Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/services/dns.xml | 2 +-
RHEL6/input/services/ftp.xml | 6 +++---
RHEL6/input/services/http.xml | 6 +++---
RHEL6/input/services/obsolete.xml | 15 ++++++++-------
RHEL6/input/services/smb.xml | 4 +++-
5 files changed, 18 insertions(+), 15 deletions(-)
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 619f99f..2dbc552 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -37,7 +37,7 @@ implementation flaws and should be disabled if possible.
<tt>named</tt> service, run the following command:
<pre># yum erase bind</pre>
</description>
-<ocil><package-remove-macro package="package_bind_removed" />
</ocil>
+<ocil><package-check-macro package="bind" /> </ocil>
<rationale>
If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 1752e4c..7d62c2c 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -20,7 +20,7 @@ data available to the public.</description>
<service-disable-macro service="vsftpd" />
</description>
<ocil>
-<service-disable-macro service="vsftpd" />
+<service-disable-check-macro service="vsftpd" />
</ocil>
<rationale>
Running FTP server software provides a network-based avenue
@@ -36,10 +36,10 @@ a risk of compromising sensitive information.
<Rule id="uninstall_vsftpd">
<title>Uninstall vsftpd Package</title>
<description>
-<package-remove-macro service="vsftpd" />
+<package-remove-macro package="vsftpd" />
</description>
<ocil>
-<package-check-macro service="vsftpd" />
+<package-check-macro package="vsftpd" />
</ocil>
<rationale>
Removing the vsftpd package decreases the risk of its
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
index 679d32a..2e29a70 100644
--- a/RHEL6/input/services/http.xml
+++ b/RHEL6/input/services/http.xml
@@ -28,7 +28,7 @@ and removed from the system.
<service-disable-macro service="httpd" />
</description>
<ocil>
-<service-disable-macro service="httpd" />
+<service-disable-check-macro service="httpd" />
</ocil>
<rationale>
Running web server software provides a network-based avenue
@@ -42,10 +42,10 @@ of attack, and should be disabled if not needed.
<Rule id="uninstall_httpd">
<title>Uninstall httpd Package</title>
<description>
-<package-remove-macro service="httpd" />
+<package-remove-macro package="httpd" />
</description>
<ocil>
-<package-check-macro service="httpd" />
+<package-check-macro package="httpd" />
</ocil>
<rationale>
If there is no need to make the web server software available,
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index c60fd2c..f28f833 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -45,7 +45,7 @@ attacks against xinetd itself.
<description>The <tt>xinetd</tt> package can be uninstalled with the
following command:
<pre># yum erase xinetd</pre>
</description>
-<ocil><package-remove-macro package="xinetd" /> </ocil>
+<ocil><package-check-macro package="xinetd" /> </ocil>
<rationale>
Removing the <tt>xinetd</tt> package decreases the risk of the
xinetd service's accidental (or intentional) activation.
@@ -85,7 +85,7 @@ subject to man-in-the-middle attacks.
<description>The <tt>telnet-server</tt> package can be uninstalled
with
the following command:
<pre># yum erase telnet-server</pre></description>
-<ocil><package-remove-macro package="telnet-server" />
</ocil>
+<ocil><package-check-macro package="telnet-server" />
</ocil>
<rationale>
Removing the <tt>telnet-server</tt> package decreases the risk of the
telnet service's accidental (or intentional) activation.
@@ -109,7 +109,7 @@ model.</description>
the following command:
<pre># yum erase rsh-server</pre>
</description>
-<ocil><package-remove-macro package="rsh-server" /> </ocil>
+<ocil><package-check-macro package="rsh-server" /> </ocil>
<rationale>The <tt>rsh-server</tt> package provides several obsolete
and insecure
network services. Removing it
decreases the risk of those services' accidental (or intentional)
@@ -262,11 +262,12 @@ as a tftp server, which does not provide encryption or
authentication.
<Rule id="uninstall_tftp-server">
<title>Uninstall tftp-server Package</title>
-<description>The <tt>tftp-server</tt> package can be removed with the
following
-command:
-<pre># yum erase tftp-server</pre>
+<description>
+<package-remove-macro package="tftp-server" />
</description>
-<ocil><package-remove-macro package="tftp-server" /> </ocil>
+<ocil>
+<package-check-macro package="tftp-server" />
+</ocil>
<rationale>
Removing the <tt>tftp-server</tt> package decreases the risk of the
accidental (or intentional) activation of tftp services.
diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
index 7c54e33..1f1e05d 100644
--- a/RHEL6/input/services/smb.xml
+++ b/RHEL6/input/services/smb.xml
@@ -25,7 +25,9 @@ sharing functionality.
<description>
<service-disable-macro service="smb" />
</description>
-<ocil><service-disable-macro service="smb" /></ocil>
+<ocil>
+<service-disable-check-macro service="smb" />
+</ocil>
<rationale>
Running a Samba server provides a network-based avenue of attack, and
should be disabled if not needed.
--
1.7.1