[PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
Shawn Wells
shawn at redhat.com
Fri Nov 16 23:00:57 UTC 2012
On 11/16/12 5:54 PM, Shawn Wells wrote:
>
> 0005-DISA-FSO-provided-copy-editing-of-RHEL6-input-servic.patch
>
>
> From 6379c05115f75f2876c8e6d841d8d430baef2ee3 Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Fri, 16 Nov 2012 07:04:26 -0500
> Subject: [PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
> DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
>
> ---
> RHEL6/input/services/dhcp.xml | 28 ++++++++++++++--------------
> 1 files changed, 14 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
> index 9511ba6..7cf381b 100644
> --- a/RHEL6/input/services/dhcp.xml
> +++ b/RHEL6/input/services/dhcp.xml
> @@ -123,7 +123,7 @@ allocations.</rationale>
> <Rule id="dhcp_server_deny_bootp">
> <title>Deny BOOTP Queries</title>
> <description>Unless your network needs to support older BOOTP clients, disable
> -support for the bootp protocol by adding or correcting the global option:
> +support for the bootp protocol by adding or correcting the global option.
> <pre>deny bootp;</pre>
> </description>
> <rationale>The bootp option tells dhcpd to respond to BOOTP queries. If support
> @@ -139,7 +139,7 @@ vectors against the DHCP server.
> <title>Minimize Served Information</title>
> <description>Edit /etc/dhcpd.conf. Examine each address range section within
> the file, and ensure that the following options are not defined unless there is
> -an operational need to provide this information via DHCP:
> +an operational need to provide this information via DHCP.
> <pre>option domain-name
> option domain-name-servers
> option nis-domain
> @@ -173,7 +173,7 @@ usually static across machines at a given site.</warning>
> <Rule id="dhcp_server_configure_logging">
> <title>Configure Logging</title>
> <description>Ensure that the following line exists in
> -<tt>/etc/syslog.conf</tt>:
> +<tt>/etc/syslog.conf</tt>.
> <pre>daemon.* /var/log/daemon.log</pre>
> Configure logwatch or other log monitoring tools to summarize error conditions
> reported by the dhcpd process.</description>
> @@ -201,13 +201,13 @@ accountability for network activity.
> <description>
> For each interface <i>IFACE</i> on the system (e.g. eth0), edit
> <tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt> and make the
> -following changes:
> +following changes.
> <ul>
> -<li> Correct the BOOTPROTO line to read:
> +<li> Correct the BOOTPROTO line to read.
> <pre>BOOTPROTO=static</pre>
> </li>
> <li> Add or correct the following lines, substituting the appropriate
> -values based on your site's addressing scheme:
> +values based on your site's addressing scheme.
> <pre>NETMASK=255.255.255.0
> IPADDR=192.168.1.2
> GATEWAY=192.168.1.1</pre>
> @@ -215,11 +215,11 @@ GATEWAY=192.168.1.1</pre>
> </ul>
> </description>
> <ocil clause="it does not">
> -To verify that DHCP is not being used, examine the following file for each interface:
> +To verify that DHCP is not being used, examine the following file for each interface.
> <pre># /etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></pre>
> -Look for the following:
> +Look for the following.
> <pre>BOOTPROTO=static</pre>
> -and the following, substituting the appropriate values based on your site's addressing scheme:
> +and the following, substituting the appropriate values based on your site's addressing scheme.
> <pre>NETMASK=255.255.255.0
> IPADDR=192.168.1.2
> GATEWAY=192.168.1.1</pre>
> @@ -248,16 +248,16 @@ dhclient(8) and dhclient.conf(5) man pages. </description>
> <title>Minimize the DHCP-Configured Options</title>
> <description>Create the file <tt>/etc/dhclient.conf</tt>, and add an
> appropriate setting for each of the ten configuration settings which can be
> -obtained via DHCP. For each setting, do one of the following:
> +obtained via DHCP. For each setting, do one of the following.
> <br/>
> If the setting should <i>not</i> be configured remotely by the DHCP server,
> -select an appropriate static value, and add the line:
> +select an appropriate static value, and add the line.
> <pre>supersede <tt>setting value</tt>;</pre>
> -If the setting should be configured remotely by the DHCP server, add the lines:
> +If the setting should be configured remotely by the DHCP server, add the lines.
> <pre>request <tt>setting</tt>;
> require <tt>setting</tt>;</pre>
> For example, suppose the DHCP server should provide only the IP address itself
> -and the subnet mask. Then the entire file should look like:
> +and the subnet mask. Then the entire file should look like.
> <pre>supersede domain-name "example.com";
> supersede domain-name-servers 192.168.1.2;
> supersede nis-domain "";
> @@ -269,7 +269,7 @@ request subnet-mask;
> require subnet-mask;</pre>
> </description>
> <rationale>By default, the DHCP client program, dhclient, requests and applies
> -ten configuration options (in addition to the IP address) from the DHCP server:
> +ten configuration options (in addition to the IP address) from the DHCP server.
> subnet-mask, broadcast-address, time-offset, routers, domain-name,
> domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers. Many
> of the options requested and applied by dhclient may be the same for every
> -- 1.7.1
Ack
(note these patches were created by FSO, not myself. I only posted
publicly.)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121116/dd9f90ee/attachment.html>
More information about the scap-security-guide
mailing list