--- RHEL6/input/system/accounts/physical.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index db67bf0..2ae7d4e 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -88,7 +88,7 @@ value of <b>password-hash</b>): </description> <ocil clause="it does not"> To verify the boot loader password has been set and encrypted, run the following command: -<pre># grep password /etc/grub.conf/</pre> +<pre># grep password /etc/grub.conf</pre> The output should show the following: <pre>password --encrypted <b>password-hash</b></pre> </ocil>
--- RHEL6/transforms/shorthand2xccdf.xslt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index d2d7b30..3d4042d 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -238,7 +238,7 @@ exclude-result-prefixes="xccdf xhtml dc"> <xsl:template match="sysctl-desc-macro"> To set the runtime status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter, run the following command: - <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of select="@sysctl"/> <xsl:value-of select="@value"/></xhtml:pre> + <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of select="@sysctl"/>=<xsl:value-of select="@value"/></xhtml:pre>
<!-- The following text could also be included conditionally, if the defaultness of the sysctl were indicated. --> If this is not the system's default value, add the following line to xhtml:code/etc/sysctl.conf</xhtml:code>:
--- RHEL6/input/system/network/iptables.xml | 1 + 1 file changed, 1 insertion(+)
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml index 2f94450..3088001 100644 --- a/RHEL6/input/system/network/iptables.xml +++ b/RHEL6/input/system/network/iptables.xml @@ -122,6 +122,7 @@ add or correct the following line in </description> <ocil clause="the default policy for the INPUT chain isn't set to DROP">Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine the default policy for the INPUT chain. It should be set to DROP. +<tt> # grep ":INPUT" /etc/sysconfig/iptables</tt> </ocil> <rationale>In <tt>iptables</tt> the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the
--- RHEL6/input/system/logging.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml index c5a0ddb..1e0643a 100644 --- a/RHEL6/input/system/logging.xml +++ b/RHEL6/input/system/logging.xml @@ -187,8 +187,8 @@ To see the permissions of a given log file, run the following command: The permissions should be 600, or more restrictive. </ocil> <rationale>Log files can contain valuable information regarding system -configuratation. If the system log files are not protected unauthorized -users could change the logged data, eliminaating their foresive value. +configuration. If the system log files are not protected unauthorized +users could change the logged data, eliminating their forensic value. </rationale> <ident cce="18095-0" /> <oval id="rsyslog_files_permissions" />
--- RHEL6/input/system/auditing.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index d10fb78..5698ecd 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -243,7 +243,7 @@ determine how many logs the system is configured to retain after rotation: <pre>num_logs = 5</pre> </ocil> <rationale>The total storage for audit log files must be large enough to retain -log information over the period required. This is a function of the maxium log +log information over the period required. This is a function of the maximum log file size and the number of logs retained.</rationale> <oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" /> <tested by="DS" on="20121024"/> @@ -266,7 +266,7 @@ determine how much data the system will retain in each audit log file: <pre>max_log_file = 6</pre> </ocil> <rationale>The total storage for audit log files must be large enough to retain -log information over the period required. This is a function of the maxium +log information over the period required. This is a function of the maximum log file size and the number of logs retained.</rationale> <oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" /> <tested by="DS" on="20121024"/>
--- RHEL6/input/system/auditing.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 5698ecd..9df97af 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -460,7 +460,7 @@ editing as needed, the new rules can be activated as follows: <Group id="audit_time_rules"> <title>Records Events that Modify Date and Time Information</title> <description>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time. All changes to the system time should be audited.</description>
@@ -483,7 +483,7 @@ desired, but is not required. See an example of multiple combined syscalls: <audit-syscall-check-macro syscall="adjtimex" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -511,7 +511,7 @@ desired, but is not required. See an example of multiple combined syscalls: <audit-syscall-check-macro syscall="settimeofday" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -537,7 +537,7 @@ See an example of multiple combined syscalls: <audit-syscall-check-macro syscall="stime" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -565,7 +565,7 @@ desired, but is not required. See an example of multiple combined syscalls: <audit-syscall-check-macro syscall="clock_settime" /> </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" /> @@ -590,7 +590,7 @@ command: If the system is configured to audit this activity, it will return a line. </ocil> <rationale>Arbitrary changes to the system time can be used to obfuscate -nefarious activites in log files as well as to confuse network services that +nefarious activities in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale> <ident cce="14051-7" />
--- RHEL6/input/system/auditing.xml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9df97af..900fcc2 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -738,7 +738,7 @@ arch=b32 replaced with arch=b64 as follows: <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of -abuse amoung both authorized and unauthorized users.</rationale> +abuse among both authorized and unauthorized users.</rationale>
<Rule id="audit_rules_dac_modification_chmod"> <title>Record Events that Modify the System's Discretionary Access Controls - chmod</title> @@ -753,7 +753,7 @@ If the system is 64 bit then also add the following: </description> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <ocil clause="the system isn't configured to audit permission changes"> <audit-syscall-check-macro syscall="fchmod" /> @@ -784,7 +784,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -812,7 +812,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -840,7 +840,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -868,7 +868,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -896,7 +896,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -924,7 +924,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -952,7 +952,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -980,7 +980,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -1008,7 +1008,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -1036,7 +1036,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -1064,7 +1064,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls @@ -1092,7 +1092,7 @@ If the system is 64 bit then also add the following: </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and +can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 900fcc2..d85672d 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -695,7 +695,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio <ocil clause="the system isn't configured to audit attempts to change the MAC policy"> To determine if the system is configured to audit changes to its SELinux configuration files, run the following command: -<pre># auditctl -l | grep "dir=selinux"</pre> +<pre># auditctl -l | grep "dir=/etc/selinux"</pre> If the system is configured to watch for changes to its SELinux configuration, a line should be returned (including <tt>perm=wa</tt> indicating permissions that are watched).
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index d85672d..64507a4 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -756,7 +756,7 @@ gain access to information that would otherwise be disallowed. Auditing DAC modi can facilitate the identification of patterns of abuse among both authorized and unauthorized users.</rationale> <ocil clause="the system isn't configured to audit permission changes"> -<audit-syscall-check-macro syscall="fchmod" /> +<audit-syscall-check-macro syscall="chmod" /> </ocil> <warning category="general">Note that these rules can be configured in a number of ways while still acheiving the desired effect. Here the system calls
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 64507a4..73a9233 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -780,7 +780,7 @@ If the system is 64 bit then also add the following: -k perm_mod</pre> </description> <ocil> -<audit-syscall-check-macro syscall="fchmod" /> +<audit-syscall-check-macro syscall="chown" /> </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications
--- RHEL6/input/system/auditing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 73a9233..5f35e28 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -976,7 +976,7 @@ If the system is 64 bit then also add the following: -k perm_mod</pre> </description> <ocil> -<audit-syscall-check-macro syscall="fchmod" /> +<audit-syscall-check-macro syscall="lchown" /> </ocil> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications
--- RHEL6/input/services/cron.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml index fce85bf..cccb8ea 100644 --- a/RHEL6/input/services/cron.xml +++ b/RHEL6/input/services/cron.xml @@ -115,9 +115,9 @@ access to these files should be disabled.</description> <Rule id="disable_at"> <title>Disable atd Service</title> <description> -<service-disable-macro service="at" /> +<service-disable-macro service="atd" /> </description> -<ocil><service-disable-check-macro service="at" /></ocil> +<ocil><service-disable-check-macro service="atd" /></ocil> <rationale> Many of the periodic or delayed execution features of the at daemon can be provided through the cron daemon instead.
--- RHEL6/input/services/ssh.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index ef91508..e64eddc 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -178,19 +178,19 @@ to compromises on another.
<Rule id="sshd_set_keepalive"> <title>Set SSH Client Alive Count</title> -<description>To ensure that the SSH idle timeout occurs precisely when the <tt>ClientAliveInterval</tt> is set, +<description>To ensure that the SSH idle timeout occurs precisely when the <tt>ClientAliveCountMax</tt> is set, edit <tt>/etc/ssh/sshd_config</tt> as follows: <pre>ClientAliveCountMax 0</pre> </description> <ocil clause="it is not"> -To ensure the SSH idle timeout will occur when the <tt>ClientAliveInterval</tt> is set, run the following command: +To ensure the SSH idle timeout will occur when the <tt>ClientAliveCountMax</tt> is set, run the following command: <pre># grep ClientAliveCountMax /etc/ssh/sshd_config</pre> If properly configured, output should be: <pre>ClientAliveCountMax 0</pre> </ocil> <rationale> -This ensures that a user login will be terminated as soon as the <tt>ClientAliveInterval</tt> +This ensures that a user login will be terminated as soon as the <tt>ClientAliveCountMax</tt> is reached. </rationale> <ident cce="14061-6" />
--- RHEL6/input/services/ldap.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml index f502bba..32ee060 100644 --- a/RHEL6/input/services/ldap.xml +++ b/RHEL6/input/services/ldap.xml @@ -61,7 +61,7 @@ To ensure TLS is configured with trust certificates, run the following command: <pre># grep cert /etc/pam_ldap.conf</pre> </ocil> <rationale>The tls_cacertdir or tls_cacertfile directives are required when -tls_cheekpeer is configured (which is the default for openldap versions 2.1 and +tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA.</rationale> <ref disa="776,778,1453" />
--- RHEL6/input/services/base.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml index ce8d72f..23aeced 100644 --- a/RHEL6/input/services/base.xml +++ b/RHEL6/input/services/base.xml @@ -18,7 +18,7 @@ system such as RHTSupport. </description> <ocil><service-disable-check-macro service="abrtd" /></ocil> <rationale> Mishandling crash data could expose sensitive information about -vulnerablities in software executing on the local machine, as well as sensitive +vulnerabilities in software executing on the local machine, as well as sensitive information from within a process's address space or registers.</rationale> <ident cce="TODO" /> <oval id="service_abrtd_disabled" />
--- RHEL6/input/system/accounts/restrictions/account_expiration.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/account_expiration.xml b/RHEL6/input/system/accounts/restrictions/account_expiration.xml index 1634aa2..f0a1d5b 100644 --- a/RHEL6/input/system/accounts/restrictions/account_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/account_expiration.xml @@ -11,7 +11,7 @@ run the following command, substituting <tt><i>NUM_DAYS</i></tt> and <tt><i>USER <pre># chage -I <i>NUM_DAYS USER</i></pre> Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the <tt>-E</tt> option. -The file <tt>/etc/defaults/useradd</tt> controls +The file <tt>/etc/default/useradd</tt> controls default settings for all newly-created accounts created with the system's normal command line utilities. </description> @@ -32,7 +32,7 @@ normal command line utilities. <title>Set Account Expiration Following Inactivity</title> <description>To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct -the following lines in <tt>/etc/defaults/useradd</tt>, substituting +the following lines in <tt>/etc/default/useradd</tt>, substituting <tt><i>NUM_DAYS</i></tt> appropriately: <pre>INACTIVE=<i>NUM_DAYS</i></pre> A value of 35 is recommended. @@ -47,10 +47,10 @@ the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users. </description> <ocil>To verify the <tt>INACTIVE</tt> setting, run the following command: -<pre>grep "INACTIVE" /etc/defaults/useradd</pre> +<pre>grep "INACTIVE" /etc/default/useradd</pre> The output should indicate the <tt>INACTIVE</tt> configuration option is set to an appropriate integer as shown in the example below: -<pre># grep "INACTIVE" /etc/defaults/useradd +<pre># grep "INACTIVE" /etc/default/useradd INACTIVE=35</pre></ocil> <rationale> Disabling inactive accounts ensures that accounts which may not
--- RHEL6/input/services/obsolete.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 3fe6bf6..00529d3 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -311,10 +311,10 @@ reduces the risk of sharing files which should remain private. </rationale> <ocil>Verify that <tt>tftp</tt> is configured by with the <tt>-s</tt> option by running the following command: -<pre>grep "server_args" /etc/xinetd.d/tftpboot</pre> +<pre>grep "server_args" /etc/xinetd.d/tftp</pre> The output should indicate the <tt>server_args</tt> variable is configured with the <tt>-s</tt> flag, matching the example below: -<pre> # grep "server_args" /etc/xinetd.d/tftpboot +<pre> # grep "server_args" /etc/xinetd.d/tftp server_args = -s /var/lib/tftpboot</pre> </ocil> <ident cce="TODO" />
--- RHEL6/input/services/ftp.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 5f6bd2f..8ca7170 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -77,7 +77,7 @@ and for consistency with future Red Hat releases, the use of vsftpd is recommend </description> <Rule id="ftp_log_transactions"> <title>Enable Logging of All FTP Transactions</title> -<description>Edit the vsftpd configuration file. Add or correct the following configuration options: +<description>Edit the vsftpd configuration file, /etc/vsftpd/vsftpd.conf. Add or correct the following configuration options: <pre>xferlog_enable=YES xferlog_std_format=NO log_ftp_protocol=YES</pre>
On 10/30/12 9:26 PM, Michele Newman wrote:
-<description>Edit the vsftpd configuration file. Add or correct the following configuration options: +<description>Edit the vsftpd configuration file, /etc/vsftpd/vsftpd.conf. Add or correct the following configuration options:
Add <tt> around the filepatch of the vsftpd
--- RHEL6/input/services/ftp.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 8ca7170..155ee92 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -119,7 +119,7 @@ To verify this configuration, run the following command: <pre>grep "banner_file" /etc/vsftpd/vsftpd.conf</pre>
The output should show the value of <tt>banner_file</tt> is set to <tt>/etc/issue</tt>, an example of which is shown below: -<pre># grep "banner_file" /etc/issue +<pre># grep "banner_file" /etc/vsftpd/vsftpd.conf banner_file=/etc/issue"</pre> </ocil> </Rule>
--- RHEL6/input/services/ftp.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 155ee92..9f28bf2 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -120,7 +120,7 @@ To verify this configuration, run the following command:
The output should show the value of <tt>banner_file</tt> is set to <tt>/etc/issue</tt>, an example of which is shown below: <pre># grep "banner_file" /etc/vsftpd/vsftpd.conf -banner_file=/etc/issue"</pre> +banner_file=/etc/issue</pre> </ocil> </Rule>
On 10/30/12 9:26 PM, Michele Newman wrote:
RHEL6/input/system/accounts/physical.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index db67bf0..2ae7d4e 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -88,7 +88,7 @@ value of <b>password-hash</b>):
</description> <ocil clause="it does not"> To verify the boot loader password has been set and encrypted, run the following command: -<pre># grep password /etc/grub.conf/</pre> +<pre># grep password /etc/grub.conf</pre> The output should show the following: <pre>password --encrypted <b>password-hash</b></pre> </ocil>
Ack to the set, with the slight modification of patch 18/20
scap-security-guide@lists.fedorahosted.org