On 1/14/13 5:35 AM, Shawn Wells wrote:

0001-DISA-FSO-Language-changes-to-RHEL6-input-services-ft.patch

From 53a0ca704eef2b6bd7826b0c7eda1615113ef3b9 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn@redhat.com>
Date: Mon, 14 Jan 2013 05:26:01 -0500
Subject: [PATCH 1/2] DISA FSO: Language changes to RHEL6/input/services/ftp.xml
 Language changes to FTP section, patched by DISA FSO

---
 RHEL6/input/services/ftp.xml |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 11cf6df..ef86002 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -92,10 +92,12 @@ If vsftpd is started by xinetd the following command will indicate the xinetd.d
 <pre># grep vsftpd /etc/xinetd.d/*</pre>
 <pre># grep server_args <i>vsftpd xinetd.d startup file</i></pre>
 This will indicate the vsftpd config file used when starting through xinetd.
-If the <i>server_args</i>line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
+If the <i>server_args</i> line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
 <pre># grep xferlog_enable <i>vsftpd config file</i></pre>
 </ocil>
 <rationale>The modifications above ensure that all commands sent to the ftp server are logged using the verbose vsftpd log
+<rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to
+the ftp server are logged using the verbose vsftpd log
 format. The default vsftpd log file is /var/log/vsftpd.log.</rationale>
 <warning category="general">If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log</warning>
 <ident cce="27142-9" />

Ack to DISA on this. Pushed.

(I caught the duplicate <rationale> tag -- which was introduced by me, not DISA -- and pushed.)