Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/accounts/pam.xml | 9 ++++++---
RHEL6/input/system/accounts/physical.xml | 2 +-
.../system/accounts/restrictions/root_logins.xml | 2 +-
RHEL6/input/system/auditing.xml | 8 +++++++-
RHEL6/input/system/permissions/files.xml | 4 ++--
RHEL6/transforms/shorthand2xccdf.xslt | 4 ++--
6 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index b432083..12f2ade 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -238,6 +238,7 @@ Look for the value of the <tt>maxrepeat</tt> parameter.
The DoD requirement is
<rationale>
Passwords with excessive repeating characters may be more vulnerable to password-guessing
attacks.
</rationale>
+<ident cce="TODO" />
<ref disa="366"/>
</Rule>
@@ -272,7 +273,7 @@ search space.
usage of uppercase letters in a password. When set to a negative number, any password
will be required to
contain that many uppercase characters. When set to a positive number, pam_cracklib will
grant +1 additional
length credit for each uppercase character.
-Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of a digit in
passwords.
+Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of an upper case
character in passwords.
</description>
<ocil clause="ucredit is not found or not set to the required value">
To check how many uppercase characters are required in a password, run the following
command:
@@ -507,8 +508,8 @@ This is the default.
<ocil clause="it does not">
Inspect the <tt>password</tt> section of
<tt>/etc/pam.d/system-auth</tt> and
ensure that the <tt>pam_unix.so</tt> module includes the argument
-<tt>sha512</tt>.
-<tt>$ grep sha512 /etc/pam.d/system-auth</tt>
+<tt>sha512</tt>:
+<pre>$ grep sha512 /etc/pam.d/system-auth</pre>
</ocil>
<rationale>
Using a stronger hashing algorithm makes password cracking attacks more difficult.
@@ -534,6 +535,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following
line appears:
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
+<ident cce="TODO" />
<ref nist="IA-5" disa="803"/>
<tested by="DS" on="20121024"/>
</Rule>
@@ -555,6 +557,7 @@ in the <tt>[default]</tt> section:
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
+<ident cce="TODO" />
<ref nist="IA-5" disa="803"/>
<tested by="DS" on="20121026"/>
</Rule>
diff --git a/RHEL6/input/system/accounts/physical.xml
b/RHEL6/input/system/accounts/physical.xml
index 013bb0b..99c9fef 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -156,7 +156,7 @@ The commands following the line below will be executed when the key
sequence is
A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
-loss of availability systems due to unintentional reboot.
+loss of availability of systems due to unintentional reboot.
In the GNOME graphical environment, risk of unintentional reboot from the
Ctrl-Alt-Del sequence is reduced because the user will be
prompted before any action is taken.
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml
b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index cc56c6d..cff8032 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -154,7 +154,7 @@ this misconfiguration should be investigated and the
accounts other than root should be removed or have their UID changed.
</description>
<ocil clause="any account other than root has a UID of 0">
-To list all password file entries for accounts with UID 0:
+To list all password file entries for accounts with UID 0, run the following command:
<pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
This should print only one line, for the user root.
</ocil>
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index c49c16b..6943c14 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -304,6 +304,7 @@ minimizes the chances of the system unexpectedly running out of disk
space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<tt>keep_logs</tt> can be employed.</rationale>
+<ident cce="TODO" />
<oval id="auditd_data_retention_max_log_file_action"
value="var_auditd_max_log_file_action" />
<ref nist="AU-1(b),AU-4,AU-11" />
<tested by="DS" on="20121024"/>
@@ -354,6 +355,7 @@ disk space is starting to run low:
</ocil>
<rationale>Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</rationale>
+<ident cce="TODO" />
<oval id="auditd_data_retention_space_left_action"
value="var_auditd_space_left_action"/>
<ref nist="AU-1(b),AU-4" disa="140,143,1339" />
<tested by="DS" on="20121024"/>
@@ -394,6 +396,7 @@ when disk space has run low:
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.
