On 6/27/12 6:18 PM, Willy Santos wrote:
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
rhel6/src/input/auxiliary/srg_support.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml
index c070e02..6167107 100644
@@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
It is unclear how to satisfy this requirement.
-<ref disa="20,31,218,219,224,386" />
+<ref disa="20,31,218,219,224,386,1092" />
</Group> <!-- end unmet_impractical_product -->
SRG-OS-000140 CCI-001092 The operating system must protect against or
must limit the effects of the organization-defined or referenced types
of Denial of Service attacks. A variety of technologies exist to limit,
or in some cases, eliminate the effects of Denial of Service attacks.
Employing increased capacity combined with service redundancy may reduce
the susceptibility to some Denial of Service attacks.
Could we argue that this is met by:
- Enabling IPTables
- Setting account password retries in PAM
- Turning off standard icmp responses
We certainly can't provide comprehensive protection against this at the
OS layer, but the above "limits the effects" enough for a mapping.