The SSH cipher text referring to problems with CBC ciphers was removed, as it was simply carried over from the RHEL5 content.
An issue with the NFS insecure_locks clause was fixed, to reflect that any output would be a finding.
The pam_faillock rule was changed slightly, from "three" to "3" for the required value.
David Smith (3): OCIL clause fix removed text referring to earlier issues with CBC ciphers Modified text from "three" to "3" in password lockout rule
RHEL6/input/services/nfs.xml | 2 +- RHEL6/input/services/ssh.xml | 7 +------ RHEL6/input/system/accounts/pam.xml | 2 +- 3 files changed, 3 insertions(+), 8 deletions(-)
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/nfs.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml index 487afd1..fa0af28 100644 --- a/RHEL6/input/services/nfs.xml +++ b/RHEL6/input/services/nfs.xml @@ -483,7 +483,7 @@ access to data for which it does not have authorization. Remove any instances of the <tt>insecure_locks</tt> option from the file <tt>/etc/exports</tt>. </description> -<ocil clause="there is no output"> +<ocil clause="there is output"> To verify that insecure file locking has been disabled, run the following command: <pre># grep insecure_locks /etc/exports</pre> </ocil>
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/ssh.xml | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index e64eddc..9320999 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -349,12 +349,7 @@ The following line in <tt>/etc/ssh/sshd_config</tt> demonstrates use of FIPS-approved ciphers: <pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc</pre> The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers. -Note that older or less capable versions of SSH client or server software -may still be found on systems such as networking equipment, and these -may not support CTR mode. This may become an issue if, for example, -these systems need to retrieve files from your SSH server using SFTP. -TODO: Need to investigate current status of this. Earlier issues with -CBC were supposed to be fixed.</description> +</description> <ocil clause="that is not the case"> Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/accounts/pam.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index ee8bb91..4cd8a9d 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -181,7 +181,7 @@ operator="equals" interactive="0"> Edit the <tt>pam_cracklib.so</tt> statement in <tt>/etc/pam.d/system-auth</tt> to show <tt>retry=3</tt>. <br /><br /> -The DoD requirement is three prompts per session. +The DoD requirement is 3 prompts per session. </description> <ocil clause="it is not the required value"> To check how many retry attempts are permitted on a per-session basis, run the following command:
On 10/31/12 7:40 AM, David Smith wrote:
The SSH cipher text referring to problems with CBC ciphers was removed, as it was simply carried over from the RHEL5 content.
An issue with the NFS insecure_locks clause was fixed, to reflect that any output would be a finding.
The pam_faillock rule was changed slightly, from "three" to "3" for the required value.
David Smith (3): OCIL clause fix removed text referring to earlier issues with CBC ciphers Modified text from "three" to "3" in password lockout rule
RHEL6/input/services/nfs.xml | 2 +- RHEL6/input/services/ssh.xml | 7 +------ RHEL6/input/system/accounts/pam.xml | 2 +- 3 files changed, 3 insertions(+), 8 deletions(-)
Ack x3
scap-security-guide@lists.fedorahosted.org