Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/services/base.xml | 20 ++++++++++----------
RHEL6/input/services/dhcp.xml | 24 ++++++------------------
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/services/ssh.xml | 3 +--
RHEL6/input/system/permissions/files.xml | 2 +-
5 files changed, 19 insertions(+), 32 deletions(-)
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 9414d7b..489a4a2 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -159,13 +159,13 @@ is little need to run the kdump service.</rationale>
<Rule id="service_mdmonitor_disabled">
<title>Disable Software RAID Monitor (mdmonitor)</title>
-<description>The mdmonitor service is used for monitoring a software RAID
(hardware
-RAID setups do not use this service).
+<description>The <tt>mdmonitor</tt> service is used for monitoring a
software RAID array; hardware
+RAID setups do not use this service.
<service-disable-macro service="mdmonitor" />
</description>
<ocil><service-disable-check-macro service="mdmonitor"
/></ocil>
-<rationale>If software RAID monitoring is not required (and it is uncommon),
-there is no need to run the service.</rationale>
+<rationale>If software RAID monitoring is not required,
+there is no need to run this service.</rationale>
<ident cce="27193-2" />
<oval id="service_mdmonitor_disabled" />
<ref nist="CM-7" />
@@ -210,7 +210,7 @@ kernel panics, which is not common.
<Rule id="service_ntpdate_disabled">
<title>Disable ntpdate Service (ntpdate)</title>
-<description>The ntpdate service sets the local hardware clock by polling NTP
servers
+<description>The <tt>ntpdate</tt> service sets the local hardware clock
by polling NTP servers
when the system boots. It synchronizes to the NTP servers listed in
<tt>/etc/ntp/step-tickers</tt> or <tt>/etc/ntp.conf</tt>
and then sets the local hardware clock to the newly synchronized
@@ -238,7 +238,7 @@ applications. Communication with <tt>oddjobd</tt> through
the system message bus
</description>
<ocil><service-disable-check-macro service="oddjobd"
/></ocil>
<rationale>The <tt>oddjobd</tt> service may provide necessary
functionality in
-some environments but it can be disabled if it is not needed. Execution of
+some environments, and can be disabled if it is not needed. Execution of
tasks by privileged programs, on behalf of unprivileged ones, has traditionally
been a source of privilege escalation security issues.</rationale>
<ident cce="27257-5" />
@@ -266,7 +266,7 @@ disabled if not needed.</rationale>
<Rule id="service_psacct_enabled">
<title>Enable Process Accounting (psacct)</title>
-<description>The process accounting service (<tt>psacct</tt>) works
with programs
+<description>The process accounting service, <tt>psacct</tt>, works
with programs
including <tt>acct</tt> and <tt>ac</tt> to allow system
administrators to view
user activity, such as commands issued by users of the system.
<service-enable-macro service="psacct" />
@@ -293,8 +293,8 @@ listen for connection attempts.
<ocil><service-disable-check-macro service="qpidd" /></ocil>
<rationale>The qpidd service is automatically installed when the "base"
package selection is selected during installation. The qpidd service listens
-for network connections which increases the attack surface of the system. If
-the system is not intended to receive AMQP traffic then the <tt>qpidd</tt>
+for network connections, which increases the attack surface of the system. If
+the system is not intended to receive AMQP traffic, then the <tt>qpidd</tt>
service is not needed and should be disabled or removed.</rationale>
<ident cce="26928-2" />
<oval id="service_qpidd_disabled" />
@@ -381,7 +381,7 @@ unnecessary and can be disabled.</rationale>
<Rule id="service_saslauthd_disabled">
<title>Disable Cyrus SASL Authentication Daemon (saslauthd)</title>
-<description>The saslauthd service handles plaintext authentication requests on
+<description>The <tt>saslauthd</tt> service handles plaintext
authentication requests on
behalf of the SASL library. The service isolates all code requiring superuser
privileges for SASL authentication into a single process, and can also be used
to provide proxy authentication services to clients that do not understand SASL
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index a611adc..38d9770 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -4,24 +4,12 @@
systems to request and obtain an IP address and other configuration
parameters from a server.
<br /><br />
-In general, sites use DHCP either to allow a large pool of
-mobile or unknown machines to share a limited number of IP
-addresses, or to standardize installations by avoiding static,
-individual IP address configuration on hosts. It is recommended
-that sites avoid DHCP as much as possible. Since DHCP
-authentication is not well-supported, DHCP clients are open to
-attacks from rogue DHCP servers. Such servers can give clients
-incorrect information (e.g. malicious DNS server addresses) which
-could lead to their compromise.
-<br /><br />
-If a machine must act as a DHCP client or server, configure
-it defensively using the guidance in this section. This guide
-recommends configuring networking on clients by manually editing
-the appropriate files under <tt>/etc/sysconfig</tt>. It is also possible to
-use the graphical front-end programs system-config-network and
-system-config-network-tui, but these programs rewrite configuration
-files from scratch based on their defaults - destroying any manual
-changes - and should therefore be used with caution.</description>
+This guide recommends configuring networking on clients by manually editing
+the appropriate files under <tt>/etc/sysconfig</tt>. Use of DHCP can make
client
+systems vulnerable to compromise by rogue DHCP servers, and should be avoided
+unless necessary. If using DHCP is necessary, however, there are best practices
+that should be followed to minimize security risk.
+</description>
<Group id="disabling_dhcp_server">
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 8f13b97..41ee480 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -276,7 +276,7 @@ found.</description>
<ocil><service-disable-check-macro service="tftp" /></ocil>
<rationale>
Disabling the <tt>tftp</tt> service ensures the system is not acting
-as a tftp server, which does not provide encryption or authentication.
+as a TFTP server, which does not provide encryption or authentication.
</rationale>
<ident cce="27055-3" />
<oval id="service_tftp_disabled" />
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 59330ab..7100584 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -224,8 +224,7 @@ can allow an attacker to move trivially to other hosts.
<Rule id="disable_host_auth" severity="medium">
<title>Disable Host-Based Authentication</title>
<description>SSH's cryptographic host-based authentication is
-more secure than <tt>.rhosts</tt> authentication,
-since hosts are cryptographically authenticated. However, it is
+more secure than <tt>.rhosts</tt> authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
<br /><br />
diff --git a/RHEL6/input/system/permissions/files.xml
b/RHEL6/input/system/permissions/files.xml
index ac5b190..53bc801 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -388,7 +388,7 @@ caused by world-writable files.</rationale>
</Rule>
<Rule id="no_unpackaged_sgid_files">
-<title>Ensure All Setgid Executables Are Authorized</title>
+<title>Ensure All SGID Executables Are Authorized</title>
<description>The SGID (set group id) bit should be set only on files that were
installed via authorized means. A straightforward means of identifying
unauthorized SGID files is determine if any were not installed as part of an
--
1.7.1