Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/services/base.xml | 11 +++++++++++
RHEL6/input/services/cron.xml | 2 ++
RHEL6/input/services/dhcp.xml | 3 +++
RHEL6/input/services/ldap.xml | 3 +++
RHEL6/input/services/mail.xml | 3 +++
RHEL6/input/services/ntp.xml | 2 ++
RHEL6/input/services/ssh.xml | 10 ++++++++++
RHEL6/input/system/accounts/pam.xml | 9 +++++++++
RHEL6/input/system/accounts/physical.xml | 2 ++
.../accounts/restrictions/password_storage.xml | 3 +++
.../system/accounts/restrictions/root_logins.xml | 5 +++++
RHEL6/input/system/auditing.xml | 13 ++++++++++++-
RHEL6/input/system/logging.xml | 5 +++++
RHEL6/input/system/network/iptables.xml | 2 ++
RHEL6/input/system/network/ipv6.xml | 2 ++
RHEL6/input/system/network/kernel.xml | 15 +++++++++++++++
RHEL6/input/system/network/uncommon.xml | 4 ++++
RHEL6/input/system/permissions/execution.xml | 2 ++
RHEL6/input/system/selinux.xml | 5 ++++-
RHEL6/input/system/software/integrity.xml | 1 +
20 files changed, 100 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index d3e32a6..bda8350 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -273,6 +273,7 @@ available in the ntpd program and should be considered
deprecated.</rationale>
<ident cce="TODO" />
<!--<oval id="service_ntpdate_disabled" /> -->
<ref nist="AU-8, CM-6" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="service_oddjobd_disabled">
@@ -291,6 +292,7 @@ been a source of privilege escalation security
issues.</rationale>
<ident cce="TODO" />
<oval id="service_oddjobd_disabled" />
<ref nist="AC-6, CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -308,6 +310,7 @@ disabled if not needed.</rationale>
<ident cce="TODO" />
<oval id="service_portreserve_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -327,6 +330,7 @@ records.</rationale>
<ident cce="TODO" />
<oval id="service_psacct_enabled" />
<ref nist="AU-12, CM-6" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="service_qpidd_disabled">
@@ -366,6 +370,7 @@ service.</rationale>
<ident cce="TODO" />
<oval id="service_quota_nld_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -385,6 +390,7 @@ dynamic network configuration information.</rationale>
<ident cce="TODO" />
<oval id="service_rdisc_disabled" />
<ref nist="AC-4, CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -403,6 +409,7 @@ desirable for some environments.</rationale>
<ident cce="3416-5" />
<oval id="service_rhnsd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -422,6 +429,7 @@ unnecessary and can be disabled.</rationale>
<ident cce="TODO" />
<oval id="service_rhsmcertd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -442,6 +450,7 @@ consulted, it is not necessary and should be
disabled.</rationale>
<ident cce="TODO" />
<oval id="service_saslauthd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -460,6 +469,7 @@ disabled.</rationale>
<ident cce="3455-3" />
<oval id="service_smartd_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
<!--
@@ -498,6 +508,7 @@ operation, but unless used this service can be
disabled.</rationale>
<ident cce="TODO" />
<oval id="service_sysstat_disabled" />
<ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
</Rule>
<!--
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index da724e6..750f419 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -20,6 +20,7 @@ enabling the cron daemon is essential.
<ident cce="4324-0" />
<oval id="service_crond_enabled" />
<ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -124,6 +125,7 @@ daemon can be provided through the cron daemon instead.
<ident cce="14466-7" />
<oval id="service_atd_disabled" />
<ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
</Rule>
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 991cf7d..64b6778 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -48,6 +48,7 @@ DHCP server if there is one.
<ident cce="4336-4" />
<oval id="service_dhcpd_disabled" />
<ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="uninstall_dhcp_server">
@@ -64,6 +65,7 @@ accidentally reactivated and disrupt network operation.
