Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/auxiliary/srg_support.xml | 2 +- RHEL6/input/services/obsolete.xml | 8 ++++---- RHEL6/input/services/ssh.xml | 4 ++-- .../accounts/restrictions/password_expiration.xml | 2 +- RHEL6/input/system/auditing.xml | 6 +++--- 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml index d80264b..b19b8d0 100644 --- a/RHEL6/input/auxiliary/srg_support.xml +++ b/RHEL6/input/auxiliary/srg_support.xml @@ -21,7 +21,7 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674" /> +<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1427,1499,1632,1693,1665,1674" /> </Rule>

diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 49e93db..4542b52 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -81,7 +81,7 @@ subject to man-in-the-middle attacks. </rationale> <ident cce="3390-2" /> <oval id="service_telnetd_disabled" /> -<ref disa="68,1436,196,197,877,888" /> +<ref disa="68,1436,197,877,888" /> <tested by="DS" on="20121026"/> </Rule>

@@ -97,7 +97,7 @@ telnet service's accidental (or intentional) activation. </rationale> <ident cce="4330-7" /> <oval id="package_telnet-server_removed" /> -<ref disa="305"/> +<ref disa="305,381"/> <tested by="DS" on="20121026"/> </Rule> </Group> @@ -124,7 +124,7 @@ activation. </rationale> <ident cce="4308-3" /> <oval id="package_rsh-server_removed" /> -<ref disa="305"/> +<ref disa="305,381"/> <tested by="DS" on="20121026"/> </Rule>

@@ -230,7 +230,7 @@ accidental (or intentional) activation of NIS or NIS+ services. </rationale> <ident cce="4348-9" /> <oval id="package_ypserv_removed" /> -<ref disa="305"/> +<ref disa="305,381"/> <tested by="DS" on="20121026"/> </Rule>

diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 901eefb..30890b3 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -345,7 +345,7 @@ access restriction in some configurations. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in <tt>/etc/ssh/sshd_config</tt> demonstrates use of FIPS-approved ciphers: -<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc</pre> +<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc</pre> The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers. </description> <ocil clause="that is not the case"> @@ -360,7 +360,7 @@ implementation. These are also required for compliance. </rationale> <ident cce="14491-5" /> <oval id="sshd_use_approved_ciphers" /> -<ref disa="803,1144,1145,1146,196" /> +<ref disa="803,1144,1145,1146" /> <tested by="DS" on="20121024"/> </Rule>

diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index 34cb775..a4e3873 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -158,7 +158,7 @@ increases the risk of users writing down the password in a convenient location subject to physical compromise.</rationale> <ident cce="4092-3" /> <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/> -<ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/> +<ref nist="CM-6, CM-7, IA-5, AC-3" disa="180,199" /> <tested by="DS" on="20121026"/> </Rule>

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index b64a160..f823a89 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -354,7 +354,7 @@ disk space is starting to run low: <rationale>Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.</rationale> <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/> -<ref disa="140,143,144,1339" /> +<ref disa="140,143,1339" /> <tested by="DS" on="20121024"/> </Rule>

@@ -394,7 +394,7 @@ audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur. </rationale> <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" /> -<ref disa="140,143,144,1343" /> +<ref disa="140,143,1343" /> <tested by="DS" on="20121024"/> </Rule>

@@ -416,7 +416,7 @@ account when it needs to notify an administrator: <rationale>Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.</rationale> <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" /> -<ref disa="139" /> +<ref disa="139,144" /> </Rule>

</Group>