--- RHEL6/input/system/selinux.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 0f952a1..f7bb184 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -87,7 +87,7 @@ and to protect the boot process. <description>SELinux can be disabled at boot time by an argument in <tt>/etc/grub.conf</tt>. Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that -file to prevent SELinux from being being disabled at boot. +file to prevent SELinux from being disabled at boot. </description> <ocil clause="SELinux is disabled at boot time"> Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
--- RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 520ee0c..c3fa7bc 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -183,7 +183,7 @@ The system must require at least four characters be changed between the old and The system must disable accounts after three consecutive unsuccessful login attempts. </title> <title rule="set_password_hashing_algorithm" shorttitle="Set Password Hashing Algorithm"> -The system must use a FIPS 140-2 approved cryptographic hashing algoithm for generating account password hashes. +The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. </title> <title rule="limiting_password_reuse" shorttitle="Limit Password Reuse"> The system must prohibit the reuse of passwords within five iterations.
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 520ee0c..c3fa7bc 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -183,7 +183,7 @@ The system must require at least four characters be changed between the old and The system must disable accounts after three consecutive unsuccessful login attempts.
</title> <title rule="set_password_hashing_algorithm" shorttitle="Set Password Hashing Algorithm"> -The system must use a FIPS 140-2 approved cryptographic hashing algoithm for generating account password hashes. +The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. </title> <title rule="limiting_password_reuse" shorttitle="Limit Password Reuse"> The system must prohibit the reuse of passwords within five iterations.
Ack
--- RHEL6/input/system/selinux.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index f7bb184..54c66f5 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -105,7 +105,7 @@ the chances that it will remain off during system operation. <tested by="DS" on="20121024"/> </Rule>
-<Rule id="set_selinux_state" severity="high"> +<Rule id="set_selinux_state" severity="medium"> <title>Ensure SELinux State is Enforcing</title> <description>The SELinux state should be set to <tt>enforcing</tt> at system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/system/selinux.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index f7bb184..54c66f5 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -105,7 +105,7 @@ the chances that it will remain off during system operation.
<tested by="DS" on="20121024"/> </Rule>
-<Rule id="set_selinux_state" severity="high"> +<Rule id="set_selinux_state" severity="medium">
<title>Ensure SELinux State is Enforcing</title> <description>The SELinux state should be set to <tt>enforcing</tt> at system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
Ack, this matches from the DoD Census call.
--- RHEL6/input/system/accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/auditing.xml | 4 ++-- RHEL6/input/system/permissions/files.xml | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 6c1c187..153a2d6 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -97,7 +97,7 @@ users and should not be used. Any <tt>.netrc</tt> files should be removed. <ocil clause="any .netrc files exist"> To check the system for the existence of any <tt>.netrc</tt> files, run the following command: -<pre># find / -name .netrc</pre> +<pre># find / -xdev -name .netrc</pre> <!-- needs fixup to limit search to home dirs --> </ocil> <rationale> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9599c5c..d10fb78 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1166,7 +1166,7 @@ these events could serve as evidence of potential system compromise.</rationale> <description>At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Then, for each setuid program on the system, add a line of the following form to <tt>/etc/audit/audit.rules</tt>, where <i>SETUID_PROG_PATH</i> is the full path to each setuid program in the list: @@ -1174,7 +1174,7 @@ in the list: </description> <ocil clause="it is not the case"> To verify that auditing of privileged command use is configured, run the following command to find relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Run the following command to verify entries in the audit rules for all programs found with the previous command: <pre># grep path /etc/audit/audit.rules</pre> It should be the case that all relevant setuid programs have a line in the audit rules. diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index b8c3871..44dabe8 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -313,7 +313,7 @@ following command: </description> <ocil clause="any world-writable directories are missing the sticky bit"> To find world-writable directories that lack the sticky bit, run the following command: -<pre># find / -type d -perm 002 ! -perm 1000</pre> +<pre># find / -xdev -type d -perm 002 ! -perm 1000</pre> </ocil> <rationale> Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. @@ -345,7 +345,7 @@ symptoms of a misconfigured application or user account.</description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <ident cce="3795-2" /> <ref nist="CM-6"/> @@ -361,7 +361,7 @@ of any unpackaged SGID files. </description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for @@ -382,7 +382,7 @@ of any unpackaged SUID files. </description> <ocil> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/system/accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/auditing.xml | 4 ++-- RHEL6/input/system/permissions/files.xml | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 6c1c187..153a2d6 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -97,7 +97,7 @@ users and should not be used. Any <tt>.netrc</tt> files should be removed.
<ocil clause="any .netrc files exist"> To check the system for the existence of any <tt>.netrc</tt> files, run the following command: -<pre># find / -name .netrc</pre> +<pre># find / -xdev -name .netrc</pre> <!-- needs fixup to limit search to home dirs --> </ocil> <rationale> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9599c5c..d10fb78 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1166,7 +1166,7 @@ these events could serve as evidence of potential system compromise.</rationale> <description>At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Then, for each setuid program on the system, add a line of the following form to <tt>/etc/audit/audit.rules</tt>, where <i>SETUID_PROG_PATH</i> is the full path to each setuid program in the list: @@ -1174,7 +1174,7 @@ in the list: </description> <ocil clause="it is not the case"> To verify that auditing of privileged command use is configured, run the following command to find relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Run the following command to verify entries in the audit rules for all programs found with the previous command: <pre># grep path /etc/audit/audit.rules</pre> It should be the case that all relevant setuid programs have a line in the audit rules. diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index b8c3871..44dabe8 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -313,7 +313,7 @@ following command: </description> <ocil clause="any world-writable directories are missing the sticky bit"> To find world-writable directories that lack the sticky bit, run the following command: -<pre># find / -type d -perm 002 ! -perm 1000</pre> +<pre># find / -xdev -type d -perm 002 ! -perm 1000</pre> </ocil> <rationale> Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. @@ -345,7 +345,7 @@ symptoms of a misconfigured application or user account.</description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <ident cce="3795-2" /> <ref nist="CM-6"/> @@ -361,7 +361,7 @@ of any unpackaged SGID files. </description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for @@ -382,7 +382,7 @@ of any unpackaged SUID files. </description> <ocil> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for
I'm still a little weary of this. What happens if a SUID or improperly chmod'd file exists on a non-local filesystem?
then your compliance check on the system hosting that filesystem should catch it, not the 1000 clients trying to walk its filesystem.
what you should be more weary of is getting all the local partitions when you use -xdev, such as /var, /tmp etc.
On 10/25/2012 05:21 PM, Shawn Wells wrote:
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/system/accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/auditing.xml | 4 ++-- RHEL6/input/system/permissions/files.xml | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 6c1c187..153a2d6 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -97,7 +97,7 @@ users and should not be used. Any <tt>.netrc</tt> files should be removed.
<ocil clause="any .netrc files exist"> To check the system for the existence of any <tt>.netrc</tt> files, run the following command: -<pre># find / -name .netrc</pre> +<pre># find / -xdev -name .netrc</pre> <!-- needs fixup to limit search to home dirs --> </ocil> <rationale> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9599c5c..d10fb78 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1166,7 +1166,7 @@ these events could serve as evidence of potential system compromise.</rationale> <description>At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Then, for each setuid program on the system, add a line of the following form to <tt>/etc/audit/audit.rules</tt>, where <i>SETUID_PROG_PATH</i> is the full path to each setuid program in the list: @@ -1174,7 +1174,7 @@ in the list: </description> <ocil clause="it is not the case"> To verify that auditing of privileged command use is configured, run the following command to find relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Run the following command to verify entries in the audit rules for all programs found with the previous command: <pre># grep path /etc/audit/audit.rules</pre> It should be the case that all relevant setuid programs have a line in the audit rules. diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index b8c3871..44dabe8 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -313,7 +313,7 @@ following command: </description> <ocil clause="any world-writable directories are missing the sticky bit"> To find world-writable directories that lack the sticky bit, run the following command: -<pre># find / -type d -perm 002 ! -perm 1000</pre> +<pre># find / -xdev -type d -perm 002 ! -perm 1000</pre> </ocil> <rationale> Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. @@ -345,7 +345,7 @@ symptoms of a misconfigured application or user account.</description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <ident cce="3795-2" /> <ref nist="CM-6"/> @@ -361,7 +361,7 @@ of any unpackaged SGID files. </description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for @@ -382,7 +382,7 @@ of any unpackaged SUID files. </description> <ocil> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for
I'm still a little weary of this. What happens if a SUID or improperly chmod'd file exists on a non-local filesystem?
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 10/25/12 5:26 PM, Jeffrey Blank wrote:
then your compliance check on the system hosting that filesystem should catch it, not the 1000 clients trying to walk its filesystem.
fair enough.
ack then.
what you should be more weary of is getting all the local partitions when you use -xdev, such as /var, /tmp etc.
Perhaps the setuid file check should be run against local partitions that do not have the nosuid mount option? See V-805 in the rhel5 content.
-Leland ________________________________________ From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Jeffrey Blank [blank@eclipse.ncsc.mil] Sent: Thursday, October 25, 2012 17:26 To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH 8/9] Added -xdev to any find commands to prevent traversing remote filesystems.
then your compliance check on the system hosting that filesystem should catch it, not the 1000 clients trying to walk its filesystem.
what you should be more weary of is getting all the local partitions when you use -xdev, such as /var, /tmp etc.
On 10/25/2012 05:21 PM, Shawn Wells wrote:
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/system/accounts/restrictions/password_storage.xml | 2 +- RHEL6/input/system/auditing.xml | 4 ++-- RHEL6/input/system/permissions/files.xml | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 6c1c187..153a2d6 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -97,7 +97,7 @@ users and should not be used. Any <tt>.netrc</tt> files should be removed.
<ocil clause="any .netrc files exist"> To check the system for the existence of any <tt>.netrc</tt> files, run the following command: -<pre># find / -name .netrc</pre> +<pre># find / -xdev -name .netrc</pre> <!-- needs fixup to limit search to home dirs --> </ocil> <rationale> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 9599c5c..d10fb78 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -1166,7 +1166,7 @@ these events could serve as evidence of potential system compromise.</rationale> <description>At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Then, for each setuid program on the system, add a line of the following form to <tt>/etc/audit/audit.rules</tt>, where <i>SETUID_PROG_PATH</i> is the full path to each setuid program in the list: @@ -1174,7 +1174,7 @@ in the list: </description> <ocil clause="it is not the case"> To verify that auditing of privileged command use is configured, run the following command to find relevant setuid programs: -<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> +<pre># find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null</pre> Run the following command to verify entries in the audit rules for all programs found with the previous command: <pre># grep path /etc/audit/audit.rules</pre> It should be the case that all relevant setuid programs have a line in the audit rules. diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index b8c3871..44dabe8 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -313,7 +313,7 @@ following command: </description> <ocil clause="any world-writable directories are missing the sticky bit"> To find world-writable directories that lack the sticky bit, run the following command: -<pre># find / -type d -perm 002 ! -perm 1000</pre> +<pre># find / -xdev -type d -perm 002 ! -perm 1000</pre> </ocil> <rationale> Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. @@ -345,7 +345,7 @@ symptoms of a misconfigured application or user account.</description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <ident cce="3795-2" /> <ref nist="CM-6"/> @@ -361,7 +361,7 @@ of any unpackaged SGID files. </description> <ocil clause="there is output"> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for @@ -382,7 +382,7 @@ of any unpackaged SUID files. </description> <ocil> To find world-writable files, run the following command: -<pre># find / -type f -perm -002</pre> +<pre># find / -xdev -type f -perm -002</pre> </ocil> <rationale>Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for
I'm still a little weary of this. What happens if a SUID or improperly chmod'd file exists on a non-local filesystem?
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 10/26/12 9:27 AM, Steinke, Leland J CTR DISA FSO (US) wrote:
Perhaps the setuid file check should be run against local partitions that do not have the nosuid mount option? See V-805 in the rhel5 content.
This is a good idea, and apparently someone agreed with you: V-165 in the rhel6 content http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6...
--- RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/services/base.xml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index c3fa7bc..9805185 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -513,7 +513,7 @@ The qpidd service must not be running. The rdisc service must not be running. </title> <title rule="service_rhnsd_disabled" shorttitle="Disable Red Hat Network Service (rhnsd)"> -The Red Hat Network Service (rhnsd) service must not be running. +The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite. </title> <title rule="service_sysstat_disabled" shorttitle="Disable System Statistics Reset Service (sysstat)"> The sysstat service must not be running. diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml index bda8350..7396512 100644 --- a/RHEL6/input/services/base.xml +++ b/RHEL6/input/services/base.xml @@ -405,7 +405,8 @@ RHN server or satellite and managed as such. <ocil><service-disable-check-macro service="rhnsd" /></ocil> <rationale>Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not -desirable for some environments.</rationale> +desirable for some environments. However, if the system is being managed by RHN or + RHN Satellite Server it can remain on, otherwise disable the service. </rationale> <ident cce="3416-5" /> <oval id="service_rhnsd_disabled" /> <ref nist="CM-6, CM-7" disa="382" />
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/services/base.xml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index c3fa7bc..9805185 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -513,7 +513,7 @@ The qpidd service must not be running. The rdisc service must not be running.
</title> <title rule="service_rhnsd_disabled" shorttitle="Disable Red Hat Network Service (rhnsd)"> -The Red Hat Network Service (rhnsd) service must not be running. +The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite. </title> <title rule="service_sysstat_disabled" shorttitle="Disable System Statistics Reset Service (sysstat)"> The sysstat service must not be running. diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml index bda8350..7396512 100644 --- a/RHEL6/input/services/base.xml +++ b/RHEL6/input/services/base.xml @@ -405,7 +405,8 @@ RHN server or satellite and managed as such. <ocil><service-disable-check-macro service="rhnsd" /></ocil> <rationale>Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not -desirable for some environments.</rationale> +desirable for some environments. However, if the system is being managed by RHN or + RHN Satellite Server it can remain on, otherwise disable the service. </rationale> <ident cce="3416-5" /> <oval id="service_rhnsd_disabled" /> <ref nist="CM-6, CM-7" disa="382" />
Please resubmit with refined language.
"it" should be "the rhnsd daemon" and the "otherwise..." text isn't needed.
It has been fixed.
====================================================== Michele Newman RHCE, RHCVA (Sr. Consultant) Email: mnewman@redhat.com Cell: 410.499.6177 Red Hat Consulting http://www.redhat.com/consulting ====================================================== Red Hat, Inc. | 1801 Varsity Dr | Raleigh, NC | 27606
On Oct 25, 2012, at 5:24 PM, Shawn Wells wrote:
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/services/base.xml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index c3fa7bc..9805185 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -513,7 +513,7 @@ The qpidd service must not be running. The rdisc service must not be running.
</title> <title rule="service_rhnsd_disabled" shorttitle="Disable Red Hat Network Service (rhnsd)"> -The Red Hat Network Service (rhnsd) service must not be running. +The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite. </title> <title rule="service_sysstat_disabled" shorttitle="Disable System Statistics Reset Service (sysstat)"> The sysstat service must not be running. diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml index bda8350..7396512 100644 --- a/RHEL6/input/services/base.xml +++ b/RHEL6/input/services/base.xml @@ -405,7 +405,8 @@ RHN server or satellite and managed as such. <ocil><service-disable-check-macro service="rhnsd" /></ocil> <rationale>Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not -desirable for some environments.</rationale> +desirable for some environments. However, if the system is being managed by RHN or + RHN Satellite Server it can remain on, otherwise disable the service. </rationale> <ident cce="3416-5" /> <oval id="service_rhnsd_disabled" /> <ref nist="CM-6, CM-7" disa="382" />
Please resubmit with refined language.
"it" should be "the rhnsd daemon" and the "otherwise..." text isn't needed. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 10/25/12 5:11 PM, Michele Newman wrote:
RHEL6/input/system/selinux.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 0f952a1..f7bb184 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -87,7 +87,7 @@ and to protect the boot process. <description>SELinux can be disabled at boot time by an argument in <tt>/etc/grub.conf</tt>. Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that -file to prevent SELinux from being being disabled at boot. +file to prevent SELinux from being disabled at boot.
</description> <ocil clause="SELinux is disabled at boot time"> Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
Ack
scap-security-guide@lists.fedorahosted.org