[PATCH v2] Proxy Prose and OVAL Checks

Michael Palmiotto mpalmiotto at tresys.com
Fri Apr 27 13:12:46 UTC 2012


Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
---
 .../service_squid_acls_configured_filemaker.xml    |   40 ++
 .../checks/service_squid_acls_configured_ftp.xml   |   40 ++
 .../service_squid_acls_configured_gopher.xml       |   40 ++
 .../service_squid_acls_configured_gss_http.xml     |   40 ++
 .../service_squid_acls_configured_http-mgmt.xml    |   40 ++
 .../checks/service_squid_acls_configured_http.xml  |   40 ++
 .../checks/service_squid_acls_configured_https.xml |   40 ++
 .../service_squid_acls_configured_localhost.xml    |   30 ++
 .../service_squid_acls_configured_multiling.xml    |   40 ++
 .../checks/service_squid_acls_configured_wais.xml  |   40 ++
 .../service_squid_authentication_configured.xml    |   30 ++
 ...ervice_squid_default_insecure_forwarded_for.xml |   30 ++
 .../service_squid_default_insecure_log_mime.xml    |   30 ++
 ...id_default_insecure_suppress_version_string.xml |   30 ++
 .../service_squid_default_insecure_underscore.xml  |   30 ++
 .../input/checks/service_squid_logs_forwarded.xml  |   30 ++
 .../checks/service_squid_privileges_lowered.xml    |   70 +++
 .../checks/squid_default_secure_cache_group.xml    |   30 ++
 .../checks/squid_default_secure_cache_user.xml     |   30 ++
 .../checks/squid_default_secure_hostnames.xml      |   30 ++
 .../input/checks/squid_default_secure_passive.xml  |   30 ++
 .../checks/squid_default_secure_reply_header.xml   |   30 ++
 .../checks/squid_default_secure_request_header.xml |   30 ++
 .../input/checks/squid_default_secure_sanity.xml   |   30 ++
 .../squid_default_secured_ignore_unknown.xml       |   30 ++
 .../input/checks/system_proxy_access_allowed.xml   |   30 ++
 rhel6/src/input/profiles/common.xml                |   39 ++-
 rhel6/src/input/services/squid.xml                 |  536 ++++++++++++++++++++
 28 files changed, 1476 insertions(+), 9 deletions(-)
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_filemaker.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_ftp.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_gopher.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_gss_http.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_http-mgmt.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_http.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_https.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_localhost.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_multiling.xml
 create mode 100644 rhel6/src/input/checks/service_squid_acls_configured_wais.xml
 create mode 100644 rhel6/src/input/checks/service_squid_authentication_configured.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_forwarded_for.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_log_mime.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_suppress_version_string.xml
 create mode 100644 rhel6/src/input/checks/service_squid_default_insecure_underscore.xml
 create mode 100644 rhel6/src/input/checks/service_squid_logs_forwarded.xml
 create mode 100644 rhel6/src/input/checks/service_squid_privileges_lowered.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_cache_group.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_cache_user.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_hostnames.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_passive.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_reply_header.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_request_header.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secure_sanity.xml
 create mode 100644 rhel6/src/input/checks/squid_default_secured_ignore_unknown.xml
 create mode 100644 rhel6/src/input/checks/system_proxy_access_allowed.xml

diff --git a/rhel6/src/input/checks/service_squid_acls_configured_filemaker.xml b/rhel6/src/input/checks/service_squid_acls_configured_filemaker.xml
new file mode 100644
index 0000000..3fdad9c
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_filemaker.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_filemaker" version="1">
+    <metadata>
+      <title>ACLs Configured for filemaker Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4519-5" source="CCE" />
+      <description>filemaker not in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" filemaker not in acl" test_ref="test_service_squid_acls_configured_filemaker_noacl" />
+	<criterion comment=" filemaker not in allow list" test_ref="test_service_squid_acls_configured_filemaker_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" filemaker not in acl" id="test_service_squid_acls_configured_filemaker_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_filemaker_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_filemaker_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+filemaker[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/591\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" filemaker not in allow list" id="test_service_squid_acls_configured_filemaker_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_filemaker_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_filemaker_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+filemaker\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_ftp.xml b/rhel6/src/input/checks/service_squid_acls_configured_ftp.xml
new file mode 100644
index 0000000..9c6fc35
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_ftp.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_ftp" version="1">
+    <metadata>
+      <title>ACLs Configured for ftp Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4255-6" source="CCE" />
+      <description>ftp in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" ftp in allow list" test_ref="test_service_squid_acls_configured_ftp_allow" />
+	<criterion comment=" ftp in acl" test_ref="test_service_squid_acls_configured_ftp_acl" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" ftp in allow list" id="test_service_squid_acls_configured_ftp_allow" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_ftp_allow" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_ftp_allow" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+ftp\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" ftp in acl" id="test_service_squid_acls_configured_ftp_acl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_ftp_acl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_ftp_acl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+ftp[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/21\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_gopher.xml b/rhel6/src/input/checks/service_squid_acls_configured_gopher.xml
new file mode 100644
index 0000000..831dd1e
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_gopher.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_gopher" version="1">
+    <metadata>
+      <title>ACLs Configured for gopher Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4127-7" source="CCE" />
+      <description>gopher not in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" gopher not in acl" test_ref="test_service_squid_acls_configured_gopher_noacl" />
+	<criterion comment=" gopher in allow list" test_ref="test_service_squid_acls_configured_gopher_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" gopher not in acl" id="test_service_squid_acls_configured_gopher_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_gopher_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_gopher_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+gopher[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/70\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" gopher in allow list" id="test_service_squid_acls_configured_gopher_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_gopher_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_gopher_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+gopher\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_gss_http.xml b/rhel6/src/input/checks/service_squid_acls_configured_gss_http.xml
new file mode 100644
index 0000000..c574f7b
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_gss_http.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_gss_http" version="1">
+    <metadata>
+      <title>ACLs Configured for gss-http Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4511-2" source="CCE" />
+      <description>gss-http not in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" gss-http not in acl" test_ref="test_service_squid_acls_configured_gss_http_noacl" />
