Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../accounts_no_nis_inclusions_etc_group.xml | 23 -----
RHEL6/input/checks/accounts_wheel_exists.xml | 29 ------
RHEL6/input/checks/cups_limit_browsing.xml | 23 -----
.../input/checks/file_group_owner_etc_crontab.xml | 25 -----
.../input/checks/file_owner_ldap_server_files.xml | 31 ------
.../checks/file_permissions_ldap_server_files.xml | 38 -------
RHEL6/input/checks/iptables_cupsd_disabled.xml | 41 --------
RHEL6/input/checks/iptables_icmp_disabled.xml | 105 --------------------
.../checks/network_ipv6_disable_interfaces.xml | 59 -----------
.../checks/no_shelllogin_for_systemaccounts.xml | 25 -----
.../checks/package_cronie-anacron_removed.xml | 25 -----
.../input/checks/package_isdn4k-utils_removed.xml | 25 -----
RHEL6/input/checks/package_ntpdate_installed.xml | 25 -----
RHEL6/input/checks/service_isdn_disabled.xml | 99 ------------------
RHEL6/input/checks/service_mcstrans_disabled.xml | 96 ------------------
RHEL6/input/checks/sysconfig_ipv6_autoconf.xml | 33 ------
RHEL6/input/checks/templates/packages_removed.csv | 3 -
RHEL6/input/checks/templates/services_disabled.csv | 2 -
18 files changed, 0 insertions(+), 707 deletions(-)
delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml
delete mode 100644 RHEL6/input/checks/accounts_wheel_exists.xml
delete mode 100644 RHEL6/input/checks/cups_limit_browsing.xml
delete mode 100644 RHEL6/input/checks/file_group_owner_etc_crontab.xml
delete mode 100644 RHEL6/input/checks/file_owner_ldap_server_files.xml
delete mode 100644 RHEL6/input/checks/file_permissions_ldap_server_files.xml
delete mode 100644 RHEL6/input/checks/iptables_cupsd_disabled.xml
delete mode 100644 RHEL6/input/checks/iptables_icmp_disabled.xml
delete mode 100644 RHEL6/input/checks/network_ipv6_disable_interfaces.xml
delete mode 100644 RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml
delete mode 100644 RHEL6/input/checks/package_cronie-anacron_removed.xml
delete mode 100644 RHEL6/input/checks/package_isdn4k-utils_removed.xml
delete mode 100644 RHEL6/input/checks/package_ntpdate_installed.xml
delete mode 100644 RHEL6/input/checks/service_isdn_disabled.xml
delete mode 100644 RHEL6/input/checks/service_mcstrans_disabled.xml
delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_autoconf.xml
diff --git a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml
b/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml
deleted file mode 100644
index 90adc23..0000000
--- a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
- <definition class="compliance"
id="accounts_no_nis_inclusions_etc_group" version="1">
- <metadata>
- <title>Remove Legacy + Entries From /etc/group</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>NIS file inclusions should be set appropriately in the
/etc/group file.</description>
- </metadata>
- <criteria>
- <criterion comment="tests for reg exp '^\+' in /etc/group"
test_ref="test_accounts_no_nis_inclusions_etc_group" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="tests for reg exp '^\+' in
/etc/group" id="test_accounts_no_nis_inclusions_etc_group"
version="1">
- <ind:object object_ref="object_accounts_no_nis_inclusions_etc_group"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_accounts_no_nis_inclusions_etc_group" version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>group</ind:filename>
- <ind:pattern operation="pattern match">^\+</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/accounts_wheel_exists.xml
b/RHEL6/input/checks/accounts_wheel_exists.xml
deleted file mode 100644
index 82dc22e..0000000
--- a/RHEL6/input/checks/accounts_wheel_exists.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="accounts_wheel_exists" version="1">
- <metadata>
- <title>Limit su Access to the wheel group</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The wheel group should exist</description>
- </metadata>
- <criteria>
- <criterion comment="Does wheel group exist"
- test_ref="test_20065" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the <:begin:>wheel setting in the
/etc/group file"
- id="test_20065" version="1">
- <ind:object object_ref="obj_20065" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20065"
- version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>group</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*wheel:.*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/cups_limit_browsing.xml
b/RHEL6/input/checks/cups_limit_browsing.xml
deleted file mode 100644
index 3531034..0000000
--- a/RHEL6/input/checks/cups_limit_browsing.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="cups_limit_browsing" version="1">
- <metadata>
- <title>Limit Printer Browsing to a Particular Subnet if
Necessary</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>By default, when printer sharing is enabled, CUPS will broadcast
to every network that its host machine is connected to through all available network
interfaces on port 631. It will also listen to incoming broadcasts from other machines on
the network. Either list one BrowseAddress line for each client machine and one
BrowseAllow line for each print server or use one of the supported shorthand notations
that the CUPS service recognizes. Please see the cupsd.conf(5) man page or the
documentation provided at
http://www.cups.org for more information on other ways to format
these directives.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="Disable browsing or..."
