Additional QA work, including tested tags, as well as a slight modification in the 'disable service' macro. I'm open to wording suggestions, but wanted to add the possibility of something not being installed without making a novel of it.
David Smith (2): more QA work slight modification of macro text
RHEL6/input/services/obsolete.xml | 13 +++++++++++++ RHEL6/input/system/accounts/banners.xml | 1 + RHEL6/input/system/accounts/pam.xml | 1 + RHEL6/input/system/accounts/physical.xml | 5 +++++ .../accounts/restrictions/password_expiration.xml | 4 ++++ RHEL6/input/system/permissions/files.xml | 13 +++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 7 files changed, 39 insertions(+), 2 deletions(-)
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/obsolete.xml | 13 +++++++++++++ RHEL6/input/system/accounts/banners.xml | 1 + RHEL6/input/system/accounts/pam.xml | 1 + RHEL6/input/system/accounts/physical.xml | 5 +++++ .../accounts/restrictions/password_expiration.xml | 4 ++++ RHEL6/input/system/permissions/files.xml | 13 +++++++++++++ 6 files changed, 37 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 4c8c7bf..3fe6bf6 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -39,6 +39,7 @@ attacks against xinetd itself. <ident cce="4252-3" /> <oval id="service_xinetd_disabled" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_xinetd"> @@ -54,6 +55,7 @@ xinetd service's accidental (or intentional) activation. <ident cce="4164-0" /> <oval id="package_xinetd_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -80,6 +82,7 @@ subject to man-in-the-middle attacks. <ident cce="3390-2" /> <oval id="service_telnetd_disabled" /> <ref disa="1436,196,197" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_telnet_server" severity="high"> @@ -95,6 +98,7 @@ telnet service's accidental (or intentional) activation. <ident cce="4330-7" /> <oval id="package_telnet-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -121,6 +125,7 @@ activation. <ident cce="4308-3" /> <oval id="package_rsh-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rexec" severity="high"> @@ -139,6 +144,7 @@ stolen by eavesdroppers on the network. <ident cce="undefined" /> <oval id="service_rexec_disabled" /> <ref disa="1436"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rsh" severity="high"> @@ -157,6 +163,7 @@ stolen by eavesdroppers on the network. <ident cce="4141-8" /> <oval id="service_rsh_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rlogin" severity="high"> @@ -175,6 +182,7 @@ stolen by eavesdroppers on the network. <ident cce="3537-8" /> <oval id="service_rlogin_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="no_rsh_trust_files" severity="high"> @@ -197,6 +205,7 @@ used in conjunction with the R-services, they can allow unauthenticated access to a system.</rationale> <ident cce="TODO" /> <oval id="no_rsh_trusted_host_files" /> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -222,6 +231,7 @@ accidental (or intentional) activation of NIS or NIS+ services. <ident cce="4348-9" /> <oval id="package_ypserv_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_ypbind" severity="medium"> @@ -238,6 +248,7 @@ as a client in a NIS or NIS+ domain. <ident cce="3705-1" /> <oval id="service_ypbind_disabled" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -265,6 +276,7 @@ as a tftp server, which does not provide encryption or authentication. <ident cce="4273-9" /> <oval id="service_tftp_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_tftp-server" severity="medium"> @@ -282,6 +294,7 @@ accidental (or intentional) activation of tftp services. <ident cce="3916-4" /> <oval id="package_tftp-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="tftpd_uses_secure_mode" severity="high"> diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index eaef2ae..243ccf9 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -80,6 +80,7 @@ reinforces policy awareness during the logon process. <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> +<tested by="DS" on="20121026"/> </Rule>
<Group id="gui_login_banner"> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 3633b6f..ee8bb91 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -487,6 +487,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul <!-- <ident cce="14063-2" /> --> <!-- <oval id="accounts_password_hashing_algorithm" /> --> <ref nist="IA-5" disa="803"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 40ac529..db67bf0 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -36,6 +36,7 @@ Only root should be able to modify important boot parameters. <ident cce="4144-2" /> <oval id="file_user_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="group_owner_grub_conf" severity="medium"> @@ -53,6 +54,7 @@ file should not have any access privileges anyway. <ident cce="4197-0" /> <oval id="file_group_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="permissions_grub_conf" severity="medium"> @@ -69,6 +71,7 @@ parameters. <ident cce="3923-0" /> <oval id="file_permissions_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="bootloader_password" severity="medium"> @@ -98,6 +101,7 @@ and whether to enter single-user mode. <ident cce="3818-2" /> <oval