<ident cce="4464-4" />
<oval id="package_dhcpd_removed" />
<ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group> <!-- <Group id="disabling_dhcp_server"> -->
@@ -230,6 +232,7 @@ unacceptable burden in many circumstances.</rationale>
<ident cce="4191-3" />
<oval id="sysconfig_networking_bootproto_ifcfg" />
<ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group> <!-- <Group id="disabling_dhcp_client"> -->
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 1ed2b6f..bdf9f0f 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -42,6 +42,7 @@ than doing LDAP over SSL.</rationale>
<ref disa="776,778,1453" />
<ident cce="14894-0" />
<oval id="ldap_client_start_tls" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="ldap_client_tls_cacertpath">
@@ -66,6 +67,7 @@ site CA.</rationale>
<ref disa="776,778,1453" />
<ident cce="14894-0" />
<oval id="ldap_client_tls_cacertpath" />
+<tested by="DS" on="20121024"/>
</Rule>
</Group><!--End <Group id="openldap_client"> -->
@@ -100,6 +102,7 @@ The output should show:
<ident cce="3501-4" />
<oval id="package_openldap-servers_removed" />
<ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="ldap_server_config_olcsuffix">
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index 2176cfd..3eeaedd 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -39,6 +39,7 @@ notification tasks.
<ident cce="14068-1" />
<oval id="service_postfix_enabled" />
<ref nist="CM-6" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="package_sendmail_removed">
@@ -55,6 +56,7 @@ its design prevents it from being effectively contained by SELinux.
Postfix
should be used instead.
</rationale>
<ref nist="CM-6" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -85,6 +87,7 @@ and not from the network, which protects it from network attack.
<ident cce="15018-5" />
<oval id="postfix_network_listening_disabled" />
<ref nist="CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group><!--End <Group id="postfix_client"> -->
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index 896ce33..85de73e 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -48,6 +48,7 @@ logs and auditing possible security breaches.</rationale>
<ident cce="4376-0" />
<oval id="service_ntpd_enabled" />
<ref disa="160" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="ntpd_specify_remote_server">
@@ -74,6 +75,7 @@ recommended.</rationale>
<ident cce="4385-1" />
<oval id="ntp_remote_server" />
<ref disa="160" />
+<tested by="DS" on="20121024"/>
</Rule>
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index ea94c4d..fada9fd 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -29,6 +29,7 @@ remote access.
</description>
<ident cce="4268-9" />
<oval id="service_sshd_disabled" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="ssh_server_iptables_exception">
@@ -82,6 +83,7 @@ should not be used.
<ident cce="4325-7" />
<oval id="sshd_protocol_2" />
<ref disa="776,774,1135,1436" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="sshd_limit_user_access">
@@ -170,6 +172,7 @@ to compromises on another.
<ident cce="3845-5" />
<oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
<ref disa="879,1133"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -193,6 +196,7 @@ is reached.
<ident cce="14061-6" />
<oval id="sshd_clientalivecountmax" />
<ref disa="879,1133"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -241,6 +245,7 @@ can allow an attacker to move trivially to other hosts.
<ident cce="4370-3" />
<oval id="sshd_hostbasedauthentication" />
<ref disa="765,766"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -262,6 +267,7 @@ and also allows direct attack attempts on root's password.
<ident cce="4387-7" />
<oval id="sshd_permitrootlogin_no" />
<ref disa="770" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -284,6 +290,7 @@ even in the event of misconfiguration elsewhere.
<ident cce="3660-8" />
<oval id="sshd_permitemptypasswords_no" />
<ref disa="765,766"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="sshd_enable_warning_banner">
@@ -307,6 +314,7 @@ should ensure usage of a banner that does not provide easy
attribution.
<ident cce="4431-3" />
<oval id="sshd_banner_set" />
<ref disa="48" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -330,6 +338,7 @@ access restriction in some configurations.
<ident cce="4422-2" />
<oval id="sshd_no_user_envset" />
<ref disa="1414" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="sshd_use_approved_ciphers">
@@ -359,6 +368,7 @@ implementation. These are also required for compliance.
<ident cce="14491-5" />
<oval id="sshd_use_approved_ciphers" />
<ref disa="803,1144,1145,1146,196" />
+<tested by="DS" on="20121024"/>
</Rule>
<Group id="sshd_strengthen_firewall">
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 64b6045..356a622 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -199,6 +199,7 @@ is different from account lockout, which is provided by the
pam_faillock module.
