On 7/31/13 2:24 PM, Brian Peake wrote:
On 7/31/13 1:36 PM, "Shawn Wells" <shawn@redhat.com> wrote:


>On 7/31/13 11:31 AM, Stuart Green wrote:
>>
>> Ah-ha!! Thanks, I was looking for the buglist actually and couldn't
>> find it!
>>
>>
>> Glad to be aboard :)
>
>
>Hm. Perhaps this whole thing can be simplified.
>
>Right now we have two checks:
>     - package_telnet-server_removed.xml
>     - service_telnetd_disabled.xml
>
>They seem redundant, and I'm failing to find reasons against just
>deleting service_telnetd_disabled. There's no way telnet can be enabled
>if the package isn't installed, right?
>
>Is there a reason to continue maintaining both checks?
Shawn,
I don't think so. I believe there are other checks that have the same
redundancy alsoŠ


Everything in the 'Obsolete Services' can trivially be migrated away to a 'uninstall' rule:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete

These would be:
    - xinetd
    - telnet-server
    - rsh-server
    - ypserv
    - tftp-server

I'd wager much of the 'Base Services' fall under this too:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base
    - abrt
    - acpid
    - certmonger
    - cgconfig
    - cgred
    - cpuspeed
    - haldaemon
    - irqbalance
    - kdump
    - mdmonitor
    - messagebus
    - netconsole
    - ntpdate
    - oddjobd
    - portreserve
    - psacct
    - quota_nld
    - rdisc
    - rhnsd
    - rhsmcertd
    - saslauthd
    - smartd
    - sysstat

Can anyone think of why we'd want to have checks for both uninstall and disabled?