+	<criterion comment=" gss-http not in allow list" test_ref="test_service_squid_acls_configured_gss_http_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" gss-http not in acl" id="test_service_squid_acls_configured_gss_http_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_gss_http_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_gss_http_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+gss\-http[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/488\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" gss-http not in allow list" id="test_service_squid_acls_configured_gss_http_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_gss_http_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_gss_http_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+gss\-http\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_http-mgmt.xml b/rhel6/src/input/checks/service_squid_acls_configured_http-mgmt.xml
new file mode 100644
index 0000000..0f78685
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_http-mgmt.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_http-mgmt" version="1">
+    <metadata>
+      <title>ACLs Configured for http-mgmt Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4373-7" source="CCE" />
+      <description>http-mgmt not in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" http-mgmt not in acl" test_ref="test_service_squid_acls_configured_http-mgmt_noacl" />
+	<criterion comment=" http-mgmt not in allow list" test_ref="test_service_squid_acls_configured_http-mgmt_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" http-mgmt not in acl" id="test_service_squid_acls_configured_http-mgmt_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_http-mgmt_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_http-mgmt_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+http\-mgmt[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/280\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" http-mgmt not in allow list" id="test_service_squid_acls_configured_http-mgmt_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_http-mgmt_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_http-mgmt_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+http\-mgmt\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_http.xml b/rhel6/src/input/checks/service_squid_acls_configured_http.xml
new file mode 100644
index 0000000..b391cc9
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_http.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_http" version="1">
+    <metadata>
+      <title>ACLs Configured for http Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4607-8" source="CCE" />
+      <description>http in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" http in allow list" test_ref="test_service_squid_acls_configured_http_allow" />
+	<criterion comment=" http in acl" test_ref="test_service_squid_acls_configured_http_acl" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" http in allow list" id="test_service_squid_acls_configured_http_allow" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_http_allow" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_http_allow" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+http\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" http in acl" id="test_service_squid_acls_configured_http_acl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_http_acl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_http_acl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+http[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/80\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_https.xml b/rhel6/src/input/checks/service_squid_acls_configured_https.xml
new file mode 100644
index 0000000..efa8801
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_https.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_https" version="1">
+    <metadata>
+      <title>ACLs Configured for https Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4529-4" source="CCE" />
+      <description>https in acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" https in allow list" test_ref="test_service_squid_acls_configured_https_allow" />
+	<criterion comment=" https in acl" test_ref="test_service_squid_acls_configured_https_acl" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" https in allow list" id="test_service_squid_acls_configured_https_allow" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_https_allow" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_https_allow" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+https\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" https in acl" id="test_service_squid_acls_configured_https_acl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_https_acl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_https_acl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+https[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/443\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_localhost.xml b/rhel6/src/input/checks/service_squid_acls_configured_localhost.xml
new file mode 100644
index 0000000..b7c642a
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_localhost.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_localhost" version="1">
+    <metadata>
+      <title>ACLs Configured Proxy localhost Access</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4413-1" source="CCE" />
+      <description>proxy access to localhost denied</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment="localhost not in allow list" test_ref="test_service_squid_acls_configured_localhost_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="localhost not in allow list" id="test_service_squid_acls_configured_localhost_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_localhost_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_localhost_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+to\_localhost\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_multiling.xml b/rhel6/src/input/checks/service_squid_acls_configured_multiling.xml
new file mode 100644
index 0000000..33b03e7
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_multiling.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_multiling" version="1">
+    <metadata>
+      <title>ACLs Configured for multiling http Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4466-9" source="CCE" />
+      <description>multiling-http commented from acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" mutltiling-http not in acl" test_ref="test_service_squid_acls_configured_multiling_noacl" />
+	<criterion comment=" multiling-http not in allow list" test_ref="test_service_squid_acls_configured_multiling_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" mutltiling-http not in acl" id="test_service_squid_acls_configured_multiling_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_multiling_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_multiling_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+multiling\-http[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/777\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" multiling-http not in allow list" id="test_service_squid_acls_configured_multiling_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_multiling_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_multiling_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+multiling\-http\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_acls_configured_wais.xml b/rhel6/src/input/checks/service_squid_acls_configured_wais.xml
new file mode 100644
index 0000000..8df9ec8
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_acls_configured_wais.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="service_squid_acls_configured_wais" version="1">
+    <metadata>
+      <title>ACLs Configured for wais Traffic</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-3610-3" source="CCE" />
+      <description>wais commented from acl allow list</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" wais not in acl" test_ref="test_service_squid_acls_configured_wais_noacl" />
+	<criterion comment=" wais not in allow list" test_ref="test_service_squid_acls_configured_wais_deny" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" wais not in acl" id="test_service_squid_acls_configured_wais_noacl" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_wais_noacl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_wais_noacl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+wais[\s]+src[\s]+[\d{1,3}]\.[\d{1,3}]\.[\d{1,3}]\/210\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment=" wais not in allow list" id="test_service_squid_acls_configured_wais_deny" version="1">
+    <ind:object object_ref="object_service_squid_acls_configured_wais_deny" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_acls_configured_wais_deny" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^http\_access[\s]+allow[\s]+wais\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_authentication_configured.xml b/rhel6/src/input/checks/service_squid_authentication_configured.xml
new file mode 100644
index 0000000..c21349c
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_authentication_configured.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_authentication_configured" version="1">
+    <metadata>
+      <title>Ensure Squid Authentication Configured (if Applicable)</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Ensure ACL Forced to Require Authentication</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" proxy_auth required" test_ref="test_service_squid_authentication_configured_acl" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" proxy_auth required" id="test_service_squid_authentication_configured_acl" version="1">
+    <ind:object object_ref="object_service_squid_authentication_configured_acl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_authentication_configured_acl" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^acl[\s]+[\w(_)*]+[\s]+proxy\_auth[\s]+REQUIRED\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_insecure_forwarded_for.xml b/rhel6/src/input/checks/service_squid_default_insecure_forwarded_for.xml
new file mode 100644
index 0000000..c4d9d10
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_insecure_forwarded_for.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_insecure_forwarded_for" version="1">
+    <metadata>
+      <title>Verify Default Insecure Forwarded Option</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4181-4" source="CCE" />
+      <description>Ensure that forwarded_for option is off</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" forwarded_for off" test_ref="test_service_squid_default_insecure_forwarded_for_off" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" forwarded_for off" id="test_service_squid_default_insecure_forwarded_for_off" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_forwarded_for_off" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_forwarded_for_off" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^forwarded\_for[\s]+off\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_insecure_log_mime.xml b/rhel6/src/input/checks/service_squid_default_insecure_log_mime.xml
new file mode 100644
index 0000000..987a689
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_insecure_log_mime.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_insecure_log_mime" version="1">
+    <metadata>
+      <title>Verify Default Insecure MIME Logged</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4577-3" source="CCE" />
+      <description>Ensure that inseucre default HTTP MIME headers are logged.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" log_mime_hdrs on" test_ref="test_service_squid_default_insecure_log_mime_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" log_mime_hdrs on" id="test_service_squid_default_insecure_log_mime_on" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_log_mime_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_log_mime_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^log\_mime\_hdrs[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_insecure_suppress_version_string.xml b/rhel6/src/input/checks/service_squid_default_insecure_suppress_version_string.xml
new file mode 100644
index 0000000..d636182
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_insecure_suppress_version_string.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_insecure_suppress_version_string" version="1">
+    <metadata>
+      <title>Verify Default Insecure Version String Suppressed</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4494-1" source="CCE" />
+      <description>Ensure that version string is suppressed</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" httpd_suppress_version_string on" test_ref="test_service_squid_default_insecure_suppress_version_string_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" httpd_suppress_version_string on" id="test_service_squid_default_insecure_suppress_version_string_on" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_suppress_version_string_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_suppress_version_string_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^httpd\_suppress\_version\_string[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_default_insecure_underscore.xml b/rhel6/src/input/checks/service_squid_default_insecure_underscore.xml
new file mode 100644
index 0000000..05c5055
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_default_insecure_underscore.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_default_insecure_underscore" version="1">
+    <metadata>
+      <title>Verify Default Insecure Underscore off</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4344-8" source="CCE" />
+      <description>Ensure that allow_underscore option is turrned off.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" allow_underscore off" test_ref="test_service_squid_default_insecure_underscore_off" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" allow_underscore off" id="test_service_squid_default_insecure_underscore_off" version="1">
+    <ind:object object_ref="object_service_squid_default_insecure_underscore_off" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_default_insecure_underscore_off" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^allow\_underscore[\s]+off\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_logs_forwarded.xml b/rhel6/src/input/checks/service_squid_logs_forwarded.xml
new file mode 100644
index 0000000..bb323e1
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_logs_forwarded.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="service_squid_logs_forwarded" version="1">
+    <metadata>
+      <title>Forwarded Log Messages to Syslog Daemon</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Check if Squid sends messages to syslog.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment=" logs forwarded" test_ref="test_service_squid_logs_forwarded_squid_opts" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" logs forwarded" id="test_service_squid_logs_forwarded_squid_opts" version="1">
+    <ind:object object_ref="object_service_squid_logs_forwarded_squid_opts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_logs_forwarded_squid_opts" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^SQUID\_OPTS\=\"\$\{SQUID\_OPTS\:\-\"\-D\"\}[\s]+\-s\"\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/service_squid_privileges_lowered.xml b/rhel6/src/input/checks/service_squid_privileges_lowered.xml
new file mode 100644
index 0000000..e704e05
--- /dev/null
+++ b/rhel6/src/input/checks/service_squid_privileges_lowered.xml
@@ -0,0 +1,70 @@
+<def-group>
+  <definition class="compliance" id="service_squid_privileges_lowered" version="1">
+    <metadata>
+      <title>Service Entry Privileges Lowered</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Ensure service entry is modified to lower priveleges</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" squid status" test_ref="test_service_squid_privileges_lowered_status" />
+	<criterion comment=" subsys remove" test_ref="test_service_squid_privileges_lowered_rm_subsys" />
+	<criterion comment=" bin determined" test_ref="test_service_squid_privileges_lowered_determine_bin" />
+	<criterion comment=" pid changed" test_ref="test_service_squid_privileges_lowered_change_pid" />
