[PATCH 2/2] added Rules to STIG profile, based on output from verify-references.py * some Rules are still tagged but have not been added yet * some of these need Values specified or require a little more investigation

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Jul 24 20:59:37 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/profiles/STIG-server.xml |   10 ++++++++++
 RHEL6/input/profiles/common.xml      |    4 ++++
 RHEL6/utils/verify-references.py     |    2 ++
 3 files changed, 16 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml
index 5ccf94c..49799bf 100644
--- a/RHEL6/input/profiles/STIG-server.xml
+++ b/RHEL6/input/profiles/STIG-server.xml
@@ -1,8 +1,18 @@
 <Profile id="stig-server" extends="common" xmlns="http://checklists.nist.gov/xccdf/1.1" >
 <title>Pre-release Draft STIG for RHEL 6 Server</title>
 <description>This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
+<select idref="aide_periodic_cron_checking" selected="true"/>
 <select idref="rpm_verify_permissions" selected="true"/>
 <select idref="disable_xwindows_with_runlevel" selected="true"/>
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <select idref="disable_dhcp_client" selected="true"/>
+<select idref="install_openswan" selected="true"/>
+<select idref="set_iptables_default_rule_forward" selected="true"/>
+<select idref="max_concurrent_login_sessions" selected="true"/>
+<select idref="configure_auditd_space_left_action" selected="true"/>
+<select idref="configure_auditd_action_mail_acct" selected="true"/>
+<select idref="configure_auditd_action_mail_acct" selected="true"/>
+<select idref="account_disable_post_pw_expiration" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/> <!-- out of scope for OS? -->
+
 </Profile>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 22de485..6f6bc84 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -21,6 +21,10 @@
 <select idref="restrict_root_console_logins" selected="true"/>
 <select idref="restrict_serial_port_logins" selected="true"/>
 <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
+<select idref="userowner_shadow_file" selected="true"/>
+<select idref="groupowner_shadow_file" selected="true"/>
+<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_passwd" selected="true"/>
 <select idref="no_empty_passwords" selected="true"/>
 <select idref="no_hashes_outside_shadow" selected="true"/>
 <select idref="no_uidzero_except_root" selected="true"/>
diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
index e4ef43c..d7f082d 100755
--- a/RHEL6/utils/verify-references.py
+++ b/RHEL6/utils/verify-references.py
@@ -8,6 +8,8 @@ import lxml.etree as ET
 # OVAL, and also search based on other criteria such as existence of policy
 # references in XCCDF.
 #
+# It must be run from the same directory as the XCCDF and OVAL content
+# it references.
 
 xccdf_ns = "http://checklists.nist.gov/xccdf/1.1" 
 oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
-- 
1.7.1



More information about the scap-security-guide mailing list