A couple of corrections, version 1.1.
Regards,
Robert K. Burns
Navy Validator
Robert.burns(a)baesystems.com
Rule_Ver,SCAP_ID
RHEL-06-000526,service_autofs_disabled
RHEL-06-000525,enable_auditd_bootloader
RHEL-06-000524,
RHEL-06-000036,userowner_gshadow_file
RHEL-06-000523,
RHEL-06-000522,
RHEL-06-000521,
RHEL-06-000519,rpm_verify_hashes
RHEL-06-000037,groupowner_gshadow_file
RHEL-06-000038,perms_gshadow_file
RHEL-06-000039,userowner_passwd_file
RHEL-06-000040,groupowner_passwd_file
RHEL-06-000518,rpm_verify_permissions
RHEL-06-000517,
RHEL-06-000516,
RHEL-06-000001,partition_for_tmp
RHEL-06-000002,partition_for_var
RHEL-06-000041,file_permissions_etc_passwd
RHEL-06-000042,userowner_group_file
RHEL-06-000043,groupowner_group_file
RHEL-06-000515,
RHEL-06-000044,perms_group_file
RHEL-06-000514,
RHEL-06-000003,partition_for_var_log
RHEL-06-000511,
RHEL-06-000045,file_permissions_library_dirs
RHEL-06-000046,file_ownership_library_dirs
RHEL-06-000004,partition_for_var_log_audit
RHEL-06-000510,configure_auditd_space_left_action
RHEL-06-000047,file_permissions_binary_dirs
RHEL-06-000005,configure_auditd_space_left_action
RHEL-06-000509,
RHEL-06-000048,file_ownership_binary_dirs
RHEL-06-000007,partition_for_home
RHEL-06-000508,
RHEL-06-000050,password_min_len
RHEL-06-000008,ensure_redhat_gpgkey_installed
RHEL-06-000051,password_min_age
RHEL-06-000009,service_rhnsd_disabled
RHEL-06-000053,password_max_age
RHEL-06-000054,password_warn_age
RHEL-06-000011,security_patches_up_to_date
RHEL-06-000056,password_require_digits
RHEL-06-000013,ensure_gpgcheck_globally_activated
RHEL-06-000507,
RHEL-06-000506,
RHEL-06-000505,
RHEL-06-000015,ensure_gpgcheck_never_disabled
RHEL-06-000504,
RHEL-06-000016,package_aide_installed
RHEL-06-000503,kernel_module_usb-storage_disabled
RHEL-06-000019,no_rsh_trust_files
RHEL-06-000027,restrict_root_console_logins
RHEL-06-000385,
RHEL-06-000028,restrict_serial_port_logins
RHEL-06-000384,
RHEL-06-000029,
RHEL-06-000030,no_empty_passwords
RHEL-06-000383,audit_logs_permissions
RHEL-06-000031,no_hashes_outside_shadow
RHEL-06-000032,no_uidzero_except_root
RHEL-06-000357,deny_password_attempts_fail_interval
RHEL-06-000033,userowner_shadow_file
RHEL-06-000034,groupowner_shadow_file
RHEL-06-000035,perms_shadow_file
RHEL-06-000082,disable_sysctl_ipv4_ip_forward
RHEL-06-000117,enable_ip6tables
RHEL-06-000120,set_iptables_default_rule
RHEL-06-000124,disable_protocol_dccp
RHEL-06-000125,disable_protocol_sctp
RHEL-06-000126,disable_protocol_rds
RHEL-06-000127,disable_protocol_tipc
RHEL-06-000133,userowner_rsyslog_files
RHEL-06-000134,groupowner_rsyslog_files
RHEL-06-000136,rsyslog_send_messages_to_logserver
RHEL-06-000137,rsyslog_send_messages_to_logserver
RHEL-06-000167,audit_rules_time_settimeofday
RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route
RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000169,audit_rules_time_stime
RHEL-06-000086,set_sysctl_net_ipv4_conf_all_secure_redirects
RHEL-06-000171,audit_rules_time_clock_settime
RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians
RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route
RHEL-06-000173,audit_rules_time_watch_localtime
RHEL-06-000174,audit_account_changes
RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects
RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects
RHEL-06-000175,audit_account_changes
RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
RHEL-06-000176,audit_account_changes
RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
RHEL-06-000177,audit_account_changes
RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies
RHEL-06-000182,audit_network_modifications
RHEL-06-000183,audit_mac_changes
RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter
RHEL-06-000184,audit_rules_dac_modification_chmod
RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter
RHEL-06-000185,audit_rules_dac_modification_chown
RHEL-06-000098,disable_ipv6_module_loading
RHEL-06-000186,audit_rules_dac_modification_fchmod
RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects
RHEL-06-000103,enable_ip6tables
RHEL-06-000187,audit_rules_dac_modification_fchmodat
RHEL-06-000106,enable_ip6tables
RHEL-06-000188,audit_rules_dac_modification_fchown
RHEL-06-000107,enable_ip6tables
RHEL-06-000189,audit_rules_dac_modification_fchownat
RHEL-06-000113,enable_iptables
RHEL-06-000190,audit_rules_dac_modification_fremovexattr
RHEL-06-000191,audit_rules_dac_modification_fsetxattr
RHEL-06-000192,audit_rules_dac_modification_lchown
RHEL-06-000193,audit_rules_dac_modification_lremovexattr
RHEL-06-000116,enable_ip6tables
RHEL-06-000194,audit_rules_dac_modification_lsetxattr
RHEL-06-000195,audit_rules_dac_modification_removexattr
RHEL-06-000196,audit_rules_dac_modification_setxattr
RHEL-06-000197,audit_file_access
RHEL-06-000198,audit_privileged_commands
RHEL-06-000199,audit_media_exports
RHEL-06-000057,password_require_uppercases
RHEL-06-000058,password_require_specials
RHEL-06-000059,password_require_lowercases
RHEL-06-000060,password_require_diffchars
RHEL-06-000061,deny_password_attempts
RHEL-06-000062,pass set_password_hashing_algorithm_systemauth
RHEL-06-000200,audit_file_deletions
RHEL-06-000063,set_password_hashing_algorithm_logindefs
RHEL-06-000064,set_password_hashing_algorithm_libuserconf
RHEL-06-000201,audit_sysadmin_actions
RHEL-06-000065,user_owner_grub_conf
RHEL-06-000202,audit_kernel_module_loading
RHEL-06-000066,group_owner_grub_conf
RHEL-06-000203,disable_xinetd
RHEL-06-000067,permissions_grub_conf
RHEL-06-000204,uninstall_xinetd
RHEL-06-000068,bootloader_password
RHEL-06-000069,require_singleuser_auth
RHEL-06-000206,uninstall_telnet_server
RHEL-06-000070,disable_interactive_boot
RHEL-06-000211,disable_telnet_service
RHEL-06-000071,package_screen_installed
RHEL-06-000213,uninstall_rsh-server
RHEL-06-000356,deny_password_attempts
RHEL-06-000073,set_system_login_banner
RHEL-06-000214,disable_rsh
RHEL-06-000349,smartcard_auth
RHEL-06-000078,enable_randomize_va_space
RHEL-06-000079,enable_execshield
RHEL-06-000216,disable_rexec
RHEL-06-000348,ftp_present_banner
RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects
RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects
RHEL-06-000218,disable_rlogin
RHEL-06-000220,uninstall_ypserv
RHEL-06-000221,disable_ypbind
RHEL-06-000224,enable_cron
RHEL-06-000222,uninstall_tftp-server
RHEL-06-000227,sshd_allow_only_protocol2
RHEL-06-000230,sshd_set_idle_timeout
RHEL-06-000223,disable_tftp
RHEL-06-000231,sshd_set_keepalive
RHEL-06-000234,sshd_disable_rhosts
RHEL-06-000236,disable_host_auth
RHEL-06-000237,sshd_disable_root_login
RHEL-06-000239,sshd_disable_empty_passwords
RHEL-06-000240,sshd_enable_warning_banner
RHEL-06-000241,sshd_do_not_permit_user_env
RHEL-06-000243,sshd_use_approved_ciphers
RHEL-06-000246,disable_avahi
RHEL-06-000347,no_netrc_files
RHEL-06-000247,enable_ntpd
RHEL-06-000248,ntpd_specify_remote_server
RHEL-06-000249,postfix_network_listening