- definition_ref="cups_disable_browsing" />
- <criteria operator="AND">
- <extend_definition comment="restrict via the BrowseAddress directive
and..."
- definition_ref="cups_limit_browsing_browseaddress" />
- <extend_definition comment="restrict via BrowseDeny then BrowseAllow
directives"
- definition_ref="cups_limit_browsing_browsedenyallow" />
- </criteria>
- </criteria>
- </definition>
-
-</def-group>
diff --git a/RHEL6/input/checks/file_group_owner_etc_crontab.xml
b/RHEL6/input/checks/file_group_owner_etc_crontab.xml
deleted file mode 100644
index 9f3dad8..0000000
--- a/RHEL6/input/checks/file_group_owner_etc_crontab.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <definition class="compliance" id="file_group_owner_etc_crontab"
version="1">
- <metadata>
- <title>Check Group Ownership /etc/crontab</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The file /etc/crontab should be owned by the root
group.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_file_group_owner_etc_crontab" />
- </criteria>
- </definition>
- <unix:file_test check="all" check_existence="all_exist"
comment="root gid for /etc/crontab"
id="test_file_group_owner_etc_crontab" version="1">
- <unix:object object_ref="object_gid_file_etc_crontab" />
- <unix:state state_ref="state_root_gid_etc_crontab" />
- </unix:file_test>
- <unix:file_object comment="/etc/crontab"
id="object_gid_file_etc_crontab" version="1">
- <unix:path>/etc</unix:path>
- <unix:filename>crontab</unix:filename>
- </unix:file_object>
- <unix:file_state id="state_root_gid_etc_crontab"
version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
-</def-group>
diff --git a/RHEL6/input/checks/file_owner_ldap_server_files.xml
b/RHEL6/input/checks/file_owner_ldap_server_files.xml
deleted file mode 100644
index b4428da..0000000
--- a/RHEL6/input/checks/file_owner_ldap_server_files.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="file_owner_ldap_server_files" version="1">
- <metadata>
- <title>Verify User Who Owns The LDAP Server Files</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The /var/lib/ldap/* files should be owned by user
ldap.</description>
- </metadata>
- <criteria>
- <criterion comment="Check file ownership of /var/lib/ldap/*"
- test_ref="test_20143" />
- </criteria>
- </definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing user ownership of /var/lib/ldap/*"
- id="test_20143" version="1">
- <unix:object object_ref="obj_20143" />
- <unix:state state_ref="state_20143" />
- </unix:file_test>
- <unix:file_state id="state_20143"
- version="1">
- <unix:user_id datatype="int">55</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/var/lib/ldap/*"
- id="obj_20143" version="1">
- <unix:path>/var/lib/ldap</unix:path>
- <unix:filename operation="pattern match">.*</unix:filename>
- </unix:file_object>
-</def-group>
diff --git a/RHEL6/input/checks/file_permissions_ldap_server_files.xml
b/RHEL6/input/checks/file_permissions_ldap_server_files.xml
deleted file mode 100644
index 73423e1..0000000
--- a/RHEL6/input/checks/file_permissions_ldap_server_files.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="file_permissions_ldap_server_files" version="1">
- <metadata>
- <title>Verify Permissions On LDAP Server Files</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The /var/lib/ldap/* files should have the appropriate
permissions.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_file_permissions_ldap_server_files" />
- </criteria>
- </definition>
- <unix:file_test check="all" check_existence="all_exist"
comment="/var/lib/ldap/* permissions"
- id="test_file_permissions_ldap_server_files" version="1">
- <unix:object object_ref="object_file_permissions_ldap_server_files"
/>
- <unix:state state_ref="state_file_permissions_ldap_server_files" />
- </unix:file_test>
- <unix:file_state id="state_file_permissions_ldap_server_files"
- version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/var/lib/ldap/* permissions"
- id="object_file_permissions_ldap_server_files" version="1">
- <unix:behaviors recurse="directories" recurse_direction="down"
max_depth="-1" recurse_file_system="local" />
- <unix:path operation="equals">/var/lib/ldap</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- </unix:file_object>
-</def-group>
diff --git a/RHEL6/input/checks/iptables_cupsd_disabled.xml
b/RHEL6/input/checks/iptables_cupsd_disabled.xml
deleted file mode 100644
index 24197f2..0000000
--- a/RHEL6/input/checks/iptables_cupsd_disabled.xml
+++ /dev/null
@@ -1,41 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="iptables_cupsd_disabled" version="1">
- <metadata>
- <title>Firewall Access to Printing Service</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Firewall access to printing service should be
- disabled unless required</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="iptables"
test_ref="test_iptables_cupsd_disabled_iptables" />
- <criterion comment="ip6tables"
test_ref="test_iptables_cupsd_disabled_ip6tables" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist" comment="Check iptables"
- id="test_iptables_cupsd_disabled_iptables" version="1">
- <ind:object object_ref="obj_iptables_cupsd_disabled_iptables" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_cupsd_disabled_iptables" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -p
(?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist" comment="Check ipv6 tables"
- id="test_iptables_cupsd_disabled_ip6tables" version="1">
- <ind:object object_ref="obj_iptables_cupsd_disabled_ip6tables" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check ipv6 tables"
- id="obj_iptables_cupsd_disabled_ip6tables" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -p
(?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/iptables_icmp_disabled.xml
b/RHEL6/input/checks/iptables_icmp_disabled.xml
deleted file mode 100644
index ec1b31e..0000000
--- a/RHEL6/input/checks/iptables_icmp_disabled.xml
+++ /dev/null
@@ -1,105 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="iptables_icmp_disabled" version="1">
- <metadata>
- <title>Restrict ICMP</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Firewall should restrict icmp at iptables and
iptables6</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="disallow all icmp"
- test_ref="test_iptables_icmp_disabled_restrict_icmp_ipv4" />
- <criterion comment="iptables-echo-reply"
- test_ref="test_iptables_icmp_disabled_echo_reply_ipv4" />
- <criterion comment="iptables-destination-unreachable"
- test_ref="test_iptables_icmp_disabled_destication_unreachable_ipv4"
/>
- <criterion comment="iptables-time-exceeded"
- test_ref="test_iptables_icmp_disabled_time_exceeded_ipv4" />
- <criterion comment="ip6tables"
- test_ref="test_iptables_icmp_disabled_drop_echo_request_ipv6" />
- <criterion comment="ip6tables"
- test_ref="test_iptables_icmp_disabled_drop_router_advertisement_ipv6"
/>
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_restrict_icmp_ipv4"
version="1">
- <ind:object object_ref="obj_iptables_icmp_disabled_restrict_icmp_ipv4"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_restrict_icmp_ipv4" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmp\s+--icmp-type\s+any\s+-j\s+ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_echo_reply_ipv4" version="1">
- <ind:object object_ref="obj_iptables_icmp_disabled_echo_reply_ipv4"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_echo_reply_ipv4" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmp\s+--icmp-type\s+echo-reply\s+-j\s+ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_destication_unreachable_ipv4"
version="1">
- <ind:object
object_ref="obj_iptables_icmp_disabled_destication_unreachable_ipv4" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_destication_unreachable_ipv4"
version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmp\s+--icmp-type\s+destination-unreachable\s+-j\s+ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_time_exceeded_ipv4"
version="1">
- <ind:object object_ref="obj_iptables_icmp_disabled_time_exceeded_ipv4"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_time_exceeded_ipv4" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmp\s+--icmp-type\s+time-exceeded\s+-j\s+ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_drop_echo_request_ipv6"
version="1">
- <ind:object
object_ref="obj_iptables_icmp_disabled_drop_echo_request_ipv6" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_drop_echo_request_ipv6"
version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+echo-request\s+-j\s+DROP$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Check iptables"
- id="test_iptables_icmp_disabled_drop_router_advertisement_ipv6"
version="1">
- <ind:object
object_ref="obj_iptables_icmp_disabled_drop_router_advertisement_ipv6" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Check iptables"
- id="obj_iptables_icmp_disabled_drop_router_advertisement_ipv6"
version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A
INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+router-advertisement\s+-j\s+DROP$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/network_ipv6_disable_interfaces.xml
b/RHEL6/input/checks/network_ipv6_disable_interfaces.xml
deleted file mode 100644
index 4c42744..0000000
--- a/RHEL6/input/checks/network_ipv6_disable_interfaces.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="network_ipv6_disable_interfaces" version="1">
- <metadata>
- <title>Disable Interface Usage of IPv6 Unless Needed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Disable ipv6 on interfaces</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Disable NETWORKING_IPV6"
test_ref="test_network_ipv6_disable_interfaces_networking" />
- <criterion comment="Disable IPV6INIT"
test_ref="test_network_ipv6_disable_interfaces_ipv6init" />
- <criterion comment="Disable IPV6INIT per interface"
test_ref="test_network_ipv6_disable_interfaces_ipv6init_per_interface" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Disable NETWORKING_IPV6"
- id="test_network_ipv6_disable_interfaces_networking"
version="1">
- <ind:object object_ref="obj_network_ipv6_disable_interfaces_networking"
/>
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object comment="Disable NETWORKING_IPV6"
- id="obj_network_ipv6_disable_interfaces_networking"
version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>network</ind:filename>
- <ind:pattern operation="pattern
match">^NETWORKING_IPV6=no$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Disable IPV6INIT"
- id="test_network_ipv6_disable_interfaces_ipv6init" version="1">
- <ind:object object_ref="obj_network_ipv6_disable_interfaces_ipv6init"
/>
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object comment="Disable IPV6INIT"
- id="obj_network_ipv6_disable_interfaces_ipv6init" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>network</ind:filename>
- <ind:pattern operation="pattern
match">^IPV6INIT=no$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Disable IPV6INIT per
interface"
- id="test_network_ipv6_disable_interfaces_ipv6init_per_interface"
version="1">
- <ind:object
object_ref="obj_network_ipv6_disable_interfaces_ipv6init_per_interface" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object comment="Disable IPV6INIT per interface"
- id="obj_network_ipv6_disable_interfaces_ipv6init_per_interface"
version="1">
- <ind:path>/etc/sysconfig/network-scripts</ind:path>
- <ind:filename operation="pattern
match">ifcfg-.*</ind:filename>
- <ind:pattern operation="pattern
match">^IPV6INIT=no$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml
b/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml
deleted file mode 100644
index fdca860..0000000
--- a/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <definition class="compliance" id="accounts_nologin_for_system"
version="1">
- <metadata>
- <title>Block Shell and Login Access for Non-Root System
Accounts</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Login access to non-root system accounts should be
disabled.</description>
- </metadata>
- <criteria>
- <criterion comment="check /etc/passwd for /sbin/nologin on non root system
accounts" test_ref="test_accounts_nologin_for_system" />
- </criteria>
- </definition>
- <unix:password_test check="none satisfy"
id="test_accounts_nologin_for_system" comment="no system user unauthorized
shell" version="1">
- <unix:object object_ref="object_accounts_nologin_for_system" />
- <unix:state state_ref="state_sys_user_unauth_shell" />
- </unix:password_test>
- <unix:password_object id="object_accounts_nologin_for_system"
version="1">
- <unix:username operation="not equal">root</unix:username>
- </unix:password_object>
- <unix:password_state id="state_sys_user_unauth_shell"
version="1" operator="AND">
- <unix:user_id datatype="int" operation="less
than">500</unix:user_id>
- <unix:login_shell datatype="string" operation="not
equal">/sbin/nologin</unix:login_shell>
- </unix:password_state>
-</def-group>
diff --git a/RHEL6/input/checks/package_cronie-anacron_removed.xml
b/RHEL6/input/checks/package_cronie-anacron_removed.xml
deleted file mode 100644
index 2e5b859..0000000
--- a/RHEL6/input/checks/package_cronie-anacron_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
- <definition class="compliance"
id="package_cronie-anacron_removed"
- version="1">
- <metadata>
- <title>Package cronie-anacron Removed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package cronie-anacron should be
removed.</description>
- </metadata>
- <criteria>
- <criterion comment="package cronie-anacron is removed"
- test_ref="test_package_cronie-anacron_removed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="none_exist"
- id="test_package_cronie-anacron_removed" version="1"
- comment="package cronie-anacron is removed">
- <linux:object object_ref="obj_package_cronie-anacron_removed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_cronie-anacron_removed"
version="1">
- <linux:name>cronie-anacron</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_isdn4k-utils_removed.xml
b/RHEL6/input/checks/package_isdn4k-utils_removed.xml
deleted file mode 100644
index 1170306..0000000
--- a/RHEL6/input/checks/package_isdn4k-utils_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
- <definition class="compliance"
id="package_isdn4k-utils_removed"
- version="1">
- <metadata>
- <title>Package isdn4k-utils Removed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package isdn4k-utils should be
removed.</description>
- </metadata>
- <criteria>
- <criterion comment="package isdn4k-utils is removed"
- test_ref="test_package_isdn4k-utils_removed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="none_exist"
- id="test_package_isdn4k-utils_removed" version="1"
- comment="package isdn4k-utils is removed">