</rationale>
+<ident cce="TODO" />
<oval id="auditd_data_retention_admin_space_left_action"
value="var_auditd_admin_space_left_action" />
<ref nist="AU-1(b),AU-4" disa="140,1343" />
<tested by="DS" on="20121024"/>
@@ -416,6 +419,7 @@ account when it needs to notify an administrator:
</ocil>
<rationale>Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</rationale>
+<ident cce="TODO" />
<oval id="auditd_data_retention_action_mail_acct"
value="var_auditd_action_mail_acct" />
<ref nist="AU-1(b),AU-4" disa="139,144" />
</Rule>
@@ -680,7 +684,7 @@ audited.</rationale>
<Rule id="audit_logs_permissions">
<title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
<description>
-Change the mode of the audit log files:
+Change the mode of the audit log files with the following command:
<pre># chmod 0640 <i>audit_file</i></pre>
</description>
<ocil clause="any are more permissive">
@@ -691,6 +695,7 @@ Audit logs must be mode 0640 or less permissive.
<rationale>
If users can write to audit logs, audit trails can be modified or destroyed.
</rationale>
+<ident cce="TODO" />
<oval id="file_permissions_var_log_audit" />
<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
<tested by="DS" on="20121024"/>
@@ -706,6 +711,7 @@ If users can write to audit logs, audit trails can be modified or
destroyed.
</ocil>
<rationale>Failure to give ownership of the audit log file(s) to root allows the
designated
owner, and unauthorized users, potential access to sensitive
information.</rationale>
+<ident cce="TODO" />
<oval id="file_ownership_var_log_audit" />
<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/permissions/files.xml
b/RHEL6/input/system/permissions/files.xml
index d2b94ab..2d05ef2 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -86,7 +86,7 @@ on the system. Protection of this file is important for system
security.</ration
<Rule id="perms_group_file" severity="medium">
<title>Verify Permissions on <tt>group</tt> File</title>
<description><fileperms-desc-macro file="/etc/group"
perms="644"/></description>
-<ocil><fileowner-check-macro file="/etc/group"
perms="-rw-r--r--"/></ocil>
+<ocil><fileperms-check-macro file="/etc/group"
perms="-rw-r--r--"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding
groups that are configured
on the system. Protection of this file is important for system
security.</rationale>
<ident cce="26954-8" />
@@ -135,7 +135,7 @@ is critical for system security.</rationale>
<title>Verify User Who Owns <tt>passwd</tt> File</title>
<description><fileowner-desc-macro file="/etc/passwd"
owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/passwd"
owner="root"/></ocil>
-<rationale>The <tt>/etc/passwd</tt> contains information about the
users that are configured on
+<rationale>The <tt>/etc/passwd</tt> file contains information about the
users that are configured on
the system. Protection of this file is critical for system security.</rationale>
<ident cce="26953-0" />
<oval id="file_owner_etc_passwd" />
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt
b/RHEL6/transforms/shorthand2xccdf.xslt
index 708e593..507238e 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -237,7 +237,7 @@ exclude-result-prefixes="xccdf xhtml dc">
<!-- convenience macros for XCCDF prose -->
<xsl:template match="sysctl-desc-macro">
To set the runtime status of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter,
- run the following command.
+ run the following command:
<xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of
select="@sysctl"/>=<xsl:value-of
select="@value"/></xhtml:pre>
<!-- The following text could also be included conditionally, if the defaultness of
the sysctl were indicated. -->
@@ -249,7 +249,7 @@ exclude-result-prefixes="xccdf xhtml dc">
The status of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter can be queried
by running the following command:
<xhtml:pre xml:space="preserve">$ sysctl <xsl:value-of
select="@sysctl"/></xhtml:pre>
- The output of the command should indicate a value of
<xhtml:code><xsl:value-of select="@value"/></xhtml:code>:
+ The output of the command should indicate a value of
<xhtml:code><xsl:value-of select="@value"/></xhtml:code>.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly in
<xhtml:code>/etc/sysctl.conf</xhtml:code>.
--
1.7.1