RHEL-06-000135,rsyslog_file_permissions
RHEL-06-000138,ensure_logrotate_activated
RHEL-06-000252,ldap_client_start_tls
RHEL-06-000253,ldap_client_tls_cacertpath
RHEL-06-000256,package_openldap-servers_removed
RHEL-06-000145,enable_auditd_service
RHEL-06-000257,set_screensaver_inactivity_timeout
RHEL-06-000258,enable_screensaver_after_idle
RHEL-06-000148,enable_auditd_service
RHEL-06-000154,enable_auditd_service
RHEL-06-000160,configure_auditd_max_log_file
RHEL-06-000161,configure_auditd_max_log_file_action
RHEL-06-000165,audit_rules_time_adjtimex
RHEL-06-000159,configure_auditd_num_logs
RHEL-06-000281,rpm_verify_hashes
RHEL-06-000259,enable_screensaver_password_lock
RHEL-06-000260,set_blank_screensaver
RHEL-06-000261,service_abrtd_disabled
RHEL-06-000262,
RHEL-06-000346,set_daemon_umask
RHEL-06-000282,world_writeable_files
RHEL-06-000265,service_ntpdate_disabled
RHEL-06-000345,user_umask_logindefs
RHEL-06-000266,service_oddjobd_disabled
RHEL-06-000344,user_umask_profile
RHEL-06-000267,service_qpidd_disabled
RHEL-06-000343,user_umask_cshrc
RHEL-06-000268,service_rdisc_disabled
RHEL-06-000342,user_umask_bashrc
RHEL-06-000269,use_nodev_option_on_nfs_mounts
RHEL-06-000341,snmpd_not_default_password
RHEL-06-000270,use_nosuid_option_on_nfs_mounts
RHEL-06-000271,mountopt_noexec_on_removable_partitions
RHEL-06-000272,require_smb_client_signing
RHEL-06-000273,require_smb_client_signing_mount.cifs
RHEL-06-000274,limiting_password_reuse
RHEL-06-000275,encrypt_partitions
RHEL-06-000340,snmpd_use_newer_protocol
RHEL-06-000276,encrypt_partitions
RHEL-06-000277,encrypt_partitions
RHEL-06-000278,rpm_verify_permissions
RHEL-06-000279,
RHEL-06-000280,
RHEL-06-000284,install_antivirus
RHEL-06-000285,install_hids
RHEL-06-000286,disable_ctrlaltdel_reboot
RHEL-06-000287,service_postfix_enable
RHEL-06-000306,aide_periodic_cron_checking
RHEL-06-000288,package_sendmail_removed
RHEL-06-000289,service_netconsole_disabled
RHEL-06-000307,aide_periodic_cron_checking
RHEL-06-000290,disable_xwindows_with_runlevel
RHEL-06-000308,disable_users_coredumps
RHEL-06-000291,packagegroup_xwindows_remove
RHEL-06-000309,no_insecure_locks_exports
RHEL-06-000311,configure_auditd_space_left_action
RHEL-06-000292,disable_dhcp_client
RHEL-06-000313,configure_auditd_action_mail_acct
RHEL-06-000294,gid_passwd_group_same
RHEL-06-000315,kernel_module_bluetooth_disabled
RHEL-06-000296,account_unique_name
RHEL-06-000319,max_concurrent_login_sessions
RHEL-06-000297,account_temp_expire_date
RHEL-06-000320,set_iptables_default_rule_forward
RHEL-06-000321,install_openswan
RHEL-06-000324,enable_gdm_login_banner
RHEL-06-000326,
RHEL-06-000298,account_temp_expire_date
RHEL-06-000331,service_bluetooth_disabled
RHEL-06-000334,account_disable_post_pw_expiration
RHEL-06-000299,password_require_consecrepeat
RHEL-06-000335,account_disable_post_pw_expiration
RHEL-06-000302,aide_periodic_cron_checking
RHEL-06-000303,aide_periodic_cron_checking
RHEL-06-000336,sticky_world_writable_dirs
RHEL-06-000304,aide_periodic_cron_checking
RHEL-06-000337,world_writable_files_system_ownership
RHEL-06-000305,aide_periodic_cron_checking
RHEL-06-000338,tftpd_uses_secure_mode
RHEL-06-000339,ftp_log_transactions
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Burns, Robert K
(US SSA)
Sent: Wednesday, September 04, 2013 3:15 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: RE: Re: mappings to DISA STIG identifiers
Here is my mapping. CSV, just cut and paste.
