[PATCH] Fixed typo in example iptables network/netmask pair for limiting ssh port to trusted networks.

Shawn Wells shawn at redhat.com
Mon Oct 1 21:33:39 UTC 2012


On 10/1/12 11:52 AM, Andrew Gilmore wrote:
>
>     Date: Sun, 30 Sep 2012 14:50:15 -0400
>     From: Shawn Wells <shawn at redhat.com <mailto:shawn at redhat.com>>
>     To: scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     Subject: Re: [PATCH] Fixed typo in example iptables network/netmask
>             pair for        limiting ssh port to trusted networks.
>     Message-ID: <50689467.5000400 at redhat.com
>     <mailto:50689467.5000400 at redhat.com>>
>     Content-Type: text/plain; charset=UTF-8; format=flowed
>
>     On 9/28/12 1:21 PM, Andrew Gilmore wrote:
>     > -<pre>-A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW
>     -p tcp --dport 22 -j ACCEPT</pre>
>     > +<pre>-A RH-Firewall-1-INPUT -s netwk/mask -m state --state NEW
>     -p tcp --dport 22 -j ACCEPT</pre>
>
>     Thanks for the catch! Ack
>
>     Please push (or indicate you need someone to do so for you).
>
>
> I don't have write access, this patch was mostly a drive by.
>
> Please push.
Out of curiosity I did a quick search to see where else this typo might be:
$ grep -rin "netwk /mask -m" *
services/ldap.xml:365:<pre>-A RH-Firewall-1-INPUT -s netwk /mask -m 
state --state NEW -p tcp --dport 389 -j ACCEPT
services/ldap.xml:366:-A RH-Firewall-1-INPUT -s netwk /mask -m state 
--state NEW -p tcp --dport 636 -j ACCEPT</pre>
services/ssh.xml:372:<pre>-A RH-Firewall-1-INPUT -s netwk /mask -m state 
--state NEW -p tcp --dport 22 -j ACCEPT</pre>

I went ahead and fixed (and pushed) this for the above lines:
https://fedorahosted.org/scap-security-guide/changeset/a1be82174ef7685790862e7711ebf0f755657978


> My agency is attempting to STIG a CentOS 6 image themselves, and I 
> both don't have time to wait, and thought someone else was probably 
> doing it. I'm glad you all are, but seems like you're months out as 
> well from production release. I know, I know, it is done when it is 
> done. :)
If you haven't already, I highly recommend checking out the SecState 
tool: https://fedorahosted.org/secstate/

The tool scans the box, can perform remediation (through linking to the 
Aqueduct project), and outputs pretty HTML to let you know if you have 
any findings. It's maintained by Tresys, and their developers lurk on 
this list too.


> I should probably introduce myself, as well.
> I work for a Dept. of Interior agency on databases and hydrology, but 
> sometimes dabble here and there. :) I have contributed to the CIS 
> benchmarks for RHEL 5 and 6, and have all of two lines of code in the 
> linux kernel. :)
And now you have 3 lines in the SCAP Security Guide, which is working 
itself to be the upstream source for  RHEL6 STIG and USGCB content. 
Welcome to our community :)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121001/d0e83df1/attachment.html>


More information about the scap-security-guide mailing list