This regex will match on $InputTCPServerRun, $InputRELPServerRun, and $UDPServerRun.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/checks/rsyslog_nolisten.xml | 21 +++++++++------------
1 files changed, 9 insertions(+), 12 deletions(-)
diff --git a/RHEL6/input/checks/rsyslog_nolisten.xml
b/RHEL6/input/checks/rsyslog_nolisten.xml
index 46cc285..d9376b6 100644
--- a/RHEL6/input/checks/rsyslog_nolisten.xml
+++ b/RHEL6/input/checks/rsyslog_nolisten.xml
@@ -1,31 +1,28 @@
<def-group>
- <definition class="compliance"
- id="rsyslog_nolisten" version="1">
+ <definition class="compliance" id="rsyslog_nolisten"
version="1">
<metadata>
- <title>Disable Rsyslogd from Accepting Remote Messages on
- Loghosts Only</title>
+ <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts
+ Only</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>RSyslogd should reject remote
- messages</description>
+ <description>rsyslogd should reject remote messages</description>
+ <reference source="MED" ref_id="20130819"
ref_url="test_attestation" />
</metadata>
<criteria>
<criterion comment="Conditions are satisfied"
test_ref="test_rsyslog_nolisten" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist"
- comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun |
$InputUDPServerRun | $InputRELPServerRun"
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist"
+ comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun |
$UDPServerRun | $InputRELPServerRun"
id="test_rsyslog_nolisten" version="1">
<ind:object object_ref="object_rsyslog_nolisten" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_rsyslog_nolisten"
- version="1">
+ <ind:textfilecontent54_object id="object_rsyslog_nolisten"
version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
- <ind:pattern operation="pattern
match">^\$Input(?:(TCP)|(UDP)|(RELP))ServerRun\s*$</ind:pattern>
+ <ind:pattern operation="pattern
match">^\$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.7.1
Show replies by date