________________________________________
From 0620e2436f830a57017414a21bffaf23ba2fbb2d Mon Sep 17 00:00:00
2001
From: Shawn Wells <shawn@redhat.com><mailto:shawn@redhat.com>
Date: Mon, 16 Jul 2012 02:13:41 -0400
Subject: [PATCH] Swapped bogus_error_messages for bogus_error_responses
https://fedorahosted.org/pipermail/scap-security-guide/2012-July/001092.html
---
...l_net_ipv4_icmp_ignore_bogus_error_messages.xml | 39 --------------------
>RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/system/network/kernel.xml | 2 +-
3 files changed, 2 insertions(+), 41 deletions(-)
delete mode 100644
RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
diff --git
a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
>b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
deleted file mode 100644
index b15444b..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
version="1">
- <metadata>
- <title>Network Parameters for Hosts and Routers</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="CCE-4133-5" source="CCE" />
- <description>Ignoring bogus ICMP responses to broadcasts
- should be enabled or disabled as appropriate.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_20123" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the
^[\s]*net\.ipv4\.icmp_ignore_bogus_error_messages[\s]*=([\s]*) expression in the
/etc/sysctl.conf file"
- id="test_20123" version="1">
- <ind:object object_ref="obj_20123" />
- <ind:state state_ref="state_20123" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20123"
- version="1">
- <ind:subexpression operation="equals" var_check="all"
- var_ref="var_20123" />
- </ind:textfilecontent54_state>
- <external_variable comment="External variable for definition 20123"
- datatype="string" id="var_20123"
- version="1" />
- <ind:textfilecontent54_object id="obj_20123"
- version="2">
- <ind:path>/etc</ind:path>
- <ind:filename>sysctl.conf</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*net\.ipv4\.icmp_ignore_bogus_error_responses[\s]*=([\s]*)</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 1b188da..b57ee15 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -59,7 +59,7 @@
<select idref="set_sysctl_net_ipv4_conf_default_accept_source_route"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_default_secure_redirects"
selected="true"/>
<select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
selected="true"/>
-<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
+<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
selected="true"/>
<select idref="set_sysctl_net_ipv4_tcp_syncookies"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_all_rp_filter"
selected="true"/>
<select idref="set_sysctl_net_ipv4_conf_default_rp_filter"
selected="true"/>
diff --git a/RHEL6/input/system/network/kernel.xml
b/RHEL6/input/system/network/kernel.xml
index 03be8ec..63bb1f5 100644
--- a/RHEL6/input/system/network/kernel.xml
+++ b/RHEL6/input/system/network/kernel.xml
@@ -293,7 +293,7 @@ addresses makes the system slightly more difficult to enumerate on the
network.
<Rule
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
-<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
+<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses"
value="1" />
</description>
Looks good. I appreciate the proper diagnosis. ACK
-Mike