[PATCH] Additional transition notes

Kevin Spargur kspargur at redhat.com
Mon Aug 13 05:25:12 UTC 2012


---
 RHEL6/input/auxiliary/transition_notes.xml |  337 ++++++++++++++++++++++++++--
 1 files changed, 323 insertions(+), 14 deletions(-)

diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 7cb67c2..b40ef00 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -324,14 +324,14 @@ rule=audit_rules_dac_modification manual=no
 
 <note ref="833" auth="KS">
 Sendmail is no longer shipped by default.  Postfix is the default instead.
-Equivilent check does not exist in the RHEL6 prose, it can be automated and 
+Equivalent check does not exist in the RHEL6 prose, it can be automated and 
 the OVAL for it does not appear to already exist. 
 rule=null manual=no
 </note>
 
 <note ref="834" auth="KS">
 Sendmail is no longer shipped by default.  Postfix is the default instead.
-Equivilent check does not exist in the RHEL6 prose, it can be automated and 
+Equivalent check does not exist in the RHEL6 prose, it can be automated and 
 the OVAL for it does not appear to already exist. 
 rule=null manual=no
 </note>
@@ -369,7 +369,9 @@ By default new home directories will be given 700 perms.
 </note>
 
 <note ref="904,905,914,915,924,986,993,995,1021,1022,1046,4087,4268, 
-4346,4357,4360,4366" auth="KS">
+4346,4357,4360,4366,11985,11986,11989,11995,12030,22302,22304,22308,
+22348,22349,22374,22378,22382,22408,22415,22421,22430,22447,22448,
+22449,22473,22475,22485,22486,22487,22488" auth="KS">
 Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
 it does not appear to already exist. 
 rule=null manual=no
@@ -394,8 +396,8 @@ the vendor for correction as a bug in the product.
 
 <note ref="923" auth="KS">
 Check does not exist in the RHEL6 prose, it cannot be entirely automated and 
-the OVAL for it does not appear to already exist. r
-ule=null manual=yes
+the OVAL for it does not appear to already exist. 
+rule=null manual=yes
 A simple example, a cronjob can be made to look for devices and compare to 
 previous lists but still requires someone to review it which is a manual 
 process
@@ -441,10 +443,10 @@ of using TCP Wrappers to protect certain versions of NFS but nothing specific
 which may be the intent as this check is not at all specific either.
 </note>
 
-<note ref="941,982" auth="KS">
+<note ref="941,982,1204" auth="KS">
 Check exists in the RHEL6 prose, it can be automated and the OVAL for it
-appears to already exist.
-rule=ensure_rsyslog_log_file_configuration manual=no
+does not appear to exist.
+group=ensure_rsyslog_log_file_configuration manual=no
 </note>
 
 <note ref="974" auth="KS">
@@ -471,12 +473,13 @@ any files that are world writable but not system owned.  System file
 permissions are addressed through the rpm verification check
 </note>
 
-<note ref="983,1048,1049,1061" auth="KS">
-Check does not exist in the RHEL6 prose, it can be automated and the OVAL for it
-does not appear to already exist.
+<note ref="983,1048,1049,1061,11981,11983,11984,11990,11994,12014,22351,
+22369,22385,22391,22397,22405,22440,22471,22472,22567,22568,22569,22571,
+22572,22573,22586,22587,22702,29289" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
+it does not appear to already exist.
 rule=null manual=no
-This and others like it should be covered under a new section targeting 
-permissions in key directories
+A new section targeting permissions in key directories will be added.
 </note>
 
 <note ref="984,985" auth="KS">
@@ -580,7 +583,7 @@ Cannot programmatically determine if a server is a "valid" DoD time source
 without maintaining a exhaustive list of potentially sensitive information
 </note>
 
-<note ref="4304" auth="KS">
+<note ref="4304,22422" auth="KS">
 Check does not exist in the RHEL6 prose, it can be automated and the OVAL for
 it does not exist.
 rule=null manual=no
@@ -600,7 +603,313 @@ does exist.
 rule=postfix_server_banner manual=no
 </note>
 
