On 6/27/12 6:18 PM, Willy Santos wrote:
Signed-off-by: Willy Santos <wsantos@redhat.com>
 rhel6/src/input/auxiliary/srg_support.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
index c070e02..6167107 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
 It is unclear how to satisfy this requirement.
-<ref disa="20,31,218,219,224,386" />
+<ref disa="20,31,218,219,224,386,1092" />
 </Group> <!-- end unmet_impractical_product -->
 <Group id="new_rule_needed">

SRG-OS-000140 CCI-001092 The operating system must protect against or must limit the effects of the organization-defined or referenced types of Denial of Service attacks. A variety of technologies exist to limit, or in some cases, eliminate the effects of Denial of Service attacks. Employing increased capacity combined with service redundancy may reduce the susceptibility to some Denial of Service attacks.

Could we argue that this is met by:
- Enabling IPTables
- Setting account password retries in PAM
- Turning off standard icmp responses

We certainly can't provide comprehensive protection against this at the OS layer, but the above "limits the effects" enough for a mapping.