On 1/14/13 5:35 AM, Shawn Wells wrote:
0001-DISA-FSO-Language-changes-to-RHEL6-input-services-ft.patch
From 53a0ca704eef2b6bd7826b0c7eda1615113ef3b9 Mon Sep 17 00:00:00 2001
From: Shawn Wells<shawn(a)redhat.com>
Date: Mon, 14 Jan 2013 05:26:01 -0500
Subject: [PATCH 1/2] DISA FSO: Language changes to RHEL6/input/services/ftp.xml
Language changes to FTP section, patched by DISA FSO
---
RHEL6/input/services/ftp.xml | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 11cf6df..ef86002 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -92,10 +92,12 @@ If vsftpd is started by xinetd the following command will indicate
the xinetd.d
<pre># grep vsftpd/etc/xinetd.d/*</pre>
<pre># grep server_args <i>vsftpd xinetd.d startup
file</i></pre>
This will indicate the vsftpd config file used when starting through xinetd.
-If the <i>server_args</i>line is missing or does not include the vsftpd
configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
+If the <i>server_args</i> line is missing or does not include the vsftpd
configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
<pre># grep xferlog_enable <i>vsftpd config file</i></pre>
</ocil>
<rationale>The modifications above ensure that all commands sent to the ftp
server are logged using the verbose vsftpd log
+<rationale>To trace malicious activity facilitated by the FTP service, it must be
configured to ensure that all commands sent to
+the ftp server are logged using the verbose vsftpd log
format. The default vsftpd log file is /var/log/vsftpd.log.</rationale>
<warning category="general">If verbose logging to vsftpd.log is done,
sparse logging of downloads to /var/log/xferlog will not also occur. However, the
information about what files were downloaded is included in the information logged to
vsftpd.log</warning>
<ident cce="27142-9" />
Ack to DISA on this. Pushed.
(I caught the duplicate <rationale> tag -- which was introduced by me,
not DISA -- and pushed.)