[PATCH] moved content from Common profile to Desktop profile
Shawn Wells
shawn at redhat.com
Thu Oct 25 18:10:47 UTC 2012
On 10/25/12 1:43 PM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/profiles/common.xml | 37 ++++++++++++++++++-------------------
> RHEL6/input/profiles/desktop.xml | 23 +++++++++++++++++++++++
> 2 files changed, 41 insertions(+), 19 deletions(-)
>
> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
> index 8b75eae..a5108f6 100644
> --- a/RHEL6/input/profiles/common.xml
> +++ b/RHEL6/input/profiles/common.xml
> @@ -169,8 +169,8 @@
> <select idref="sshd_use_approved_ciphers" selected="true"/>
> <!-- <select idref="xwindows_remote_listening" selected="true"/> Rule to be rewritten to refer to /etc/gdm/custom.conf -->
> <select idref="disable_avahi" selected="true"/>
> -<select idref="disable_dhcp_server" selected="true"/>
> -<select idref="uninstall_dhcp_server" selected="true"/>
> +<!-- <select idref="disable_dhcp_server" selected="true"/> -->
> +<!-- <select idref="uninstall_dhcp_server" selected="true"/> -->
> <select idref="enable_ntpd" selected="true"/>
> <select idref="ntpd_specify_remote_server" selected="true"/>
> <select idref="postfix_network_listening" selected="true"/>
> @@ -183,9 +183,9 @@ these should likely be moved out of common.
> <select idref="service_rpcgssd_disabled" selected="true"/>
> <select idref="service_rpcidmapd_disabled" selected="true"/>
> <select idref="service_netfs_disabled" selected="true"/>
> -<select idref="service_rpcbind_disabled" selected="true"/>-->
> -<select idref="service_nfs_disabled" selected="true"/>
> -<select idref="service_rpcsvcgssd_disabled" selected="true"/>
> +<select idref="service_rpcbind_disabled" selected="true"/>
> +<select idref="service_nfs_disabled" selected="true"/>
> +<select idref="service_rpcsvcgssd_disabled" selected="true"/> -->
>
> <select idref="set_screensaver_inactivity_timeout" selected="true"/>
> <refine-value idref="inactivity_timeout_value" selector="15_minutes"/>
> @@ -201,25 +201,24 @@ these should likely be moved out of common.
> <select idref="service_oddjobd_disabled" selected="true"/>
> <select idref="service_qpidd_disabled" selected="true"/>
> <select idref="service_rdisc_disabled" selected="true"/>
> -<select idref="service_sysstat_disabled" selected="true"/>
>
> <select idref="use_nodev_option_on_nfs_mounts" selected="true"/>
> <select idref="use_nosuid_option_on_nfs_mounts" selected="true"/>
> -<select idref="disable_dns_server" selected="true"/>
> -<select idref="uninstall_bind" selected="true"/>
> -<select idref="disable_vsftpd" selected="true"/>
> -<select idref="uninstall_vsftpd" selected="true"/>
> -<select idref="disable_httpd" selected="true"/>
> -<select idref="uninstall_httpd" selected="true"/>
> -<select idref="disable_dovecot" selected="true"/>
> -<select idref="uninstall_dovecot" selected="true"/>
> -<select idref="disable_smb_server" selected="true"/>
> +<!-- <select idref="disable_dns_server" selected="true"/> -->
> +<!-- <select idref="uninstall_bind" selected="true"/> -->
> +<!-- <select idref="disable_vsftpd" selected="true"/> -->
> +<!-- <select idref="uninstall_vsftpd" selected="true"/> -->
> +<!-- <select idref="disable_httpd" selected="true"/> -->
> +<!-- <select idref="uninstall_httpd" selected="true"/> -->
> +<!-- <select idref="disable_dovecot" selected="true"/> -->
> +<!-- <select idref="uninstall_dovecot" selected="true"/> -->
> +<!-- <select idref="disable_smb_server" selected="true"/> -->
> <select idref="require_smb_client_signing" selected="true"/>
> <select idref="require_smb_client_signing_mount.cifs" selected="true"/>
> -<select idref="disable_squid" selected="true"/>
> -<select idref="uninstall_squid" selected="true"/>
> -<select idref="disable_snmpd" selected="true"/>
> -<select idref="uninstall_net-snmp" selected="true"/>
> +<!-- <select idref="disable_squid" selected="true"/> -->
> +<!-- <select idref="uninstall_squid" selected="true"/> -->
> +<!-- <select idref="disable_snmpd" selected="true"/> -->
> +<!-- <select idref="uninstall_net-snmp" selected="true"/> -->
> <select idref="limiting_password_reuse" selected="true"/>
> <!-- Refine Values -->
> <refine-value idref="var_umask_for_daemons" selector="027"/>
> diff --git a/RHEL6/input/profiles/desktop.xml b/RHEL6/input/profiles/desktop.xml
> index 61f84a4..e0e8c03 100644
> --- a/RHEL6/input/profiles/desktop.xml
> +++ b/RHEL6/input/profiles/desktop.xml
> @@ -8,6 +8,29 @@
> <select idref="enable_screensaver_password_lock" selected="true"/>
> <select idref="set_blank_screensaver" selected="true"/>
> <select idref="install_openswan" selected="true"/>
> +<select idref="disable_vsftpd" selected="true"/>
> +<select idref="uninstall_vsftpd" selected="true"/>
> +<select idref="disable_dns_server" selected="true"/>
> +<select idref="uninstall_bind" selected="true"/>
> +<select idref="disable_httpd" selected="true"/>
> +<select idref="uninstall_httpd" selected="true"/>
> +<select idref="disable_smb_server" selected="true"/>
> +<select idref="disable_squid" selected="true"/>
> +<select idref="uninstall_squid" selected="true"/>
> +<select idref="disable_snmpd" selected="true"/>
> +<select idref="uninstall_net-snmp" selected="true"/>
> +<select idref="disable_dovecot" selected="true"/>
> +<select idref="uninstall_dovecot" selected="true"/>
> +<select idref="service_nfs_disabled" selected="true"/>
> +<select idref="service_rpcsvcgssd_disabled" selected="true"/>
> +<select idref="service_nfslock_disabled" selected="true"/>
> +<select idref="service_rpcgssd_disabled" selected="true"/>
> +<select idref="service_rpcidmapd_disabled" selected="true"/>
> +<select idref="service_netfs_disabled" selected="true"/>
> +<select idref="service_rpcbind_disabled" selected="true"/>
> +<select idref="disable_dhcp_server" selected="true"/>
> +<select idref="uninstall_dhcp_server" selected="true"/>
> +
> <!-- Refine Values -->
> <!-- inactivity timeout for GNOME screensaver -->
> <refine-value idref="inactivity_timeout_value" selector="15_minutes"/>
This matches the ones I had on my list.
Eventually we'll want to create profiles for these (e.g.
rhel6-stig-dhcp, rhel6-stig-nfs, etc) .... but in the sake of time I
agree we should just strip them out of common.
More information about the scap-security-guide
mailing list