[PATCH 21/26] Mapped CCI-001109 to default_iptables_policies in iptables.xml
Willy Santos
wsantos at redhat.com
Wed Jun 13 16:06:12 UTC 2012
CCI-001109 requires the default firewall policy to deny all traffic explicitly permitted. The default_iptables_policies rule meets this requirement.
Signed-off-by: Willy Santos <wsantos at redhat.com>
---
rhel6/src/input/system/network/iptables.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/network/iptables.xml b/rhel6/src/input/system/network/iptables.xml
index 58ab1e6..a0c836c 100644
--- a/rhel6/src/input/system/network/iptables.xml
+++ b/rhel6/src/input/system/network/iptables.xml
@@ -147,7 +147,7 @@ the INPUT built-in chain.</description>
are examined for a match. Connection attempts that are not explicitly authorized should be denied by default.</rationale>
<ident cce="14264-6" />
<oval id="iptables_default_policy_drop" />
-<ref nist="AC-4, CM-6" />
+<ref nist="AC-4, CM-6" disa="1109" />
</Rule>
</Group><!--<Group id="default_iptables_policies">-->
--
1.7.7.6
More information about the scap-security-guide
mailing list