[PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml

Shawn Wells shawn at redhat.com
Fri Nov 16 23:00:57 UTC 2012


On 11/16/12 5:54 PM, Shawn Wells wrote:
>
> 0005-DISA-FSO-provided-copy-editing-of-RHEL6-input-servic.patch
>
>
>  From 6379c05115f75f2876c8e6d841d8d430baef2ee3 Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Fri, 16 Nov 2012 07:04:26 -0500
> Subject: [PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
>   DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml
>
> ---
>   RHEL6/input/services/dhcp.xml |   28 ++++++++++++++--------------
>   1 files changed, 14 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
> index 9511ba6..7cf381b 100644
> --- a/RHEL6/input/services/dhcp.xml
> +++ b/RHEL6/input/services/dhcp.xml
> @@ -123,7 +123,7 @@ allocations.</rationale>
>   <Rule id="dhcp_server_deny_bootp">
>   <title>Deny BOOTP Queries</title>
>   <description>Unless your network needs to support older BOOTP clients, disable
> -support for the bootp protocol by adding or correcting the global option:
> +support for the bootp protocol by adding or correcting the global option.
>   <pre>deny bootp;</pre>
>   </description>
>   <rationale>The bootp option tells dhcpd to respond to BOOTP queries. If support
> @@ -139,7 +139,7 @@ vectors against the DHCP server.
>   <title>Minimize Served Information</title>
>   <description>Edit /etc/dhcpd.conf. Examine each address range section within
>   the file, and ensure that the following options are not defined unless there is
> -an operational need to provide this information via DHCP:
> +an operational need to provide this information via DHCP.
>   <pre>option domain-name
>   option domain-name-servers
>   option nis-domain
> @@ -173,7 +173,7 @@ usually static across machines at a given site.</warning>
>   <Rule id="dhcp_server_configure_logging">
>   <title>Configure Logging</title>
>   <description>Ensure that the following line exists in
> -<tt>/etc/syslog.conf</tt>:
> +<tt>/etc/syslog.conf</tt>.
>   <pre>daemon.*           /var/log/daemon.log</pre>
>   Configure logwatch or other log monitoring tools to summarize error conditions
>   reported by the dhcpd process.</description>
> @@ -201,13 +201,13 @@ accountability for network activity.
>   <description>
>   For each interface <i>IFACE</i> on the system (e.g. eth0), edit
>   <tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt> and make the
> -following changes:
> +following changes.
>   <ul>
> -<li> Correct the BOOTPROTO line to read:
> +<li> Correct the BOOTPROTO line to read.
>   <pre>BOOTPROTO=static</pre>
>   </li>
>   <li> Add or correct the following lines, substituting the appropriate
> -values based on your site's addressing scheme:
> +values based on your site's addressing scheme.
>   <pre>NETMASK=255.255.255.0
>   IPADDR=192.168.1.2
>   GATEWAY=192.168.1.1</pre>
> @@ -215,11 +215,11 @@ GATEWAY=192.168.1.1</pre>
>   </ul>
>   </description>
>   <ocil clause="it does not">
> -To verify that DHCP is not being used, examine the following file for each interface:
> +To verify that DHCP is not being used, examine the following file for each interface.
>   <pre># /etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></pre>
> -Look for the following:
> +Look for the following.
>   <pre>BOOTPROTO=static</pre>
> -and the following, substituting the appropriate values based on your site's addressing scheme:
> +and the following, substituting the appropriate values based on your site's addressing scheme.
>   <pre>NETMASK=255.255.255.0
>   IPADDR=192.168.1.2
>   GATEWAY=192.168.1.1</pre>
> @@ -248,16 +248,16 @@ dhclient(8) and dhclient.conf(5) man pages.  </description>
>   <title>Minimize the DHCP-Configured Options</title>
>   <description>Create the file <tt>/etc/dhclient.conf</tt>, and add an
>   appropriate setting for each of the ten configuration settings which can be
> -obtained via DHCP. For each setting, do one of the following:
> +obtained via DHCP. For each setting, do one of the following.
>   <br/>
>   If the setting should <i>not</i> be configured remotely by the DHCP server,
> -select an appropriate static value, and add the line:
> +select an appropriate static value, and add the line.
>   <pre>supersede <tt>setting value</tt>;</pre>
> -If the setting should be configured remotely by the DHCP server, add the lines:
> +If the setting should be configured remotely by the DHCP server, add the lines.
>   <pre>request <tt>setting</tt>;
>   require <tt>setting</tt>;</pre>
>   For example, suppose the DHCP server should provide only the IP address itself
> -and the subnet mask. Then the entire file should look like:
> +and the subnet mask. Then the entire file should look like.
>   <pre>supersede domain-name "example.com";
>   supersede domain-name-servers 192.168.1.2;
>   supersede nis-domain "";
> @@ -269,7 +269,7 @@ request subnet-mask;
>   require subnet-mask;</pre>
>   </description>
>   <rationale>By default, the DHCP client program, dhclient, requests and applies
> -ten configuration options (in addition to the IP address) from the DHCP server:
> +ten configuration options (in addition to the IP address) from the DHCP server.
>   subnet-mask, broadcast-address, time-offset, routers, domain-name,
>   domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers.  Many
>   of the options requested and applied by dhclient may be the same for every
> -- 1.7.1

Ack

(note these patches were created by FSO, not myself. I only posted 
publicly.)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121116/dd9f90ee/attachment.html>


More information about the scap-security-guide mailing list