[PATCH] Update for/of service-disable-check-macro

Michael J. McConachie michael at redhat.com
Tue Oct 2 16:57:15 UTC 2012


All:

I tweaked the macro to facilitate the idea that service(s) that
are deemed necessary to disable -- may/may not apply to all environments.

The reasoning for this is that the way it was worded previously, it appeared
that they should be disabled, when in fact it is all contingent on the
environment, climate, and mission.

EX: of how it looks NOW:

-----------------------------------
For pre-determined environments, it is prudent to check that the rhnsd
service is disabled at boot time via chkconfig and not currently running
on the system (runtime configuration). Run the following command to
verify rhnsd is disabled through current runtime configuration:

# service rhnsd status

If the service is disabled, the command will return:

rhnsd is stopped

Run the following command to verify rhnsd is disabled through system
boot configuration:

# chkconfig rhnsd --list

Output should indicate the rhnsd service has been disabled at all
runlevels, as shown in the example below:

# chkconfig rhnsd --list
rhnsd       0:off   1:off   2:off   3:off   4:off   5:off   6:off


If the service is running, this is a finding. 
-----------------------------------


More information about the scap-security-guide mailing list