[PATCH 2/2] SRG/CCI reference fixups per FSO feedback from 11/20

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Dec 17 23:08:18 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/srg_support.xml              |    2 +-
 RHEL6/input/services/obsolete.xml                  |    8 ++++----
 RHEL6/input/services/ssh.xml                       |    4 ++--
 .../accounts/restrictions/password_expiration.xml  |    2 +-
 RHEL6/input/system/auditing.xml                    |    6 +++---
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index d80264b..b19b8d0 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -21,7 +21,7 @@ compliance. This is a permanent not a finding.
 <description> 
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674" />
+<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1427,1499,1632,1693,1665,1674" />
 </Rule>
 
 
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 49e93db..4542b52 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -81,7 +81,7 @@ subject to man-in-the-middle attacks.
 </rationale>
 <ident cce="3390-2" />
 <oval id="service_telnetd_disabled" />
-<ref disa="68,1436,196,197,877,888" />
+<ref disa="68,1436,197,877,888" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -97,7 +97,7 @@ telnet service's accidental (or intentional) activation.
 </rationale>
 <ident cce="4330-7" />
 <oval id="package_telnet-server_removed" />
-<ref disa="305"/>
+<ref disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
@@ -124,7 +124,7 @@ activation.
 </rationale>
 <ident cce="4308-3" />
 <oval id="package_rsh-server_removed" />
-<ref disa="305"/>
+<ref disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -230,7 +230,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
 </rationale>
 <ident cce="4348-9" />
 <oval id="package_ypserv_removed" />
-<ref disa="305"/>
+<ref disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 901eefb..30890b3 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -345,7 +345,7 @@ access restriction in some configurations.
 Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
 The following line in <tt>/etc/ssh/sshd_config</tt>
 demonstrates use of FIPS-approved ciphers:
-<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc</pre>
+<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc</pre>
 The man page <tt>sshd_config(5)</tt> contains a list of supported ciphers.
 </description>
 <ocil clause="that is not the case">
@@ -360,7 +360,7 @@ implementation. These are also required for compliance.
 </rationale>
 <ident cce="14491-5" />
 <oval id="sshd_use_approved_ciphers" />
-<ref disa="803,1144,1145,1146,196" />
+<ref disa="803,1144,1145,1146" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 34cb775..a4e3873 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -158,7 +158,7 @@ increases the risk of users writing down the password in a convenient
 location subject to physical compromise.</rationale>
 <ident cce="4092-3" />
 <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
-<ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/>
+<ref nist="CM-6, CM-7, IA-5, AC-3" disa="180,199" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index b64a160..f823a89 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -354,7 +354,7 @@ disk space is starting to run low:
 <rationale>Notifying administrators of an impending disk space problem may
 allow them to take corrective action prior to any disruption.</rationale>
 <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref disa="140,143,144,1339" />
+<ref disa="140,143,1339" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -394,7 +394,7 @@ audit records. If a separate partition or logical volume of adequate size
 is used, running low on space for audit records should never occur.
 </rationale>
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref disa="140,143,144,1343" />
+<ref disa="140,143,1343" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -416,7 +416,7 @@ account when it needs to notify an administrator:
 <rationale>Email sent to the root account is typically aliased to the
 administrators of the system, who can take appropriate action.</rationale>
 <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref disa="139" />
+<ref disa="139,144" />
 </Rule>
 
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list