[PATCH 10/18] Created OVAL check for iptables access to port 80
Willy Santos
wsantos at redhat.com
Thu Apr 12 00:33:46 UTC 2012
---
rhel6/src/input/checks/iptables_http_enabled.xml | 42 ++++++++++++++++++++++
1 files changed, 42 insertions(+), 0 deletions(-)
create mode 100644 rhel6/src/input/checks/iptables_http_enabled.xml
diff --git a/rhel6/src/input/checks/iptables_http_enabled.xml b/rhel6/src/input/checks/iptables_http_enabled.xml
new file mode 100644
index 0000000..6a1f79d
--- /dev/null
+++ b/rhel6/src/input/checks/iptables_http_enabled.xml
@@ -0,0 +1,42 @@
+<def-group>
+ <definition class="compliance"
+ id="iptables_http_enabled" version="1">
+ <metadata>
+ <title>Allow firewall access to the Apache service over port 443.</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <!-- <reference ref_id="TODO:CCE" source="CCE" />-->
+ <description>If Apache is installed, the firewall should allow access to
+ the https service over port 443.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="Test ipv4 port 80 Accept" test_ref="test_iptables_http_enabled_ipv4" />
+ <criterion comment="Test ipv6 port 80 Accept" test_ref="test_iptables_http_enabled_ipv6" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist" comment="Test for port 80 access over ipv4"
+ id="test_iptables_http_enabled_ipv4" version="1">
+ <ind:object object_ref="obj_iptables_http_enabled_ipv4" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="Test for port 80 access over ipv4"
+ id="obj_iptables_http_enabled_ipv4" version="1">
+ <ind:path>/etc/sysconfig</ind:path>
+ <ind:filename>iptables</ind:filename>
+ <ind:pattern operation="pattern match">^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist" comment="Test for port 80 access over ipv6"
+ id="test_iptables_http_enabled_ipv6" version="1">
+ <ind:object object_ref="obj_iptables_http_enabled_ipv6" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="Test for port 80 access over ipv6"
+ id="obj_iptables_http_enabled_ipv6" version="1">
+ <ind:path>/etc/sysconfig</ind:path>
+ <ind:filename>ip6tables</ind:filename>
+ <ind:pattern operation="pattern match">^-A (?:RH-Firewall-1-)?INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.7.6
--------------060302030708000108020305
Content-Type: text/x-patch;
name="0011-Created-OVAL-checks-for-iptables-access-to-port-443.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename*0="0011-Created-OVAL-checks-for-iptables-access-to-port-443.pat";
filename*1="ch"
More information about the scap-security-guide
mailing list