[PATCH 2/2] linebreak removals from sessions file
Shawn Wells
shawn at redhat.com
Thu Aug 16 23:41:19 UTC 2012
On 8/16/12 6:25 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/accounts/session.xml | 43 ++++++++-----------------------
> 1 files changed, 11 insertions(+), 32 deletions(-)
>
> diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
> index a96cb79..66d9263 100644
> --- a/RHEL6/input/system/accounts/session.xml
> +++ b/RHEL6/input/system/accounts/session.xml
> @@ -1,9 +1,6 @@
> <Group id="accounts-session">
> -<title>
> -Secure Session Configuration Files for Login Accounts
> -</title>
> -<description>
> -When a user logs into a Unix account, the system
> +<title>Secure Session Configuration Files for Login Accounts</title>
> +<description>When a user logs into a Unix account, the system
> configures the user's session by reading a number of files. Many of
> these files are located in the user's home directory, and may have
> weak permissions as a result of user error or misconfiguration. If
> @@ -12,9 +9,7 @@ configuration information, he can often gain full access to the
> affected user's account. Therefore, it is important to test and
> correct configuration file permissions for interactive accounts,
> particularly those of privileged users such as root or system
> -administrators.
> -</description>
> -
> +administrators.</description>
>
> <Value id="max_concurrent_login_sessions_value" type="number"
> operator="equals" interactive="0">
> @@ -28,9 +23,7 @@ operator="equals" interactive="0">
> </Value>
>
> <Rule id="max_concurrent_login_sessions">
> -<title>
> -Set the number of concurrent login sessions allowed per user
> -</title>
> +<title>Set the number of concurrent login sessions allowed per user</title>
> <description>
> Limiting the number of allowed users and sessions per user can limit risks related to Denial of
> Service attacks. This addresses concurrent sessions for a single account and does not address
> @@ -70,9 +63,7 @@ privileged commands by typing the full path to the
> command.</description>
>
> <Rule id="root_path_no_dot">
> -<title>
> -Ensure that Root's Path Does Not Include Relative Paths or Null Directories
> -</title>
> +<title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</title>
> <description>
> Ensure that none of the directories in root's path is equal to a single
> <tt>.</tt> character, or
> @@ -94,9 +85,7 @@ execute code from an untrusted location.
> </Rule>
>
> <Rule id="root_path_no_groupother_writable">
> -<title>
> -Ensure that Root's Path Does Not Include World or Group-Writable Directories
> -</title>
> +<title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
> <description>
> For each element in root's path, run:
> <pre># ls -ld DIR</pre>
> @@ -115,9 +104,7 @@ and potentially malicious code.
> </Group>
>
> <Rule id="homedir_perms_no_groupwrite_worldread">
> -<title>
> -Ensure that User Home Directories are not Group-Writable or World-Readable
> -</title>
> +<title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
> <description>For each human user USER of the system, view the
> permissions of the user's home directory:
> <pre># ls -ld /home/USER</pre>
> @@ -201,9 +188,7 @@ operator="equals" interactive="0">
> </Value>
>
> <Rule id="user_umask_bashrc">
> -<title>
> -Ensure the Default Bash Umask is Set Correctly
> -</title>
> +<title>Ensure the Default Bash Umask is Set Correctly</title>
> <description>
> To ensure the default umask for users of the Bash shell is set properly,
> add or correct in <tt>/etc/bashrc</tt> the line:
> @@ -218,9 +203,7 @@ written to by unauthorized users.</rationale>
> </Rule>
>
> <Rule id="user_umask_cshrc">
> -<title>
> -Ensure the Default C Shell Umask is Set Correctly
> -</title>
> +<title>Ensure the Default C Shell Umask is Set Correctly</title>
> <description>
> To ensure the default umask for users of the C shell is set properly,
> add or correct in <tt>/etc/csh.cshrc</tt> the line:
> @@ -236,9 +219,7 @@ written to by unauthorized users.</rationale>
>
>
> <Rule id="user_umask_profile">
> -<title>
> -Ensure the Default Umask is Set Correctly in /etc/profile
> -</title>
> +<title>Ensure the Default Umask is Set Correctly in /etc/profile</title>
> <description>
> To ensure the default umask controlled by <tt>/etc/profile</tt> is set properly,
> add or correct the line:
> @@ -254,9 +235,7 @@ written to by unauthorized users.</rationale>
>
>
> <Rule id="user_umask_logindefs">
> -<title>
> -Ensure the Default Umask is Set Correctly in login.defs
> -</title>
> +<title>Ensure the Default Umask is Set Correctly in login.defs</title>
> <description>
> To ensure the default umask controlled by <tt>/etc/login.defs</tt> is set properly,
> add or correct the line:
Ack
--
Shawn Wells
Technical Director,
U.S. Intelligence Programs
(e) shawn at redhat.com
(c) 443.534.0130
More information about the scap-security-guide
mailing list