[PATCH 4/4] cleanup of prose for iptables

Jeffrey Blank blank at eclipse.ncsc.mil
Sun Jun 24 20:41:06 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/system/network/iptables.xml |   51 +++++++++++++++++---------
 1 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/rhel6/src/input/system/network/iptables.xml b/rhel6/src/input/system/network/iptables.xml
index a0c836c..5918507 100644
--- a/rhel6/src/input/system/network/iptables.xml
+++ b/rhel6/src/input/system/network/iptables.xml
@@ -70,7 +70,9 @@ IPv6 lacks reliable connection-tracking functionality.</description>
 <Rule id="enable_ip6tables">
 <title>Verify ip6tables Enabled</title>
 <description> The <tt>ip6tables</tt> service can be enabled with the following
-command: <pre># service ip6tables restart # chkconfig ip6tables on</pre>
+commands:
+<pre># service ip6tables restart
+# chkconfig ip6tables on</pre>
 </description>
 <rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
 capability for IPv6 and ICMPv6.  
@@ -128,28 +130,41 @@ requirements. Otherwise, this program should not be used to make
 changes to the firewall configuration because it re-writes the
 saved configuration file.</warning>
 
-<Group id="default_iptables_policies">
-<title>Change the Default Policies</title>
-<description>Change the default policy to DROP (from ACCEPT) for
-the INPUT and FORWARD built-in chains:
-<pre>*filter
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]</pre>
-Changing the default policy in this way implements proper
-design for a firewall, i.e. any packets which are not explicitly
-permitted should not be accepted.</description>
-
 <Rule id="set_iptables_default_rule">
-<title>Set Default Firewall Policy</title>
-<description>Change the default policy to DROP (from ACCEPT) for
-the INPUT built-in chain.</description>
-<rationale>In iptables the default policy is applied only after all the applicable rules in the table
-are examined for a match. Connection attempts that are not explicitly authorized should be denied by default.</rationale>
+<title>Set Default Iptables Policy for Incoming Packets</title>
+<description>To set the default policy to DROP (instead of ACCEPT) for
+the built-in INPUT chain which processes incoming packets,
+add or correct the following line in
+<tt>/etc/sysconfig/iptables</tt>:
+<pre>:INPUT DROP [0:0]</pre>
+</description>
+<rationale>In <tt>iptables</tt> the default policy is applied only after all
+the applicable rules in the table are examined for a match.  Setting the
+default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
+any packets which are not explicitly permitted should not be
+accepted.</rationale>
 <ident cce="14264-6" />
 <oval id="iptables_default_policy_drop" />
 <ref nist="AC-4, CM-6" disa="1109" />
 </Rule>
-</Group><!--<Group id="default_iptables_policies">-->
+
+<Rule id="set_iptables_default_rule_forward">
+<title>Set Default Iptables Policy for Forwarded Packets</title>
+<description>To set the default policy to DROP (instead of ACCEPT) for
+the built-in FORWARD chain which processes packets that will be forwarded from
+one interface to another,
+add or correct the following line in
+<tt>/etc/sysconfig/iptables</tt>:
+<pre>:FORWARD DROP [0:0]</pre>
+</description>
+<rationale>In <tt>iptables</tt> the default policy is applied only after all
+the applicable rules in the table are examined for a match.  Setting the
+default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
+any packets which are not explicitly permitted should not be
+accepted.</rationale>
+<ident cce="14264-6" />
+<ref nist="AC-4, CM-6" disa="1109" />
+</Rule>
 
 <Rule id="iptables_icmp_disabled">
 <title>Restrict ICMP Message Types</title>
-- 
1.7.1



More information about the scap-security-guide mailing list