[PATCH] Swapped bogus_error_messages for bogus_error_responses

Shawn Wells shawn at redhat.com
Tue Jul 17 00:27:48 UTC 2012


my EMail headers were jacked - this apparently sent out as Sept 17 2001, 
so may be lost in some peoples inboxes. Thanks Spencer for pointing this 
out.

-Shawn


On 7/16/12 2:21 AM, Shawn Wells wrote:
>
> 0001-Swapped-bogus_error_messages-for-bogus_error_respons.patch
>
>
>  From 0620e2436f830a57017414a21bffaf23ba2fbb2d Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Mon, 16 Jul 2012 02:13:41 -0400
> Subject: [PATCH] Swapped bogus_error_messages for bogus_error_responses
>
> https://fedorahosted.org/pipermail/scap-security-guide/2012-July/001092.html
> ---
>   ...l_net_ipv4_icmp_ignore_bogus_error_messages.xml |   39 --------------------
>   RHEL6/input/profiles/common.xml                    |    2 +-
>   RHEL6/input/system/network/kernel.xml              |    2 +-
>   3 files changed, 2 insertions(+), 41 deletions(-)
>   delete mode 100644 RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
>
> diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
> deleted file mode 100644
> index b15444b..0000000
> --- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
> +++ /dev/null
> @@ -1,39 +0,0 @@
> -<def-group>
> -  <definition class="compliance"
> -  id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages" version="1">
> -    <metadata>
> -      <title>Network Parameters for Hosts and Routers</title>
> -      <affected family="unix">
> -        <platform>Red Hat Enterprise Linux 6</platform>
> -      </affected>
> -      <reference ref_id="CCE-4133-5" source="CCE" />
> -      <description>Ignoring bogus ICMP responses to broadcasts
> -      should be enabled or disabled as appropriate.</description>
> -    </metadata>
> -    <criteria>
> -      <criterion test_ref="test_20123" />
> -    </criteria>
> -  </definition>
> -  <ind:textfilecontent54_test check="all"
> -  check_existence="all_exist"
> -  comment="Tests the value of the ^[\s]*net\.ipv4\.icmp_ignore_bogus_error_messages[\s]*=([\s]*) expression in the /etc/sysctl.conf file"
> -  id="test_20123" version="1">
> -    <ind:object object_ref="obj_20123" />
> -    <ind:state state_ref="state_20123" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_state id="state_20123"
> -  version="1">
> -    <ind:subexpression operation="equals" var_check="all"
> -    var_ref="var_20123" />
> -  </ind:textfilecontent54_state>
> -  <external_variable comment="External variable for definition 20123"
> -  datatype="string" id="var_20123"
> -  version="1" />
> -  <ind:textfilecontent54_object id="obj_20123"
> -  version="2">
> -    <ind:path>/etc</ind:path>
> -    <ind:filename>sysctl.conf</ind:filename>
> -    <ind:pattern operation="pattern match">^[\s]*net\.ipv4\.icmp_ignore_bogus_error_responses[\s]*=([\s]*)</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -</def-group>
> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
> index 1b188da..b57ee15 100644
> --- a/RHEL6/input/profiles/common.xml
> +++ b/RHEL6/input/profiles/common.xml
> @@ -59,7 +59,7 @@
>   <select idref="set_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
> -<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" selected="true"/>
> +<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
> index 03be8ec..63bb1f5 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -293,7 +293,7 @@ addresses makes the system slightly more difficult to enumerate on the network.
>   
>   
>   <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
> -<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
> +<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
>   </description>
> -- 1.7.1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120716/2cd1f716/attachment.html>


More information about the scap-security-guide mailing list