<ident cce="15054-0" />
<oval id="accounts_password_pam_cracklib_retry"
value="var_password_pam_cracklib_retry"/>
<ref nist="IA-5" disa="1092" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="password_require_3consecrepeat">
@@ -241,6 +242,7 @@ search space.
<ident cce="14113-5" />
<oval id="accounts_password_pam_cracklib_dcredit"
value="var_password_pam_cracklib_dcredit"/>
<ref nist="IA-5,194" disa="194"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="password_require_uppercases">
@@ -265,6 +267,7 @@ more difficult by ensuring a larger search space.
<ident cce="14672-0" />
<oval id="accounts_password_pam_cracklib_ucredit"
value="var_password_pam_cracklib_ucredit"/>
<ref nist="IA-5" disa="192" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="password_require_specials">
@@ -289,6 +292,7 @@ more difficult by ensuring a larger search space.
<ident cce="14122-6" />
<oval id="accounts_password_pam_cracklib_ocredit"
value="var_password_pam_cracklib_ocredit"/>
<ref nist="IA-5" disa="1619" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="password_require_lowercases">
@@ -313,6 +317,7 @@ more difficult by ensuring a larger search space.
<ident cce="14712-4" />
<oval id="accounts_password_pam_cracklib_lcredit"
value="var_password_pam_cracklib_lcredit"/>
<ref nist="IA-5" disa="193" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="password_require_diffchars">
@@ -338,6 +343,7 @@ Note that passwords which are changed on compromised systems will
still be compr
<ident cce="14701-7" />
<oval id="accounts_password_pam_cracklib_difok"
value="var_password_pam_cracklib_difok"/>
<ref nist="IA-5" disa="195"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
</Group>
@@ -406,6 +412,7 @@ Preventing re-use of previous passwords helps ensure that a
compromised password
<ident cce="14939-3" />
<oval id="accounts_password_reuse_limit"
value="password_history_retain_number" />
<ref nist="IA-5" disa="200" />
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
@@ -438,6 +445,7 @@ Using a stronger hashing algorithm makes password cracking attacks
more difficul
<!-- <ident cce="14063-2" /> -->
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ref nist="IA-5" disa="803"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_password_hashing_algorithm_logindefs">
@@ -457,6 +465,7 @@ Using a stronger hashing algorithm makes password cracking attacks
more difficul
<!-- <ident cce="14063-2" /> -->
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ref nist="IA-5" disa="803"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_password_hashing_algorithm_libuserconf">
diff --git a/RHEL6/input/system/accounts/physical.xml
b/RHEL6/input/system/accounts/physical.xml
index b331bbb..60edd6d 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -128,6 +128,7 @@ by configuring the bootloader password.
<ident cce="4241-6" />
<oval id="singleuser_password" />
<ref nist="AC-6, IA-5" disa="213" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="disable_ctrlaltdel_reboot">
@@ -185,6 +186,7 @@ services, weakening system security.
<ident cce="4245-7" />
<oval id="interactive_boot_disable" />
<ref nist="CM-7, IA-4, SC-2" disa="213"/>
+<tested by="DS" on="20121024"/>
</Rule>
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml
b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index a4db5f7..6e295d8 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -39,6 +39,7 @@ environments.
<ident cce="4238-2" />
<oval id="accounts_pam_no_nullok" />
<ref nist="AC-3, CM-6, IA-5" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="no_hashes_outside_shadow">
@@ -64,6 +65,7 @@ which is readable by all users.
<ident cce="14300-8" />
<oval id="accounts_password_all_shadowed" />
<ref nist="IA-5" disa="201" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="gid_passwd_group_same">
@@ -81,6 +83,7 @@ There should be no output.
Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having
unintended rights.
</rationale>
<ref disa="366" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="no_netrc_files">
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml
b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 516a6ba..9240658 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -61,6 +61,7 @@ using the root account.
<ident cce="3485-0" />
<oval id="securetty_root_login_console_only" />
<ref nist="CM-6, CM-7" disa="770" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="restrict_serial_port_logins">
@@ -85,6 +86,7 @@ using the root account.
<ident cce="4256-4" />
<oval id="securetty_no_serial" />
<ref nist="AC-3, AC-6" disa="770" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -142,6 +144,7 @@ become inaccessible.
