[PATCH 2/3] updated refine-value names for password items, removed defunct/commented profile items

Jeffrey Blank blank at eclipse.ncsc.mil
Tue May 29 21:26:51 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/profiles/common.xml |   29 ++++-------------------------
 1 files changed, 4 insertions(+), 25 deletions(-)

diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 80c6d68..aba7c92 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -79,7 +79,6 @@
 <select idref="groupowner_rsyslog_files" selected="true"/>
 <select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
-<!-- <select idref="rsyslog_accept_remote_messages" selected="true"/> -->
 <select idref="ensure_logrotate_activated" selected="true"/>
 <select idref="enable_auditd_service" selected="true"/>
 <select idref="enable_auditd_bootloader" selected="true"/>
@@ -90,18 +89,10 @@
 <select idref="configure_auditd_admin_space_left_action" selected="true"/>
 <select idref="configure_auditd_max_log_file_action" selected="true"/>
 
-<!--Too much variation to be in profile
-<select idref="configure_logwatch_hostlimit" selected="true"/>
-<select idref="configure_logwatch_splithosts" selected="true"/>
-
-<select idref="disable_logwatch_for_logserver" selected="true"/>-->
-
 <select idref="audit_time_rules" selected="true"/>
 <select idref="audit_account_changes" selected="true"/>
 <select idref="audit_network_modifications" selected="true"/>
 <select idref="audit_mac_changes" selected="true"/>
-<select idref="audit_manual_logon_edits" selected="true" />
-<select idref="audit_manual_session_edits" selected="true" />
 <select idref="audit_dac_actions" selected="true"/>
 <select idref="audit_file_access" selected="true"/>
 <select idref="audit_privileged_commands" selected="true"/>
@@ -123,19 +114,6 @@
 <select idref="uninstall_tftp-server" selected="true"/>
 <select idref="disable_tftp" selected="true"/>
 <select idref="enable_cron" selected="true"/>
-<!-- FILE PERMISSIONS <select idref="file_user_owner_etc_crontab" selected="true"/> -->
-<!-- FILE PERMISSIONS <select idref="file_group_owner_etc_crontab" selected="true"/> -->
-<!-- FILE PERMISSIONS <select idref="file_mode_etc_crontab" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="groupowner_cron.hourly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="groupowner_cron.daily" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="groupowner_cron.weekly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="groupowner_cron.monthly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="groupowner_cron.d" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="userowner_cron.hourly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="userowner_cron.daily" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="userowner_cron.weekly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="userowner_cron.monthly" selected="true"/> -->
-<!-- DBG-DOES-NOT-EXIST <select idref="userowner_cron.d" selected="true"/> -->
 <select idref="disable_at" selected="true"/>
 <select idref="sshd_allow_only_protocol2" selected="true"/>
 <select idref="sshd_set_idle_timeout" selected="true"/>
@@ -153,7 +131,6 @@
 <select idref="uninstall_dhcp_server" selected="true"/>
 <select idref="enable_ntpd" selected="true"/>
 <select idref="ntpd_specify_remote_server" selected="true"/>
-<!-- <select idref="postfix_package_installation" selected="true"/> -->
 <select idref="postfix_network_listening" selected="true"/>
 <select idref="ldap_client_tls_checkpeer" selected="true"/>
 <select idref="package_openldap-servers_removed" selected="true"/>
@@ -187,9 +164,11 @@
 <!-- daemon umask -->
 <refine-value idref="var_password_min_len" selector="14"/>
 <!-- password minimum length -->
-<refine-value idref="password_max_age_login_defs_value" selector="90"/>
+<refine-value idref="var_password_max_age" selector="90"/>
 <!-- maximum password age -->
-<refine-value idref="password_warn_age_login_defs_value" selector="7"/>
+<refine-value idref="var_password_min_age" selector="7"/>
+<!-- minimum password age -->
+<refine-value idref="var_password_warn_age" selector="7"/>
 <!-- password warn age -->
 <refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
 <!-- Number of retry attempts before erroring out -->
-- 
1.7.1



More information about the scap-security-guide mailing list