
> -<ident cce="14813-0" />
> +<ident cce="26647-8" />
> <oval id="yum_gpgcheck_never_disabled" />
> <ref nist="SI-2" disa="352,663"/>
> <tested by="MM" on="20120928"/>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance