On 7/16/12 12:35 PM, Michael Palmiotto wrote:
---
RHEL6/input/profiles/common.xml | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 1b188da..5a97392 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -59,7 +59,9 @@
<select idref="set_sysctl_net_ipv4_conf_default_accept_source_route"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_default_secure_redirects"
selected="true"/>
<select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
selected="true"/>
-<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
+<!-- Check not referenced in any Rule
+ <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
+-->
<select idref="set_sysctl_net_ipv4_tcp_syncookies"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_all_rp_filter"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_default_rp_filter"
selected="true"/>
@@ -223,7 +225,9 @@ these should likely be moved out of common.
<!-- net.ipv4.conf.default.secure_redirects -->
<refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"
selector="enabled"/>
<!-- net.ipv4.icmp_echo_ignore_broadcast -->
-<refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/>
+<!-- Value not referenced in any Rules
+ <refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/>
+-->
<!-- net.ipv4.icmp_ignore_bogus_error_messages -->
<refine-value idref="sysctl_net_ipv4_tcp_syncookies_value"
selector="enabled"/>
<!-- net.ipv4.tcp_syncookie -->
It's called out on
scap-security-guide/RHEL6/input/system/network/kernel.xml:295
<Rule
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses"
value="1" />
</description>
<rationale>Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</rationale>
<ident cce="4133-5" />
<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
</Rule>
It's then called out in the "common" XCCDF profile
scap-security-guide/RHEL6/input/profiles/common.xml via....
selection at scap-security-guide/RHEL6/input/profiles/common.xml:62
<select
idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
and refinement at scap-security-guide/RHEL6/input/profiles/common.xml:226
<refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/>
Unless I'm missing something (it happens...), nack