[PATCH] Removed duplicate service_rhnsd_disabled
root (none)
root at rhel6.
Sat Jul 14 16:07:11 UTC 2012
[root at rhel6 output]# oscap xccdf eval --profile STIG-server rhel6-xccdf-stigformat.xml
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}selectableItemIdKey'.
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}ruleIdKey'.
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}itemIdKey'.
Turns out there were two sections calling it:
[root at rhel6 input]# grep -ri "service_rhnsd" *
Binary file checks/.service_rhnsd_disabled.xml.swp matches
.........
services/base.xml:<Rule id="service_rhnsd_disabled">
services/base.xml:<oval id="service_rhnsd_disabled" />
system/software/updating.xml:<Rule id="service_rhnsd_disabled">
system/software/updating.xml:<oval id="service_rhnsd_disabled" />
I kept flip flopping on what section to remove the duplicate service_rhnsd_disabled. I ended up choosing to remove the duplicate from system/software/updating.xml as rhnsd is a base service, and seems to make sense to call it out there.
Thoughts from the group?
---
RHEL6/input/system/software/updating.xml | 16 ----------------
1 files changed, 0 insertions(+), 16 deletions(-)
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 5a7757d..0918db1 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -33,22 +33,6 @@ are from Red Hat.
<ref nist="SI-2, SI-7, SC-13"/>
</Rule>
-<Rule id="service_rhnsd_disabled">
-<title>Disable Red Hat Network Service (rhnsd)</title>
-<description>The Red Hat Network service automatically queries Red Hat Network
-servers to determine whether there are any actions that should be executed,
-such as package updates. This only occurs if the system was registered to an
-RHN server or satellite and managed as such.
-<service-disable-macro service="rhnsd" />
-</description>
-<rationale>Although systems management and patching is extremely important to
-system security, management by a system outside the enterprise enclave is not
-desirable for some environments.</rationale>
-<ident cce="3416-5" />
-<oval id="service_rhnsd_disabled" />
-<ref nist="CM-6, CM-7" />
-</Rule>
-
<Rule id="security_patches_up_to_date">
<title>Ensure Software Patches Installed</title>
<description>The following command prints a list of packages that
--
1.7.1
--sm4nu43k4a2Rpi4c--
More information about the scap-security-guide
mailing list