[PATCH 3/3] Cleaned up some references to RHEL5 settings

Kevin Spargur kspargur at redhat.com
Mon Oct 15 03:08:45 UTC 2012


---
 RHEL6/input/services/dns.xml            |   10 ++++----
 RHEL6/input/services/ftp.xml            |    6 ++--
 RHEL6/input/services/http.xml           |   13 +++--------
 RHEL6/input/services/imap.xml           |    6 +----
 RHEL6/input/services/ldap.xml           |   22 +++++++++---------
 RHEL6/input/services/mail.xml           |    5 +--
 RHEL6/input/services/printing.xml       |   20 +++++++----------
 RHEL6/input/services/ssh.xml            |    6 ++--
 RHEL6/input/system/network/iptables.xml |   35 ++++++++++++------------------
 9 files changed, 51 insertions(+), 72 deletions(-)

diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 6f3e28c..4e700b7 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -106,11 +106,11 @@ configuration file. That is, when this guide recommends editing
 
 <Group id="dns_server_firewall">
 <title>Configure Firewalls to Protect the DNS Server</title>
-<description>Edit the file <tt>/etc/sysconfig/iptables</tt>. Add the following
-lines, ensuring that they appear before the final LOG and DROP lines for the
-RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
--A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT</pre>
+<description>
+By default, <tt>iptables</tt> blocks access to the ports used by the DNS 
+server.
+<iptables-desc-macro proto="udp" port="53" />
+<iptables-desc-macro proto="tcp" port="53" />
 </description>
 <rationale>These lines are necessary in order to allow remote machines to
 contact the DNS server. If this server is only available to the local network,
diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml
index 92bd0fe..4b80424 100644
--- a/RHEL6/input/services/ftp.xml
+++ b/RHEL6/input/services/ftp.xml
@@ -179,9 +179,9 @@ these users from filling a disk used by other services.</rationale>
 
 <Group id="ftp_configure_firewall">
 <title>Configure Firewalls to Protect the FTP Server</title>
-<description>Edit the file <tt>/etc/sysconfig/iptables</tt>. Add the following lines, ensuring that they appear before the final
-LOG and DROP lines for the RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT</pre>
+<description>By default, <tt>iptables</tt>
+blocks access to the ports used by the web server.
+<iptables-desc-macro allow="true" proto="tcp" port="21" />
 Edit the file <tt>/etc/sysconfig/iptables-config</tt>. Ensure that the space-separated list of modules contains
 the FTP connection tracking module:
 <pre>IPTABLES_MODULES="ip_conntrack_ftp"</pre></description>
diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
index 51bae93..57883b3 100644
--- a/RHEL6/input/services/http.xml
+++ b/RHEL6/input/services/http.xml
@@ -811,15 +811,10 @@ to access information about the web server or to alter the server's configuratio
 <Group id="httpd_configure_iptables">
 <title>Configure <tt>iptables</tt> to Allow Access to the Web Server</title>
 <description>
-By default, <tt>iptables</tt> blocks access to the ports used by the web server.
-To configure <tt>iptables</tt> to allow port 80 traffic edit <tt>/etc/sysconfig/iptables</tt>.
-Add the following line, ensuring that it appears before the final LOG and DROP lines for
-the RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT</pre>
-To configure <tt>iptables</tt> to allow port 443 traffic edit <tt>/etc/sysconfig/iptables</tt>.
-Add the following line, ensuring that it appears before the final LOG and DROP lines for
-the RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT</pre>
+By default, <tt>iptables</tt>
+blocks access to the ports used by the web server.
+<iptables-desc-macro allow="true" proto="tcp" port="80" />
+<iptables-desc-macro allow="true" proto="tcp" port="443" />
 </description>
 
 </Group> <!-- <Group id="httpd_configure_iptables"> -->
diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
index a173122..b2dfbd0 100644
--- a/RHEL6/input/services/imap.xml
+++ b/RHEL6/input/services/imap.xml
@@ -175,11 +175,7 @@ attacker access to credentials by monitoring network traffic.
 access to any services. This modification will allow remote hosts to 
 initiate connections to the IMAP daemon, while keeping all other ports 
 on the server in their default protected state. 
-<br /><br />
-Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring 
-that it appears before the final <tt>LOG</tt> and <tt>DROP</tt> lines 
-for the <tt>RH-Firewall-1-INPUT</tt> chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT</pre>
+<iptables-desc-macro proto="tcp" port="143" />
 </description>
 
 </Group> <!-- <Group id="dovecot_allow_imap_access"> -->
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index e292b24..bdb51fb 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -358,18 +358,18 @@ permissions. This will prevent slapd from starting correctly.
 
 <Rule id="iptables_ldap_enabled">
 <title>Configure iptables to Allow Access to the LDAP Server</title>
-<description>Determine an appropriate network block, netwk , and network mask, mask , representing the machines on
+<description>Determine an appropriate network block representing the machines on
 your network which will synchronize to this server.
-Edit /etc/sysconfig/iptables. Add the following lines, ensuring that they appear before the final LOG and
-DROP lines for the RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -s netwk/mask -m state --state NEW -p tcp --dport 389 -j ACCEPT
--A RH-Firewall-1-INPUT -s netwk/mask -m state --state NEW -p tcp --dport 636 -j ACCEPT</pre>
-The default Iptables configuration does not allow inbound access to any services. These modifications allow
-access to the LDAP primary (389) and encrypted-only (636) ports, while keeping all other ports on the server
-in their default protected state.
-Note: Even if the LDAP server restricts connections so that only encrypted queries are allowed, it will probably
-be necessary to allow traffic to the default port 389. This is true because many LDAP clients implement
-encryption by connecting to the primary port and issuing the STARTTLS command.
+<iptables-desc-macro net="true" proto="tcp" port="389" />
+<iptables-desc-macro net="true" proto="tcp" port="636" />
+The default Iptables configuration does not allow inbound access to any 
+services. These modifications allow access to the LDAP primary (389) and 
+encrypted-only (636) ports, while keeping all other ports on the server in 
+their default protected state.
+Note: Even if the LDAP server restricts connections so that only encrypted 
+queries are allowed, it will probably be necessary to allow traffic to the 
+default port 389. This is true because many LDAP clients implement encryption 
+by connecting to the primary port and issuing the STARTTLS command.
 </description>
 <!--<ident cce="TODO:CCE" />-->
 <oval id="iptables_ldap_enabled" />
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index 8e98851..5942ddb 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -127,9 +127,8 @@ ensure that only system administrators are allowed shell access to the MTA host.
 
 <Rule id="iptables_smtp_enabled">
 <title>Configure iptables to Allow Access to the Mail Server</title>
-<description>Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring that it appears before the final LOG and
-DROP lines for the RH-Firewall-1-INPUT chain:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT</pre>
+<description>
+<iptables-desc-macro proto="tcp" port="25" />
 </description>
 <rationale>The default Iptables configuration does not allow inbound access to the SMTP service. This modification allows
 that access, while keeping other ports on the server in their default protected state.
diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml
index 459aeac..a1a9c1c 100644
--- a/RHEL6/input/services/printing.xml
+++ b/RHEL6/input/services/printing.xml
@@ -22,22 +22,18 @@ homepage and more detailed documentation are available at http://www.cups.org.
 </Rule>
 
 <Rule id="iptables_cupsd_disabled">
-<title>Disable Firewall Access to Printing Service</title>
-<description>If the system does not need to act as a network print server, edit
-the files <tt>/etc/sysconfig/iptables</tt> and
-<tt>/etc/sysconfig/ip6tables</tt> (if IPv6 is in use). In each file, locate and
-delete the lines:
-<pre>-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
--A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT</pre>
+<title>Enable Firewall Access to Printing Service</title>
+<description>If the system must act as a network print server then 
+<tt>iptables</tt> should be configured to allow traffic for it through.
+<iptables-desc-macro proto="tcp" port="631" />
+<iptables-desc-macro proto="tcp" port="631" />
 </description>
 <rationale>By default, inbound connections to the Internet Printing Protocol
-port are allowed. If the print server does not need to be accessed, either
-because the machine is not running the print service at all or because the
-machine is not providing a remote network printer to other machines, this
-exception should be removed from the firewall configuration.
+port are not allowed. If the print server does need to be accessed this
+exception should be added to the firewall configuration.
 </rationale>
 <ident cce="3649-1" />
-<oval id="iptables_cupsd_disabled" />
+<!-- Need to invert this check <oval id="iptables_cupsd_disabled" /> -->
 <ref nist="CM-7" />
 </Rule>
 
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 5d57317..ae9d4b6 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -39,7 +39,7 @@ firewall configuration.
 <br /><br />
 Edit the files <tt>/etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>
 (if IPv6 is in use). In each file, locate and delete the line:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</pre>
+<pre>-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</pre>
 This is unusual, as SSH is a common method for encrypted and authenticated
 remote access.
 </description>
@@ -372,9 +372,9 @@ representing the machines on your network which will be allowed to access this S
 <br /><br />
 Edit the files <tt>etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>
 (if IPv6 is in use). In each file, locate the line:
-<pre>-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</pre>
+<pre>-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</pre>
 and replace it with:
-<pre>-A RH-Firewall-1-INPUT -s netwk/mask -m state --state NEW -p tcp --dport 22 -j ACCEPT</pre>
+<pre>-A INPUT -s netwk/mask -m state --state NEW -p tcp --dport 22 -j ACCEPT</pre>
 </description>
 <rationale>
 Restricting SSH access to only trusted network segments reduces exposure of the SSH 
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index ae146db..1948224 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -46,14 +46,7 @@ num  target     prot opt source       destination
 
 Chain OUTPUT (policy ACCEPT)
 num  target     prot opt source       destination</pre>
-The <tt>ip6tables</tt> default rules are similar, with its rules 2 and
-10 reflecting protocol naming and addressing differences. Instead
-of rule 8, however, <tt>ip6tables</tt> includes two rules that accept all
-incoming udp and tcp packets with a particular destination port
-range. This is because the current Netfilter implementation for
-IPv6 lacks reliable connection-tracking functionality.</description>
-
-
+The <tt>ip6tables</tt> default rules are essentially the same.</description>
 
 
 <Rule id="enable_ip6tables">
@@ -164,20 +157,20 @@ The output should be simular to the following:
 <Group id="iptables_icmp_disabled">
 <title>Restrict ICMP Message Types</title>
 <description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages types can be restricted. To accept only ICMP echo reply, destination unreachable, and time exceeded messages, remove the line:<br />
-<pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT</pre>
+<pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</pre>
 and insert the lines:
-<pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-reply -j ACCEPT
--A RH-Firewall-1-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
--A RH-Firewall-1-INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</pre>
+<pre>-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
+-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</pre>
 To allow the system to respond to pings, also insert the following line:
-<pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -j ACCEPT</pre>
+<pre>-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</pre>
 Ping responses can also be limited to certain networks or hosts by using the -s option in the previous rule.
 Because IPv6 depends so heavily on ICMPv6, it is preferable to deny the ICMPv6 packets you know you
 don't need (e.g. ping requests) in <tt>/etc/sysconfig/ip6tables</tt>, while letting everything else through:
-<pre>-A RH-Firewall-1-INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</pre>
+<pre>-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</pre>
 If you are going to statically configure the machine's address, it should ignore Router Advertisements which
 could add another IPv6 address to the interface or alter important network settings:
-<pre>-A RH-Firewall-1-INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
+<pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
 </description>
 <ref nist="AC-4, CM-6" />
 <rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the oper-
@@ -194,12 +187,12 @@ logging these spoofing or suspicious attempts before they are dropped. If you do
 traffic, add identical rules with a target of DROP after each LOG.
 To log and then drop these IPv4 packets, insert the following rules in <tt>/etc/sysconfig/iptables</tt> (excepting
 any that are intentionally used):
-<pre>-A INPUT -i eth0 -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
--A INPUT -i eth0 -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
--A INPUT -i eth0 -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
--A INPUT -i eth0 -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
--A INPUT -i eth0 -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
--A INPUT -i eth0 -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</pre>
+<pre>-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
+-A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
+-A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
+-A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
+-A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
+-A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</pre>
 Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected
 on your network:
 <pre>-A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: "
-- 
1.7.7.6



More information about the scap-security-guide mailing list