<ident cce="3987-5" />
<oval id="accounts_nologin_for_system" />
<ref nist="AC-3, CM-6" disa="178" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -167,6 +170,7 @@ access to root privileges in an accountable manner.
<ident cce="4009-7" />
<oval id="accounts_no_uid_except_zero" />
<ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="root_path_default">
@@ -190,6 +194,7 @@ The root account's executable search path must be the vendor
default, and must
contain only absolute paths.
</rationale>
<ref disa="366" />
+<tested by="DS" on="20121024"/>
</Rule>
<!--
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 2a50c46..20e15dd 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -95,6 +95,7 @@ actions will be taken if other obstacles exist.
<ident cce="4292-9" />
<oval id="service_auditd_enabled" />
<ref nist="CM-6, CM-7"
disa="169,172,174,1353,1462,1487,1115,1454,067,158,831,1123,1190,1312,1263,130"
/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="enable_auditd_bootloader">
@@ -245,6 +246,7 @@ determine how many logs the system is configured to retain after
rotation:
log information over the period required. This is a function of the maxium log
file size and the number of logs retained.</rationale>
<oval id="auditd_data_retention_num_logs"
value="var_auditd_num_logs" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -267,6 +269,7 @@ determine how much data the system will retain in each audit log
file:
log information over the period required. This is a function of the maxium
log file size and the number of logs retained.</rationale>
<oval id="auditd_data_retention_max_log_file"
value="var_auditd_max_log_file" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -299,6 +302,7 @@ being overwhelmed with log data. However, for systems that must never
discard
log data, or which use external processes to transfer it and reclaim space,
<tt>keep_logs</tt> can be employed.</rationale>
<oval id="auditd_data_retention_max_log_file_action"
value="var_auditd_max_log_file_action" />
+<tested by="DS" on="20121024"/>
</Rule>
<!--
@@ -347,6 +351,7 @@ disk space is starting to run low:
allow them to take corrective action prior to any disruption.</rationale>
<oval id="auditd_data_retention_space_left_action"
value="var_auditd_space_left_action"/>
<ref disa="140,143,144" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -386,6 +391,7 @@ is used, running low on space for audit records should never occur.
</rationale>
<oval id="auditd_data_retention_admin_space_left_action"
value="var_auditd_admin_space_left_action" />
<ref disa="140,143,144,1343" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -663,6 +669,7 @@ If users can write to audit logs, audit trails can be modified or
destroyed.
</rationale>
<oval id="file_permissions_var_log_audit" />
<ref disa="366" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="audit_logs_rootowner">
@@ -677,6 +684,7 @@ If users can write to audit logs, audit trails can be modified or
destroyed.
owner, and unauthorized users, potential access to sensitive
information.</rationale>
<oval id="file_ownership_var_log_audit" />
<ref nist="AU-2" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="audit_mac_changes">
@@ -1164,7 +1172,7 @@ Then, for each setuid program on the system, add a line of the
following form to
in the list:
<pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F
auid>=500 -F auid!=4294967295 -k privileged</pre>
</description>
-<ocil clause="it is the case">
+<ocil clause="it is not the case">
To verify that auditing of privileged command use is configured, run the following
command to find relevant setuid programs:
<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre>
Run the following command to verify entries in the audit rules for all programs found
with the previous command:
@@ -1179,6 +1187,7 @@ unusual activity.
<ident cce="14296-8" />
<oval id="audit_rules_privileged_commands" />
<ref nist="AU-2" disa="40" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="audit_media_exports">
@@ -1200,6 +1209,7 @@ loss.</rationale>
<ident cce="14569-8" />
<oval id="audit_rules_media_export" />
<ref nist="AU-2" disa="126"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="audit_file_deletions">
@@ -1241,6 +1251,7 @@ of what was executed on the system as well as for accountability
purposes.</rati
<ident cce="14824-7" />
<oval id="audit_rules_sysadmin_actions" />
<ref nist="AU-2" disa="126"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="audit_kernel_module_loading">
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index 99cb419..ff1b7a0 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -33,6 +33,7 @@ system logging services.
<ident cce="17742-8" />
<oval id="package_rsyslog_installed" />
<ref nist="AU-2, AU-9, CM-6" disa="1311,1312"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -50,6 +51,7 @@ logging services, which are essential to system administration.