Regards,
Robert K. Burns
Navy Validator
SCAP_ID,Rule_Ver
RHEL-06-000526,service_autofs_disabled
RHEL-06-000525,enable_auditd_bootloader
RHEL-06-000524,
RHEL-06-000036,userowner_gshadow_file
RHEL-06-000523,
RHEL-06-000522,
RHEL-06-000521,
RHEL-06-000519,rpm_verify_hashes
RHEL-06-000037,groupowner_gshadow_file
RHEL-06-000038,perms_gshadow_file
RHEL-06-000039,userowner_passwd_file
RHEL-06-000040,groupowner_passwd_file
RHEL-06-000518,rpm_verify_permissions
RHEL-06-000517,
RHEL-06-000516,
RHEL-06-000001,partition_for_tmp
RHEL-06-000002,partition_for_var
RHEL-06-000041,file_permissions_etc_passwd
RHEL-06-000042,userowner_group_file
RHEL-06-000043,groupowner_group_file
RHEL-06-000515,
RHEL-06-000044,perms_group_file
RHEL-06-000514,
RHEL-06-000003,partition_for_var_log
RHEL-06-000511,
RHEL-06-000045,file_permissions_library_dirs
RHEL-06-000046,file_ownership_library_dirs
RHEL-06-000004,partition_for_var_log_audit
RHEL-06-000510,configure_auditd_space_left_action
RHEL-06-000047,file_permissions_binary_dirs
RHEL-06-000005,configure_auditd_space_left_action
RHEL-06-000509,
RHEL-06-000048,file_ownership_binary_dirs
RHEL-06-000007,partition_for_home
RHEL-06-000508,
RHEL-06-000050,password_min_len
RHEL-06-000008,ensure_redhat_gpgkey_installed
RHEL-06-000051,password_min_age
RHEL-06-000009,service_rhnsd_disabled
RHEL-06-000053,password_max_age
RHEL-06-000054,password_warn_age
RHEL-06-000011,security_patches_up_to_date
RHEL-06-000056,password_require_digits
RHEL-06-000013,ensure_gpgcheck_globally_activated
RHEL-06-000507,
RHEL-06-000506,
RHEL-06-000505,
RHEL-06-000015,ensure_gpgcheck_never_disabled
RHEL-06-000504,
RHEL-06-000016,package_aide_installed
RHEL-06-000503,kernel_module_usb-storage_disabled
RHEL-06-000019,no_rsh_trust_files
RHEL-06-000027,restrict_root_console_logins
RHEL-06-000385,
RHEL-06-000028,restrict_serial_port_logins
RHEL-06-000384,
RHEL-06-000029,
RHEL-06-000030,no_empty_passwords
RHEL-06-000383,audit_logs_permissions
RHEL-06-000031,no_hashes_outside_shadow
RHEL-06-000032,no_uidzero_except_root
RHEL-06-000357,deny_password_attempts_fail_interval
RHEL-06-000033,userowner_shadow_file
RHEL-06-000034,groupowner_shadow_file
RHEL-06-000035,perms_shadow_file
RHEL-06-000082,disable_sysctl_ipv4_ip_forward
RHEL-06-000117,enable_ip6tables
RHEL-06-000120,set_iptables_default_rule
RHEL-06-000124,disable_protocol_dccp
RHEL-06-000125,disable_protocol_sctp
RHEL-06-000126,disable_protocol_rds
RHEL-06-000127,disable_protocol_tipc
RHEL-06-000133,userowner_rsyslog_files
RHEL-06-000134,groupowner_rsyslog_files
RHEL-06-000136,rsyslog_send_messages_to_logserver
RHEL-06-000137,rsyslog_send_messages_to_logserver
RHEL-06-000167,audit_rules_time_settimeofday
RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route
RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000169,audit_rules_time_stime
RHEL-06-000086,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000171,audit_rules_time_clock_settime
RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians
RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route
RHEL-06-000173,audit_rules_time_watch_localtime
RHEL-06-000174,audit_account_changes
RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects
RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects
RHEL-06-000175,audit_account_changes
RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
RHEL-06-000176,audit_account_changes
RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
