Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/services/avahi.xml | 12 ++++++------
RHEL6/input/services/cron.xml | 2 +-
RHEL6/input/services/dhcp.xml | 32 ++++++++++++++++----------------
RHEL6/input/services/dns.xml | 30 +++++++++++++++---------------
RHEL6/input/services/ftp.xml | 20 ++++++++++----------
RHEL6/input/services/imap.xml | 20 ++++++++++----------
RHEL6/input/services/ldap.xml | 6 +++---
RHEL6/input/services/mail.xml | 16 ++++++++--------
RHEL6/input/services/nfs.xml | 13 +++++++------
RHEL6/input/services/ntp.xml | 4 ++--
RHEL6/input/services/obsolete.xml | 6 +++---
RHEL6/input/system/network/ipv6.xml | 8 ++++----
12 files changed, 85 insertions(+), 84 deletions(-)
diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
index a8cf18b..2733018 100644
--- a/RHEL6/input/services/avahi.xml
+++ b/RHEL6/input/services/avahi.xml
@@ -38,7 +38,7 @@ can be trusted.
If your system requires the Avahi daemon, its configuration can be restricted
to improve security. The Avahi daemon configuration file is
<tt>/etc/avahi/avahi-daemon.conf</tt>. The following security
recommendations
-should be applied to this file.
+should be applied to this file:
See the avahi-daemon.conf(5) man page or documentation at
http://www.avahi.org for more detailed information about the configuration options.
</description>
@@ -47,9 +47,9 @@
http://www.avahi.org for more detailed information about the
configuration optio
<title>Serve Avahi Only via Required Protocol</title>
<description>
If you are using only IPv4, edit <tt>/etc/avahi/avahi-daemon.conf</tt> and
ensure
-the following line exists in the <tt>[server]</tt> section.
+the following line exists in the <tt>[server]</tt> section:
<pre>use-ipv6=no</pre>
-Similarly, if you are using only IPv6, disable IPv4 sockets with the line.
+Similarly, if you are using only IPv6, disable IPv4 sockets with the line:
<pre>use-ipv4=no</pre>
</description>
<ref nist="CM-7" />
@@ -78,7 +78,7 @@ are not permitted.
<title>Prevent Other Programs from Using Avahi's Port</title>
<description>
To prevent other mDNS stacks from running, edit
<tt>/etc/avahi/avahi-daemon.conf</tt>
-and ensure the following line appears in the <tt>[server]</tt> section.
+and ensure the following line appears in the <tt>[server]</tt> section:
<pre>disallow-other-stacks=yes</pre>
</description>
<rationale>
@@ -92,7 +92,7 @@ that port on the system.
<title>Disable Avahi Publishing</title>
<description>
To prevent other mDNS stacks from running, edit
<tt>/etc/avahi/avahi-daemon.conf</tt>
-and ensure the following line appears in the <tt>[server]</tt> section.
+and ensure the following line appears in the <tt>[server]</tt> section:
<pre>disallow-other-stacks=yes</pre>
</description>
<rationale>
@@ -109,7 +109,7 @@ If it is necessary to publish some information to the network, it
should not be
by any extraneous information, or by information supplied by a non-trusted source
on the system.
Prevent user applications from using Avahi to publish services by adding or
-correcting the following line in the <tt>[publish]</tt> section.
+correcting the following line in the <tt>[publish]</tt> section:
<pre>disable-user-service-publishing=yes</pre>
Implement as many of the following lines as possible, to restrict the information
published by Avahi.
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index d4e03bc..5972a7f 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -27,7 +27,7 @@ enabling the cron daemon is essential.
<title>Disable anacron Service</title>
<description>The <tt>cronie-anacron</tt> package which provides
anacron
functionality is installed by default. To disable <tt>anacron</tt> support,
-run the following commands.