id="bootloader_password" /> <ref nist="CM-7, IA-5, AC-3" disa="213" /> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -376,6 +380,7 @@ for users who may need to suspend console logins. <ident cce="3910-7" /> <oval id="package_vlock_installed" /> <ref nist="CM-6, CM-7" disa="58" /> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index 5f01b5c..8a6f17e 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -104,6 +104,7 @@ behavior that may result. <ident cce="4154-1" /> <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -130,6 +131,7 @@ after satisfying the password reuse requirement. <ident cce="4180-6" /> <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/> <ref nist="CM-6, IA-5" disa="198"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -157,6 +159,7 @@ location subject to physical compromise.</rationale> <ident cce="4092-3" /> <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -182,6 +185,7 @@ make the change at a practical time. <ident cce="4097-2" /> <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" /> <ref nist="CM-6, CM-7, IA-5, AC-3" /> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 216999c..4b6c040 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -29,6 +29,7 @@ which could weaken the system security posture.</rationale> <ident cce="3918-0" /> <oval id="file_owner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_shadow_file" severity="medium"> @@ -40,6 +41,7 @@ critical for system security.</rationale> <ident cce="3988-3" /> <oval id="file_groupowner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_shadow_file" severity="medium"> @@ -54,6 +56,7 @@ which could weaken the system security posture.</rationale> <ident cce="4130-1" /> <oval id="file_permissions_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_group_file" severity="medium"> @@ -65,6 +68,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3276-3" /> <oval id="file_owner_etc_group" /> <ref nist="AC-3, CM-6"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_group_file" severity="medium"> @@ -76,6 +80,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3883-6" /> <oval id="file_groupowner_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_group_file" severity="medium"> @@ -87,6 +92,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3967-7" /> <oval id="file_permissions_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_gshadow_file" severity="medium"> @@ -98,6 +104,7 @@ is critical for system security.</rationale> <ident cce="4210-1" /> <oval id="file_owner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_gshadow_file" severity="medium"> @@ -109,6 +116,7 @@ is critical for system security.</rationale> <ident cce="4064-2" /> <oval id="file_groupowner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_gshadow_file" severity="medium"> @@ -120,6 +128,7 @@ is critical for system security.</rationale> <ident cce="3932-1" /> <oval id="file_permissions_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_passwd_file" severity="medium"> @@ -131,6 +140,7 @@ the system. Protection of this file is critical for system security.</rationale> <ident cce="3958-6" /> <oval id="file_owner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_passwd_file" severity="medium"> @@ -142,6 +152,7 @@ the system. Protection of this file is critical for system security.</rationale> <ident cce="3495-9" /> <oval id="file_groupowner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="file_permissions_etc_passwd" severity="medium"> @@ -155,6 +166,7 @@ is critical for system security.</rationale> <ident cce="3566-7" /> <oval id="file_permissions_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -200,6 +212,7 @@ space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system. </rationale> <ref disa="1499"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="file_ownership_library_dirs" severity="medium">
On 10/26/12 12:53 PM, David Smith wrote:
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil
RHEL6/input/services/obsolete.xml | 13 +++++++++++++ RHEL6/input/system/accounts/banners.xml | 1 + RHEL6/input/system/accounts/pam.xml | 1 + RHEL6/input/system/accounts/physical.xml | 5 +++++ .../accounts/restrictions/password_expiration.xml | 4 ++++ RHEL6/input/system/permissions/files.xml | 13 +++++++++++++ 6 files changed, 37 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 4c8c7bf..3fe6bf6 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -39,6 +39,7 @@ attacks against xinetd itself.
<ident cce="4252-3" /> <oval id="service_xinetd_disabled" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_xinetd"> @@ -54,6 +55,7 @@ xinetd service's accidental (or intentional) activation. <ident cce="4164-0" /> <oval id="package_xinetd_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -80,6 +82,7 @@ subject to man-in-the-middle attacks. <ident cce="3390-2" /> <oval id="service_telnetd_disabled" /> <ref disa="1436,196,197" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_telnet_server" severity="high"> @@ -95,6 +98,7 @@ telnet service's accidental (or intentional) activation. <ident cce="4330-7" /> <oval id="package_telnet-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -121,6 +125,7 @@ activation.
