$ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p
stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml
These ones seem to make sense, and many are mapped to actual CCI/SRG:
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_prelink
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: aide_build_database
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mountopt_nodev_on_nonroot_partitions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mountopt_nodev_on_removable_partitions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mountopt_nosuid_on_removable_partitions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_tmp_nodev
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_tmp_noexec
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_tmp_nosuid
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_dev_shm_nodev
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_dev_shm_noexec
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_dev_shm_nosuid
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: mount_option_var_tmp_bind_var
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: console_device_restrict_access_desktop
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: console_device_restrict_access_server
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: bootloader_nousb_argument
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: bios_disable_usb_boot
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: gconf_gnome_disable_automount
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_cramfs
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_freevxfs
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_jffs2
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_hfs
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_hfsplus
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_squashfs
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_module_udf
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_gnome_thumbnailers
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: no_unpackaged_sgid_files
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: no_unpackaged_suid_files
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_setuid_coredumps
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: bios_enable_execution_restrictions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_restorecond_enabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: selinux_confinement_of_daemons
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: root_path_no_dot
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: root_path_no_groupother_writable
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: homedir_perms_no_groupwrite_worldread
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_user_list
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_disable_unused_interfaces
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_disable_zeroconf
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_sniffer_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: wireless_disable_in_bios
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: deactivate_wireless_interfaces
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_disable_interfaces
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_disable_rpc
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: set_sysctl_net_ipv6_conf_default_accept_ra
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_static_address
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_privacy_extensions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_default_gateway
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: network_ipv6_limit_requests
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: rsyslog_logfiles_exist
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: rsyslog_accept_remote_messages_none
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: rsyslog_accept_remote_messages_tcp
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: rsyslog_accept_remote_messages_udp
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: configure_logwatch_hostlimit
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: configure_logwatch_splithosts
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_logwatch_for_logserver
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: audit_logs_rootowner
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: audit_manual_logon_edits
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: audit_manual_session_edits
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: audit_config_immutable
I'm not terribly in favor of specifying what services people can/can't
run without an
incredibly good reason, and I do not see a valid policy requirement to
get this included
into the STIG. Perhaps we should remove the CCI reference (it's the
generic catch all)?
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_acpid_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_certmonger_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_cgconfig_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_cgred_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_cpuspeed_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_haldaemon_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_irqbalance_enabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_kdump_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_mdmonitor_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_messagebus_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_portreserve_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_psacct_enabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_quota_nld_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_rhsmcertd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_saslauthd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_smartd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_sysstat_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_anacron
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ssh_server_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ssh_server_iptables_exception
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: sshd_limit_user_access
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: avahi_ip_only
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: avahi_check_ttl
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: avahi_prevent_port_sharing
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: avahi_disable_publishing
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_cups_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: iptables_cupsd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: cups_disable_browsing
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: cups_disable_printserver
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_dhcp_server
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_dhcp_server
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dhcp_server_disable_ddns
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dhcp_server_deny_decline
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dhcp_server_deny_bootp
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dhcp_server_configure_logging
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ntpd_specify_multiple_servers
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: iptables_smtp_enabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_logging
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_install_ssl_cert
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_server_denial_of_service
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_server_banner
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_server_mail_relay_set_trusted_networks
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_server_mail_relay_for_trusted_networks
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server:
postfix_server_mail_relay_smtp_auth_for_untrusted_networks
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: postfix_server_mail_relay_require_tls_for_smtp_auth
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_olcsuffix
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_bdb_file_security
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_olcrootpw
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_certificate_files
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_olcaccess
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_directory_file_security
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: iptables_ldap_enabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ldap_server_config_logging
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_nfslock_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_rpcgssd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_rpcidmapd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_netfs_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_rpcbind_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: nfs_fixed_lockd_tcp_port
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: nfs_fixed_lockd_udp_port
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: nfs_fixed_statd_port
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: nfs_fixed_mountd_port
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_nfs_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: service_rpcsvcgssd_disabled
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: use_root_squashing_all_exports
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: restrict_nfs_clients_to_privileged_ports
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_dns_server
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_bind
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dns_server_chroot
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dns_server_disable_dynamic_updates
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_vsftpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_vsftpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: install_vsftpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ftp_restrict_to_anon
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ftp_disable_uploads
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: ftp_home_partition
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_httpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_httpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_servertokens_prod
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_serversignature_off
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_digest_authentication
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_mod_rewrite
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_ldap_support
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_server_side_includes
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_mime_magic
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_webdav
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_server_activity_status
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_server_configuration_display
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_url_correction
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_proxy_support
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_cache_support
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_cgi_support
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_restrict_root_directory
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_restrict_web_directory
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_restrict_critical_directories
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_limit_available_methods
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_install_mod_ssl
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_install_mod_security
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_logs_permissions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_conf_dir_permissions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: httpd_conf_files_permissions
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_dovecot
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_dovecot
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dovecot_support_necessary_protocols
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dovecot_enable_ssl
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dovecot_configure_ssl_cert
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dovecot_configure_ssl_key
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: dovecot_disable_plaintext_auth
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_smb_server
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: smb_server_disable_root
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: smb_set_auth_levels
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_squid
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_squid
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: disable_snmpd
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: uninstall_net-snmp
XCCDF Rule found with DISA CCI reference outside Profile
stig-rhel6-server: snmpd_configuration_guidance
Show replies by thread