+run the following commands:
<pre># yum install cronie-noanacron
# yum erase cronie-anacron</pre>
The <tt>anacron</tt> service provides <tt>cron</tt> functionality
for systems
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index ca414d7..7a8d199 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -123,7 +123,7 @@ allocations.</rationale>
<Rule id="dhcp_server_deny_bootp">
<title>Deny BOOTP Queries</title>
<description>Unless your network needs to support older BOOTP clients, disable
-support for the bootp protocol by adding or correcting the global option.
+support for the bootp protocol by adding or correcting the global option:
<pre>deny bootp;</pre>
</description>
<rationale>The bootp option tells dhcpd to respond to BOOTP queries. If support
@@ -139,7 +139,7 @@ vectors against the DHCP server.
<title>Minimize Served Information</title>
<description>Edit /etc/dhcpd.conf. Examine each address range section within
the file, and ensure that the following options are not defined unless there is
-an operational need to provide this information via DHCP.
+an operational need to provide this information via DHCP:
<pre>option domain-name
option domain-name-servers
option nis-domain
@@ -173,7 +173,7 @@ usually static across machines at a given site.</warning>
<Rule id="dhcp_server_configure_logging">
<title>Configure Logging</title>
<description>Ensure that the following line exists in
-<tt>/etc/syslog.conf</tt>.
+<tt>/etc/syslog.conf</tt>:
<pre>daemon.* /var/log/daemon.log</pre>
Configure logwatch or other log monitoring tools to summarize error conditions
reported by the dhcpd process.</description>
@@ -199,15 +199,15 @@ accountability for network activity.
<Rule id="disable_dhcp_client">
<title>Disable DHCP Client</title>
<description>
-For each interface <i>IFACE</i> on the system (e.g. eth0), edit
-<tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt> and
make the
-following changes.
+For each interface on the system (e.g. eth0), edit
+<tt>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></tt>
and make the
+following changes:
<ul>
-<li> Correct the BOOTPROTO line to read.
+<li> Correct the BOOTPROTO line to read:
<pre>BOOTPROTO=static</pre>
</li>
<li> Add or correct the following lines, substituting the appropriate
-values based on your site's addressing scheme.
+values based on your site's addressing scheme:
<pre>NETMASK=255.255.255.0
IPADDR=192.168.1.2
GATEWAY=192.168.1.1</pre>
@@ -215,11 +215,11 @@ GATEWAY=192.168.1.1</pre>
</ul>
</description>
<ocil clause="it does not">
-To verify that DHCP is not being used, examine the following file for each interface.
-<pre># /etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></pre>
-Look for the following.
+To verify that DHCP is not being used, examine the following file for each interface:
+<pre>#
/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></pre>
+Look for the following:
<pre>BOOTPROTO=static</pre>
-and the following, substituting the appropriate values based on your site's
addressing scheme.
+and the following, substituting the appropriate values based on your site's
addressing scheme:
<pre>NETMASK=255.255.255.0
IPADDR=192.168.1.2
GATEWAY=192.168.1.1</pre>
@@ -248,16 +248,16 @@ dhclient(8) and dhclient.conf(5) man pages. </description>
<title>Minimize the DHCP-Configured Options</title>
<description>Create the file <tt>/etc/dhclient.conf</tt>, and add an
appropriate setting for each of the ten configuration settings which can be
-obtained via DHCP. For each setting, do one of the following.
+obtained via DHCP. For each setting, do one of the following:
<br/>
If the setting should <i>not</i> be configured remotely by the DHCP server,
-select an appropriate static value, and add the line.
+select an appropriate static value, and add the line:
<pre>supersede <tt>setting value</tt>;</pre>
-If the setting should be configured remotely by the DHCP server, add the lines.
+If the setting should be configured remotely by the DHCP server, add the lines:
<pre>request <tt>setting</tt>;
require <tt>setting</tt>;</pre>
For example, suppose the DHCP server should provide only the IP address itself
-and the subnet mask. Then the entire file should look like.
+and the subnet mask. Then the entire file should look like:
<pre>supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 6afc4ca..579520a 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -34,7 +34,7 @@ implementation flaws and should be disabled if possible.