RHEL-06-000177,audit_account_changes
RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies
RHEL-06-000182,audit_network_modifications
RHEL-06-000183,audit_mac_changes
RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter
RHEL-06-000184,audit_rules_dac_modification_chmod
RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter
RHEL-06-000185,audit_rules_dac_modification_chown
RHEL-06-000098,disable_ipv6_module_loading
RHEL-06-000186,audit_rules_dac_modification_fchmod
RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects
RHEL-06-000103,enable_ip6tables
RHEL-06-000187,audit_rules_dac_modification_fchmodat
RHEL-06-000106,enable_ip6tables
RHEL-06-000188,audit_rules_dac_modification_fchown
RHEL-06-000107,enable_ip6tables
RHEL-06-000189,audit_rules_dac_modification_fchownat
RHEL-06-000113,enable_ip6tables
RHEL-06-000190,audit_rules_dac_modification_fremovexattr
RHEL-06-000191,audit_rules_dac_modification_fsetxattr
RHEL-06-000192,audit_rules_dac_modification_lchown
RHEL-06-000193,audit_rules_dac_modification_lremovexattr
RHEL-06-000116,enable_ip6tables
RHEL-06-000194,audit_rules_dac_modification_lsetxattr
RHEL-06-000195,audit_rules_dac_modification_removexattr
RHEL-06-000196,audit_rules_dac_modification_setxattr
RHEL-06-000197,audit_file_access
RHEL-06-000198,audit_privileged_commands
RHEL-06-000199,audit_media_exports
RHEL-06-000057,password_require_uppercases
RHEL-06-000058,password_require_specials
RHEL-06-000059,password_require_lowercases
RHEL-06-000060,password_require_diffchars
RHEL-06-000061,deny_password_attempts
RHEL-06-000062,
RHEL-06-000200,audit_file_deletions
RHEL-06-000063,set_password_hashing_algorithm_logindefs
RHEL-06-000064,set_password_hashing_algorithm_libuserconf
RHEL-06-000201,audit_sysadmin_actions
RHEL-06-000065,user_owner_grub_conf
RHEL-06-000202,audit_kernel_module_loading
RHEL-06-000066,group_owner_grub_conf
RHEL-06-000203,disable_xinetd
RHEL-06-000067,permissions_grub_conf
RHEL-06-000204,uninstall_xinetd
RHEL-06-000068,bootloader_password
RHEL-06-000069,require_singleuser_auth
RHEL-06-000206,uninstall_telnet_server
RHEL-06-000070,disable_interactive_boot
RHEL-06-000211,disable_telnet_service
RHEL-06-000071,package_screen_installed
RHEL-06-000213,uninstall_rsh-server
RHEL-06-000356,deny_password_attempts
RHEL-06-000073,set_system_login_banner
RHEL-06-000214,disable_rsh
RHEL-06-000349,smartcard_auth
RHEL-06-000078,enable_randomize_va_space
RHEL-06-000079,enable_execshield
RHEL-06-000216,disable_rexec
RHEL-06-000348,ftp_present_banner
RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects
RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects
RHEL-06-000218,disable_rlogin
RHEL-06-000220,uninstall_ypserv
RHEL-06-000221,disable_ypbind
RHEL-06-000224,enable_cron
RHEL-06-000222,uninstall_tftp-server
RHEL-06-000227,sshd_allow_only_protocol2
RHEL-06-000230,sshd_set_idle_timeout
RHEL-06-000223,disable_tftp
RHEL-06-000231,sshd_set_keepalive
RHEL-06-000234,sshd_disable_rhosts
RHEL-06-000236,disable_host_auth
RHEL-06-000237,sshd_disable_root_login
RHEL-06-000239,sshd_disable_empty_passwords
RHEL-06-000240,sshd_enable_warning_banner
RHEL-06-000241,sshd_do_not_permit_user_env
RHEL-06-000243,sshd_use_approved_ciphers
RHEL-06-000246,disable_avahi
RHEL-06-000347,no_netrc_files
RHEL-06-000247,enable_ntpd
RHEL-06-000248,ntpd_specify_remote_server
RHEL-06-000249,postfix_network_listening
RHEL-06-000135,rsyslog_file_permissions
RHEL-06-000138,ensure_logrotate_activated
