[PATCH 2/2] added Rules to STIG profile, based on output from verify-references.py * some Rules are still tagged but have not been added yet * some of these need Values specified or require a little more investigation

Shawn Wells shawn at redhat.com
Tue Jul 24 21:39:08 UTC 2012


On 7/24/12 4:59 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/profiles/STIG-server.xml |   10 ++++++++++
>   RHEL6/input/profiles/common.xml      |    4 ++++
>   RHEL6/utils/verify-references.py     |    2 ++
>   3 files changed, 16 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml
> index 5ccf94c..49799bf 100644
> --- a/RHEL6/input/profiles/STIG-server.xml
> +++ b/RHEL6/input/profiles/STIG-server.xml
> @@ -1,8 +1,18 @@
>   <Profile id="stig-server" extends="common" xmlns="http://checklists.nist.gov/xccdf/1.1" >
>   <title>Pre-release Draft STIG for RHEL 6 Server</title>
>   <description>This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
> +<select idref="aide_periodic_cron_checking" selected="true"/>
>   <select idref="rpm_verify_permissions" selected="true"/>
>   <select idref="disable_xwindows_with_runlevel" selected="true"/>
>   <select idref="packagegroup_xwindows_remove" selected="true"/>
>   <select idref="disable_dhcp_client" selected="true"/>
> +<select idref="install_openswan" selected="true"/>
> +<select idref="set_iptables_default_rule_forward" selected="true"/>
> +<select idref="max_concurrent_login_sessions" selected="true"/>
> +<select idref="configure_auditd_space_left_action" selected="true"/>
> +<select idref="configure_auditd_action_mail_acct" selected="true"/>
> +<select idref="configure_auditd_action_mail_acct" selected="true"/>
> +<select idref="account_disable_post_pw_expiration" selected="true"/>
> +<select idref="bios_disable_usb_boot" selected="true"/> <!-- out of scope for OS? -->
> +
>   </Profile>
> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
> index 22de485..6f6bc84 100644
> --- a/RHEL6/input/profiles/common.xml
> +++ b/RHEL6/input/profiles/common.xml
> @@ -21,6 +21,10 @@
>   <select idref="restrict_root_console_logins" selected="true"/>
>   <select idref="restrict_serial_port_logins" selected="true"/>
>   <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
> +<select idref="userowner_shadow_file" selected="true"/>
> +<select idref="groupowner_shadow_file" selected="true"/>
> +<select idref="perms_shadow_file" selected="true"/>
> +<select idref="file_permissions_etc_passwd" selected="true"/>
>   <select idref="no_empty_passwords" selected="true"/>
>   <select idref="no_hashes_outside_shadow" selected="true"/>
>   <select idref="no_uidzero_except_root" selected="true"/>
> diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
> index e4ef43c..d7f082d 100755
> --- a/RHEL6/utils/verify-references.py
> _/*+++ b/RHEL6/utils/verify-references.py
> @@ -8,6 +8,8 @@ import lxml.etree as ET
>   # OVAL, and also search based on other criteria such as existence of policy
>   # references in XCCDF.
>   #
> +# It must be run from the same directory as the XCCDF and OVAL content
> +# it references.*/_
>   
>   xccdf_ns = "http://checklists.nist.gov/xccdf/1.1"
>   oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"

hahaha, if only I read this patch in full after applying the first one. 
sounds like you had the same "wtf?!" as I did.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120724/4dba1291/attachment.html>


More information about the scap-security-guide mailing list