- <linux:object object_ref="obj_package_isdn4k-utils_removed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_isdn4k-utils_removed"
version="1">
- <linux:name>isdn4k-utils</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_ntpdate_installed.xml
b/RHEL6/input/checks/package_ntpdate_installed.xml
deleted file mode 100644
index 6c7d0fc..0000000
--- a/RHEL6/input/checks/package_ntpdate_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_ntpdate_installed"
- version="1">
- <metadata>
- <title>Package ntpdate Installed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package ntpdate should be
installed.</description>
- </metadata>
- <criteria>
- <criterion comment="package ntpdate is installed"
- test_ref="test_package_ntpdate_installed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="all_exist"
- id="test_package_ntpdate_installed" version="1"
- comment="package ntpdate is installed">
- <linux:object object_ref="obj_package_ntpdate_installed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_ntpdate_installed"
version="1">
- <linux:name>ntpdate</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/service_isdn_disabled.xml
b/RHEL6/input/checks/service_isdn_disabled.xml
deleted file mode 100644
index ff01e72..0000000
--- a/RHEL6/input/checks/service_isdn_disabled.xml
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. -->
- <definition class="compliance" id="service_isdn_disabled"
- version="1">
- <metadata>
- <title>Service isdn Disabled</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The isdn service should be disabled if
possible.</description>
- </metadata>
- <criteria comment="package isdn4k-utils removed or service isdn is not
configured to start" operator="OR">
- <extend_definition comment="isdn4k-utils removed"
definition_ref="package_isdn4k-utils_removed" />
- <criteria operator="AND" comment="service isdn is not configured to
start">
- <criterion comment="isdn runlevel 0"
test_ref="test_runlevel0_isdn" />
- <criterion comment="isdn runlevel 1"
test_ref="test_runlevel1_isdn" />
- <criterion comment="isdn runlevel 2"
test_ref="test_runlevel2_isdn" />
- <criterion comment="isdn runlevel 3"
test_ref="test_runlevel3_isdn" />
- <criterion comment="isdn runlevel 4"
test_ref="test_runlevel4_isdn" />
- <criterion comment="isdn runlevel 5"
test_ref="test_runlevel5_isdn" />
- <criterion comment="isdn runlevel 6"
test_ref="test_runlevel6_isdn" />
- </criteria>
- </criteria>
- </definition>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel0_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel0_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel1_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel1_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel2_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel2_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel3_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel3_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel4_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel4_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel5_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel5_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel6_isdn"
- version="2">
- <unix:object object_ref="obj_runlevel6_isdn" />
- <unix:state state_ref="state_service_isdn_off" />
- </unix:runlevel_test>
- <unix:runlevel_object id="obj_runlevel0_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">0</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel1_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">1</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel2_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">2</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel3_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">3</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel4_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">4</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel5_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">5</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel6_isdn" version="1">
- <unix:service_name>isdn</unix:service_name>
- <unix:runlevel operation="equals">6</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_state comment="not configured to start"
id="state_service_isdn_off" version="1">
- <unix:start datatype="boolean">false</unix:start>
- <unix:kill datatype="boolean">true</unix:kill>
- </unix:runlevel_state>
-</def-group>
diff --git a/RHEL6/input/checks/service_mcstrans_disabled.xml
b/RHEL6/input/checks/service_mcstrans_disabled.xml
deleted file mode 100644
index 65a90d2..0000000
--- a/RHEL6/input/checks/service_mcstrans_disabled.xml
+++ /dev/null
@@ -1,96 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. -->
- <definition class="compliance" id="service_mcstrans_disabled"
- version="1">
- <metadata>
- <title>Service mcstrans Disabled</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The mcstrans service should be disabled if
possible.</description>
- </metadata>
- <criteria operator="AND" comment="service mcstrans is not
configured to start">
- <criterion comment="mcstrans runlevel 0"
test_ref="test_runlevel0_mcstrans" />
- <criterion comment="mcstrans runlevel 1"
test_ref="test_runlevel1_mcstrans" />
- <criterion comment="mcstrans runlevel 2"
test_ref="test_runlevel2_mcstrans" />
- <criterion comment="mcstrans runlevel 3"
test_ref="test_runlevel3_mcstrans" />
- <criterion comment="mcstrans runlevel 4"
test_ref="test_runlevel4_mcstrans" />
- <criterion comment="mcstrans runlevel 5"
test_ref="test_runlevel5_mcstrans" />
- <criterion comment="mcstrans runlevel 6"
test_ref="test_runlevel6_mcstrans" />
- </criteria>
- </definition>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel0_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel0_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel1_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel1_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel2_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel2_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel3_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel3_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel4_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel4_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel5_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel5_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel6_mcstrans"
- version="2">
- <unix:object object_ref="obj_runlevel6_mcstrans" />
- <unix:state state_ref="state_service_mcstrans_off" />
- </unix:runlevel_test>
- <unix:runlevel_object id="obj_runlevel0_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">0</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel1_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">1</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel2_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">2</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel3_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">3</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel4_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">4</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel5_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">5</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel6_mcstrans"
version="1">
- <unix:service_name>mcstrans</unix:service_name>
- <unix:runlevel operation="equals">6</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_state comment="not configured to start"
id="state_service_mcstrans_off" version="1">
- <unix:start datatype="boolean">false</unix:start>
- <unix:kill datatype="boolean">true</unix:kill>
- </unix:runlevel_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml
b/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml
deleted file mode 100644
index d75bd00..0000000
--- a/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="sysconfig_ipv6_autoconf" version="1">
- <metadata>
- <title>Disable Automatic Configuration</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Accepting redirects from IPv6 routers should be
- disabled as appropriate for all network interfaces. (and
- dependencies are met)</description>
- </metadata>
- <criteria comment="Either IPv6 kernel module is not loaded or this feature
should be disabled"
- operator="OR">
- <extend_definition comment="Automatic loading of the IPv6 kernel module
should be disabled"
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="Unknown test stub"
- test_ref="test_43130" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="at_least_one_exists" comment="TODO::INSERT"
- id="test_43130" version="1">
- <ind:object object_ref="obj_43130" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="TODO::INSERT"
- id="obj_43130" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>network</ind:filename>
- <ind:pattern operation="pattern
match">^IPV6_AUTOCONF=no$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_removed.csv
b/RHEL6/input/checks/templates/packages_removed.csv
index 9f95f6b..7a0f878 100644
--- a/RHEL6/input/checks/templates/packages_removed.csv
+++ b/RHEL6/input/checks/templates/packages_removed.csv
@@ -4,7 +4,6 @@ autofs
bind
certmonger
cpuspeed
-cronie-anacron
cups
cyrus-sasl
dbus
@@ -14,7 +13,6 @@ dovecot
hal
httpd
iputils
-isdn4k-utils
kexec-tools
libcgroup
mdadm
@@ -35,7 +33,6 @@ samba
sendmail
smartmontools
squid
-sssd
subscription-manager
sysstat
talk
diff --git a/RHEL6/input/checks/templates/services_disabled.csv
b/RHEL6/input/checks/templates/services_disabled.csv
index 57f6c71..642dd8c 100644
--- a/RHEL6/input/checks/templates/services_disabled.csv
+++ b/RHEL6/input/checks/templates/services_disabled.csv
@@ -13,9 +13,7 @@ dhcpd,dhcp
dovecot,dovecot
haldaemon,hal
httpd,httpd
-isdn,isdn4k-utils
kdump,kexec-tools
-mcstrans,
mdmonitor,mdadm
messagebus,dbus
named,bind
--
1.7.1