Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/profiles/STIG-server.xml | 10 ++++++++++
RHEL6/input/profiles/common.xml | 4 ++++
RHEL6/utils/verify-references.py | 2 ++
3 files changed, 16 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml
index 5ccf94c..49799bf 100644
--- a/RHEL6/input/profiles/STIG-server.xml
+++ b/RHEL6/input/profiles/STIG-server.xml
@@ -1,8 +1,18 @@
<Profile id="stig-server" extends="common"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
<title>Pre-release Draft STIG for RHEL 6 Server</title>
<description>This profile is being developed under the DoD consensus model to
become a STIG in coordination with DISA FSO.</description>
+<select idref="aide_periodic_cron_checking" selected="true"/>
<select idref="rpm_verify_permissions" selected="true"/>
<select idref="disable_xwindows_with_runlevel"
selected="true"/>
<select idref="packagegroup_xwindows_remove" selected="true"/>
<select idref="disable_dhcp_client" selected="true"/>
+<select idref="install_openswan" selected="true"/>
+<select idref="set_iptables_default_rule_forward"
selected="true"/>
+<select idref="max_concurrent_login_sessions"
selected="true"/>
+<select idref="configure_auditd_space_left_action"
selected="true"/>
+<select idref="configure_auditd_action_mail_acct"
selected="true"/>
+<select idref="configure_auditd_action_mail_acct"
selected="true"/>
+<select idref="account_disable_post_pw_expiration"
selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/> <!--
out of scope for OS? -->
+
</Profile>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 22de485..6f6bc84 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -21,6 +21,10 @@
<select idref="restrict_root_console_logins" selected="true"/>
<select idref="restrict_serial_port_logins" selected="true"/>
<select idref="no_shelllogin_for_systemaccounts"
selected="true"/>
+<select idref="userowner_shadow_file" selected="true"/>
+<select idref="groupowner_shadow_file" selected="true"/>
+<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_passwd" selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="no_hashes_outside_shadow" selected="true"/>
<select idref="no_uidzero_except_root" selected="true"/>
diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
index e4ef43c..d7f082d 100755
--- a/RHEL6/utils/verify-references.py
+++ b/RHEL6/utils/verify-references.py
@@ -8,6 +8,8 @@ import lxml.etree as ET
# OVAL, and also search based on other criteria such as existence of policy
# references in XCCDF.
#
+# It must be run from the same directory as the XCCDF and OVAL content
+# it references.
xccdf_ns = "http://checklists.nist.gov/xccdf/1.1"
oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
--
1.7.1