RHEL-06-000252,ldap_client_start_tls
RHEL-06-000253,ldap_client_tls_cacertpath
RHEL-06-000256,package_openldap-servers_removed
RHEL-06-000145,enable_auditd_service
RHEL-06-000257,set_screensaver_inactivity_timeout
RHEL-06-000258,enable_screensaver_after_idle
RHEL-06-000148,enable_auditd_service
RHEL-06-000154,enable_auditd_service
RHEL-06-000160,configure_auditd_max_log_file
RHEL-06-000161,configure_auditd_max_log_file_action
RHEL-06-000165,audit_rules_time_adjtimex
RHEL-06-000159,configure_auditd_num_logs
RHEL-06-000281,rpm_verify_hashes
RHEL-06-000259,enable_screensaver_password_lock
RHEL-06-000260,set_blank_screensaver
RHEL-06-000261,service_abrtd_disabled
RHEL-06-000262,
RHEL-06-000346,set_daemon_umask
RHEL-06-000282,world_writeable_files
RHEL-06-000265,service_ntpdate_disabled
RHEL-06-000345,user_umask_logindefs
RHEL-06-000266,service_oddjobd_disabled
RHEL-06-000344,user_umask_profile
RHEL-06-000267,service_qpidd_disabled
RHEL-06-000343,user_umask_cshrc
RHEL-06-000268,service_rdisc_disabled
RHEL-06-000342,user_umask_bashrc
RHEL-06-000269,use_nodev_option_on_nfs_mounts
RHEL-06-000341,snmpd_not_default_password
RHEL-06-000270,use_nosuid_option_on_nfs_mounts
RHEL-06-000271,mountopt_noexec_on_removable_partitions
RHEL-06-000272,require_smb_client_signing
RHEL-06-000273,require_smb_client_signing_mount.cifs
RHEL-06-000274,limiting_password_reuse
RHEL-06-000275,encrypt_partitions
RHEL-06-000340,snmpd_use_newer_protocol
RHEL-06-000276,encrypt_partitions
RHEL-06-000277,encrypt_partitions
RHEL-06-000278,rpm_verify_permissions
RHEL-06-000279,
RHEL-06-000280,
RHEL-06-000284,install_antivirus
RHEL-06-000285,install_hids
RHEL-06-000286,disable_ctrlaltdel_reboot
RHEL-06-000287,service_postfix_enable
RHEL-06-000306,aide_periodic_cron_checking
RHEL-06-000288,package_sendmail_removed
RHEL-06-000289,service_netconsole_disabled
RHEL-06-000307,aide_periodic_cron_checking
RHEL-06-000290,disable_xwindows_with_runlevel
RHEL-06-000308,disable_users_coredumps
RHEL-06-000291,packagegroup_xwindows_remove
RHEL-06-000309,no_insecure_locks_exports
RHEL-06-000311,configure_auditd_space_left_action
RHEL-06-000292,disable_dhcp_client
RHEL-06-000313,configure_auditd_action_mail_acct
RHEL-06-000294,gid_passwd_group_same
RHEL-06-000315,kernel_module_bluetooth_disabled
RHEL-06-000296,account_unique_name
RHEL-06-000319,max_concurrent_login_sessions
RHEL-06-000297,account_temp_expire_date
RHEL-06-000320,set_iptables_default_rule_forward
RHEL-06-000321,install_openswan
RHEL-06-000324,enable_gdm_login_banner
RHEL-06-000326,
RHEL-06-000298,account_temp_expire_date
RHEL-06-000331,service_bluetooth_disabled
RHEL-06-000334,account_disable_post_pw_expiration
RHEL-06-000299,password_require_consecrepeat
RHEL-06-000335,account_disable_post_pw_expiration
RHEL-06-000302,aide_periodic_cron_checking
RHEL-06-000303,aide_periodic_cron_checking
RHEL-06-000336,sticky_world_writable_dirs
RHEL-06-000304,aide_periodic_cron_checking
RHEL-06-000337,world_writable_files_system_ownership
RHEL-06-000305,aide_periodic_cron_checking
RHEL-06-000338,tftpd_uses_secure_mode
RHEL-06-000339,ftp_log_transactions
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Moessbauer,
David
Sent: Wednesday, September 04, 2013 4:18 AM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: RE: Re: mappings to DISA STIG identifiers
Thanks that is the exact kind of artifact I was looking for - though I do understand that
its current state may not be 4.0.
