It has been fixed.


====================================================== 
Michele Newman RHCE, RHCVA (Sr. Consultant) 
Email: mnewman@redhat.com Cell: 410.499.6177 
Red Hat Consulting http://www.redhat.com/consulting 
====================================================== 
Red Hat, Inc. | 1801 Varsity Dr | Raleigh, NC | 27606 




On Oct 25, 2012, at 5:24 PM, Shawn Wells wrote:

On 10/25/12 5:11 PM, Michele Newman wrote:
---
 RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
 RHEL6/input/services/base.xml             | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index c3fa7bc..9805185 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -513,7 +513,7 @@ The qpidd service must not be running.
 The rdisc service must not be running.
 </title>
 <title rule="service_rhnsd_disabled" shorttitle="Disable Red Hat Network Service (rhnsd)">
-The Red Hat Network Service (rhnsd) service must not be running.
+The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite.
 </title>
 <title rule="service_sysstat_disabled" shorttitle="Disable System Statistics Reset Service (sysstat)">
 The sysstat service must not be running.
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index bda8350..7396512 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -405,7 +405,8 @@ RHN server or satellite and managed as such.
 <ocil><service-disable-check-macro service="rhnsd" /></ocil>
 <rationale>Although systems management and patching is extremely important to
 system security, management by a system outside the enterprise enclave is not
-desirable for some environments.</rationale>
+desirable for some environments.  However, if the system is being managed by RHN or
+ RHN Satellite Server it can remain on, otherwise disable the service. </rationale>
 <ident cce="3416-5" />
 <oval id="service_rhnsd_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />

Please resubmit with refined language.

"it" should be "the rhnsd daemon" and the "otherwise..." text isn't needed.
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide