[PATCH 3/7] added alternate title text for STIG profile rules

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Oct 19 17:09:33 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/alt-titles-stig.xml |   23 +++++++++++++++++++----
 1 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index df2a4ec..223a718 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -1,4 +1,3 @@
-<?xml version="1.0"?>
 <titles xmlns="http://checklists.nist.gov/xccdf/1.1" id="stig">
 <!-- This file can be used to specify alternative titles.
      The rule attribute is used to identify the Rule with which to associate the title.
@@ -161,7 +160,7 @@ The /etc/group file must not contain a plus (+) entry.
 <title rule="no_nis_inclusions_passwd" shorttitle="Remove Legacy + Entries From /etc/passwd">
 The /etc/passwd file must not contain a plus (+) entry.
 </title>
-<title rule="password_retry" shorttitle="Set Password Retry Prompts Permitted Per-session">
+<title rule="password_retry" shorttitle="Set Password Retry Prompts Permitted Per-Session">
 The system must reject session authentication after three consecutive failed authentication attempts.
 </title>
 <title rule="password_require_digits" shorttitle="Set Password Strength Minimum Digit Characters">
@@ -329,7 +328,7 @@ The system must provide VPN connectivity for communications over untrusted netwo
 <title rule="package_rsyslog_installed" shorttitle="Ensure rsyslog is Installed">
 The system must provide system logging services.
 </title>
-<title rule="service_rsyslog_enabled" shorttitle="Enable Rsyslog Service (rsyslog)">
+<title rule="service_rsyslog_enabled" shorttitle="Enable rsyslog Service">
 The system's system logging services must be enabled.
 </title>
 <title rule="userowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate User">
@@ -491,7 +490,7 @@ The TFTP service must not be running.
 <title rule="uninstall_tftp-server" shorttitle="Uninstall tftp-server Package">
 The tftp-servicer package must not be installed.
 </title>
-<title rule="tftpd_uses_secure_mode" shorttitle="Ensure TFTP Daemon Uses Secure Mode">
+<title rule="tftpd_uses_secure_mode" shorttitle="Ensure tftp Daemon Uses Secure Mode">
 The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system.
 </title>
 <title rule="service_abrtd_disabled" shorttitle="Disable Automatic Bug Reporting Tool (abrtd)">
@@ -655,4 +654,20 @@ The snmpd service must be disabled unless required.
 <title rule="uninstall_net-snmp" shorttitle="Uninstall net-snmp Package">
 The net-snmp package must not be installed unless required.
 </title>
+<title rule="install_hids" shorttitle="Install Intrusion Detection Software">
+The system must have a host-based intrusion detection tool installed.
+</title>
+<title rule="install_antivirus" shorttitle="Install Virus Scanning Software">
+The system must use and update a DoD-approved virus scan program.
+</title>
+<title rule="root_path_default" shorttitle="Root Path Must Be Vendor Default">
+The root account's executable search path must be the vendor default.
+</title>
+<title rule="ftp_log_transactions" shorttitle="Enable Logging of All FTP Transactions">
+The FTP daemon must be configured for logging or verbose mode.
+</title>
+<title rule="smartcard_auth" shorttitle="Enable Smart Card Login">
+The system, if capable, must be configured to require the use of a CAC, PIV
+compliant hardware token, or Alternate Logon Token (ALT) for authentication.
+</title>
 </titles>
-- 
1.7.1



More information about the scap-security-guide mailing list