>From 03aff743f3a0884055c9c523aaf13b170db81d56 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 16 May 2012 15:35:35 -0400 Subject: [PATCH 09/11] Removed description fields in auxilary.xml Just realized we didn't need the tag in the aux files, only the rationale, so deleting them --- rhel6/src/input/auxiliary/srg_support.xml | 14 -------------- 1 files changed, 0 insertions(+), 14 deletions(-) diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index 1a92060..2fe2c99 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -17,14 +17,12 @@ Red Hat Enterprise Linux meets this requirement by design. The operating system must notify, as required, appropriate individuals for account termination. -Monitoring account termination is critical to ensure a denial of service situation does not exist on the operating system. An unexpected account termination can also be a sign of a rogue administrator account that may be deleting traces of activity. In order to facilitate the monitoring, the operating system must notify designated personnel when an account is terminated. The Red Hat Enterprise Linux Auditing Subsystem provides this functionality natively, placing this information in the audit logs for system administrator review. The operating system must notify, as required, appropriate individuals when accounts are created. -Monitoring account creation is critical to ensure only appropriate personnel have access to the operating system. This reduces the possibility a rogue account will be created. In order to facilitate the monitoring, the operating system must notify designated personnel when an account is created. The Red Hat Enterprise Linux Auditing Subsystem provides this functionality natively, placing this information in the audit logs for system administrator review. @@ -47,23 +45,12 @@ The requirement is impractical or out of scope. The operating system must enforce requirements for remote connections to the information system -The organization will define the requirements for connection of remote connections. In order -to ensure the connection provides adequate integrity and confidentiality of the connection, the operating system must enforce these requirements. - The technical specifications to meet this policy are organizationally defined, and therefor generic guidance is not availabile. The operating system must employ automated mechanisms to centrally manage configuration settings -Configuration settings are the configurable security-related parameters of information technology -products that are part of the information system. Security-related parameters are those parameters -impacting the security state of the system including parameters related to meeting other security control -requirements. Security-related parameters include, for example, registry settings; account, file, and directory -settings (i.e., permissions); and settings for services, ports, protocols, and remote connections. Rather -than visiting each system when making configuration changes, organizations must employ automated tools that -can make changes across all systems. This greatly increases efficiency and manageability of applications in a -large scale environment. An organizational configuration management policy is out of scope of this security guide. @@ -80,5 +67,4 @@ The requirement is impractical or out of scope. - -- 1.7.1