[PATCH 3/4] removed some CCI references from best-practice base service disablement Rules

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Oct 25 23:49:18 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/services/base.xml |   30 +++++++++++++++---------------
 1 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 297e424..b447cab 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -40,7 +40,7 @@ accidental or trivially achievable denial of service situations and disabling
 it is appropriate.</rationale>
 <ident cce="4298-6" />
 <oval id="service_acpid_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 
@@ -80,7 +80,7 @@ fulfilling some roles a PKI infrastructure, but its functionality is not necesss
 for many other use cases.</rationale>
 <ident cce="TODO" />
 <oval id="service_certmonger_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 
@@ -97,7 +97,7 @@ service is not necessary.
 </rationale>
 <ident cce="TODO" />
 <oval id="service_cgconfig_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="service_cgred_disabled">
@@ -112,7 +112,7 @@ service is not necessary.
 </rationale>
 <ident cce="TODO" />
 <oval id="service_cgred_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="service_cpuspeed_disabled">
@@ -129,7 +129,7 @@ highly desirable or necessary.
 </rationale>
 <ident cce="4051-9" />
 <oval id="service_cpuspeed_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 
@@ -149,7 +149,7 @@ that do not require these.
 </rationale>
 <ident cce="4364-6" />
 <oval id="service_haldaemon_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 
@@ -180,7 +180,7 @@ crash, which can load information from the crashed kernel for analysis.
 is little need to run the kdump service.</rationale>
 <ident cce="3425-6" />
 <oval id="service_kdump_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <!--
@@ -214,7 +214,7 @@ RAID setups do not use this service).
 there is no need to run the service.</rationale>
 <ident cce="3854-7" />
 <oval id="service_mdmonitor_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 
@@ -235,7 +235,7 @@ a graphical login session.
 </rationale>
 <ident cce="3822-4" />
 <oval id="service_messagebus_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="service_netconsole_disabled">
@@ -309,7 +309,7 @@ preventing conflicting usage of ports in the reserved port range, but it can be
 disabled if not needed.</rationale>
 <ident cce="TODO" />
 <oval id="service_portreserve_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -369,7 +369,7 @@ disk quota violation is not desired then there is no need to run this
 service.</rationale>
 <ident cce="TODO" />
 <oval id="service_quota_nld_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -429,7 +429,7 @@ expected to require remote changes to their subscription status, it is
 unnecessary and can be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_rhsmcertd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -450,7 +450,7 @@ use Kerberos and LDAP. For others, however, in which only local files may be
 consulted, it is not necessary and should be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_saslauthd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -469,7 +469,7 @@ system's drives are not SMART-capable (such as solid state drives), it can be
 disabled.</rationale>
 <ident cce="3455-3" />
 <oval id="service_smartd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -508,7 +508,7 @@ boot to reset the statistics, which can be retrieved using programs such as
 operation, but unless used this service can be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_sysstat_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list