This regex will match on $InputTCPServerRun, $InputRELPServerRun, and $UDPServerRun.
- Maura Dailey
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- RHEL6/input/checks/rsyslog_nolisten.xml | 21 +++++++++------------ 1 files changed, 9 insertions(+), 12 deletions(-)
diff --git a/RHEL6/input/checks/rsyslog_nolisten.xml b/RHEL6/input/checks/rsyslog_nolisten.xml index 46cc285..d9376b6 100644 --- a/RHEL6/input/checks/rsyslog_nolisten.xml +++ b/RHEL6/input/checks/rsyslog_nolisten.xml @@ -1,31 +1,28 @@ <def-group> - <definition class="compliance" - id="rsyslog_nolisten" version="1"> + <definition class="compliance" id="rsyslog_nolisten" version="1"> <metadata> - <title>Disable Rsyslogd from Accepting Remote Messages on - Loghosts Only</title> + <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts + Only</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>RSyslogd should reject remote - messages</description> + <description>rsyslogd should reject remote messages</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_nolisten" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" - comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $InputUDPServerRun | $InputRELPServerRun" + <ind:textfilecontent54_test check="all" check_existence="none_exist" + comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun" id="test_rsyslog_nolisten" version="1"> <ind:object object_ref="object_rsyslog_nolisten" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_rsyslog_nolisten" - version="1"> + <ind:textfilecontent54_object id="object_rsyslog_nolisten" version="1"> ind:path/etc</ind:path> ind:filenamersyslog.conf</ind:filename> - <ind:pattern operation="pattern match">^$Input(?:(TCP)|(UDP)|(RELP))ServerRun\s*$</ind:pattern> + <ind:pattern operation="pattern match">^$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>
scap-security-guide@lists.fedorahosted.org