<ident cce="17698-2" />
<oval id="service_rsyslog_enabled" />
<ref nist="AU-12, CM-6" disa="1557,1312,1311" />
+<tested by="DS" on="20121024"/>
</Rule>
@@ -136,6 +138,7 @@ protected from unauthorized access.</rationale>
<ident cce="17857-4" />
<oval id="rsyslog_files_ownership" />
<ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="groupowner_rsyslog_files">
@@ -161,6 +164,7 @@ protected from unauthorized access.</rationale>
<ident cce="18240-2" />
<oval id="rsyslog_files_groupownership" />
<ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -189,6 +193,7 @@ users could change the logged data, eliminaating their foresive
value.
<ident cce="18095-0" />
<oval id="rsyslog_files_permissions" />
<ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
diff --git a/RHEL6/input/system/network/iptables.xml
b/RHEL6/input/system/network/iptables.xml
index bb97a11..2f94450 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -61,6 +61,7 @@ capability for IPv6 and ICMPv6.
<ident cce="4167-3" />
<oval id="service_ip6tables_enabled" />
<ref nist="CM-6, CM-7"
disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="enable_iptables" severity="medium">
@@ -76,6 +77,7 @@ capability for IPv4 and ICMP.
<ident cce="4189-7" />
<oval id="service_iptables_enabled" />
<ref nist="CM-6, CM-7"
disa="66,1115,1118,1092,27,1117,1098,1100,1097,1123,1124,1414" />
+<tested by="DS" on="20121024"/>
</Rule>
</Group><!--<Group id="iptables_activation">-->
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index 2b0b165..cfb90d2 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -46,6 +46,7 @@ the vulnerability to exploitation.
<ident cce="CCE-3562-6" />
<oval id="kernel_module_ipv6_option_disabled" />
<ref nist="CM-6, CM-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="network_ipv6_disable_interfaces">
@@ -60,6 +61,7 @@ prevention mechanism:
<pre>IPV6INIT=no</pre>
</description>
<ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="network_ipv6_disable_rpc">
diff --git a/RHEL6/input/system/network/kernel.xml
b/RHEL6/input/system/network/kernel.xml
index 379bd21..e3b27a3 100644
--- a/RHEL6/input/system/network/kernel.xml
+++ b/RHEL6/input/system/network/kernel.xml
@@ -25,6 +25,7 @@ only appropriate for routers.</rationale>
<ident cce="4151-7" />
<oval id="sysctl_net_ipv4_conf_default_send_redirects" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="disable_sysctl_ipv4_all_send_redirects">
@@ -41,6 +42,7 @@ only appropriate for routers.</rationale>
<ident cce="4155-8" />
<oval id="sysctl_net_ipv4_conf_all_send_redirects" />
<ref nist="CM-6" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="disable_sysctl_ipv4_ip_forward">
@@ -57,6 +59,7 @@ only appropriate for routers.</rationale>
<ident cce="3561-8" />
<oval id="sysctl_net_ipv4_ip_forward" />
<ref nist="AC-3, CM-6, CM-7, SC-5" disa="366"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
@@ -207,6 +210,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<ident cce="4236-6" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="CM-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_accept_redirects">
@@ -222,6 +226,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<ident cce="4217-6" />
<oval id="sysctl_net_ipv4_conf_all_accept_redirects"
value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
<ref nist="CM-7" disa="1503,1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -239,6 +244,7 @@ absolutely required.</rationale>
<ident cce="3472-8" />
<oval id="sysctl_net_ipv4_conf_all_secure_redirects"
value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
<ref nist="CM-7, AC-4" disa="1503,1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_log_martians">
@@ -256,6 +262,7 @@ to be detected.</rationale>
<ident cce="4320-8" />
<oval id="sysctl_net_ipv4_conf_all_log_martians"
value="sysctl_net_ipv4_conf_all_log_martians_value" />
<ref nist="CM-7" disa="126"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -272,6 +279,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<ident cce="4091-5" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -288,6 +296,7 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<ident cce="4186-3" />
<oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -305,6 +314,7 @@ absolutely required.</rationale>
<ident cce="3339-9" />
<oval id="sysctl_net_ipv4_conf_default_secure_redirects"
value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -322,6 +332,7 @@ addresses makes the system slightly more difficult to enumerate on the
network.