<ident cce="4308-3" /> <oval id="package_rsh-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rexec" severity="high"> @@ -139,6 +144,7 @@ stolen by eavesdroppers on the network. <ident cce="undefined" /> <oval id="service_rexec_disabled" /> <ref disa="1436"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rsh" severity="high"> @@ -157,6 +163,7 @@ stolen by eavesdroppers on the network. <ident cce="4141-8" /> <oval id="service_rsh_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_rlogin" severity="high"> @@ -175,6 +182,7 @@ stolen by eavesdroppers on the network. <ident cce="3537-8" /> <oval id="service_rlogin_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="no_rsh_trust_files" severity="high"> @@ -197,6 +205,7 @@ used in conjunction with the R-services, they can allow unauthenticated access to a system.</rationale> <ident cce="TODO" /> <oval id="no_rsh_trusted_host_files" /> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -222,6 +231,7 @@ accidental (or intentional) activation of NIS or NIS+ services. <ident cce="4348-9" /> <oval id="package_ypserv_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="disable_ypbind" severity="medium"> @@ -238,6 +248,7 @@ as a client in a NIS or NIS+ domain. <ident cce="3705-1" /> <oval id="service_ypbind_disabled" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -265,6 +276,7 @@ as a tftp server, which does not provide encryption or authentication.
<ident cce="4273-9" /> <oval id="service_tftp_disabled" /> <ref disa="1436" /> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="uninstall_tftp-server" severity="medium"> @@ -282,6 +294,7 @@ accidental (or intentional) activation of tftp services. <ident cce="3916-4" /> <oval id="package_tftp-server_removed" /> <ref disa="305"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="tftpd_uses_secure_mode" severity="high"> diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml index eaef2ae..243ccf9 100644 --- a/RHEL6/input/system/accounts/banners.xml +++ b/RHEL6/input/system/accounts/banners.xml @@ -80,6 +80,7 @@ reinforces policy awareness during the logon process. <ident cce="4060-0" /> <oval id="banner_etc_issue" value="login_banner_text"/> <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" /> +<tested by="DS" on="20121026"/> </Rule>
<Group id="gui_login_banner"> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 3633b6f..ee8bb91 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -487,6 +487,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul <!-- <ident cce="14063-2" /> --> <!-- <oval id="accounts_password_hashing_algorithm" /> --> <ref nist="IA-5" disa="803"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 40ac529..db67bf0 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -36,6 +36,7 @@ Only root should be able to modify important boot parameters.
<ident cce="4144-2" /> <oval id="file_user_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="group_owner_grub_conf" severity="medium"> @@ -53,6 +54,7 @@ file should not have any access privileges anyway. <ident cce="4197-0" /> <oval id="file_group_owner_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="permissions_grub_conf" severity="medium"> @@ -69,6 +71,7 @@ parameters. <ident cce="3923-0" /> <oval id="file_permissions_grub_conf" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="bootloader_password" severity="medium"> @@ -98,6 +101,7 @@ and whether to enter single-user mode. <ident cce="3818-2" /> <oval id="bootloader_password" /> <ref nist="CM-7, IA-5, AC-3" disa="213" /> +<tested by="DS" on="20121026"/> </Rule>
</Group> @@ -376,6 +380,7 @@ for users who may need to suspend console logins. <ident cce="3910-7" /> <oval id="package_vlock_installed" /> <ref nist="CM-6, CM-7" disa="58" /> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index 5f01b5c..8a6f17e 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -104,6 +104,7 @@ behavior that may result.
<ident cce="4154-1" /> <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -130,6 +131,7 @@ after satisfying the password reuse requirement.
<ident cce="4180-6" /> <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/> <ref nist="CM-6, IA-5" disa="198"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -157,6 +159,7 @@ location subject to physical compromise.</rationale>
<ident cce="4092-3" /> <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/> <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/> +<tested by="DS" on="20121026"/> </Rule>
@@ -182,6 +185,7 @@ make the change at a practical time.
