[PATCH] some light QA work

David Smith dsmith at eclipse.ncsc.mil
Wed Oct 24 22:19:03 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/base.xml                      |   11 +++++++++++
 RHEL6/input/services/cron.xml                      |    2 ++
 RHEL6/input/services/dhcp.xml                      |    3 +++
 RHEL6/input/services/ldap.xml                      |    3 +++
 RHEL6/input/services/mail.xml                      |    3 +++
 RHEL6/input/services/ntp.xml                       |    2 ++
 RHEL6/input/services/ssh.xml                       |   10 ++++++++++
 RHEL6/input/system/accounts/pam.xml                |    9 +++++++++
 RHEL6/input/system/accounts/physical.xml           |    2 ++
 .../accounts/restrictions/password_storage.xml     |    3 +++
 .../system/accounts/restrictions/root_logins.xml   |    5 +++++
 RHEL6/input/system/auditing.xml                    |   13 ++++++++++++-
 RHEL6/input/system/logging.xml                     |    5 +++++
 RHEL6/input/system/network/iptables.xml            |    2 ++
 RHEL6/input/system/network/ipv6.xml                |    2 ++
 RHEL6/input/system/network/kernel.xml              |   15 +++++++++++++++
 RHEL6/input/system/network/uncommon.xml            |    4 ++++
 RHEL6/input/system/permissions/execution.xml       |    2 ++
 RHEL6/input/system/selinux.xml                     |    5 ++++-
 RHEL6/input/system/software/integrity.xml          |    1 +
 20 files changed, 100 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index d3e32a6..bda8350 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -273,6 +273,7 @@ available in the ntpd program and should be considered deprecated.</rationale>
 <ident cce="TODO" />
 <!--<oval id="service_ntpdate_disabled" /> -->
 <ref nist="AU-8, CM-6" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="service_oddjobd_disabled">
@@ -291,6 +292,7 @@ been a source of privilege escalation security issues.</rationale>
 <ident cce="TODO" />
 <oval id="service_oddjobd_disabled" />
 <ref nist="AC-6, CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -308,6 +310,7 @@ disabled if not needed.</rationale>
 <ident cce="TODO" />
 <oval id="service_portreserve_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -327,6 +330,7 @@ records.</rationale>
 <ident cce="TODO" />
 <oval id="service_psacct_enabled" />
 <ref nist="AU-12, CM-6" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="service_qpidd_disabled">
@@ -366,6 +370,7 @@ service.</rationale>
 <ident cce="TODO" />
 <oval id="service_quota_nld_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -385,6 +390,7 @@ dynamic network configuration information.</rationale>
 <ident cce="TODO" />
 <oval id="service_rdisc_disabled" />
 <ref nist="AC-4, CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -403,6 +409,7 @@ desirable for some environments.</rationale>
 <ident cce="3416-5" />
 <oval id="service_rhnsd_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -422,6 +429,7 @@ unnecessary and can be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_rhsmcertd_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -442,6 +450,7 @@ consulted, it is not necessary and should be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_saslauthd_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -460,6 +469,7 @@ disabled.</rationale>
 <ident cce="3455-3" />
 <oval id="service_smartd_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <!--
@@ -498,6 +508,7 @@ operation, but unless used this service can be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_sysstat_disabled" />
 <ref nist="CM-6, CM-7" disa="382" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <!--
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index da724e6..750f419 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -20,6 +20,7 @@ enabling the cron daemon is essential.
 <ident cce="4324-0" />
 <oval id="service_crond_enabled" />
 <ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -124,6 +125,7 @@ daemon can be provided through the cron daemon instead.
 <ident cce="14466-7" />
 <oval id="service_atd_disabled" />
 <ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 991cf7d..64b6778 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -48,6 +48,7 @@ DHCP server if there is one.
 <ident cce="4336-4" />
 <oval id="service_dhcpd_disabled" />
 <ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="uninstall_dhcp_server">
@@ -64,6 +65,7 @@ accidentally reactivated and disrupt network operation.
 <ident cce="4464-4" />
 <oval id="package_dhcpd_removed" />
 <ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 </Group> <!-- <Group id="disabling_dhcp_server"> -->
@@ -230,6 +232,7 @@ unacceptable burden in many circumstances.</rationale>
 <ident cce="4191-3" />
 <oval id="sysconfig_networking_bootproto_ifcfg" />
 <ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group> <!-- <Group id="disabling_dhcp_client"> -->
 
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 1ed2b6f..bdf9f0f 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -42,6 +42,7 @@ than doing LDAP over SSL.</rationale>
 <ref disa="776,778,1453" />
 <ident cce="14894-0" />
 <oval id="ldap_client_start_tls" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="ldap_client_tls_cacertpath">
@@ -66,6 +67,7 @@ site CA.</rationale>
 <ref disa="776,778,1453" />
 <ident cce="14894-0" />
 <oval id="ldap_client_tls_cacertpath" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 </Group><!--End <Group id="openldap_client"> -->
@@ -100,6 +102,7 @@ The output should show:
 <ident cce="3501-4" />
 <oval id="package_openldap-servers_removed" />
 <ref nist="CM-6, CM-7" disa="366"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="ldap_server_config_olcsuffix">
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index 2176cfd..3eeaedd 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -39,6 +39,7 @@ notification tasks.
 <ident cce="14068-1" />
 <oval id="service_postfix_enabled" />
 <ref nist="CM-6" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="package_sendmail_removed">
@@ -55,6 +56,7 @@ its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
 </rationale>
 <ref nist="CM-6" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -85,6 +87,7 @@ and not from the network, which protects it from network attack.
 <ident cce="15018-5" />
 <oval id="postfix_network_listening_disabled" />
 <ref nist="CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 </Group><!--End <Group id="postfix_client"> -->
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index 896ce33..85de73e 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -48,6 +48,7 @@ logs and auditing possible security breaches.</rationale>
 <ident cce="4376-0" />
 <oval id="service_ntpd_enabled" />
 <ref disa="160" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="ntpd_specify_remote_server">
@@ -74,6 +75,7 @@ recommended.</rationale>
 <ident cce="4385-1" />
 <oval id="ntp_remote_server" />
 <ref disa="160" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index ea94c4d..fada9fd 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -29,6 +29,7 @@ remote access.
 </description>
 <ident cce="4268-9" />
 <oval id="service_sshd_disabled" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="ssh_server_iptables_exception">
@@ -82,6 +83,7 @@ should not be used.
 <ident cce="4325-7" />
 <oval id="sshd_protocol_2" />
 <ref disa="776,774,1135,1436" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="sshd_limit_user_access">
@@ -170,6 +172,7 @@ to compromises on another.
 <ident cce="3845-5" />
 <oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
 <ref disa="879,1133"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -193,6 +196,7 @@ is reached.
 <ident cce="14061-6" />
 <oval id="sshd_clientalivecountmax" />
 <ref disa="879,1133"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -241,6 +245,7 @@ can allow an attacker to move trivially to other hosts.
 <ident cce="4370-3" />
 <oval id="sshd_hostbasedauthentication" />
 <ref disa="765,766"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -262,6 +267,7 @@ and also allows direct attack attempts on root's password.
 <ident cce="4387-7" />
 <oval id="sshd_permitrootlogin_no" />
 <ref disa="770" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -284,6 +290,7 @@ even in the event of misconfiguration elsewhere.
 <ident cce="3660-8" />
 <oval id="sshd_permitemptypasswords_no" />
 <ref disa="765,766"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="sshd_enable_warning_banner">
@@ -307,6 +314,7 @@ should ensure usage of a banner that does not provide easy attribution.
 <ident cce="4431-3" />
 <oval id="sshd_banner_set" />
 <ref disa="48" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -330,6 +338,7 @@ access restriction in some configurations.
 <ident cce="4422-2" />
 <oval id="sshd_no_user_envset" />
 <ref disa="1414" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="sshd_use_approved_ciphers">
@@ -359,6 +368,7 @@ implementation. These are also required for compliance.
 <ident cce="14491-5" />
 <oval id="sshd_use_approved_ciphers" />
 <ref disa="803,1144,1145,1146,196" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Group id="sshd_strengthen_firewall">
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 64b6045..356a622 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -199,6 +199,7 @@ is different from account lockout, which is provided by the pam_faillock module.
 <ident cce="15054-0" />
 <oval id="accounts_password_pam_cracklib_retry" value="var_password_pam_cracklib_retry"/>
 <ref nist="IA-5" disa="1092" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="password_require_3consecrepeat">
@@ -241,6 +242,7 @@ search space.
 <ident cce="14113-5" />
 <oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/>
 <ref nist="IA-5,194" disa="194"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="password_require_uppercases">
@@ -265,6 +267,7 @@ more difficult by ensuring a larger search space.
 <ident cce="14672-0" />
 <oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/>
 <ref nist="IA-5" disa="192" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="password_require_specials">
@@ -289,6 +292,7 @@ more difficult by ensuring a larger search space.
 <ident cce="14122-6" />
 <oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
 <ref nist="IA-5" disa="1619" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="password_require_lowercases">
@@ -313,6 +317,7 @@ more difficult by ensuring a larger search space.
 <ident cce="14712-4" />
 <oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/>
 <ref nist="IA-5" disa="193" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="password_require_diffchars">
@@ -338,6 +343,7 @@ Note that passwords which are changed on compromised systems will still be compr
 <ident cce="14701-7" />
 <oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/>
 <ref nist="IA-5" disa="195"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 </Group>
@@ -406,6 +412,7 @@ Preventing re-use of previous passwords helps ensure that a compromised password
 <ident cce="14939-3" />
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
 <ref nist="IA-5" disa="200" />
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
@@ -438,6 +445,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 <!-- <ident cce="14063-2" /> -->
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
 <ref nist="IA-5" disa="803"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_password_hashing_algorithm_logindefs">
@@ -457,6 +465,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 <!-- <ident cce="14063-2" /> -->
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
 <ref nist="IA-5" disa="803"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_password_hashing_algorithm_libuserconf">
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index b331bbb..60edd6d 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -128,6 +128,7 @@ by configuring the bootloader password.
 <ident cce="4241-6" />
 <oval id="singleuser_password" />
 <ref nist="AC-6, IA-5" disa="213" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="disable_ctrlaltdel_reboot">
@@ -185,6 +186,7 @@ services, weakening system security.
 <ident cce="4245-7" />
 <oval id="interactive_boot_disable" />
 <ref nist="CM-7, IA-4, SC-2" disa="213"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index a4db5f7..6e295d8 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -39,6 +39,7 @@ environments.
 <ident cce="4238-2" />
 <oval id="accounts_pam_no_nullok" />
 <ref nist="AC-3, CM-6, IA-5" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="no_hashes_outside_shadow">
@@ -64,6 +65,7 @@ which is readable by all users.
 <ident cce="14300-8" />
 <oval id="accounts_password_all_shadowed" />
 <ref nist="IA-5" disa="201" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="gid_passwd_group_same">
@@ -81,6 +83,7 @@ There should be no output.
 Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having unintended rights.
 </rationale>
 <ref disa="366" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="no_netrc_files">
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 516a6ba..9240658 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -61,6 +61,7 @@ using the root account.
 <ident cce="3485-0" />
 <oval id="securetty_root_login_console_only" />
 <ref nist="CM-6, CM-7" disa="770" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="restrict_serial_port_logins">
@@ -85,6 +86,7 @@ using the root account.
 <ident cce="4256-4" />
 <oval id="securetty_no_serial" />
 <ref nist="AC-3, AC-6" disa="770" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -142,6 +144,7 @@ become inaccessible.
 <ident cce="3987-5" />
 <oval id="accounts_nologin_for_system" />
 <ref nist="AC-3, CM-6" disa="178" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -167,6 +170,7 @@ access to root privileges in an accountable manner.
 <ident cce="4009-7" />
 <oval id="accounts_no_uid_except_zero" />
 <ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="root_path_default">
@@ -190,6 +194,7 @@ The root account's executable search path must be the vendor default, and must
 contain only absolute paths.
 </rationale>
 <ref disa="366" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <!--
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 2a50c46..20e15dd 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -95,6 +95,7 @@ actions will be taken if other obstacles exist.
 <ident cce="4292-9" />
 <oval id="service_auditd_enabled" />
 <ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,067,158,831,1123,1190,1312,1263,130" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="enable_auditd_bootloader">
@@ -245,6 +246,7 @@ determine how many logs the system is configured to retain after rotation:
 log information over the period required. This is a function of the maxium log
 file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" /> 
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -267,6 +269,7 @@ determine how much data the system will retain in each audit log file:
 log information over the period required. This is a function of the maxium
 log file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" /> 
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -299,6 +302,7 @@ being overwhelmed with log data. However, for systems that must never discard
 log data, or which use external processes to transfer it and reclaim space,
 <tt>keep_logs</tt> can be employed.</rationale>
 <oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <!--
@@ -347,6 +351,7 @@ disk space is starting to run low:
 allow them to take corrective action prior to any disruption.</rationale>
 <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
 <ref disa="140,143,144" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -386,6 +391,7 @@ is used, running low on space for audit records should never occur.
 </rationale>
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
 <ref disa="140,143,144,1343" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -663,6 +669,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 </rationale>
 <oval id="file_permissions_var_log_audit" />
 <ref disa="366" />
+<tested by="DS" on="20121024"/>
 </Rule> 
 
 <Rule id="audit_logs_rootowner">
@@ -677,6 +684,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 owner, and unauthorized users, potential access to sensitive information.</rationale>
 <oval id="file_ownership_var_log_audit" />
 <ref nist="AU-2" />
+<tested by="DS" on="20121024"/>
 </Rule> 
 
 <Rule id="audit_mac_changes">
@@ -1164,7 +1172,7 @@ Then, for each setuid program on the system, add a line of the following form to
 in the list:
 <pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged</pre>
 </description>
-<ocil clause="it is the case">
+<ocil clause="it is not the case">
 To verify that auditing of privileged command use is configured, run the following command to find relevant setuid programs:
 <pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre>
 Run the following command to verify entries in the audit rules for all programs found with the previous command:
@@ -1179,6 +1187,7 @@ unusual activity.
 <ident cce="14296-8" />
 <oval id="audit_rules_privileged_commands" />
 <ref nist="AU-2" disa="40" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="audit_media_exports">
@@ -1200,6 +1209,7 @@ loss.</rationale>
 <ident cce="14569-8" />
 <oval id="audit_rules_media_export" />
 <ref nist="AU-2" disa="126"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="audit_file_deletions">
@@ -1241,6 +1251,7 @@ of what was executed on the system as well as for accountability purposes.</rati
 <ident cce="14824-7" />
 <oval id="audit_rules_sysadmin_actions" />
 <ref nist="AU-2" disa="126"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="audit_kernel_module_loading">
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index 99cb419..ff1b7a0 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -33,6 +33,7 @@ system logging services.
 <ident cce="17742-8" />
 <oval id="package_rsyslog_installed" />
 <ref nist="AU-2, AU-9, CM-6" disa="1311,1312"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -50,6 +51,7 @@ logging services, which are essential to system administration.
 <ident cce="17698-2" />
 <oval id="service_rsyslog_enabled" />
 <ref nist="AU-12, CM-6" disa="1557,1312,1311" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -136,6 +138,7 @@ protected from unauthorized access.</rationale>
 <ident cce="17857-4" />
 <oval id="rsyslog_files_ownership" />
 <ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="groupowner_rsyslog_files">
@@ -161,6 +164,7 @@ protected from unauthorized access.</rationale>
 <ident cce="18240-2" />
 <oval id="rsyslog_files_groupownership" />
 <ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -189,6 +193,7 @@ users could change the logged data, eliminaating their foresive value.
 <ident cce="18095-0" />
 <oval id="rsyslog_files_permissions" />
 <ref nist="AC-3, CM-6" disa="1314"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index bb97a11..2f94450 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -61,6 +61,7 @@ capability for IPv6 and ICMPv6.
 <ident cce="4167-3" />
 <oval id="service_ip6tables_enabled" />
 <ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="enable_iptables" severity="medium">
@@ -76,6 +77,7 @@ capability for IPv4 and ICMP.
 <ident cce="4189-7" />
 <oval id="service_iptables_enabled" />
 <ref nist="CM-6, CM-7" disa="66,1115,1118,1092,27,1117,1098,1100,1097,1123,1124,1414" />
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group><!--<Group id="iptables_activation">-->
 
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index 2b0b165..cfb90d2 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -46,6 +46,7 @@ the vulnerability to exploitation.
 <ident cce="CCE-3562-6" />
 <oval id="kernel_module_ipv6_option_disabled" />
 <ref nist="CM-6, CM-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="network_ipv6_disable_interfaces">
@@ -60,6 +61,7 @@ prevention mechanism:
 <pre>IPV6INIT=no</pre>
 </description>
 <ref nist="CM-6, CM-7" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="network_ipv6_disable_rpc">
diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
index 379bd21..e3b27a3 100644
--- a/RHEL6/input/system/network/kernel.xml
+++ b/RHEL6/input/system/network/kernel.xml
@@ -25,6 +25,7 @@ only appropriate for routers.</rationale>
 <ident cce="4151-7" />
 <oval id="sysctl_net_ipv4_conf_default_send_redirects" />
 <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="disable_sysctl_ipv4_all_send_redirects">
@@ -41,6 +42,7 @@ only appropriate for routers.</rationale>
 <ident cce="4155-8" />
 <oval id="sysctl_net_ipv4_conf_all_send_redirects" />
 <ref nist="CM-6" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="disable_sysctl_ipv4_ip_forward">
@@ -57,6 +59,7 @@ only appropriate for routers.</rationale>
 <ident cce="3561-8" />
 <oval id="sysctl_net_ipv4_ip_forward" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" disa="366"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
@@ -207,6 +210,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4236-6" />
 <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
 <ref nist="CM-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_accept_redirects">
@@ -222,6 +226,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4217-6" />
 <oval id="sysctl_net_ipv4_conf_all_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
 <ref nist="CM-7" disa="1503,1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -239,6 +244,7 @@ absolutely required.</rationale>
 <ident cce="3472-8" />
 <oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
 <ref nist="CM-7, AC-4" disa="1503,1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_log_martians">
@@ -256,6 +262,7 @@ to be detected.</rationale>
 <ident cce="4320-8" />
 <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
 <ref nist="CM-7" disa="126"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -272,6 +279,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4091-5" />
 <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
 <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -288,6 +296,7 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="4186-3" />
 <oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
 <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -305,6 +314,7 @@ absolutely required.</rationale>
 <ident cce="3339-9" />
 <oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
 <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -322,6 +332,7 @@ addresses makes the system slightly more difficult to enumerate on the network.
 <ident cce="3644-2" />
 <oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -338,6 +349,7 @@ log size, although some activity would not be logged.</rationale>
 <ident cce="4133-5" />
 <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
 <ref nist="AC-3, CM-6, CM-7, SC-5" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_tcp_syncookies">
@@ -358,6 +370,7 @@ enables the system to continue servicing valid connection requests.
 <ident cce="4265-5" />
 <oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
 <ref nist="CM-6, CM-7" disa="1092, 1095" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_all_rp_filter">
@@ -376,6 +389,7 @@ networks.</rationale>
 <ident cce="4080-8" />
 <oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" />
 <ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_sysctl_net_ipv4_conf_default_rp_filter">
@@ -394,6 +408,7 @@ networks.</rationale>
 <ident cce="3840-6" />
 <oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" />
 <ref nist="AC-4, SC-5, SC-7" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
index 902ddce..48beb0c 100644
--- a/RHEL6/input/system/network/uncommon.xml
+++ b/RHEL6/input/system/network/uncommon.xml
@@ -30,6 +30,7 @@ the system against exploitation of any flaws in its implementation.
 <ident cce="14268-7" />
 <oval id="kernel_module_dccp_disabled" />
 <ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -52,6 +53,7 @@ the system against exploitation of any flaws in its implementation.
 <ident cce="14132-5" />
 <oval id="kernel_module_sctp_disabled" />
 <ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -73,6 +75,7 @@ the system against exploitation of any flaws in its implementation.
 <ident cce="14027-7" />
 <oval id="kernel_module_rds_disabled" />
 <ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 
@@ -94,6 +97,7 @@ the system against exploitation of any flaws in its implementation.
 <ident cce="14911-2" />
 <oval id="kernel_module_tipc_disabled" />
 <ref nist="CM-6, CM-7" disa="382"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index c387e1a..fdb6607 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -128,6 +128,7 @@ address range.</rationale>
 <ident cce="4168-1" />
 <oval id="sysctl_kernel_exec_shield" />
 <ref nist="CM-7" />
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="enable_randomize_va_space">
@@ -143,6 +144,7 @@ in order to re-purpose it using return oriented programming (ROP) techniques.
 <ident cce="4146-7" />
 <oval id="sysctl_kernel_randomize_va_space" />
 <ref nist="AC-3, CM-6" />
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 1592874..0f952a1 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -102,6 +102,7 @@ the chances that it will remain off during system operation.
 <ident cce="3977-6" />
 <oval id="selinux_bootloader_notdisabled" />
 <ref nist="AC-3, CM-6" disa="22,32"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_selinux_state" severity="high">
@@ -124,6 +125,7 @@ privileges.
 <ident cce="3999-0" />
 <oval id="selinux_mode" value="var_selinux_state_name"/>
 <ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="set_selinux_policy">
@@ -149,6 +151,7 @@ targeted for exploitation, such as network services or system services.
 <ident cce="3624-4" />
 <oval id="selinux_policytype" value="var_selinux_policy_name"/>
 <ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
@@ -241,10 +244,10 @@ It should produce no output in a well-configured system.</ocil>
 If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
 cannot properly restrict access to the device file.
 </rationale>
-
 <ident cce="14991-4" />
 <oval id="selinux_all_devicefiles_labeled" />
 <ref nist="CM-6, CM-7" disa="22,32"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 96c2bcc..e1cee67 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -41,6 +41,7 @@ The AIDE package must be installed if it is to be available for integrity checki
 <ident cce="4209-3" />
 <oval id="package_aide_installed" />
 <ref nist="CM-6, CM-7, SC-28, SI-7" disa="1069"/>
+<tested by="DS" on="20121024"/>
 </Rule>
 
 <Rule id="disable_prelink">
-- 
1.7.1



More information about the scap-security-guide mailing list