+	<criterion comment=" new pid location" test_ref="test_service_squid_privileges_lowered_new_pid_loc" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" squid status" id="test_service_squid_privileges_lowered_status" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_status" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_status" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^status[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" subsys remove" id="test_service_squid_privileges_lowered_rm_subsys" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_rm_subsys" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_rm_subsys" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^rm[\s]+\-f[\s]+\/var\/lock\/subsys\/squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" bin determined" id="test_service_squid_privileges_lowered_determine_bin" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_determine_bin" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_determine_bin" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^\[[\s]+\-f[\s]+\/usr\/sbin\/squid[\s]+\][\s]+\&amp;\&amp;[\s]+SQUID\=\"sudo[\s]+\-u[\s]+squid[\s]+squid\"\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" pid changed" id="test_service_squid_privileges_lowered_change_pid" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_change_pid" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_change_pid" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^\[[\s]+\$RETVAL[\s]+\-eq[\s]+0[\s]+\][\s]+\&amp;\&amp;[\s]+touch[\s]+\/var\/lock\/subsys\/squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment=" new pid location" id="test_service_squid_privileges_lowered_new_pid_loc" version="1">
+    <ind:object object_ref="object_service_squid_privileges_lowered_new_pid_loc" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_service_squid_privileges_lowered_new_pid_loc" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^[\w(_)*]+[\s]+\/var\/spool\/squid\/squid\.pid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_cache_group.xml b/rhel6/src/input/checks/squid_default_secure_cache_group.xml
new file mode 100644
index 0000000..9d072e7
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_cache_group.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_cache_group" version="1">
+    <metadata>
+      <title>Ensure default cache group specified.</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4454-5" source="CCE" />
+      <description>Squid secure cache specified</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" cache_effective_group" test_ref="test_squid_default_secure_cache_group_squid" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" cache_effective_group" id="test_squid_default_secure_cache_group_squid" version="1">
+    <ind:object object_ref="object_squid_default_secure_cache_group_squid" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_cache_group_squid" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^cache\_effective\_group[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_cache_user.xml b/rhel6/src/input/checks/squid_default_secure_cache_user.xml
new file mode 100644
index 0000000..d92da5d
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_cache_user.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_cache_user" version="1">
+    <metadata>
+      <title>Ensure EUID set to appropriate user.</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-3692-1" source="CCE" />
+      <description>Squid secure cache user</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" cache_effective_user" test_ref="test_squid_default_secure_cache_user_squid" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" cache_effective_user" id="test_squid_default_secure_cache_user_squid" version="1">
+    <ind:object object_ref="object_squid_default_secure_cache_user_squid" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_cache_user_squid" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^cache\_effective\_user[\s]+squid\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_hostnames.xml b/rhel6/src/input/checks/squid_default_secure_hostnames.xml
new file mode 100644
index 0000000..210998f
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_hostnames.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_hostnames" version="1">
+    <metadata>
+      <title>Ensure Squid hostnames on</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4503-9" source="CCE" />
+      <description>Squid hostnames on</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" check_hostnames" test_ref="test_squid_default_secure_hostnames_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" check_hostnames" id="test_squid_default_secure_hostnames_on" version="1">
+    <ind:object object_ref="object_squid_default_secure_hostnames_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_hostnames_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^check\_hostnames[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_passive.xml b/rhel6/src/input/checks/squid_default_secure_passive.xml
new file mode 100644
index 0000000..3767579
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_passive.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_passive" version="1">
+    <metadata>
+      <title>Ensure Squid ftp enabled</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4454-5" source="CCE" />
+      <description>Squid ftp enabled</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" ftp_passive" test_ref="test_squid_default_secure_passive_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" ftp_passive" id="test_squid_default_secure_passive_on" version="1">
+    <ind:object object_ref="object_squid_default_secure_passive_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_passive_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ftp\_passive[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_reply_header.xml b/rhel6/src/input/checks/squid_default_secure_reply_header.xml
new file mode 100644
index 0000000..3420244
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_reply_header.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_reply_header" version="1">
+    <metadata>
+      <title>Ensure reply header max size set.</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4419-8" source="CCE" />
+      <description>Squid reply header max</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" reply_header_max_size" test_ref="test_squid_default_secure_reply_header_max" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" reply_header_max_size" id="test_squid_default_secure_reply_header_max" version="1">
+    <ind:object object_ref="object_squid_default_secure_reply_header_max" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_reply_header_max" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^reply\_header\_max\_size[\s]+20[\s]+KB\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_request_header.xml b/rhel6/src/input/checks/squid_default_secure_request_header.xml
new file mode 100644
index 0000000..76f9e86
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_request_header.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_request_header" version="1">
+    <metadata>
+      <title>Ensure request header max size set</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4353-9" source="CCE" />
+      <description>Squid request header max</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" request_header_max_size" test_ref="test_squid_default_secure_request_header_max" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" request_header_max_size" id="test_squid_default_secure_request_header_max" version="1">
+    <ind:object object_ref="object_squid_default_secure_request_header_max" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_request_header_max" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^request\_header\_max\_size[\s]+20[\s]+KB\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secure_sanity.xml b/rhel6/src/input/checks/squid_default_secure_sanity.xml
new file mode 100644
index 0000000..5273c73
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secure_sanity.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secure_sanity" version="1">
+    <metadata>
+      <title>Ensure Squid sanitycheck on</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4459-4" source="CCE" />
+      <description>Squid sanitycheck on</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" ftp_sanitycheck" test_ref="test_squid_default_secure_sanity_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" ftp_sanitycheck" id="test_squid_default_secure_sanity_on" version="1">
+    <ind:object object_ref="object_squid_default_secure_sanity_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secure_sanity_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ftp\_sanitycheck[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/squid_default_secured_ignore_unknown.xml b/rhel6/src/input/checks/squid_default_secured_ignore_unknown.xml
new file mode 100644
index 0000000..d9d6e4e
--- /dev/null
+++ b/rhel6/src/input/checks/squid_default_secured_ignore_unknown.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="squid_default_secured_ignore_unknown" version="1">
