[PATCH 13/16] Mapped CCI-000066 to iptables sections
Shawn Wells
shawn at redhat.com
Tue Jul 24 02:34:33 UTC 2012
In support of https://fedorahosted.org/scap-security-guide/ticket/74
---
RHEL6/input/system/network/iptables.xml | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 699d7e0..23f5dee 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -18,7 +18,7 @@ the iptables and ip6tables configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</description>
-<ref disa="86" />
+<ref disa="66,86" />
<Group id="iptables_activation">
<title>Inspect and Activate Default Rules</title>
@@ -76,7 +76,7 @@ capability for IPv6 and ICMPv6.
</rationale>
<ident cce="4167-3" />
<oval id="service_ip6tables_enabled" />
-<ref nist="CM-6, CM-7" disa="1115,1118,1092,1117,1098,1100,1097,1123,1124"/>
+<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124"/>
</Rule>
<Rule id="enable_iptables">
@@ -90,7 +90,7 @@ capability for IPv4 and ICMP.
</rationale>
<ident cce="4189-7" />
<oval id="service_iptables_enabled" />
-<ref nist="CM-6, CM-7" disa="1115,1118,1092,27,1117,1098,1100,1097,1123,1124" />
+<ref nist="CM-6, CM-7" disa="66,1115,1118,1092,27,1117,1098,1100,1097,1123,1124" />
</Rule>
</Group><!--<Group id="iptables_activation">-->
@@ -140,7 +140,7 @@ any packets which are not explicitly permitted should not be
accepted.</rationale>
<ident cce="14264-6" />
<oval id="iptables_default_policy_drop" />
-<ref nist="AC-4, CM-6" disa="1109,1154" />
+<ref nist="AC-4, CM-6" disa="66,1109,1154" />
</Rule>
<Rule id="set_iptables_default_rule_forward">
--
1.7.1
--CE+1k2dSO48ffgeK--
More information about the scap-security-guide
mailing list