+<note ref="4387" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
+it does not exist.
+rule=null manual=no
+If we must include a section on ftp we should at least require it be done over
+SSH.
+</note>
+
+<note ref="4392" auth="KS">
+Check does not exist in the RHEL6 prose, it cannot be automated and the OVAL 
+for it does not exist.
+rule=null manual=yes
+This is not really feasible without maintaining an exhaustive list which 
+constantly changes.  Also, why NMS?  We're allowed to run unauthorized s/w
+on non-NMS systems?
+</note>
+
+<note ref="4395,22455" auth="KS">
+Partial check does exists in the RHEL6 prose, it cannot be entirely automated 
+and partial OVAL check for it does exist.
+rule=rsyslog_send_messages_to_logserver manual=yes
+We can verify that logs are sent to a remote server but we cannot determine in 
+an automated fashion if it is "justified and documented using site-defined 
+procedures."
+</note>
+
+<note ref="4397" auth="KS">
+Partial check does exists in the RHEL6 prose, it can be automated an OVAL check 
+for it appears to exist.
+rule=disable_dhcp_client manual=no
+</note>
+
+<note ref="4399,11987,11988" auth="KS">
+Check in the RHEL6 prose requires NIS not be installed, it can be automated and 
+an OVAL check for it appears to exist.
+rule=uninstall_ypserv manual=no
+Let NIS die.
+</note>
+
+<note ref="4427,4428" auth="KS">
+Check in the RHEL6 prose requires most if not all of these files be removed, 
+it can be automated and an OVAL check for it appears to exist.
+rule=no_rsh_trust_files manual=no
+What "r-commands" are we suggesting be used with these? V-11988 wants these 
+removed anyway.
+</note>
+
+<note ref="4430" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
+it does not exist.
+rule=null manual=no
+This is root:root by default.  A new section will be added discussing 
+permissions on key files.
+</note>
+
+
+<note ref="4689" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
+it does not exist.
+rule=null manual=no
+Wouldn't this also be covered by V-783 on keeping the system patched?
+</note>
+
+<note ref="4689,4691" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
+it does not exist.
+rule=null manual=no
+Wouldn't this also be covered by V-783 on keeping the system patched?
+</note>
+
+<note ref="4695" auth="KS">
+Check does exist in the RHEL6 prose to deny use of TFTP, it can be automated 
+and the OVAL for it does exist.
+rule=tftp-server manual=no
+Is it not necessary for other software on the system to be authorized and 
+approved? 
+</note>
+
+<note ref="4697,12016,12017" auth="KS">
+Check does not exist in the RHEL6 prose, it cannot be automated 
+and the OVAL for it does not exist.
+rule=null manual=yes
+Without knowing what hosts should be trusted we can't do this, we don't really
+want to either.  X has numerous issues.  If remote connections to X must be 
+used it should be tunneled over something such as SSH.
+</note>
+
+<note ref="4702" auth="KS">
+Check does not exist in the RHEL6 prose, it cannot be automated
+and the OVAL for it does not exist.
+rule=null manual=yes
+No automated means to determine presence in DMZ. We should not be allowing FTP.
+</note>
+
+<note ref="11976" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=password_max_age manual=yes
+</note>
+
+<note ref="11980" auth="KS">
+Partial check for authpriv does exist in the RHEL6 prose, it can be automated 
+and the OVAL for it does exist.
+group=ensure_rsyslog_log_file_configuration manual=no
+The authpriv portion seems to be covered in several different places (V-12004,
+V-941).  The value provided by the second half of this is not apparent and not
+in the RHEL6 prose.
+</note>
+
+<note ref="11996" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+appears to exist.
+rule=disable_users_coredumps manual=no
+</note>
+
+<note ref="11999" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=enable_execshield manual=no
+</note>
+
+<note ref="12002" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=set_sysctl_net_ipv4_conf_all_accept_source_route manual=no
+This check is split in the RHEL6 prose and addressed in the rule listed above 
+and the set_sysctl_net_ipv4_conf_default_accept_source_route rule
+</note>
 
+<note ref="846,12010,12011,23732" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+appears to exist.
+rule=uninstall_vsftpd manual=no
+Per V-12010 don't allow FTP.  Lets get rid of these other random FTP rules.
+</note>
 
+<note ref="12023" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=disable_sysctl_ipv4_ip_forward manual=no
+</note>
+
+<note ref="12028" auth="KS">
+Check does not exist in the RHEL6 prose, it cannot be automated and the OVAL 
+for it does not exist.
+rule=null manual=yes
+Any automated effort to check this is at best a token effort.
+</note>
+
+<note ref="22301" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=set_blank_screensaver manual=no
+</note>
+
+<note ref="22303" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=set_password_hashing_algorithm manual=no
+</note>
+
+<note ref="22305,22306,22307" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+group=password_quality_pamcracklib manual=no
+The cracklib checks are in the RHEL6 prose.
+</note>
+
+<note ref="22312" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=no_files_unowned_by_group manual=no
+</note>
+
+<note ref="22339" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=userowner_shadow_file manual=no
+</note>
+
+<note ref="22347" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=no_hashes_outside_shadow manual=no
+</note>
+
+<note ref="22375" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
+does exist.
+rule=configure_auditd_space_left_action manual=no
+</note>
+
+<note ref="22376,22377" auth="KS">
+Partial check does exist in the RHEL6 prose, it can be automated and a partial
+OVAL for it does exist.
+rule=audit_account_changes manual=no
+Auditing of the files is in place but not the commands.
+</note>
+
+<note ref="22383" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=audit_kernel_module_loading manual=no
+</note>
+
+<note ref="22404" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=service_kdump_disabled manual=no
+</note>
+
+<note ref="22409" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=iptables_icmp_disabled manual=no
+This is accomplished by whitelisting specific types of icmp traffic.
+</note>
+
+<note ref="22410,22411" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts manual=no
+V-22410 and V-22411 are the same.
+</note>
+
+<note ref="22414" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=set_sysctl_net_ipv4_conf_all_accept_source_route manual=no
+This check is split in the RHEL6 prose into the above and the 
+set_sysctl_net_ipv4_conf_default_accept_source_route rule.
+</note>
+
+<note ref="22416" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=set_sysctl_net_ipv4_conf_all_accept_redirects manual=no
+This check is split in the RHEL6 prose into the above and the 
+set_sysctl_net_ipv4_conf_default_accept_redirects rule.
+</note>
+
+<note ref="22417" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=disable_sysctl_ipv4_all_send_redirects manual=no
+This check is split in the RHEL6 prose into the above and the 
+disable_sysctl_ipv4_default_send_redirects rule.
+</note>
+
+<note ref="22418" auth="KS">
+Partial check does exist in the RHEL6 prose, it can be automated and partial 
+OVAL for it does exist.
+rule=set_sysctl_net_ipv4_conf_all_log_martians manual=no
+This check is split in the RHEL6 prose into the above but no equivalent rule 
+exists for "default."
+</note>
+
+<note ref="22419" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=set_sysctl_net_ipv4_tcp_syncookies manual=no
+</note>
+
+<note ref="22429" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=service_rpcbind_disabled manual=no
+</note>
+
+<note ref="22431,22432,22433,22434" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=uninstall_rsh-server manual=no
+</note>
+
+<note ref="22456,22461,22462,22463,22474" auth="KS">
+Check does not exist in the RHEL6 prose, it can be automated and OVAL for it 
+does not exist.
+rule=null manual=no
+No check exists for the client side.
+</note>
+
+<note ref="22457" auth="KS">
+Check does not exist in the RHEL6 prose, it cannot be automated and OVAL for 
+it does not exist.
+rule=null manual=yes
+No automated way to determine the management interface.
+</note>
+
+<note ref="22458,22459" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=sshd_use_approved_ciphers manual=no
+V-22458 and V-22459 are essentially the same.
+</note>
+
+<note ref="22470" auth="KS">
+Partial check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=sshd_limit_user_access manual=no
+Prose focuses on blacklisting where we should prefer a whitelist.
+</note>
+
+<note ref="22489" auth="KS">
+Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
+exist.
+rule=sshd_enable_warning_banner manual=no
+</note>
 
 </notegroup>
-- 
1.7.7.6



More information about the scap-security-guide mailing list