<Rule id="uninstall_bind">
<title>Uninstall bind Package</title>
<description>To remove the <tt>bind</tt> package, which contains the
-<tt>named</tt> service, run the following command.
+<tt>named</tt> service, run the following command:
<pre># yum erase bind</pre>
</description>
<ocil><package-check-macro package="bind" /> </ocil>
@@ -68,21 +68,21 @@ machines which act as organizational DNS servers.</description>
<Rule id="dns_server_chroot">
<title>Run DNS Software in a chroot Jail</title>
-<description>Install the <tt>bind-chroot</tt> package.
+<description>Install the <tt>bind-chroot</tt> package:
<pre># yum install bind-chroot</pre>
-Place a valid named.conf file inside the chroot jail.
+Place a valid named.conf file inside the chroot jail:
<pre># cp /etc/named.conf /var/named/chroot/etc/named.conf
# chown root:root /var/named/chroot/etc/named.conf
# chmod 644 /var/named/chroot/etc/named.conf</pre>
Create and populate an appropriate zone directory within the jail, based on the
-options directive. If your <tt>named.conf</tt> includes.
+options directive. If your <tt>named.conf</tt> includes:
<pre>options {
directory "/path/to/DIRNAME ";
...
}</pre>
-then copy that directory and its contents from the original zone directory.
+then copy that directory and its contents from the original zone directory:
<pre># cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME</pre>
-Add or correct the following line within <tt>/etc/sysconfig/named</tt>.
+Add or correct the following line within <tt>/etc/sysconfig/named</tt>:
<pre>ROOTDIR=/var/named/chroot</pre>
</description>
<rationale>Chroot jails are not foolproof. However, they serve to make it more
@@ -134,7 +134,7 @@ DNS data.</description>
<description>Is it possible to run external and internal nameservers on
separate machines? If so, follow the configuration guidance in this section. On
the external nameserver, edit <tt>/etc/named.conf</tt> to add or correct the
-following directives.
+following directives:
<pre>options {
allow-query { any; };
recursion no;
@@ -145,7 +145,7 @@ zone "example.com " IN {
};</pre>
On the internal nameserver, edit <tt>/etc/named.conf</tt>. Add or correct
the
following directives, where SUBNET is the numerical IP representation of your
-organization in the form xxx.xxx.xxx.xxx/xx.
+organization in the form xxx.xxx.xxx.xxx/xx:
<pre>acl internal {
SUBNET ;
localhost;
@@ -190,7 +190,7 @@ Separate machines should be used to fill these two functions whenever
possible.
separate physical machines, run BIND9 and simulate this feature using views.
Edit <tt>/etc/named.conf</tt>. Add or correct the following directives
(where
SUBNET is the numerical IP representation of your organization in the form
-xxx.xxx.xxx.xxx/xx).
+xxx.xxx.xxx.xxx/xx):
<pre>acl internal {
SUBNET ;
localhost;
@@ -237,7 +237,7 @@ this server as a general-purpose nameserver.</warning>
via zone transfer from the primary server? If not, follow the instructions in
this section. If so, see the next section for instructions on protecting zone
transfers.
-Add or correct the following directive within <tt>/etc/named.conf</tt>.
+Add or correct the following directive within <tt>/etc/named.conf</tt>:
<pre>options {
allow-transfer { none; };
...
@@ -257,15 +257,15 @@ disabled to avoid the potential for abuse.</rationale>
<title>Authenticate Zone Transfers</title>
<description>If it is necessary for a secondary nameserver to receive zone data
via zone transfer from the primary server, follow the instructions here. Use
-dnssec-keygen to create a symmetric key file in the current directory.
+dnssec-keygen to create a symmetric key file in the current directory:
<pre># cd /tmp
# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST
dns.example.com
Kdns.example.com .+aaa +iiiii</pre>
This output is the name of a file containing the new key. Read the file to find
-the base64-encoded key string.
+the base64-encoded key string:
<pre># cat
Kdns.example.com .+NNN +MMMMM .key
dns.example.com IN KEY 512 3 157 base64-key-string</pre>
-Add the directives to <tt>/etc/named.conf</tt> on the primary server.
