[PATCH 03/26] Mapped CCI-001092 to iptables_icmp_disabled and enable_iptables enable_ip6tables.

Shawn Wells shawn at redhat.com
Fri Jun 29 22:24:27 UTC 2012


On 6/29/12 5:45 PM, Willy Santos wrote:
> CCI-001092 requires limiting the effects of a DoS attack. The referenced rules provide some protection agains these type of attacks.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/system/network/iptables.xml |    6 +++---
>   1 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/rhel6/src/input/system/network/iptables.xml b/rhel6/src/input/system/network/iptables.xml
> index d5ae221..df8f390 100644
> --- a/rhel6/src/input/system/network/iptables.xml
> +++ b/rhel6/src/input/system/network/iptables.xml
> @@ -79,7 +79,7 @@ capability for IPv6 and ICMPv6.
>   </rationale>
>   <ident cce="4167-3" />
>   <oval id="service_ip6tables_enabled" />
> -<ref nist="CM-6, CM-7" disa="1115,1118"/>
> +<ref nist="CM-6, CM-7" disa="1115,1118,1092"/>
>   </Rule>
>   
>   <Rule id="enable_iptables">
> @@ -95,7 +95,7 @@ capability for IPv4 and ICMP.
>   </rationale>
>   <ident cce="4189-7" />
>   <oval id="service_iptables_enabled" />
> -<ref nist="CM-6, CM-7" disa="1115,1118" />
> +<ref nist="CM-6, CM-7" disa="1115,1118,1092" />
>   </Rule>
>   </Group><!--<Group id="iptables_activation">-->
>   
> @@ -188,7 +188,7 @@ could add another IPv6 address to the interface or alter important network setti
>   ation of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
>   <!--<ident cce="14264-6" />-->
>   <oval id="iptables_icmp_disabled" />
> -<ref nist="AC-4, CM-6" />
> +<ref nist="AC-4, CM-6" disa="1092" />
>   </Rule>
>   
>   <Rule id="iptables_log_and_drop_suspicious">



Ack


More information about the scap-security-guide mailing list