<ident cce="4097-2" /> <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" /> <ref nist="CM-6, CM-7, IA-5, AC-3" /> +<tested by="DS" on="20121026"/> </Rule> </Group>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 216999c..4b6c040 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -29,6 +29,7 @@ which could weaken the system security posture.</rationale>
<ident cce="3918-0" /> <oval id="file_owner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_shadow_file" severity="medium"> @@ -40,6 +41,7 @@ critical for system security.</rationale> <ident cce="3988-3" /> <oval id="file_groupowner_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_shadow_file" severity="medium"> @@ -54,6 +56,7 @@ which could weaken the system security posture.</rationale> <ident cce="4130-1" /> <oval id="file_permissions_etc_shadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_group_file" severity="medium"> @@ -65,6 +68,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3276-3" /> <oval id="file_owner_etc_group" /> <ref nist="AC-3, CM-6"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_group_file" severity="medium"> @@ -76,6 +80,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3883-6" /> <oval id="file_groupowner_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_group_file" severity="medium"> @@ -87,6 +92,7 @@ on the system. Protection of this file is important for system security.</ration <ident cce="3967-7" /> <oval id="file_permissions_etc_group" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_gshadow_file" severity="medium"> @@ -98,6 +104,7 @@ is critical for system security.</rationale> <ident cce="4210-1" /> <oval id="file_owner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_gshadow_file" severity="medium"> @@ -109,6 +116,7 @@ is critical for system security.</rationale> <ident cce="4064-2" /> <oval id="file_groupowner_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="perms_gshadow_file" severity="medium"> @@ -120,6 +128,7 @@ is critical for system security.</rationale> <ident cce="3932-1" /> <oval id="file_permissions_etc_gshadow" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="userowner_passwd_file" severity="medium"> @@ -131,6 +140,7 @@ the system. Protection of this file is critical for system security.</rationale> <ident cce="3958-6" /> <oval id="file_owner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="groupowner_passwd_file" severity="medium"> @@ -142,6 +152,7 @@ the system. Protection of this file is critical for system security.</rationale> <ident cce="3495-9" /> <oval id="file_groupowner_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="file_permissions_etc_passwd" severity="medium"> @@ -155,6 +166,7 @@ is critical for system security.</rationale> <ident cce="3566-7" /> <oval id="file_permissions_etc_passwd" /> <ref nist="AC-3, CM-6" disa="225"/> +<tested by="DS" on="20121026"/> </Rule> </Group>
@@ -200,6 +212,7 @@ space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system.
</rationale> <ref disa="1499"/> +<tested by="DS" on="20121026"/> </Rule>
<Rule id="file_ownership_library_dirs" severity="medium">
Pushed
Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index f083cbf..d2d7b30 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -351,8 +351,8 @@ exclude-result-prefixes="xccdf xhtml dc"> To check that the xhtml:code<xsl:value-of select="@service"/></xhtml:code> service is disabled in system boot configuration, run the following command: xhtml:pre# chkconfig xhtml:code<xsl:value-of select="@service"/></xhtml:code> --list</xhtml:pre> - Output should indicate the xhtml:code<xsl:value-of select="@service"/></xhtml:code> service has been disabled at all runlevels, - as shown in the example below: + Output should indicate the xhtml:code<xsl:value-of select="@service"/></xhtml:code> service has either not been installed, + or has been disabled at all runlevels, as shown in the example below: xhtml:pre# chkconfig xhtml:code<xsl:value-of select="@service"/></xhtml:code> --list xhtml:code<xsl:value-of select="@service"/></xhtml:code> 0:off 1:off 2:off 3:off 4:off 5:off 6:off</xhtml:pre>
On 10/26/12 12:53 PM, David Smith wrote:
Additional QA work, including tested tags, as well as a slight modification in the 'disable service' macro. I'm open to wording suggestions, but wanted to add the possibility of something not being installed without making a novel of it.
David Smith (2): more QA work slight modification of macro text
RHEL6/input/services/obsolete.xml | 13 +++++++++++++ RHEL6/input/system/accounts/banners.xml | 1 + RHEL6/input/system/accounts/pam.xml | 1 + RHEL6/input/system/accounts/physical.xml | 5 +++++ .../accounts/restrictions/password_expiration.xml | 4 ++++ RHEL6/input/system/permissions/files.xml | 13 +++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 7 files changed, 39 insertions(+), 2 deletions(-)
The macro wording is sane, ack
On 10/26/12 1:00 PM, Shawn Wells wrote:
On 10/26/12 12:53 PM, David Smith wrote:
Additional QA work, including tested tags, as well as a slight modification in the 'disable service' macro. I'm open to wording suggestions, but wanted to add the possibility of something not being installed without making a novel of it.
David Smith (2): more QA work slight modification of macro text
RHEL6/input/services/obsolete.xml | 13 +++++++++++++ RHEL6/input/system/accounts/banners.xml | 1 + RHEL6/input/system/accounts/pam.xml | 1 + RHEL6/input/system/accounts/physical.xml | 5 +++++ .../accounts/restrictions/password_expiration.xml | 4 ++++ RHEL6/input/system/permissions/files.xml | 13 +++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 7 files changed, 39 insertions(+), 2 deletions(-)
The macro wording is sane, ack
Pushed
scap-security-guide@lists.fedorahosted.org