+Add the directives to <tt>/etc/named.conf</tt> on the primary server:
<pre>key zone-transfer-key {
algorithm hmac-md5;
secret "base64-key-string ";
@@ -275,7 +275,7 @@ zone "example.com " IN {
allow-transfer { key zone-transfer-key; };
...
};</pre>
-Add the directives below to <tt>/etc/named.conf</tt> on the secondary
nameserver.
+Add the directives below to <tt>/etc/named.conf</tt> on the secondary
nameserver:
<pre>key zone-transfer-key {
algorithm hmac-md5;
secret "base64-key-string ";
@@ -314,7 +314,7 @@ key files
Kdns.example.com .+NNN +MMMMM .key and
Kdns.example.com
.+NNN +MMMMM
<title>Disable Dynamic Updates</title>
<description>Is there a mission-critical reason to enable the risky dynamic
update functionality? If not, edit <tt>/etc/named.conf</tt>. For each zone
-specification, correct the following directive if necessary.
+specification, correct the following directive if necessary:
<pre>zone "example.com " IN {
allow-update { none; };
...
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 83449ea..95892f1 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -78,7 +78,7 @@ and for consistency with future Red Hat releases, the use of vsftpd is
recommend
<Rule id="ftp_log_transactions">
<title>Enable Logging of All FTP Transactions</title>
<description>Add or correct the following configuration options within the
<tt>vsftpd</tt>
-configuration file, located at <tt>/etc/vsftpd/vsftpd.conf</tt>.
+configuration file, located at <tt>/etc/vsftpd/vsftpd.conf</tt>:
<pre>xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES</pre>
@@ -88,7 +88,7 @@ Find if logging is applied to the ftp daemon.
<br/><br/>
Procedures:
<br/><br/>
-If vsftpd is started by xinetd the following command will indicate the xinetd.d startup
file.
+If vsftpd is started by xinetd the following command will indicate the xinetd.d startup
file:
<pre># grep vsftpd /etc/xinetd.d/*</pre>
<pre># grep server_args <i>vsftpd xinetd.d startup
file</i></pre>
This will indicate the vsftpd config file used when starting through xinetd.
@@ -107,7 +107,7 @@ format. The default vsftpd log file is
/var/log/vsftpd.log.</rationale>
<Rule id="ftp_present_banner" severity="medium">
<title>Create Warning Banners for All FTP Users</title>
<description>Edit the vsftpd configuration file, which resides at
<tt>/etc/vsftpd/vsftpd.conf</tt>
-by default. Add or correct the following configuration options.
+by default. Add or correct the following configuration options:
<pre>banner_file=/etc/issue</pre>
</description>
<rationale>This setting will cause the system greeting banner to be used for FTP
connections as well.</rationale>
@@ -116,10 +116,10 @@ by default. Add or correct the following configuration options.
<!--<oval id="ftp_present_banner" />-->
<!--<ref nist="CM-7" /> -->
<ocil clause="it does not">
-To verify this configuration, run the following command.
+To verify this configuration, run the following command:
<pre>grep "banner_file" /etc/vsftpd/vsftpd.conf</pre>
-The output should show the value of <tt>banner_file</tt> is set to
<tt>/etc/issue</tt>, an example of which is shown below.
+The output should show the value of <tt>banner_file</tt> is set to
<tt>/etc/issue</tt>, an example of which is shown below:
<pre># grep "banner_file" /etc/vsftpd/vsftpd.conf
banner_file=/etc/issue</pre>
</ocil>
@@ -134,7 +134,7 @@ identified need for this access.</description>
<Rule id="ftp_restrict_to_anon">
<title>Restrict Access to Anonymous Users if Possible</title>
<description>Is there a mission-critical reason for users to transfer files to/from
their own accounts using FTP, rather than
-using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration file. Add or
correct the following configuration option.