+    <metadata>
+      <title>Ensure ignore unknown nameservers enabled as appropriate.</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-4476-8" source="CCE" />
+      <description>Squid ignore unknown</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" ignore_unknown_nameservers" test_ref="test_squid_default_secured_ignore_unknown_on" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" ignore_unknown_nameservers" id="test_squid_default_secured_ignore_unknown_on" version="1">
+    <ind:object object_ref="object_squid_default_secured_ignore_unknown_on" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_squid_default_secured_ignore_unknown_on" version="1">
+    <ind:path> /etc/squid</ind:path>
+    <ind:filename> squid.conf</ind:filename>
+    <ind:pattern operation="pattern match">^ignore\_unknown\_nameservers[\s]+on\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/system_proxy_access_allowed.xml b/rhel6/src/input/checks/system_proxy_access_allowed.xml
new file mode 100644
index 0000000..496f2d0
--- /dev/null
+++ b/rhel6/src/input/checks/system_proxy_access_allowed.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="system_proxy_access_allowed" version="1">
+    <metadata>
+      <title>Configured iptables to Allow Access to the Proxy Server</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Check inbound access to Squid proxy service.</description>
+    </metadata>
+   
+    <criteria operator="AND">
+      
+	<criterion comment=" inbound access to squid proxy service" test_ref="test_system_proxy_access_allowed_netwk_mask" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" inbound access to squid proxy service" id="test_system_proxy_access_allowed_netwk_mask" version="1">
+    <ind:object object_ref="object_system_proxy_access_allowed_netwk_mask" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_system_proxy_access_allowed_netwk_mask" version="1">
+    <ind:path> /etc/sysconfig</ind:path>
+    <ind:filename> iptables"</ind:filename>
+    <ind:pattern operation="pattern match">^\-A[\s]+RH\-Firewall\-1\-INPUT[\s]+\-s[\s]+netwk[\s]+\/mask[\s]+\-m[\s]+state[\s]+\-\-state[\s]+NEW[\s]+\-p[\s]+tcp[\s]+\-\-dport[\s]+\d{4}[\s]+\-j[\s]+ACCEPT\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 8ac2554..4574619 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -193,17 +193,38 @@
 <select idref="require_smb_client_signing" selected="true"/>
 <select idref="require_smb_client_signing_mount.cifs" selected="true"/>
 
-<!--<select idref="select_squid_listening_port" selected="true"/>
-<select idref="verify_default_secure_settings" selected="true"/>
-<select idref="change_default_insecure_settings" selected="true"/>
-<select idref="configure_authentication" selected="true"/>
-<select idref="access_control_lists" selected="true"/>
-<select idref="configure_icp" selected="true"/>
+<select idref="proxy_filemaker_configured" selected="true"/>
+<select idref="proxy_ftp_configured" selected="true"/>
+<select idref="proxy_gopher_configured" selected="true"/>
+<select idref="proxy_gss-http_configured" selected="true"/>
+<select idref="proxy_http-mgmt_configured" selected="true"/>
+<select idref="proxy_https_configured" selected="true"/>
+<select idref="proxy_http_configured" selected="true"/>
+<select idref="proxy_localhost_configured" selected="true"/>
+<select idref="proxy_multiling_configured" selected="true"/>
+<select idref="proxy_wais_configured" selected="true"/>
+
+
+<select idref="verify_forwarded_for_off" selected="true"/>
+<select idref="verify_log_mime_hdrs_on" selected="true"/>
+<select idref="verify_suppress_version_string_on" selected="true"/>
+<select idref="verify_allow_underscore_off" selected="true"/>
+
+<select idref="lower_privileges" selected="true"/>
+
+<select idref="verify_cache_effective_group" selected="true"/>
+<select idref="verify_cache_effective_user" selected="true"/>
+<select idref="verify_ignore_unknown_nameservers" selected="true"/>
+<select idref="verify_ftp_check_hostnames" selected="true"/>
+<select idref="verify_ftp_passive_on" selected="true"/>
+<select idref="verify_reply_header_max" selected="true"/>
+<select idref="verify_request_header_max" selected="true"/>
+<select idref="verify_ftp_sanitycheck_on" selected="true"/>
+
 <select idref="allow_proxy_server_access" selected="true"/>
-<seelect idref="forward_logs_to_syslogd" selected="true"/>
+<select idref="forward_logs_to_syslogd" selected="true"/>
 <select idref="run_squid_in_chroot_jail" selected="true"/>
-<select idref="lower_privileges" selected="true"/>
--->
+
 
 <select idref="disable_squid" selected="true"/>
 <select idref="uninstall_squid" selected="true"/>
diff --git a/rhel6/src/input/services/squid.xml b/rhel6/src/input/services/squid.xml
index 80dc4a4..e13573a 100644
--- a/rhel6/src/input/services/squid.xml
+++ b/rhel6/src/input/services/squid.xml
@@ -44,5 +44,541 @@ removing it provides a safeguard against its activation.
 <oval id="package_squid_removed" />
 </Rule>
 </Group>
+
+<Group id="configure_squid">
+<title> Configure Squid if Necessary</title>
+<description> 
+The Squid configuration file is /etc/squid/squid.conf. The following recommendations can be applied to this 
+file. 
+Note: If a particular tag is not present in the configuration file, Squid falls back to the default setting (which 
+is often illustrated by a comment).</description>
+
+<Rule id="select_squid_listening_port">
+<title> Listen on Uncommon Port</title>
+<description> 
+The default listening port for the Squid service is 3128. As such, it is frequently scanned by adversaries looking 
+for proxy servers. 
+Select an arbitrary (but uncommon) high port to use as the Squid listening port and make the corresponding 
+change to the configuration file: 
+<pre>http_port port </pre>
+Run the following command to add a new SELinux port mapping for the service: 
+<pre># semanage port -a -t http_cache_port_t -p tcp port</pre></description>
+<oval id="squid_listening_port_uncommon" />
+</Rule>
+
+<Group id="verify_default_secure_settings">
+<title>Configure Default Secure Settings</title>
+<description>Several security-enhancing settings in the Squid configuration file are enabled by default, but appear as comments 
+in the configuration file. In these instances, the explicit directive is not present, 
+which means it is implicitly enabled. If you are operating with a default configuration file, this section can be 
+ignored. 
+Ensure that the following security settings are NOT explicitly changed from their default values: 
+</description>
+<!--<ident cce="4454-5, 4353-9, 4503-9, 3585-7, 4419-8, 3692-1, 4459-4, 4476-8" />-->  
+
+<Rule id="verify_ftp_passive_on">
+<title> Verify FTP Passive Connections are Forced</title>
+<description> 
+<pre>ftp_passive on</pre>
+<tt>ftp passive</tt> forces FTP passive connections.</description>
+<ident cce="4454-5" />
+<oval id="squid_default_secure_passive" />
+</Rule>
+
+<Rule id="verify_ftp_sanitycheck_on">
+<title></title>
+<description>
+<pre>ftp_sanitycheck on</pre>
+<tt>ftp sanitycheck</tt> performs additional sanity checks on FTP data connections.
+</description>
+<ident cce="4459-4" />
+<oval id="squid_default_secure_sanity" />
+</Rule>
+
+<Rule id="verify_ftp_check_hostnames_on">
+<title></title>
+<description>
+<pre>check_hostnames on</pre>
+<tt>check hostnames</tt> ensures that hostnames meet RFC compliance.
+</description>
+<ident cce="4503-9" />
+<oval id="squid_default_secure_hostnames" />
+</Rule>
+
+<Rule id="verify_request_header_max">
+<title></title>
+<description>
+<pre>request_header_max_size 20 KB</pre>
+<tt>request header max size</tt> and <tt>reply header max size</tt> place an upper limit on HTTP header length, precau-
+tions against denial-of-service and buffer overflow vulnerabilities.
+</description>
+<ident cce="4353-9" />
+<oval id="squid_default_secure_request_header" />
+</Rule>
+
+<Rule id="verify_reply_header_max">
+<title></title>
+<description>
+<pre>reply_header_max_size 20 KB</pre>
+<tt> header max size</tt> and <tt>reply header max size</tt> place an upper limit on HTTP header length, precau-
+tions against denial-of-service and buffer overflow vulnerabilities.
+</description>
+<ident cce="4419-8" />
+<oval id="squid_default_secure_reply_header" />
+</Rule>
+
+<Rule id="verify_cache_effective_user">
+<title></title>
+<description>
+<pre>cache_effective_user squid</pre>
+<tt>cache effective user</tt> and <tt>cache effective group</tt> designate the EUID and EGID of Squid following initial-
+ization (it is essential that the EUID/EGID be set to an unprivileged sandbox account).
+</description>
+<ident cce="3692-1" />
+<oval id="squid_default_secure_cache_user" />
+</Rule>
+
+<Rule id="verify_cache_effective_group">
+<title></title>
+<description>
+<pre>cache_effective_group squid</pre>
+<tt>cache effective group</tt> designate the EUID and EGID of Squid following initial-
+ization (it is essential that the EUID/EGID be set to an unprivileged sandbox account).
+</description>
+<ident cce="4476-8" />
+<oval id="squid_default_secure_cache_group" />
+</Rule>
+
+<Rule id="verify_ignore_unknown_nameservers">
+<title></title>
+<description>
+<pre>ignore_unknown_nameservers on</pre>
+<tt>ignore unknown nameservers</tt> checks to make sure that DNS responses come from the same IP the request was
+sent to.
+</description>
+<ident cce="3585-7" />
+<oval id= "squid_default_secured_ignore_unknown" />
+</Rule>
 </Group>
 
+<Group id="change_default_insecure_settings">
+<title> Change Default Insecure Settings</title>
+<description> 
+The default configuration settings for the following tags are considered to be weak security and NOT recom- 
+mended:
+<ul>
+<li><tt>allow_underscore</tt> enforces RFC 1034 compliance on hostnames by disallowing the use of underscores.</li>
+<li><tt>httpd</tt> suppress version string prevents Squid from revealing version information in web headers and error 
+pages.</li>
+<li><tt>forwarded_for</tt> reveals proxy client IP addresses in HTTP headers and should be disabled to prevent the leakage of internal network configuration details. </li>
+<li><tt>log_mime_hdrs</tt> enables logging of HTTP response/request headers.</li>
+</ul>
+</description>
+<!--<ident cce="4181-4, 4577-3, 4344-8, 4494-1" />
+<oval id="service_squid_default_insecure_changed" />-->
+
+<Rule id="verify_forwarded_for_off">
+<title> Change Default Insecure Settings</title>
+<description>
+The default configuration settings for the following tags are considered to be weak security and NOT recom-
+mended.
+Add or modify the configuration file to include the following lines:
+<pre>
+forwarded_for off
+</pre>
+<tt>forwarded_for</tt> reveals proxy client IP addresses in HTTP headers and should be disabled to prevent the leakage
+of internal network configuration details.
+</description>
+<ident cce="4181-4"/>
+<oval id="service_squid_default_insecure_forwarded_for" />
+</Rule>
+
+<Rule id="verify_log_mime_hdrs_on">
+<title> Change Default Insecure Settings</title>
+<description>
+Add or modify the configuration file to include the following lines:
+<pre>
+log_mime_hdrs on
+</pre>
+<tt>log_mime_hdrs</tt> enables logging of HTTP response/request headers.</description>
+<ident cce="4577-3"/>
+<oval id="service_squid_default_insecure_log_mime" />
+</Rule>
+
+<Rule id="verify_suppress_version_string_on">
+<title> Change Default Insecure Settings</title>
+<description>
+Add or modify the configuration file to include the following lines:
+<pre>
+httpd_suppress_version_string on
+</pre>
+<tt>httpd</tt> suppress version string prevents Squid from revealing version information in web headers and error
+pages.
+</description>
+<ident cce="4494-1"/>
+<oval id="service_squid_default_insecure_suppress_version_string" />
+
+</Rule>
+
+<Rule id="verify_allow_underscore_off">
+<title> Change Default Insecure Settings</title>
+<description>
+Add or modify the configuration file to include the following lines:
+<pre>allow_underscore off
+</pre>
+<tt>allow_underscore</tt> enforces RFC 1034 compliance on hostnames by disallowing the use of underscores.
+</description>
+<ident cce="4344-8"/>
+<oval id="service_squid_default_insecure_underscore" />
+</Rule>
+</Group> <!-- End <Group id="change_default_insecure_settings"> -->
+
+<Rule id="configure_authentication">
+<title> Configure Authentication if Applicable</title>
+<description> 
+Note: Authentication cannot be used in the case of transparent proxies due to limitations of the TCP/IP 
+protocol. 
+Similar to web servers, two of the available options are Basic and Digest authentication. The other options are 
+NTLM and Negotiate authentication. Basic authentication transmits passwords in 
+plain-text and is susceptible to passive monitoring. If network sniffing is a concern, basic authentication should 
+not be used. Negotiate is the newest and most secure protocol. It attempts to use Kerberos authentication and 
+falls back to NTLM if it cannot. It should be noted that Kerberos requires a third-party Key Distribution Center 
+(KDC) to function properly, whereas the other methods of authentication are two-party schemes. 
+
+Squid also offers the ability to choose a custom external authenticator. Designating an external authenticator 
+(also known as a "helper" module) allows Squid to offer pluggable third-party authentication schemes. LDAP is 
+one example of a helper module that exists and is in use today. 
+There are comments under the <tt>auth_param</tt> tag inside <tt>/etc/squid/squid.conf</tt> that provide extensive detail on how to configure each of these methods. If authentication is necessary, choose a method of authentication and 
+configure appropriately. The recommended minimum configurations illustrated for each method are acceptable. 
+To force an ACL to require authentication, use the following directive: 
+<pre>acl <i>name-of-ACL</i> proxy_auth REQUIRED</pre>
+Note: The keyword <tt>REQUIRED</tt> can be replaced with a user or list of users to further restrict access to a smaller 
+subset of users.</description>
+<oval id="service_squid_authentication_configured" />
+</Rule>
+
+
+<Group id="access_control_lists">
+<title> Access Control Lists (ACL)</title>
+<description> 
+Be very careful with the order of access control tags. Access control is handled top-down. The first 
+rule that matches is the only rule adhered to. The last rule on the list defines the default behavior 
+in the case of no rule match. 
+The acl and http_access tags are used in combination to allow filtering based on a series of access control lists. 
+Squid has a list of default ACLs for localhost, SSL ports, and "safe" ports. Following the definition of these 
+ACLs, a series of http access directives establish the following default filtering policy: 
+<ul>
+<li> Allow <tt>cachemgr</tt> access only from localhost </li>
+<li> Allow access to only ports in the "safe" access control list </li>
+<li> Limit <tt>CONNECT</tt> method to SSL ports only </li>
+<li> Allow access from localhost </li>
+<li> Deny all other requests </li>
+</ul>
+The default ACL policies are reasonable from a security standpoint. However, the number of ports listed as 
+"safe" could be significantly trimmed depending on the needs of your network. Out of the box, ports 21, 70, 80, 
+210, 280, 443, 488, 591, 777, and 1025 through 65535 are all considered safe. Some of these ports are associated
+with deprecated or rarely used protocols. As such, this list could be trimmed to further tighten filtering.
+The following actions should be taken to tighten the ACL policies:
+</description>
+
+<Rule id="localhost_access_denied">
+<title>Proxy Access to localhost Denied by Default</title>
+<description>
+1.There is a filter line in the configuration file that is recommended but commented out. This line should
+be uncommented or added to prevent access to localhost from the proxy:
+<pre>http access deny to_localhost</pre>
+</description>
+<ident cce="CCE-4413-1" />
+<oval id="service_squid_acls_configured_localhost" />
+</Rule>
+
+<Group id="proxy_access_list">
+<title> Establish an Access List for Subset of IPs</title>
+<description>
+2.An access list should be setup for the specific network or networks that the proxy is intended to serve.
+Only this subset of IP addresses should be allowed access.
+Add these lines where the following comment appears:
+
+<pre>
+# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
+acl your-network-acl-name src ip-range
+http_access allow your-network-acl-name
+</pre>
+
+Note: <tt>ip-range</tt> is of the format xxx.xxx.xxx.xxx/xx
+<!--4.Consult the chart below. Corresponding <tt>acl</tt> entries for unused protocols should be commented out and thus denied. -->
+
+</description>
+
+<Rule id="proxy_ftp_configured">
+<description>
+Port: 21<br />
+Service: <tt>ftp</tt> <br />
+File Transfer Protocol(FTP) is a widely used file transfer protocol. <br />
+ALLOW <br />
+<pre>
+acl ftp src 21
+http_access allow ftp
+</pre>
+</description>
+<ident cce="4255-6" />
+<oval id="service_squid_acls_configured_ftp" />
+</Rule>
+
+<Rule id="proxy_gopher_configured">
+<description>
+Port: 70 <br />
+Service: <tt>gopher</tt> <br />
+The gopher protocol is a deprecated search and retrieval protocol
+that is almost extinct, with as few as 100 gopher servers present worldwide.
+Support for gopher is disabled in most modern browsers.<br />
+DENY<br />
+<pre>
+acl gopher src 70
+http_access allow gopher
+</pre>
+</description>
+<ident cce="4127-7" />
+<oval id="service_squid_acls_configured_gopher" />
+</Rule>
+
+<Rule id="proxy_http_configured">
+<description>
+Port: 80<br />
+Service: <tt>http</tt><br />
+A web proxy needs to allow access to HTTP traffic. <br />
+ALLOW<br />
+<pre>
+acl http src 80
+http_access allow http
+</pre>
+</description>
+<ident cce="4607-8" />
+<oval id="service_squid_acls_configured_http" />
+</Rule>
+
+<Rule id="proxy_wais_configured">
+<description>
+Port: 210<br />
+Service: <tt>wais</tt><br />
+The Wide Area Information Server port is similar 
+to gopher, serving as a text searching system
+to scour indexes on remote machines. Today, it is
+deprecated and nearly non-existent on the Inter-
+net.<br />
+DENY<br />
+<pre>
+acl wais src 210
+http_access allow wais
+</pre>
+</description>
+<ident cce="3610-3" />
+<oval id="service_squid_acls_configured_wais" />
+</Rule>
+
+<Rule id="proxy_http-mgmt_configured">
+<description>
+Port: 280<br />
+Service: <tt>http-mgmt</tt><br />
+No documentation of any kind could be found on the
+obscure service that resides on this port.<br />
+DENY<br />
+<pre>
+acl http-mgmt src 280
+http_access allow http-mgmt
+</pre>
+</description>
+<ident cce="4373-7" />
+<oval id="service_squid_acls_configured_http-mgmt" />
+</Rule>
+
+<Rule id="proxy_https_configured">
+<description>
+Port: 443<br />
+Service: <tt>https</tt><br />
+SSL traffic is likely (and recommended) for any
+proxy and should be allowed.<br />
+ALLOW<br />
+<pre>
+acl https src 443
+http_access allow https
+</pre>
+</description>
+<ident cce="4529-4" />
+<oval id="service_squid_acls_configured_https" />
+</Rule>
+
+<Rule id="proxy_gss-http_configured">
+<description>
+Port: 488<br />
+Service: <tt>gss-http</tt><br />
+No documentation of any kind could be found on
+the obscure service that resides on this port.<br />
+DENY<br />
+<pre>
+acl gss-http src 488
+http_access allow gss-http
+</pre>
+</description>
+<ident cce="4511-2" />
+<oval id="service_squid_acls_configured_gss-http" />
+</Rule>
+
+<Rule id="proxy_filemaker_configured">
+<description>
+Port: 591<br />
+Service: <tt>filemaker</tt><br />
+Filemaker is a database application originally offered 
+by Apple in the 1980s. Although development continues
+and it remains in use today, it should be disabled 
+if your network does not require such traffic.<br />
+DENY<br />
+<pre>
+acl filemaker src 591
+http_access allow filemaker
+</pre>
+</description>
+<ident cce="4519-5" />
+<oval id="service_squid_acls_configured_filemaker" />
+</Rule>
+
+<Rule id="proxy_multiling-http_configured">
+<description>
+Port: 777<br />
+Service: <tt>multiling http</tt><br />
+No documentation of any kind could be found on
+the obscure service that resides on this port.<br />
+DENY<br />
+<pre>
+acl ftp src 777
+http_access allow multiling-http
+</pre>
+</description>
+<ident cce="4466-9" />
+<oval id="service_squid_acls_configured_multiling" />
+</Rule>
+
+<!--
+<li>
+Port: 1025-65535<br />
+Service: unregistered ports<br />
+Random high ports are used by a variety of applications
+and should be allowed.<br />
+ALLOW<br />
+</li>
+</ul>
+</description>
+-->
+
+<Group id="proxy_acls_unfiltered">
+<title>Deny All Unfiltered Traffic</title>
+<description>
+Ensure that the final http access line to appear in the document is the following:
+
+<pre>http_access deny all</pre>
+
+This guarantees that all traffic not meeting an explicit filtering rule is denied.
+Further filters should be established to meet the specific needs of a network, explicitly allowing access
+only where necessary.
+</description>
+</Group>
+</Group>
+</Group>
+
+<!-- Removed because this item does not enhance security
+<Rule id="configure_icp">
+ICP protocol is a cache communication protocol that allows multiple Squid servers to communicate. The 
+ICP protocol was designed with no security in mind, relying on user-defined access control lists alone to determine 
+which ICP messages to allow. 
+If a Squid server is standalone, the ICP port should be disabled by adding or correcting the following line in 
+the configuration file: 
+<pre>icp_port 0 </pre>
+If the Squid server is meant to speak with peers, strict ACLs should be established to only allow ICP traffic 
+from trusted neighbors. To accomplish this, add or correct the following lines: 
+<pre>icp_access allow <i>acl-defining-trusted-neighbors</i> 
+icp_access deny all</pre>
+</description>
+<oval id="system_icp_configured" />
+</Rule>-->
+
+<Rule id="allow_proxy_server_access">
+<title> Configure iptables to Allow Access to the Proxy Server</title>
+<description> 
+Determine an appropriate network block, <i>netwk</i>, and network mask, <i>mask</i>, representing the machines on 
+your network which should operate as clients of the proxy server. 
+Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring that it appears <i>before</i> the final <tt>LOG</tt> and <tt>DROP</tt> lines for the <tt>RH-Firewall-1-INPUT</tt> chain: 
+<pre>-A RH-Firewall-1-INPUT -s <i>netwk/mask</i> -m state --state NEW -p tcp --dport <i>port</i> -j ACCEPT </pre>
+For port , use either the default 3128. 
+The default Iptables configuration does not allow inbound access to the Squid proxy service. This modification 
+allows that access, while keeping other ports on the server in their default protected state.  
+</description>
+<oval id="system_proxy_access_allowed" />
+</Rule>
+
+
+<Rule id="forward_logs_to_syslogd">
+<title> Forward Log Messages to Syslog Daemon</title>
+<description> 
+The default behavior of Squid is to record its log messages in <tt>/var/log/squid.log</tt>. This behavior can be 
+supplemented so that Squid also sends messages to syslog as well. This is useful for centralizing log data, 
+particularly in instances where multiple Squid servers are present. 
+Squid provides a command line argument to enable syslog forwarding. Modify the <tt>SQUID_OPTS</tt> line in 
+<tt>/etc/init.d/squid</tt> to include the <tt>-s</tt> option: 
+<pre>SQUID_OPTS="${SQUID_OPTS:-"-D"} -s"</pre></description>
+<oval id="service_squid_logs_forwarded" />
+</Rule>
+
+
+<Group id="disallow_squid_root">
+<title> Do Not Run as Root</title>
+<description> 
+Since Squid is loaded by the system's <tt>service</tt> utility, it starts as root and then changes its effective UID to the 
+UID specified by the <tt>cache_effective_user</tt> directive. However, since it was still executed by root, the program 
+maintains a saved UID of root even after changing its effective UID. 
+To prevent this undesired behavior, Squid must either be configured to run in a chroot environment or it must 
+be executed by a non-privileged user in non-daemon mode (the <tt>service</tt> utility must not be used).</description>
+
+<Rule id="run_squid_in_chroot_jail">
+<title> Run Squid in a <tt>chroot</tt> Jail</title>
+<description> 
+Chrooting Squid can be a very complicated task. Documentation for the process is vague and a great deal 
+of trial and error may be required to determine all the files that need to be transitioned over to the chroot 
+environment. Therefore, this guide recommends instead the method detailed in Section 3.19.2.9.2 to lower 
+privileges. If chrooting Squid is still desired, it can be enabled with the following directive in the configuration 
+file: 
+<pre>chroot <i>chroot-path</i></pre>
+Then, all the necessary files used by Squid must be copied into the <i>chroot-path</i> directory. The specifics of this 
+step cannot be covered in this guide because they are highly dependent on the external programs used in the 
+Squid configuration. 
+Note: The <tt>strace</tt> utility is a valuable resource for discovering the files needed for the chroot environment.</description>
+<oval id="service_squid_chroot_jailed" />
+</Rule>
+
+
+<Rule id="lower_privileges">
+<title> Modify Service Entry to Lower Privileges</title>
+<description> 
+The following modification to <tt>/etc/init.d/squid</tt> forces the <tt>service</tt> utility to execute Squid as the squid
+user instead of the root user: 
+<pre># determine the name of the squid binary 
+[ -f /usr/sbin/squid ] &amp;&amp; SQUID="sudo -u squid squid" </pre>
+Making this change prevents Squid from writing its pid to <tt>/var/run</tt>. This pid file is used by <tt>service</tt> to 
+check to see if the program started successfully. Therefore, a new location must be chosen for this pid file 
+that the squid user has access to, and the corresponding references in <tt>/etc/init.d/squid</tt> must be altered 
+to point to it. 
+Make the following modification to the Squid configuration file: 
+<pre>pid_filename /var/spool/squid/squid.pid</pre>
+Edit the file <tt>/etc/init.d/squid</tt> by changing all occurrences of <tt>/var/run/squid.pid</tt> to <tt>/var/spool/squid/squid.pid</tt>
+Also modify the following line in <tt>/etc/init.d/squid</tt>: 
+<pre>[ $RETVAL -eq 0 ] &amp;&amp; touch /var/lock/subsys/squid</pre>
+and add the following lines immediately after it: 
+<pre>rm -f /var/lock/subsys/squid 
+status squid
+</pre>
+</description>
+<oval id="service_squid_privileges_lowered" />
+</Rule>
+
+</Group> <!-- End <Group id="disallow_squid_root"> -->
+</Group> <!-- End <Group id="configure_squid"> -->
+</Group> <!-- End <Group id="proxy"> -->
-- 
1.7.6.5



More information about the scap-security-guide mailing list