[PATCH] severity changes
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Oct 23 16:36:20 UTC 2012
We're supposed to meet with Michele about this today, but I guess this
serves as an example.
Please work on comprehensive proofreading instead.
On 10/23/2012 10:52 AM, David Smith wrote:
>
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/network/iptables.xml | 8 ++++----
> RHEL6/input/system/selinux.xml | 6 +++---
> RHEL6/input/system/software/updating.xml | 8 ++++----
> 3 files changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
> index 1948224..bb97a11 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -49,7 +49,7 @@ num target prot opt source destination</pre>
> The <tt>ip6tables</tt> default rules are essentially the same.</description>
>
>
> -<Rule id="enable_ip6tables">
> +<Rule id="enable_ip6tables" severity="medium">
> <title>Verify ip6tables Enabled</title>
> <description>
> <service-enable-macro service="ip6tables" />
> @@ -63,7 +63,7 @@ capability for IPv6 and ICMPv6.
> <ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/>
> </Rule>
>
> -<Rule id="enable_iptables">
> +<Rule id="enable_iptables" severity="medium">
> <title>Verify iptables Enabled</title>
> <description>
> <service-enable-macro service="iptables" />
> @@ -110,7 +110,7 @@ requirements. Otherwise, this program should not be used to make
> changes to the firewall configuration because it re-writes the
> saved configuration file.</warning>
>
> -<Rule id="set_iptables_default_rule">
> +<Rule id="set_iptables_default_rule" severity="medium">
> <title>Set Default Iptables Policy for Incoming Packets</title>
> <description>To set the default policy to DROP (instead of ACCEPT) for
> the built-in INPUT chain which processes incoming packets,
> @@ -131,7 +131,7 @@ accepted.</rationale>
> <ref nist="AC-4, CM-6" disa="66,1109,1154,1414" />
> </Rule>
>
> -<Rule id="set_iptables_default_rule_forward">
> +<Rule id="set_iptables_default_rule_forward" severity="medium">
> <title>Set Default Iptables Policy for Forwarded Packets</title>
> <description>To set the default policy to DROP (instead of ACCEPT) for
> the built-in FORWARD chain which processes packets that will be forwarded from
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 6e00f85..1592874 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -82,7 +82,7 @@ and to protect the boot process.
> <value selector="mls">mls</value>
> </Value>
>
> -<Rule id="enable_selinux_bootloader">
> +<Rule id="enable_selinux_bootloader" severity="high">
> <title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
> <description>SELinux can be disabled at boot time by an argument in
> <tt>/etc/grub.conf</tt>.
> @@ -104,7 +104,7 @@ the chances that it will remain off during system operation.
> <ref nist="AC-3, CM-6" disa="22,32"/>
> </Rule>
>
> -<Rule id="set_selinux_state">
> +<Rule id="set_selinux_state" severity="high">
> <title>Ensure SELinux State is Enforcing</title>
> <description>The SELinux state should be set to <tt>enforcing</tt> at
> system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
> @@ -208,7 +208,7 @@ which use category labelling.</description>
> </Group>
> -->
>
> -<Rule id="selinux_confinement_of_daemons">
> +<Rule id="selinux_confinement_of_daemons" severity="medium">
> <title>Ensure No Daemons are Unconfined by SELinux</title>
> <description>
> Daemons for which the SELinux policy does not contain rules will inherit the
> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
> index 30331e6..4ed4123 100644
> --- a/RHEL6/input/system/software/updating.xml
> +++ b/RHEL6/input/system/software/updating.xml
> @@ -18,7 +18,7 @@ for this reason, their use is strongly encouraged.
> </description>
> <ref disa="1233" />
>
> -<Rule id="ensure_redhat_gpgkey_installed">
> +<Rule id="ensure_redhat_gpgkey_installed" severity="high">
> <title>Ensure Red Hat GPG Key Installed</title>
> <description>
> To ensure that the system can cryptographically verify base software
> @@ -46,7 +46,7 @@ are from Red Hat.
> <!-- REMINDER: Before telling people to update their systems
> via the security_patches_up_to_date rule, we must
> ensure they have configured an update source! -->
> -<Rule id="ensure_gpgcheck_globally_activated">
> +<Rule id="ensure_gpgcheck_globally_activated" severity="high">
> <title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
> <description>The <tt>gpgcheck</tt> option should be used to ensure that
> checking of an RPM package's signature always occurs prior to its
> @@ -75,7 +75,7 @@ protects against malicious tampering.
> <tested by="MM" on="20120928"/>
> </Rule>
>
> -<Rule id="ensure_gpgcheck_never_disabled">
> +<Rule id="ensure_gpgcheck_never_disabled" severity="high">
> <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
> <description>To ensure that signature checking is not disabled for
> any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
> @@ -100,7 +100,7 @@ protects against malicious tampering.
> <tested by="MM" on="20120928"/>
> </Rule>
>
> -<Rule id="security_patches_up_to_date">
> +<Rule id="security_patches_up_to_date" severity="high">
> <title>Ensure Software Patches Installed</title>
> <description>If the system is joined to the Red Hat Network, a Red Hat Satellite Server,
> or a yum server, run the following command to install updates:
More information about the scap-security-guide
mailing list