+using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration file. Add or
correct the following configuration option:
<pre>local_enable=NO</pre>
If non-anonymous FTP logins are necessary, follow the guidance in the remainder of this
section to secure
these logins as much as possible.</description>
@@ -146,11 +146,11 @@ these logins as much as possible.</description>
<Group id="ftp_limit_users">
<title>Limit Users Allowed FTP Access if Necessary</title>
-<description>If there is a mission-critical reason for users to access their
accounts via the insecure FTP protocol, limit the set of users who are allowed this
access. Edit the vsftpd configuration file. Add or correct the following configuration
options.
+<description>If there is a mission-critical reason for users to access their
accounts via the insecure FTP protocol, limit the set of users who are allowed this
access. Edit the vsftpd configuration file. Add or correct the following configuration
options:
<pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</pre>
-Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should
be allowed to access the system via ftp, add a line containing that user's name.
+Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should
be allowed to access the system via ftp, add a line containing that user's name:
<pre>USERNAME</pre>
If anonymous access is also required, add the anonymous usernames to
<tt>/etc/vsftp.ftpusers</tt> as well.
<pre>anonymous
@@ -167,7 +167,7 @@ ftp</pre>
<Rule id="ftp_disable_uploads">
<title>Disable FTP Uploads if Possible</title>
<description>Is there a mission-critical reason for users to upload files via FTP?
If not,
-edit the vsftpd configuration file to add or correct the following configuration
options.
+edit the vsftpd configuration file to add or correct the following configuration
options:
<pre>write_enable=NO</pre>
If FTP uploads are necessary, follow the guidance in the remainder of this section to
secure these transactions
as much as possible.</description>
@@ -197,7 +197,7 @@ these users from filling a disk used by other
services.</rationale>
blocks access to the ports used by the web server.
<iptables-desc-macro allow="true" proto="tcp" port="21"
/>
Edit the file <tt>/etc/sysconfig/iptables-config</tt>. Ensure that the
space-separated list of modules contains
-the FTP connection tracking module.
+the FTP connection tracking module:
<pre>IPTABLES_MODULES="ip_conntrack_ftp"</pre></description>
<rationale>These settings configure iptables to allow connections to an FTP server.
The first line allows initial connections
to the FTP server port.
diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
index ea75dd0..bbd7666 100644
--- a/RHEL6/input/services/imap.xml
+++ b/RHEL6/input/services/imap.xml
@@ -31,7 +31,7 @@ avenue of attack, and should be disabled if not needed.
<Rule id="uninstall_dovecot">
<title>Uninstall dovecot Package</title>
<description>The <tt>dovecot</tt> package can be uninstalled
-with the following command.
+with the following command:
<pre># yum erase dovecot</pre>
</description>
<ocil>
@@ -61,7 +61,7 @@ SSL-protected versions of those protocols. Configure the Dovecot server
to support only the protocols needed by your site. Edit
<tt>/etc/dovecot/dovecot.conf</tt>.
Add or correct the following lines, replacing <tt>PROTOCOL</tt> with
only the subset of protocols (<tt>imap</tt>, <tt>imaps</tt>,
-<tt>pop3</tt>, <tt>pop3s</tt>) required.
+<tt>pop3</tt>, <tt>pop3s</tt>) required:
<pre>protocols = PROTOCOL</pre>
If possible, require SSL protection for all transactions. The SSL
protocol variants listen on alternate ports (995 instead of 110 for
@@ -97,7 +97,7 @@ the server.
<description>To allow clients to make encrypted connections the
<tt>ssl</tt>
flag in Dovecot's configuration file needs to be set to <tt>yes</tt>.
<br /><br />
-Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following line.
+Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following line:
<pre>ssl = yes</pre>
</description>
<rationale>
@@ -112,12 +112,12 @@ impersonating the server.
<Rule id="dovecot_configure_ssl_cert">
<title>Configure Dovecot to Use the SSL Certificate file</title>
-<description>This option tell Dovecot where to find the the mail
+<description>This option tells Dovecot where to find the the mail
server's SSL Certificate.
<br /><br />
Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following
-line. The path below is the default path set by the Dovecot installation. If
-you are using a different path, ensure you reference the appropriate file.
