[PATCH 2/3] Added a macro for common iptable rules
Kevin Spargur
kspargur at redhat.com
Mon Oct 15 03:08:44 UTC 2012
---
RHEL6/transforms/shorthand2xccdf.xslt | 31 +++++++++++++++++++++++++++++++
1 files changed, 31 insertions(+), 0 deletions(-)
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index c9077d1..d1b1258 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -395,6 +395,37 @@ system call, run the following command:
If the system is configured to audit this activity, it will return a line.
</xsl:template>
+ <!--Example usage: <iptables-desc-macro allow="true" net="false" proto="tcp"
+ port="80" /> -->
+ <!-- allow (boolean): optional attribute which defaults to true, or to
+ allow this traffic through -->
+ <!-- net (boolean): optional attribute which determines if -s netwk/mask
+ is put in. By defaults this is false -->
+ <!-- proto (string): protocol in question, typically tcp or udp -->
+ <!-- port (integer): port in question -->
+ <xsl:template match="iptables-desc-macro">
+ <xsl:choose>
+ <xsl:when test="@allow = 'false'">
+ <!-- allow: optional attribute which defaults to true, or to allow this traffic through -->
+ To configure <xhtml:code>iptables</xhtml:code> to not allow port
+ <xsl:value-of select="@port"/> traffic one must edit
+ <xhtml:code>/etc/sysconfig/iptables</xhtml:code> and
+ <xhtml:code>/etc/sysconfig/ip6tables</xhtml:code> (if IPv6 is in use).
+ Remove the following line, ensuring that it does not appear in the INPUT
+ chain:
+ <xhtml:pre xml:space="preserve">-A INPUT <xsl:if test="@net = 'true'">-s netwk/mask </xsl:if>-m state --state NEW -p <xsl:value-of select="@proto"/> --dport <xsl:value-of select="@port"/> -j ACCEPT</xhtml:pre>
+ </xsl:when>
+ <xsl:otherwise>
+ To configure <xhtml:code>iptables</xhtml:code> to allow port
+ <xsl:value-of select="@port"/> traffic one must edit
+ <xhtml:code>/etc/sysconfig/iptables</xhtml:code> and
+ <xhtml:code>/etc/sysconfig/ip6tables</xhtml:code> (if IPv6 is in use).
+ Add the following line, ensuring that it appears before the final LOG
+ and DROP lines for the INPUT chain:
+ <xhtml:pre xml:space="preserve">-A INPUT <xsl:if test="@net = 'true'">-s netwk/mask </xsl:if>-m state --state NEW -p <xsl:value-of select="@proto"/> --dport <xsl:value-of select="@port"/> -j ACCEPT</xhtml:pre>
+ </xsl:otherwise>
+ </xsl:choose>
+ </xsl:template>
<xsl:template match="sshd-check-macro">
<!-- could also do this with sshd -T to test live configuration -->
--
1.7.7.6
More information about the scap-security-guide
mailing list