>From 673263473b1ee0dacd6a50bd2301e425374d74d6 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 11 Sep 2013 19:56:42 -0400 Subject: [PATCH 09/22] OVAL signoff + remediation: disable_interactive_boot - Updated OVAL namings to match XCCDF - OVAL signoff (the old regex was broke) - Added remediation TESTING: [root@SSG-RHEL6 checks]# ./testcheck.py disable_interactive_boot.xml Evaluating with OVAL tempfile : /tmp/disable_interactive_bootG_DyZK.xml Writing results to : /tmp/disable_interactive_bootG_DyZK.xml-results Definition oval:scap-security-guide.testing:def:146: false Evaluation done. [root@SSG-RHEL6 checks]# bash ../fixes/bash/disable_interactive_boot.sh [root@SSG-RHEL6 checks]# ./testcheck.py disable_interactive_boot.xml Evaluating with OVAL tempfile : /tmp/disable_interactive_boot6iRseC.xml Writing results to : /tmp/disable_interactive_boot6iRseC.xml-results Definition oval:scap-security-guide.testing:def:146: true Evaluation done. --- RHEL6/input/checks/disable_interactive_boot.xml | 30 ++++++++++++++++++++ RHEL6/input/checks/interactive_boot_disable.xml | 28 ------------------ RHEL6/input/fixes/bash/disable_interactive_boot.sh | 5 +++ RHEL6/input/system/accounts/physical.xml | 2 +- 4 files changed, 36 insertions(+), 29 deletions(-) create mode 100644 RHEL6/input/checks/disable_interactive_boot.xml delete mode 100644 RHEL6/input/checks/interactive_boot_disable.xml create mode 100644 RHEL6/input/fixes/bash/disable_interactive_boot.sh diff --git a/RHEL6/input/checks/disable_interactive_boot.xml b/RHEL6/input/checks/disable_interactive_boot.xml new file mode 100644 index 0000000..1a4f55b --- /dev/null +++ b/RHEL6/input/checks/disable_interactive_boot.xml @@ -0,0 +1,30 @@ + + + + Disable Interactive Boot + + Red Hat Enterprise Linux 6 + + The ability for users to perform interactive startups should + be disabled. + + + + + + + + + + + + + /etc/sysconfig/init + ^[\s]*PROMPT[\s]*=[\s]*no[\s]*$ + 1 + + + diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml deleted file mode 100644 index 0f694ea..0000000 --- a/RHEL6/input/checks/interactive_boot_disable.xml +++ /dev/null @@ -1,28 +0,0 @@ - - - - Disable Interactive Boot - - Red Hat Enterprise Linux 6 - - The ability for users to perform interactive startups should - be disabled. - - - - - - - - - - /etc/sysconfig - init - - PROMPT[\s]*=[\s]*no\s*$ - 1 - - diff --git a/RHEL6/input/fixes/bash/disable_interactive_boot.sh b/RHEL6/input/fixes/bash/disable_interactive_boot.sh new file mode 100644 index 0000000..f95ace8 --- /dev/null +++ b/RHEL6/input/fixes/bash/disable_interactive_boot.sh @@ -0,0 +1,5 @@ +grep -q ^PROMPT /etc/sysconfig/init && \ + sed -i "s/PROMPT.*/PROMPT=no/g" /etc/sysconfig/init +if ! [ $? -eq 0 ]; then + echo "PROMPT=no" >> /etc/sysconfig/init +fi diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index e4863c1..390a953 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -191,7 +191,7 @@ the console user could disable auditing, firewalls, or other services, weakening system security. - + -- 1.7.1