+line (<i>note: the path below is the default path set by the Dovecot installation.
If
+you are using a different path, ensure you reference the appropriate file</i>):
<pre>ssl_cert = </etc/pki/dovecot/certs/dovecot.pem</pre>
</description>
<rationale>
@@ -133,12 +133,12 @@ text over the network.
<Rule id="dovecot_configure_ssl_key">
<title>Configure Dovecot to Use the SSL Key file</title>
-<description>This option tell Dovecot where to find the the mail
+<description>This option tells Dovecot where to find the the mail
server's SSL Key.
<br /><br />
Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the
following
-line. The path below is the default path set by the Dovecot installation. If
-you are using a different path, ensure you reference the appropriate file.
+line (<i>note: the path below is the default path set by the Dovecot installation.
If
+you are using a different path, ensure you reference the appropriate file</i>):
<pre>ssl_key = </etc/pki/dovecot/private/dovecot.pem</pre>
</description>
<rationale>
@@ -156,7 +156,7 @@ text over the network.
<title>Disable Plaintext Authentication</title>
<description>To prevent Dovecot from attempting plaintext
authentication of clients, edit <tt>/etc/dovecot/conf.d/10-auth.conf</tt> and
add
-or correct the following line.
+or correct the following line:
<pre>disable_plaintext_auth = yes</pre>
</description>
<rationale>
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index a9eadf1..06bdfe9 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -95,7 +95,7 @@ intended for use as an LDAP Server it should be removed.
To verify the <tt>openldap-servers</tt> package is not installed,
run the following command:
<pre>$ rpm -q openldap-servers</pre>
-The output should show the following.
+The output should show the following:
<pre>package openldap-servers is not installed</pre>
</ocil>
<rationale>Unnecessary packages should not be installed to decrease the attack
surface of the system.</rationale>
@@ -111,7 +111,7 @@ The output should show the following.
Is this system an OpenLDAP server? If so,
edit the ldap configuration file at
<tt>/etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif</tt>
-to include suffix information relevant to your domain.
+to include suffix information relevant to your domain:
<pre>olcSuffix: "dc=example,dc=com "
olcRootDN: "cn=Manager,dc=example,dc=com "</pre>
where dc=example,dc=com is the same root you will use on the LDAP clients.
@@ -166,7 +166,7 @@ In addition, be sure to use a reasonably strong hash function. The
default hash
<Rule id="ldap_server_config_certificate_files">
<title>Protect LDAP Certificate Files</title>
-<description>Create the PKI directory for LDAP certificates if it does not already
exist.
+<description>Create the PKI directory for LDAP certificates if it does not already
exist:
<pre># mkdir /etc/pki/tls/ldap
# chown root:root /etc/pki/tls/ldap
# chmod 755 /etc/pki/tls/ldap</pre>
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index 261c57a..9d226e3 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -165,16 +165,16 @@ an SSL certificate are independent of the MTA in use, and are
described here.
<Group id="postfix_create_cert">
<title>Create an SSL Certificate</title>
<description>
-Change into the CA certificate directory.
+Change into the CA certificate directory:
<pre># cd /etc/pki/tls/certs</pre>
-Generate a key pair for the mail server.
+Generate a key pair for the mail server:
<pre># openssl genrsa -out mailserverkey.pem 2048</pre>
Next, generate a certificate signing request (CSR) for the CA to sign, making sure to
supply your mail
-server's fully qualified domain name as the Common Name.
+server's fully qualified domain name as the Common Name:
<pre># openssl req -new -key mailserverkey.pem -out mailserver.csr</pre>
Next, the mail server CSR must be signed to create the mail server certificate. You can
either send the CSR
to an established CA or sign it with your CA.
-To sign mailserver.csr using your CA.
+To sign mailserver.csr using your CA:
<pre># openssl ca -in mailserver.csr -out mailservercert.pem</pre>
</description>
<rationale>This step creates a private key, <tt>mailserverkey.pem</tt>,
and a public certificate, <tt>mailservercert.pem</tt>.
