In order to resolve ticket #411 (https://fedorahosted.org/scap-security-guide/ticket/411), I created an OVAL check titled "ftp_present_banner.xml" and added it to the ftp XCCDF content.
Caleb Cooper (1): Created a OVAL check for the presence of a FTP banner.
RHEL6/input/checks/ftp_present_banner.xml | 31 +++++++++++++++++++++++++++++ 1 files changed, 31 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/ftp_present_banner.xml
Signed-off-by: Caleb Cooper coopercd@ornl.gov --- RHEL6/input/checks/ftp_present_banner.xml | 31 +++++++++++++++++++++++++++++ 1 files changed, 31 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/ftp_present_banner.xml
diff --git a/RHEL6/input/checks/ftp_present_banner.xml b/RHEL6/input/checks/ftp_present_banner.xml new file mode 100644 index 0000000..8777157 --- /dev/null +++ b/RHEL6/input/checks/ftp_present_banner.xml @@ -0,0 +1,31 @@ +<def-group> + <definition class="compliance" id="ftp_present_banner" version="1"> + <metadata> + <title>Create Warning Banners for All FTP Users</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>Edit the vsftpd configuration file, which resides at /etc/vsftpd/vsftpd.conf +by default. Add or correct the following configuration options: +banner_file=/etc/issue</description> + <reference source="coopercd" ref_id="20131216" ref_url="test_attestation" /> + </metadata> + <criteria comment="FTP is not being used or conditions are met" + operator="OR"> + <extend_definition comment="vsftpd service is disabled" + definition_ref="service_vsftpd_disabled" /> + <criterion comment="Check Banner for banner path in /etc/vsftpd/vsftpd.conf" + test_ref="test_ftpd_banner_set" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Tests the value of the Banner setting in the /etc/vsftpd/vsftpd.conf file" + id="test_ftpd_banner_set" version="1"> + <ind:object object_ref="obj_ftpd_banner_set" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="obj_ftpd_banner_set" version="1"> + ind:filepath/etc/vsftpd/vsftpd.conf</ind:filepath> + <ind:pattern operation="pattern match">^banner_file=/etc/issue$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group>
scap-security-guide@lists.fedorahosted.org