Looks fine, please push.
On 04/30/2013 12:58 PM, David Smith wrote:
---
RHEL6/input/services/ftp.xml | 12 ++++++------
RHEL6/input/system/permissions/permissions.xml | 2 +-
RHEL6/input/system/selinux.xml | 2 +-
RHEL6/input/system/software/disk_partitioning.xml | 2 +-
4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 27957c8..361f7dc 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -84,7 +84,7 @@ xferlog_std_format=NO
log_ftp_protocol=YES</pre>
</description>
<ocil clause="xferlog_enable is missing, or is not set to yes">
-Find if logging is applied to the ftp daemon.
+Find if logging is applied to the FTP daemon.
<br/><br/>
Procedures:
<br/><br/>
@@ -96,7 +96,7 @@ If the <i>server_args</i> line is missing or does not
include the vsftpd configu
<pre># grep xferlog_enable <i>vsftpd config file</i></pre>
</ocil>
<rationale>To trace malicious activity facilitated by the FTP service, it must be
configured to ensure that all commands sent to
-the ftp server are logged using the verbose vsftpd log
+the FTP server are logged using the verbose vsftpd log
format. The default vsftpd log file is
<tt>/var/log/vsftpd.log</tt>.</rationale>
<warning category="general">If verbose logging to
<tt>vsftpd.log</tt> is done, sparse logging of downloads to
<tt>/var/log/xferlog</tt> will not also occur. However, the information about
what files were downloaded is included in the information logged to
<tt>vsftpd.log</tt></warning>
<ident cce="27142-9" />
@@ -152,13 +152,13 @@ these logins as much as possible.</description>
<pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</pre>
-Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who
should be allowed to access the system via ftp, add a line containing that user's
name:
+Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who
should be allowed to access the system via FTP, add a line containing that user's
name:
<pre>USERNAME</pre>
If anonymous access is also required, add the anonymous usernames to
<tt>/etc/vsftp.ftpusers</tt> as well.
<pre>anonymous
ftp</pre>
</description>
-<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a
list of users who were not allowed to access the system via ftp. It was used to prevent
system users such as the root user from logging in via the insecure ftp protocol. However,
when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd
interprets ftpusers as the set of users who are allowed to login via ftp. Since it should
be possible for most users to access their accounts via secure protocols, it is
recommended that this setting be used, so that non-anonymous ftp access can be limited to
legacy users who have been explicitly identified.</rationale>
+<rationale>Historically, the file <tt>/etc/ftpusers</tt> contained a
list of users who were not allowed to access the system via FTP. It was used to prevent
system users such as the root user from logging in via the insecure FTP protocol. However,
when the configuration option <tt>userlist deny=NO</tt> is set, vsftpd
interprets ftpusers as the set of users who are allowed to login via FTP. Since it should
be possible for most users to access their accounts via secure protocols, it is
recommended that this setting be used, so that non-anonymous FTP access can be limited to
legacy users who have been explicitly identified.</rationale>
<!--<oval id="ftp_limit_users" />-->
<!--<ref nist="CM-7" /> -->
</Group>
@@ -183,7 +183,7 @@ is necessary to ensure that files cannot be uploaded and downloaded
from the sam
<Rule id="ftp_home_partition">
<title>Place the FTP Home Directory on its Own Partition</title>
-<description>By default, the anonymous FTP root is the home directory of the ftp
user account. The df command can
+<description>By default, the anonymous FTP root is the home directory of the FTP
user account. The df command can
be used to verify that this directory is on its own partition.</description>
<rationale>If there is a mission-critical reason for anonymous users to upload
files, precautions must be taken to prevent
these users from filling a disk used by other services.</rationale>
@@ -202,7 +202,7 @@ the FTP connection tracking module:
<rationale>These settings configure iptables to allow connections to an FTP
server. The first line allows initial connections
to the FTP server port.
FTP is an older protocol which is not very compatible with firewalls. During the initial
FTP dialogue, the client
-and server negotiate an arbitrary port to be used for data transfer. The ip conntrack
ftp module is used by
+and server negotiate an arbitrary port to be used for data transfer. The
<tt>ip_conntrack_ftp</tt> module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP
negotiates. This allows an
FTP server to operate on a machine which is running a firewall.</rationale>
<!--<oval id="ftp_configure_firewall" />-->
diff --git a/RHEL6/input/system/permissions/permissions.xml
b/RHEL6/input/system/permissions/permissions.xml
index 3dfb32e..8e5e148 100644
--- a/RHEL6/input/system/permissions/permissions.xml
+++ b/RHEL6/input/system/permissions/permissions.xml
@@ -18,6 +18,6 @@ The following command prints a list of ext4 partitions on the local
machine, which is the default filesystem for Red Hat Enterprise Linux
6 installations:
<pre>$ mount -t ext4 | awk '{print $3}'</pre>
-If your site uses a local filesystem type other than ext4 then you
+If your site uses a local filesystem type other than ext4, you
will need to modify this command.</description>
</Group>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 9de5714..dec9054 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -10,7 +10,7 @@ sufficiently developed and debugged that it should be usable on
almost any Red Hat machine with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
-services such as mail servers, ftp servers, and DNS servers - from
+services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
diff --git a/RHEL6/input/system/software/disk_partitioning.xml
b/RHEL6/input/system/software/disk_partitioning.xml
index 7d5cc5b..a94943b 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -1,6 +1,6 @@
<Group id="disk_partitioning">
<title>Disk Partitioning</title>
-<description>To ensure separation and protection of data there
+<description>To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance