[PATCH] Removed duplicate service_rhnsd_disabled

root (none) root at rhel6.
Sat Jul 14 16:07:11 UTC 2012


[root at rhel6 output]# oscap xccdf eval --profile STIG-server rhel6-xccdf-stigformat.xml
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}selectableItemIdKey'.
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}ruleIdKey'.
1 1877 In file 'rhel6-xccdf-stigformat.xml' on line 7335: Element '{http://checklists.nist.gov/xccdf/1.1}Rule': Duplicate key-sequence ['service_rhnsd_disabled'] in key identity-constraint '{http://checklists.nist.gov/xccdf/1.1}itemIdKey'.

Turns out there were two sections calling it:
[root at rhel6 input]# grep -ri "service_rhnsd" *
Binary file checks/.service_rhnsd_disabled.xml.swp matches
.........
services/base.xml:<Rule id="service_rhnsd_disabled">
services/base.xml:<oval id="service_rhnsd_disabled" />
system/software/updating.xml:<Rule id="service_rhnsd_disabled">
system/software/updating.xml:<oval id="service_rhnsd_disabled" />

I kept flip flopping on what section to remove the duplicate service_rhnsd_disabled. I ended up choosing to remove the duplicate from system/software/updating.xml as rhnsd is a base service, and seems to make sense to call it out there.

Thoughts from the group?
---
 RHEL6/input/system/software/updating.xml |   16 ----------------
 1 files changed, 0 insertions(+), 16 deletions(-)

diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 5a7757d..0918db1 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -33,22 +33,6 @@ are from Red Hat.
 <ref nist="SI-2, SI-7, SC-13"/>
 </Rule>
 
-<Rule id="service_rhnsd_disabled">
-<title>Disable Red Hat Network Service (rhnsd)</title>
-<description>The Red Hat Network service automatically queries Red Hat Network
-servers to determine whether there are any actions that should be executed,
-such as package updates. This only occurs if the system was registered to an
-RHN server or satellite and managed as such.
-<service-disable-macro service="rhnsd" />
-</description>
-<rationale>Although systems management and patching is extremely important to
-system security, management by a system outside the enterprise enclave is not
-desirable for some environments.</rationale>
-<ident cce="3416-5" />
-<oval id="service_rhnsd_disabled" />
-<ref nist="CM-6, CM-7" />
-</Rule>
-
 <Rule id="security_patches_up_to_date">
 <title>Ensure Software Patches Installed</title>
 <description>The following command prints a list of packages that
-- 
1.7.1


--sm4nu43k4a2Rpi4c--


More information about the scap-security-guide mailing list