Regarding the NIST controls; yes I know this is eventually coming down the pike (at least
as of last I heard), but there is a need to address accreditations in the interim. And
as the Navy is my branch of interest, I expect it may still be a little while until these
controls are fully replaced.
If in the future this also included the NIST controls, that would be very helpful in
POA&M transitions to the newer controls.
V/r
David W. Moessbauer
System Engineer
Progeny Systems Corporation
david.moessbauer(a)progeny.net
SIPR: david.moessbauer.ctr(a)progeny.spawar-chas.navy.smil.mil
(410) 627-5633 (M)
(703) 368-6107 x315 (O) / x125 (lab)
Sent from my Verizon Wireless 4G LTE Smartphone
-------- Original message --------
From: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
Date: 09/03/2013 23:13 (GMT-05:00)
To: scap-security-guide(a)lists.fedorahosted.org
Subject: (nwl) Re: mappings to DISA STIG identifiers
Ah, gotcha.
I can't find the authoritative memo that says so (DIARMF-related?), but what I'd
been hearing for a while is that the DoD will be adopting the NIST 800-53 controls (via
CNSS 1253). Can anyone else speak to this from the policy angle? I assume this is why
the older DoD IA controls are not explicitly included with the RHEL 6 STIG. I assume this
represents represents DoD thinking (11 months ago, anyway):
http://csrc.nist.gov/groups/SMA/ispab/documents/minutes/2012-10/ispab_oct...
As for such a table, we're generating something similar already:
http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6.html
However, the STIG-related references here likely aren't accurate, as we haven't
account for any changes made by FSO, so I can't recommend using this yet. Once we can
synchronize with them and establish the undesirability of any future private changes, it
should be possible to scalably reduce costs for C&A activities by providing such
commonly-used tables in the project.
On Tue, Sep 3, 2013 at 10:08 PM, Moessbauer, David <david.moessbauer(a)progeny.net>
wrote:
At a minimum, I would suggest that such a table would contain
a unique identifier such as the Group ID (Vulid) or the Rule Version
(STIG-ID), the CCE number currently detailed in the SCAP results and
the Severity (CAT).
With this all can be easily linked back to the pertinent STIG. The IA
Control was also presented in the prior iteration of the UNIX
Checklist and earlier versions of the RHEL5 XCCDF.
An IAC is the 'Information Assurance Control' as defined in DoDD
8500.01 and enumerated in DoDI 8500.2.
The definition detailed in paragraph E2.1.19 of Directive states that
"an IA Control is an objective IA condition of integrity, availability
or confidentiality achieved through the application of specific
safeguards or through the regulation of specific activities that is
expressed in a specified format, i.e., a control number, a control
name, control text, and a control class. Specific management,
personnel, operational, and technical controls are applied to each DoD
information system to achieve an appropriate level of integrity,
availability, and confidentiality in accordance with reference"
The following is an excerpt of a couple of them as displayed in this
Instruction, where the 5 digit identifier is the IAC (IE: 'DCCB-2')
DCCB-2 Control Board
All information systems are under the control of a chartered
Configuration Control Board that meets regularly according to DCPR-1.
The IAM is a member of the CCB.
DCCS-2 Configuration Specifications
A DoD reference document such as a security technical implementation
guide or security recommendation guide constitutes the primary source
for security configuration or implementation guidance for the
deployment of newly acquired IA- and IA-enabled IT products that
require use of the product's IA capabilities. If a DoD reference
document is not available, the system owner works with DISA or NSA to
draft configuration guidance for inclusion in a Departmental reference
guide.
DCCT-1 Compliance Testing
A comprehensive set of procedures is implemented that tests all
patches, upgrades, and new AIS applications prior to deployment.
BTW: apologize for my prior hijacking of subject line…
v/r
David Moessbauer
(410) 627-5633 (M)
The Information contained in or attached to this communication may be
confidential and privileged proprietary intended only for the
individual/s or entity to whom/which it is addressed. Any unauthorized
use, distribution, copying or disclosure of this information is
strictly prohibited. If you have received this communication in error
please contact the sender immediately and delete from your system.
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf
Of Jeffrey Blank
Sent: Tuesday, September 03, 2013 9:30 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: (nwl) mappings to DISA STIG identifiers
I have started a new subject/thread for this discussion.
Please note: Subscribers to the list should never reply to any
message, particularly one with a complex subject, and move to an
off-topic discussion. It quickly results in confusion for mail
clients which perform threaded display, as well as the list's web archives.
As to David's question, there has been some informal discussion, but
we have also not fully settled on how to do this. This will be a
topic of an upcoming discussion, and it will also be key to ensuring
that there is good correspondence between the STIG profile in SSG and
the STIG which FSO releases.
The CAT level should be identified as Severity (and this should be
present in scan results).
Assuming your desired output is a table, can you describe what columns
would be in it?
What's an IAC?
On Tue, Sep 3, 2013 at 6:25 PM, Moessbauer, David
<david.moessbauer(a)progeny.net> wrote:
> A crucial piece of the current C&A Package is the need to
> appropriately identify any vulnerabilities found via scans, inclusive
> of the CAT level, both of which are identified in the STIG. Aside
> from this, the STIG ID provides means to identify the IAC of a given vulnerability as
well.
>
> CCI mapping would help, however, as these are not unique, it does not
> fully accomplish the task at hand.
>
> Speaking as one that completes C&A Packages for purposes of ATO
> acquisition, I would argue that this is a critical mapping.
>
> v/r
>
> David Moessbauer
> (410) 627-5633 (M)
>
> The Information contained in or attached to this communication may be
> confidential and privileged proprietary intended only for the
> individual/s or entity to whom/which it is addressed. Any
> unauthorized use, distribution, copying or disclosure of this
> information is strictly prohibited. If you have received this
> communication in error please contact the sender immediately and delete from your
system.
>
>
> -----Original Message-----
> From: scap-security-guide-bounces(a)lists.fedorahosted.org
> [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf
> Of Shawn Wells
> Sent: Tuesday, September 03, 2013 3:25 PM
> Cc: scap-security-guide(a)lists.fedorahosted.org
> Subject: Re: Possibility of Fedora SCAP content to be served by SCAP
> security guide repository (either as subdirectory or via separated branch)?
>
> On 9/3/13 2:22 PM, Moessbauer, David wrote:
>> Is there a matrix that can be referenced that will map the DISA
>> STIG-ID (or Group ID) to the CCE Audit IDs? ...or any other mapping
>> that can be deduced
>>
>> In Example:
>> Group ID (Vulid): V-38487
>> Group Title: SRG-OS-000103
>> Rule ID: SV-50288r1_rule
>> Rule Version (STIG-ID): RHEL-06-000015
>
>
> That metadata hasn't been added... to be honest, nobody has found the
> mappings meaningful enough to do. Can you help us understand how it'd
> benefit you?
>
> Right now SSG rules are mapped back to the CCIs through various <ref>
> tags, e.g.:
> <ref nist="AC-6,AU-9" disa="22,32" />
>
> We could easily extend this to include a "stigid" name-pair value,
> should (a) the community be convinced this would help end-users, and
> (b) volunteers to perform the mapping
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide