[PATCH 5/7] ipv6 edits for consistency, linebreak fixes

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Oct 19 17:09:35 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/network/ipv6.xml |  122 ++++++++++++++++++++++++-----------
 1 files changed, 83 insertions(+), 39 deletions(-)

diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index b7e8ad0..2b0b165 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -13,29 +13,35 @@ Despite configuration that suggests support for IPv6 has
 been disabled, link-local IPv6 address autoconfiguration occurs
 even when only an IPv4 address is assigned. The only way to
 effectively prevent execution of the IPv6 networking stack is to
-instruct the IPv6 kernel module not to load it.</description>
+instruct the system not to activate the IPv6 kernel module.
+</description>
 
 <Rule id="disable_ipv6_module_loading">
 <title>Disable IPv6 Networking Support Automatic Loading</title>
-<description>To prevent the IPv6 kernel module (<tt>ipv6</tt>) from loading the IPv6 networking stack, add the following line to <tt>/etc/modprobe.d/disabled.conf</tt> (or another file in <tt>/etc/modprobe.d</tt>):
+<description>To prevent the IPv6 kernel module (<tt>ipv6</tt>) from loading the
+IPv6 networking stack, add the following line to
+<tt>/etc/modprobe.d/disabled.conf</tt> (or another file in
+<tt>/etc/modprobe.d</tt>):
 <pre>options ipv6 disable=1</pre>
-This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it),
-while disabling support for the IPv6 protocol.
+This permits the IPv6 module to be loaded (and thus satisfy other modules that
+depend on it), while disabling support for the IPv6 protocol.
 </description>
 <ocil clause="the ipv6 kernel module is loaded">
 If the system is configured to prevent the loading of the
 <tt>ipv6</tt> kernel module, it will contain a line
 of the form:
 <pre>options ipv6 disable=1</pre>
-inside any file in <tt>/etc/modprobe.d</tt> or the deprecated<tt>/etc/modprobe.conf</tt>.
-This permits insertion of the IPv6 kernel module (which other parts of the system
-expect to be present), but otherwise keeps it inactive.
-Run the following command to search for such lines in all files in <tt>/etc/modprobe.d</tt>
-and the deprecated <tt>/etc/modprobe.conf</tt>:
+inside any file in <tt>/etc/modprobe.d</tt> or the
+deprecated<tt>/etc/modprobe.conf</tt>.  This permits insertion of the IPv6
+kernel module (which other parts of the system expect to be present), but
+otherwise keeps it inactive.  Run the following command to search for such
+lines in all files in <tt>/etc/modprobe.d</tt> and the deprecated
+<tt>/etc/modprobe.conf</tt>:
 <pre xml:space="preserve">$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d</pre>
 </ocil>
 <rationale>
-Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
+Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
+the vulnerability to exploitation.
 </rationale>
 <ident cce="CCE-3562-6" />
 <oval id="kernel_module_ipv6_option_disabled" />
@@ -44,10 +50,13 @@ Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
 
 <Rule id="network_ipv6_disable_interfaces">
 <title>Disable Interface Usage of IPv6</title>
-<description>To prevent configuration of IPv6 for all interfaces, add or correct the following lines in <tt>/etc/sysconfig/network</tt>:
+<description>To prevent configuration of IPv6 for all interfaces, add or
+correct the following lines in <tt>/etc/sysconfig/network</tt>:
 <pre>NETWORKING_IPV6=no
 IPV6INIT=no</pre>
-For each network interface <i>IFACE</i> , add or correct the following lines in <tt>/etc/sysconfig/network-scripts/</tt> ifcfg-<i>IFACE</i> as an additional prevention mechanism:
+For each network interface <i>IFACE</i> , add or correct the following lines in
+<tt>/etc/sysconfig/network-scripts/</tt> ifcfg-<i>IFACE</i> as an additional
+prevention mechanism:
 <pre>IPV6INIT=no</pre>
 </description>
 <ref nist="CM-6, CM-7" />
@@ -55,11 +64,14 @@ For each network interface <i>IFACE</i> , add or correct the following lines in
 
 <Rule id="network_ipv6_disable_rpc">
 <title>Disable Support for RPC IPv6</title>
-<description>RPC services for NFSv4 try to load transport modules for <tt>udp6</tt> and <tt>tcp6</tt> by default, even if IPv6 has been disabled in <tt>/etc/modprobe.d</tt>. To prevent RPC services such as <tt>rpc.mountd</tt> from attempting to start IPv6 network listeners, remove or comment out the following two lines in <tt>/etc/netconfig</tt>:
+<description>RPC services for NFSv4 try to load transport modules for
+<tt>udp6</tt> and <tt>tcp6</tt> by default, even if IPv6 has been disabled in
+<tt>/etc/modprobe.d</tt>. To prevent RPC services such as <tt>rpc.mountd</tt>
+from attempting to start IPv6 network listeners, remove or comment out the
+following two lines in <tt>/etc/netconfig</tt>:
 <pre>udp6       tpi_clts      v     inet6    udp     -       -
 tcp6       tpi_cots_ord  v     inet6    tcp     -       -</pre>
 </description>
-<!--<ident cce="CCE-3842-2" />-->
 <oval id="network_ipv6_disable_rpc" />
 <ref nist="CM-6, CM-7" />
 </Rule>
@@ -71,7 +83,7 @@ tcp6       tpi_cots_ord  v     inet6    tcp     -       -</pre>
 implementing it can automatically configure their networking
 devices using information from the network. From a security
 perspective, manually configuring important configuration
-information is always preferable to accepting it from the network
+information is preferable to accepting it from the network
 in an unauthenticated fashion.</description>
 
 <Group id="disabling_ipv6_autoconfig">
@@ -113,22 +125,27 @@ operator="equals" interactive="0">
 
 <Rule id="set_sysctl_net_ipv6_conf_default_accept_ra">
 <title>Disable Accepting IPv6 Router Advertisements</title>
-<description>The default setting for accepting IPv6 router
-advertisements should be: <tt><sub idref="sysctl_net_ipv6_conf_default_accept_ra_value" /></tt> for all interfaces.  To do so add the following lines to <tt>/etc/sysctl.conf</tt> to limit the configuration information requested from other systems, and accepted from the network:
-<pre>net.ipv6.conf.default.accept_ra = <sub idref="sysctl_net_ipv6_conf_default_accept_ra_value" /></pre></description>
+<description>
+<sysctl-desc-macro sysctl="net.ipv6.conf.default.accept_ra" value="0" />
+</description>
+<ocil>
+<sysctl-check-macro sysctl="net.ipv6.conf.default.accept_ra" value="0" />
+</ocil>
+<rationale>
+An illicit router advertisement message could result in a man-in-the-middle attack.
+</rationale>
 <ident cce="CCE-4269-7" />
-<oval id="sysctl_net_ipv6_conf_default_accept_ra" /> <!--value="sysctl_net_ipv6_conf_default_accept_ra_value" /> -->
+<oval id="sysctl_net_ipv6_conf_default_accept_ra" />
 <ref nist="CM-7" />
 </Rule>
 
 <Rule id="set_sysctl_ipv6_default_accept_redirects">
 <title>Disable Accepting IPv6 Redirects</title>
-<description>The setting for accepting IPv6 redirects should be: <tt><sub idref="sysctl_net_ipv6_conf_default_accept_redirects_value" /></tt> for all interfaces.  To do so add the following lines to <tt>/etc/sysctl.conf</tt> to limit the configuration information requested from other systems, and accepted from the network:
-<pre>net.ipv6.conf.default.accept_redirects = <sub idref="sysctl_net_ipv6_conf_default_accept_redirects_value" /></pre>
+<description>
+<sysctl-desc-macro sysctl="net.ipv6.conf.default.accept_redirects" value="0" />
 </description>
-<ocil clause="there is not output">
-To ensure IPv6 redirects are disabled, run the following command:
-<pre># grep ipv6 /etc/sysctl.conf</pre>
+<ocil>
+<sysctl-check-macro sysctl="net.ipv6.conf.default.accept_redirects" value="0" />
 </ocil>
 <rationale>
 An illicit ICMP redirect message could result in a man-in-the-middle attack.
@@ -142,19 +159,30 @@ An illicit ICMP redirect message could result in a man-in-the-middle attack.
 
 <Rule id="network_ipv6_static_address">
 <title>Manually Assign Global IPv6 Address</title>
-<description>To manually assign an IP address for an interface IFACE , edit the file <tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>. Add or correct the following line (substituting the correct IPv6 address):
+<description>To manually assign an IP address for an interface IFACE , edit the
+file <tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>. Add or correct the
+following line (substituting the correct IPv6 address):
 <pre>IPV6ADDR=2001:0DB8::ABCD/64</pre>
-Manually assigning an IP address is preferable to accepting one from routers or from the network otherwise. The example address here is an IPv6 address reserved for documentation purposes, as defined by RFC3849.</description>
-<!--<ident cce="CCE-3842-2" />-->
+Manually assigning an IP address is preferable to accepting one from routers or
+from the network otherwise. The example address here is an IPv6 address
+reserved for documentation purposes, as defined by RFC3849.
+</description>
 <oval id="network_ipv6_static_address" />
 <ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="network_ipv6_privacy_extensions">
 <title>Use Privacy Extensions for Address</title>
-<description>To introduce randomness into the automatic generation of IPv6 addresses, add or correct the following line in <tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>:
+<description>To introduce randomness into the automatic generation of IPv6
+addresses, add or correct the following line in
+<tt>/etc/sysconfig/network-scripts/ifcfg-IFACE</tt>:
 <pre>IPV6_PRIVACY=rfc3041</pre>
-Automatically-generated IPv6 addresses are based on the underlying hardware (e.g. Ethernet) address, and so it becomes possible to track a piece of hardware over its lifetime using its traffic. If it is important for a system's IP address to not trivially reveal its hardware address, this setting should be applied.</description>
+Automatically-generated IPv6 addresses are based on the underlying hardware
+(e.g. Ethernet) address, and so it becomes possible to track a piece of
+hardware over its lifetime using its traffic. If it is important for a system's
+IP address to not trivially reveal its hardware address, this setting should be
+applied.
+</description>
 <ident cce="CCE-3842-2" />
 <oval id="network_ipv6_privacy_extensions" />
 <ref nist="CM-6, CM-7" />
@@ -162,17 +190,22 @@ Automatically-generated IPv6 addresses are based on the underlying hardware (e.g
 
 <Rule id="network_ipv6_default_gateway">
 <title>Manually Assign IPv6 Router Address</title>
-<description>Edit the file <tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt>, and add or correct the following line (substituting your gateway IP as appropriate):
+<description>Edit the file
+<tt>/etc/sysconfig/network-scripts/ifcfg-<i>IFACE</i></tt>, and add or correct
+the following line (substituting your gateway IP as appropriate):
 <pre>IPV6_DEFAULTGW=2001:0DB8::0001</pre>
-Router addresses should be manually set and not accepted via any autoconfiguration or router advertisement.</description>
-<!--<ident cce="CCE-3842-2" />-->
+Router addresses should be manually set and not accepted via any
+autoconfiguration or router advertisement.
+</description>
 <oval id="network_ipv6_default_gateway" />
 <ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="network_ipv6_limit_requests">
 <title>Limit Network-Transmitted Configuration</title>
-<description>Add the following lines to <tt>/etc/sysctl.conf</tt> to limit the configuration information requested from other systems, and accepted from the network:
+<description>Add the following lines to <tt>/etc/sysctl.conf</tt> to limit the
+configuration information requested from other systems, and accepted from the
+network:
 <pre>net.ipv6.conf.default.router_solicitations = 0
 net.ipv6.conf.default.accept_ra_rtr_pref = 0
 net.ipv6.conf.default.accept_ra_pinfo = 0
@@ -180,17 +213,28 @@ net.ipv6.conf.default.accept_ra_defrtr = 0
 net.ipv6.conf.default.autoconf = 0
 net.ipv6.conf.default.dad_transmits = 0
 net.ipv6.conf.default.max_addresses = 1</pre>
-The <tt>router_solicitations</tt> setting determines how many router solicitations are sent when bringing up the interface. If addresses are statically assigned, there is no need to send any solicitations.
+The <tt>router_solicitations</tt> setting determines how many router
+solicitations are sent when bringing up the interface. If addresses are
+statically assigned, there is no need to send any solicitations.
 <br />
-The <tt>accept_ra_pinfo</tt> setting controls whether the system will accept prefix info from the router.
+The <tt>accept_ra_pinfo</tt> setting controls whether the system will accept
+prefix info from the router.
 <br />
-The <tt>accept_ra_defrtr</tt> setting controls whether the system will accept Hop Limit settings from a router advertisement. Setting it to 0 prevents a router from changing your default IPv6 Hop Limit for outgoing packets.
+The <tt>accept_ra_defrtr</tt> setting controls whether the system will accept
+Hop Limit settings from a router advertisement. Setting it to 0 prevents a
+router from changing your default IPv6 Hop Limit for outgoing packets.
 <br />
-The <tt>autoconf</tt> setting controls whether router advertisements can cause the system to assign a global unicast address to an interface.
+The <tt>autoconf</tt> setting controls whether router advertisements can cause
+the system to assign a global unicast address to an interface.
 <br />
-The <tt>dad_transmits</tt> setting determines how many neighbor solicitations to send out per address (global and link-local) when bringing up an interface to ensure the desired address is unique on the network.
+The <tt>dad_transmits</tt> setting determines how many neighbor solicitations
+to send out per address (global and link-local) when bringing up an interface
+to ensure the desired address is unique on the network.
 <br />
-The <tt>max_addresses</tt> setting determines how many global unicast IPv6 addresses can be assigned to each interface.  The default is 16, but it should be set to exactly the number of statically configured global addresses required.
+The <tt>max_addresses</tt> setting determines how many global unicast IPv6
+addresses can be assigned to each interface.  The default is 16, but it should
+be set to exactly the number of statically configured global addresses
+required.
 </description>
 <ident cce="CCE-4221-8" />
 <ident cce="CCE-4137-6" />
-- 
1.7.1



More information about the scap-security-guide mailing list