[PATCH 13/16] Mapped CCI-000066 to iptables sections

Shawn Wells shawn at redhat.com
Tue Jul 24 02:34:33 UTC 2012


In support of https://fedorahosted.org/scap-security-guide/ticket/74
---
 RHEL6/input/system/network/iptables.xml |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 699d7e0..23f5dee 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -18,7 +18,7 @@ the iptables and ip6tables configurations included with the system.
 For more complete information that may allow the construction of a
 sophisticated ruleset tailored to your environment, please consult
 the references at the end of this section.</description>
-<ref disa="86" />
+<ref disa="66,86" />
 
 <Group id="iptables_activation">
 <title>Inspect and Activate Default Rules</title>
@@ -76,7 +76,7 @@ capability for IPv6 and ICMPv6.
 </rationale>
 <ident cce="4167-3" />
 <oval id="service_ip6tables_enabled" />
-<ref nist="CM-6, CM-7" disa="1115,1118,1092,1117,1098,1100,1097,1123,1124"/>
+<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124"/>
 </Rule>
 
 <Rule id="enable_iptables">
@@ -90,7 +90,7 @@ capability for IPv4 and ICMP.
 </rationale>
 <ident cce="4189-7" />
 <oval id="service_iptables_enabled" />
-<ref nist="CM-6, CM-7" disa="1115,1118,1092,27,1117,1098,1100,1097,1123,1124" />
+<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,27,1117,1098,1100,1097,1123,1124" />
 </Rule>
 </Group><!--<Group id="iptables_activation">-->
 
@@ -140,7 +140,7 @@ any packets which are not explicitly permitted should not be
 accepted.</rationale>
 <ident cce="14264-6" />
 <oval id="iptables_default_policy_drop" />
-<ref nist="AC-4, CM-6" disa="1109,1154" />
+<ref nist="AC-4, CM-6" disa="66,1109,1154" />
 </Rule>
 
 <Rule id="set_iptables_default_rule_forward">
-- 
1.7.1


--CE+1k2dSO48ffgeK--


More information about the scap-security-guide mailing list