@@ -284,12 +284,12 @@ with SSL support.
<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the
contents of the <tt>mynetworks</tt> variable in one of the following
ways:
<ul>
-<li>If any machine in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line.
+<li>If any machine in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line:
<pre>mynetworks_style = subnet</pre></li>
-<li>If only the MTA host itself is trusted to relay messages, add or correct the
following line.
+<li>If only the MTA host itself is trusted to relay messages, add or correct the
following line:
<pre>mynetworks_style = host</pre></li>
<li>If the set of machines which can relay is more complicated, manually specify an
entry for each netblock
-or IP address which is trusted to relay by setting the <tt>mynetworks</tt>
variable directly.
+or IP address which is trusted to relay by setting the <tt>mynetworks</tt>
variable directly:
<pre>mynetworks = 10.0.0.0/16 , 192.168.1.0/24 , 127.0.0.1</pre></li>
</ul>
</description>
@@ -342,7 +342,7 @@ smtpd_recipient_restrictions =
reject_unauth_destination,
...</pre>
Then edit <tt>/usr/lib/sasl2/smtpd.conf</tt> and add or correct the following
line with the correct authentication
-mechanism for SASL to use.
+mechanism for SASL to use:
<pre>pwcheck_method: saslauthd</pre>
<service-enable-macro service="saslauthd" />
</description>
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index f21d309..0b3c139 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -69,7 +69,7 @@ this service should be disabled.
<Group id="disabling_netfs">
<title>Disable netfs if Possible</title>
<description>To determine if any network filesystems handled by netfs are
-currently mounted on the system execute the following command.
+currently mounted on the system execute the following command:
<pre># mount -t nfs,nfs4,smbfs,cifs,ncpfs</pre>
If the command did not return any output then disable netfs.
</description>
@@ -109,7 +109,7 @@ NFSv2, NIS (see Section 3.2.4 for information about NIS, which is not
recommended), or any third-party or custom RPC-based program. If none of these
programs are in use, however, rpcbind should be disabled to improve system
security. In order to get more information about whether rpcbind may be
-disabled on a given host, query rpcbind using the following command.
+disabled on a given host, query rpcbind using the following command:
<pre># rpcinfo -p</pre>
If the only services listed are portmapper and status, it is safe to disable
rpcbind. If other services are listed and your site is not running NFS or NIS,
@@ -338,13 +338,14 @@ intercept the request and substitute a malicious file. Allowing
setuid files to
be executed from remote servers is particularly risky, both for this reason and
because it requires the clients to extend root-level trust to the NFS
server.</description>
+
<Rule id="use_nodev_option_on_nfs_mounts" severity="medium">
<title>Mount Remote Filesystems with nodev</title>
<description>
<mount-desc-macro option="nodev" part="any NFS mounts" />
</description>
<ocil clause="the setting does not show">
-To verify the <tt>nodev</tt> option is configured for all NFS mounts, run the
following command.
+To verify the <tt>nodev</tt> option is configured for all NFS mounts, run the
following command:
<pre>$ mount | grep nfs</pre>
All NFS mounts should show the <tt>nodev</tt> setting in parentheses.
</ocil>
@@ -361,7 +362,7 @@ should not present device files to users.</rationale>
<mount-desc-macro option="nosuid" part="any NFS mounts" />
</description>
<ocil clause="the setting does not show">
-To verify the <tt>nosuid</tt> option is configured for all NFS mounts, run
the following command.
+To verify the <tt>nosuid</tt> option is configured for all NFS mounts, run
the following command:
<pre>$ mount | grep nfs</pre>
All NFS mounts should show the <tt>nosuid</tt> setting in parentheses.
</ocil>
@@ -389,7 +390,7 @@ The syntax of the <tt>exports</tt> file is not necessarily
checked fully on relo
can leave your NFS configuration more open than intended. Therefore, exercise caution
when modifying
the file.
<br /><br />
-The syntax of each line in <tt>/etc/exports</tt> is
+The syntax of each line in <tt>/etc/exports</tt> is:
<pre>/DIR host1(opt1,opt2) host2(opt3)</pre>
where <tt>/DIR</tt> is a directory or filesystem to export,
<tt>hostN</tt> is an IP address, netblock,
hostname, domain, or netgroup to which to export, and <tt>optN</tt> is an
option.
@@ -484,7 +485,7 @@ Remove any instances of the
<tt>insecure_locks</tt> option from the file
<tt>/etc/exports</tt>.
</description>
<ocil clause="there is output">
-To verify insecure file locking has been disabled, run the following command.
+To verify insecure file locking has been disabled, run the following command:
<pre># grep insecure_locks /etc/exports</pre>
</ocil>
<rationale>Allowing insecure file locking could allow for sensitive data to be
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index cde65de..c5c866e 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -55,14 +55,14 @@ logs and auditing possible security breaches.</rationale>
<title>Specify a Remote NTP Server</title>
<description>To specify a remote NTP server for time synchronization, edit
the file <tt>/etc/ntp.conf</tt>. Add or correct the following lines,
-substituting the IP or hostname of a remote NTP server for
<em>ntpserver</em>.
+substituting the IP or hostname of a remote NTP server for
<em>ntpserver</em>:
<pre>server <i>ntpserver</i></pre>
This instructs the NTP software to contact that remote server to obtain time
data.
</description>
<ocil clause="this is not the case">
A remote NTP server should be configured for time synchronization. To verify
-one is configured, open the following file.
+one is configured, open the following file:
<pre>/etc/ntp.conf</pre>
In the file, there should be a section similar to the following:
<pre># --- OUR TIMESERVERS -----
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 88dcf9c..c07a15e 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -189,7 +189,7 @@ stolen by eavesdroppers on the network.
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
-location.
+location:
<pre># rm /etc/hosts.equiv</pre>
<pre>$ rm ~/.rhosts</pre>
</description>
@@ -309,10 +309,10 @@ given directory. Serving files from an intentionally-specified
directory
reduces the risk of sharing files which should remain private.
</rationale>
<ocil>Verify <tt>tftp</tt> is configured by with the
<tt>-s</tt> option by running the
-following command.
+following command:
<pre>grep "server_args" /etc/xinetd.d/tftp</pre>
The output should indicate the <tt>server_args</tt> variable is configured
with the <tt>-s</tt>
-flag, matching the example below.
+flag, matching the example below:
<pre> # grep "server_args" /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot</pre>
</ocil>
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index 7d78337..98387d8 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -163,8 +163,8 @@ An illicit ICMP redirect message could result in a man-in-the-middle
attack.
<Rule id="network_ipv6_static_address">
<title>Manually Assign Global IPv6 Address</title>
-<description>To manually assign an IP address for an interface IFACE , edit the
-file <tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>. Add or correct the
+<description>To manually assign an IP address for an interface, edit the
+file
<tt>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></tt>.
Add or correct the
following line (substituting the correct IPv6 address):
<pre>IPV6ADDR=2001:0DB8::ABCD/64</pre>
Manually assigning an IP address is preferable to accepting one from routers or
@@ -180,7 +180,7 @@ reserved for documentation purposes, as defined by RFC3849.
<title>Use Privacy Extensions for Address</title>
<description>To introduce randomness into the automatic generation of IPv6
addresses, add or correct the following line in
-<tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>:
+<tt>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></tt>:
<pre>IPV6_PRIVACY=rfc3041</pre>
Automatically-generated IPv6 addresses are based on the underlying hardware
(e.g. Ethernet) address, and so it becomes possible to track a piece of
@@ -196,7 +196,7 @@ applied.
<Rule id="network_ipv6_default_gateway">
<title>Manually Assign IPv6 Router Address</title>
<description>Edit the file
-<tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt>, and
add or correct
+<tt>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></tt>,
and add or correct
the following line (substituting your gateway IP as appropriate):
<pre>IPV6_DEFAULTGW=2001:0DB8::0001</pre>
Router addresses should be manually set and not accepted via any
--
1.7.1