<ident cce="3644-2" />
<oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -338,6 +349,7 @@ log size, although some activity would not be
logged.</rationale>
<ident cce="4133-5" />
<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_sysctl_net_ipv4_tcp_syncookies">
@@ -358,6 +370,7 @@ enables the system to continue servicing valid connection requests.
<ident cce="4265-5" />
<oval id="sysctl_net_ipv4_tcp_syncookies"
value="sysctl_net_ipv4_tcp_syncookies_value" />
<ref nist="CM-6, CM-7" disa="1092, 1095" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_rp_filter">
@@ -376,6 +389,7 @@ networks.</rationale>
<ident cce="4080-8" />
<oval id="sysctl_net_ipv4_conf_all_rp_filter"
value="sysctl_net_ipv4_conf_all_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_default_rp_filter">
@@ -394,6 +408,7 @@ networks.</rationale>
<ident cce="3840-6" />
<oval id="sysctl_net_ipv4_conf_default_rp_filter"
value="sysctl_net_ipv4_conf_default_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" />
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
diff --git a/RHEL6/input/system/network/uncommon.xml
b/RHEL6/input/system/network/uncommon.xml
index 902ddce..48beb0c 100644
--- a/RHEL6/input/system/network/uncommon.xml
+++ b/RHEL6/input/system/network/uncommon.xml
@@ -30,6 +30,7 @@ the system against exploitation of any flaws in its implementation.
<ident cce="14268-7" />
<oval id="kernel_module_dccp_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -52,6 +53,7 @@ the system against exploitation of any flaws in its implementation.
<ident cce="14132-5" />
<oval id="kernel_module_sctp_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -73,6 +75,7 @@ the system against exploitation of any flaws in its implementation.
<ident cce="14027-7" />
<oval id="kernel_module_rds_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
</Rule>
@@ -94,6 +97,7 @@ the system against exploitation of any flaws in its implementation.
<ident cce="14911-2" />
<oval id="kernel_module_tipc_disabled" />
<ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
diff --git a/RHEL6/input/system/permissions/execution.xml
b/RHEL6/input/system/permissions/execution.xml
index c387e1a..fdb6607 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -128,6 +128,7 @@ address range.</rationale>
<ident cce="4168-1" />
<oval id="sysctl_kernel_exec_shield" />
<ref nist="CM-7" />
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="enable_randomize_va_space">
@@ -143,6 +144,7 @@ in order to re-purpose it using return oriented programming (ROP)
techniques.
<ident cce="4146-7" />
<oval id="sysctl_kernel_randomize_va_space" />
<ref nist="AC-3, CM-6" />
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 1592874..0f952a1 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -102,6 +102,7 @@ the chances that it will remain off during system operation.
<ident cce="3977-6" />
<oval id="selinux_bootloader_notdisabled" />
<ref nist="AC-3, CM-6" disa="22,32"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_selinux_state" severity="high">
@@ -124,6 +125,7 @@ privileges.
<ident cce="3999-0" />
<oval id="selinux_mode" value="var_selinux_state_name"/>
<ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="set_selinux_policy">
@@ -149,6 +151,7 @@ targeted for exploitation, such as network services or system
services.
<ident cce="3624-4" />
<oval id="selinux_policytype"
value="var_selinux_policy_name"/>
<ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
@@ -241,10 +244,10 @@ It should produce no output in a well-configured
system.</ocil>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
cannot properly restrict access to the device file.
</rationale>
-
<ident cce="14991-4" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
</Rule>
</Group>
diff --git a/RHEL6/input/system/software/integrity.xml
b/RHEL6/input/system/software/integrity.xml
index 96c2bcc..e1cee67 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -41,6 +41,7 @@ The AIDE package must be installed if it is to be available for
integrity checki
<ident cce="4209-3" />
<oval id="package_aide_installed" />
<ref nist="CM-6, CM-7, SC-28, SI-7" disa="1069"/>
+<tested by="DS" on="20121024"/>
</Rule>
<Rule id="disable_prelink">
--
1.7.1