We're supposed to meet with Michele about this today, but I guess this
serves as an example.
Please work on comprehensive proofreading instead.
On 10/23/2012 10:52 AM, David Smith wrote:
Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/network/iptables.xml | 8 ++++----
RHEL6/input/system/selinux.xml | 6 +++---
RHEL6/input/system/software/updating.xml | 8 ++++----
3 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/RHEL6/input/system/network/iptables.xml
b/RHEL6/input/system/network/iptables.xml
index 1948224..bb97a11 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -49,7 +49,7 @@ num target prot opt source destination</pre>
The <tt>ip6tables</tt> default rules are essentially the
same.</description>
-<Rule id="enable_ip6tables">
+<Rule id="enable_ip6tables" severity="medium">
<title>Verify ip6tables Enabled</title>
<description>
<service-enable-macro service="ip6tables" />
@@ -63,7 +63,7 @@ capability for IPv6 and ICMPv6.
<ref nist="CM-6, CM-7"
disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/>
</Rule>
-<Rule id="enable_iptables">
+<Rule id="enable_iptables" severity="medium">
<title>Verify iptables Enabled</title>
<description>
<service-enable-macro service="iptables" />
@@ -110,7 +110,7 @@ requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</warning>
-<Rule id="set_iptables_default_rule">
+<Rule id="set_iptables_default_rule" severity="medium">
<title>Set Default Iptables Policy for Incoming Packets</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
@@ -131,7 +131,7 @@ accepted.</rationale>
<ref nist="AC-4, CM-6" disa="66,1109,1154,1414" />
</Rule>
-<Rule id="set_iptables_default_rule_forward">
+<Rule id="set_iptables_default_rule_forward"
severity="medium">
<title>Set Default Iptables Policy for Forwarded Packets</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 6e00f85..1592874 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -82,7 +82,7 @@ and to protect the boot process.
<value selector="mls">mls</value>
</Value>
-<Rule id="enable_selinux_bootloader">
+<Rule id="enable_selinux_bootloader" severity="high">
<title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
<description>SELinux can be disabled at boot time by an argument in
<tt>/etc/grub.conf</tt>.
@@ -104,7 +104,7 @@ the chances that it will remain off during system operation.
<ref nist="AC-3, CM-6" disa="22,32"/>
</Rule>
-<Rule id="set_selinux_state">
+<Rule id="set_selinux_state" severity="high">
<title>Ensure SELinux State is Enforcing</title>
<description>The SELinux state should be set to <tt>enforcing</tt> at
system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct
the
@@ -208,7 +208,7 @@ which use category labelling.</description>
</Group>
-->
-<Rule id="selinux_confinement_of_daemons">
+<Rule id="selinux_confinement_of_daemons" severity="medium">
<title>Ensure No Daemons are Unconfined by SELinux</title>
<description>
Daemons for which the SELinux policy does not contain rules will inherit the
diff --git a/RHEL6/input/system/software/updating.xml
b/RHEL6/input/system/software/updating.xml
index 30331e6..4ed4123 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -18,7 +18,7 @@ for this reason, their use is strongly encouraged.
</description>
<ref disa="1233" />
-<Rule id="ensure_redhat_gpgkey_installed">
+<Rule id="ensure_redhat_gpgkey_installed" severity="high">
<title>Ensure Red Hat GPG Key Installed</title>
<description>
To ensure that the system can cryptographically verify base software
@@ -46,7 +46,7 @@ are from Red Hat.
<!-- REMINDER: Before telling people to update their systems
via the security_patches_up_to_date rule, we must
ensure they have configured an update source! -->
-<Rule id="ensure_gpgcheck_globally_activated">
+<Rule id="ensure_gpgcheck_globally_activated"
severity="high">
<title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
<description>The <tt>gpgcheck</tt> option should be used to ensure
that
checking of an RPM package's signature always occurs prior to its
@@ -75,7 +75,7 @@ protects against malicious tampering.
<tested by="MM" on="20120928"/>
</Rule>
-<Rule id="ensure_gpgcheck_never_disabled">
+<Rule id="ensure_gpgcheck_never_disabled" severity="high">
<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
<description>To ensure that signature checking is not disabled for
any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the
form:
@@ -100,7 +100,7 @@ protects against malicious tampering.
<tested by="MM" on="20120928"/>
</Rule>
-<Rule id="security_patches_up_to_date">
+<Rule id="security_patches_up_to_date" severity="high">
<title>Ensure Software Patches Installed</title>
<description>If the system is joined to the Red Hat Network, a Red Hat Satellite
Server,
or a yum server, run the following command to install updates: