[PATCH] moved content from Common profile to Desktop profile

Shawn Wells shawn at redhat.com
Thu Oct 25 18:10:47 UTC 2012


On 10/25/12 1:43 PM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/profiles/common.xml  |   37 ++++++++++++++++++-------------------
>   RHEL6/input/profiles/desktop.xml |   23 +++++++++++++++++++++++
>   2 files changed, 41 insertions(+), 19 deletions(-)
>
> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
> index 8b75eae..a5108f6 100644
> --- a/RHEL6/input/profiles/common.xml
> +++ b/RHEL6/input/profiles/common.xml
> @@ -169,8 +169,8 @@
>   <select idref="sshd_use_approved_ciphers" selected="true"/>
>   <!-- <select idref="xwindows_remote_listening" selected="true"/> Rule to be rewritten to refer to /etc/gdm/custom.conf -->
>   <select idref="disable_avahi" selected="true"/>
> -<select idref="disable_dhcp_server" selected="true"/>
> -<select idref="uninstall_dhcp_server" selected="true"/>
> +<!-- <select idref="disable_dhcp_server" selected="true"/> -->
> +<!-- <select idref="uninstall_dhcp_server" selected="true"/> -->
>   <select idref="enable_ntpd" selected="true"/>
>   <select idref="ntpd_specify_remote_server" selected="true"/>
>   <select idref="postfix_network_listening" selected="true"/>
> @@ -183,9 +183,9 @@ these should likely be moved out of common.
>   <select idref="service_rpcgssd_disabled" selected="true"/>
>   <select idref="service_rpcidmapd_disabled" selected="true"/>
>   <select idref="service_netfs_disabled" selected="true"/>
> -<select idref="service_rpcbind_disabled" selected="true"/>-->
> -<select idref="service_nfs_disabled" selected="true"/>
> -<select idref="service_rpcsvcgssd_disabled" selected="true"/>
> +<select idref="service_rpcbind_disabled" selected="true"/>
> +<select idref="service_nfs_disabled" selected="true"/>
> +<select idref="service_rpcsvcgssd_disabled" selected="true"/> -->
>   
>   <select idref="set_screensaver_inactivity_timeout" selected="true"/>
>   <refine-value idref="inactivity_timeout_value" selector="15_minutes"/>
> @@ -201,25 +201,24 @@ these should likely be moved out of common.
>   <select idref="service_oddjobd_disabled" selected="true"/>
>   <select idref="service_qpidd_disabled" selected="true"/>
>   <select idref="service_rdisc_disabled" selected="true"/>
> -<select idref="service_sysstat_disabled" selected="true"/>
>   
>   <select idref="use_nodev_option_on_nfs_mounts" selected="true"/>
>   <select idref="use_nosuid_option_on_nfs_mounts" selected="true"/>
> -<select idref="disable_dns_server" selected="true"/>
> -<select idref="uninstall_bind" selected="true"/>
> -<select idref="disable_vsftpd" selected="true"/>
> -<select idref="uninstall_vsftpd" selected="true"/>
> -<select idref="disable_httpd" selected="true"/>
> -<select idref="uninstall_httpd" selected="true"/>
> -<select idref="disable_dovecot" selected="true"/>
> -<select idref="uninstall_dovecot" selected="true"/>
> -<select idref="disable_smb_server" selected="true"/>
> +<!-- <select idref="disable_dns_server" selected="true"/> -->
> +<!-- <select idref="uninstall_bind" selected="true"/> -->
> +<!-- <select idref="disable_vsftpd" selected="true"/> -->
> +<!-- <select idref="uninstall_vsftpd" selected="true"/> -->
> +<!-- <select idref="disable_httpd" selected="true"/> -->
> +<!-- <select idref="uninstall_httpd" selected="true"/> -->
> +<!-- <select idref="disable_dovecot" selected="true"/> -->
> +<!-- <select idref="uninstall_dovecot" selected="true"/> -->
> +<!-- <select idref="disable_smb_server" selected="true"/> -->
>   <select idref="require_smb_client_signing" selected="true"/>
>   <select idref="require_smb_client_signing_mount.cifs" selected="true"/>
> -<select idref="disable_squid" selected="true"/>
> -<select idref="uninstall_squid" selected="true"/>
> -<select idref="disable_snmpd" selected="true"/>
> -<select idref="uninstall_net-snmp" selected="true"/>
> +<!-- <select idref="disable_squid" selected="true"/> -->
> +<!-- <select idref="uninstall_squid" selected="true"/> -->
> +<!-- <select idref="disable_snmpd" selected="true"/> -->
> +<!-- <select idref="uninstall_net-snmp" selected="true"/> -->
>   <select idref="limiting_password_reuse" selected="true"/>
>   <!-- Refine Values -->
>   <refine-value idref="var_umask_for_daemons" selector="027"/>
> diff --git a/RHEL6/input/profiles/desktop.xml b/RHEL6/input/profiles/desktop.xml
> index 61f84a4..e0e8c03 100644
> --- a/RHEL6/input/profiles/desktop.xml
> +++ b/RHEL6/input/profiles/desktop.xml
> @@ -8,6 +8,29 @@
>   <select idref="enable_screensaver_password_lock" selected="true"/>
>   <select idref="set_blank_screensaver" selected="true"/>
>   <select idref="install_openswan" selected="true"/>
> +<select idref="disable_vsftpd" selected="true"/>
> +<select idref="uninstall_vsftpd" selected="true"/>
> +<select idref="disable_dns_server" selected="true"/>
> +<select idref="uninstall_bind" selected="true"/>
> +<select idref="disable_httpd" selected="true"/>
> +<select idref="uninstall_httpd" selected="true"/>
> +<select idref="disable_smb_server" selected="true"/>
> +<select idref="disable_squid" selected="true"/>
> +<select idref="uninstall_squid" selected="true"/>
> +<select idref="disable_snmpd" selected="true"/>
> +<select idref="uninstall_net-snmp" selected="true"/>
> +<select idref="disable_dovecot" selected="true"/>
> +<select idref="uninstall_dovecot" selected="true"/>
> +<select idref="service_nfs_disabled" selected="true"/>
> +<select idref="service_rpcsvcgssd_disabled" selected="true"/>
> +<select idref="service_nfslock_disabled" selected="true"/>
> +<select idref="service_rpcgssd_disabled" selected="true"/>
> +<select idref="service_rpcidmapd_disabled" selected="true"/>
> +<select idref="service_netfs_disabled" selected="true"/>
> +<select idref="service_rpcbind_disabled" selected="true"/>
> +<select idref="disable_dhcp_server" selected="true"/>
> +<select idref="uninstall_dhcp_server" selected="true"/>
> +
>   <!-- Refine Values -->
>   <!-- inactivity timeout for GNOME screensaver -->
>   <refine-value idref="inactivity_timeout_value" selector="15_minutes"/>



This matches the ones I had on my list.

Eventually we'll want to create profiles for these (e.g. 
rhel6-stig-dhcp, rhel6-stig-nfs, etc) .... but in the sake of time I 
agree we should just strip them out of common.


More information about the scap-security-guide mailing list