[PATCH 1/2] more QA work

David Smith dsmith at eclipse.ncsc.mil
Fri Oct 26 16:53:44 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/obsolete.xml                  |   13 +++++++++++++
 RHEL6/input/system/accounts/banners.xml            |    1 +
 RHEL6/input/system/accounts/pam.xml                |    1 +
 RHEL6/input/system/accounts/physical.xml           |    5 +++++
 .../accounts/restrictions/password_expiration.xml  |    4 ++++
 RHEL6/input/system/permissions/files.xml           |   13 +++++++++++++
 6 files changed, 37 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 4c8c7bf..3fe6bf6 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -39,6 +39,7 @@ attacks against xinetd itself.
 <ident cce="4252-3" />
 <oval id="service_xinetd_disabled" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="uninstall_xinetd">
@@ -54,6 +55,7 @@ xinetd service's accidental (or intentional) activation.
 <ident cce="4164-0" />
 <oval id="package_xinetd_removed" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 </Group>
@@ -80,6 +82,7 @@ subject to man-in-the-middle attacks.
 <ident cce="3390-2" />
 <oval id="service_telnetd_disabled" />
 <ref disa="1436,196,197" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="uninstall_telnet_server" severity="high">
@@ -95,6 +98,7 @@ telnet service's accidental (or intentional) activation.
 <ident cce="4330-7" />
 <oval id="package_telnet-server_removed" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
@@ -121,6 +125,7 @@ activation.
 <ident cce="4308-3" />
 <oval id="package_rsh-server_removed" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="disable_rexec" severity="high">
@@ -139,6 +144,7 @@ stolen by eavesdroppers on the network.
 <ident cce="undefined" />
 <oval id="service_rexec_disabled" />
 <ref disa="1436"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="disable_rsh" severity="high">
@@ -157,6 +163,7 @@ stolen by eavesdroppers on the network.
 <ident cce="4141-8" />
 <oval id="service_rsh_disabled" />
 <ref disa="1436" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="disable_rlogin" severity="high">
@@ -175,6 +182,7 @@ stolen by eavesdroppers on the network.
 <ident cce="3537-8" />
 <oval id="service_rlogin_disabled" />
 <ref disa="1436" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="no_rsh_trust_files" severity="high">
@@ -197,6 +205,7 @@ used in conjunction with the R-services, they can allow
 unauthenticated access to a system.</rationale>
 <ident cce="TODO" />
 <oval id="no_rsh_trusted_host_files" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 </Group>
@@ -222,6 +231,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
 <ident cce="4348-9" />
 <oval id="package_ypserv_removed" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="disable_ypbind" severity="medium">
@@ -238,6 +248,7 @@ as a client in a NIS or NIS+ domain.
 <ident cce="3705-1" />
 <oval id="service_ypbind_disabled" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
@@ -265,6 +276,7 @@ as a tftp server, which does not provide encryption or authentication.
 <ident cce="4273-9" />
 <oval id="service_tftp_disabled" />
 <ref disa="1436" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="uninstall_tftp-server" severity="medium">
@@ -282,6 +294,7 @@ accidental (or intentional) activation of tftp services.
 <ident cce="3916-4" />
 <oval id="package_tftp-server_removed" />
 <ref disa="305"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="tftpd_uses_secure_mode" severity="high">
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
index eaef2ae..243ccf9 100644
--- a/RHEL6/input/system/accounts/banners.xml
+++ b/RHEL6/input/system/accounts/banners.xml
@@ -80,6 +80,7 @@ reinforces policy awareness during the logon process.
 <ident cce="4060-0" />
 <oval id="banner_etc_issue" value="login_banner_text"/>
 <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Group id="gui_login_banner">
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 3633b6f..ee8bb91 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -487,6 +487,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 <!-- <ident cce="14063-2" /> -->
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
 <ref nist="IA-5" disa="803"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 40ac529..db67bf0 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -36,6 +36,7 @@ Only root should be able to modify important boot parameters.
 <ident cce="4144-2" />
 <oval id="file_user_owner_grub_conf" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="group_owner_grub_conf" severity="medium">
@@ -53,6 +54,7 @@ file should not have any access privileges anyway.
 <ident cce="4197-0" />
 <oval id="file_group_owner_grub_conf" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="permissions_grub_conf" severity="medium">
@@ -69,6 +71,7 @@ parameters.
 <ident cce="3923-0" />
 <oval id="file_permissions_grub_conf" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="bootloader_password" severity="medium">
@@ -98,6 +101,7 @@ and whether to enter single-user mode.
 <ident cce="3818-2" />
 <oval id="bootloader_password" />
 <ref nist="CM-7, IA-5, AC-3" disa="213" />
+<tested by="DS" on="20121026"/>
 </Rule>
 
 </Group>
@@ -376,6 +380,7 @@ for users who may need to suspend console logins.
 <ident cce="3910-7" />
 <oval id="package_vlock_installed" />
 <ref nist="CM-6, CM-7" disa="58" />
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 5f01b5c..8a6f17e 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -104,6 +104,7 @@ behavior that may result.
 <ident cce="4154-1" />
 <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
 <ref nist="CM-6, CM-7, IA-5, AC-3" disa="205"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 
@@ -130,6 +131,7 @@ after satisfying the password reuse requirement.
 <ident cce="4180-6" />
 <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
 <ref nist="CM-6, IA-5" disa="198"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 
@@ -157,6 +159,7 @@ location subject to physical compromise.</rationale>
 <ident cce="4092-3" />
 <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
 <ref nist="CM-6, CM-7, IA-5, AC-3" disa="180"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 
@@ -182,6 +185,7 @@ make the change at a practical time.
 <ident cce="4097-2" />
 <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
 <ref nist="CM-6, CM-7, IA-5, AC-3" />
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 216999c..4b6c040 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -29,6 +29,7 @@ which could weaken the system security posture.</rationale>
 <ident cce="3918-0" />
 <oval id="file_owner_etc_shadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="groupowner_shadow_file" severity="medium">
@@ -40,6 +41,7 @@ critical for system security.</rationale>
 <ident cce="3988-3" />
 <oval id="file_groupowner_etc_shadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="perms_shadow_file" severity="medium">
@@ -54,6 +56,7 @@ which could weaken the system security posture.</rationale>
 <ident cce="4130-1" />
 <oval id="file_permissions_etc_shadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="userowner_group_file" severity="medium">
@@ -65,6 +68,7 @@ on the system. Protection of this file is important for system security.</ration
 <ident cce="3276-3" />
 <oval id="file_owner_etc_group" />
 <ref nist="AC-3, CM-6"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="groupowner_group_file" severity="medium">
@@ -76,6 +80,7 @@ on the system. Protection of this file is important for system security.</ration
 <ident cce="3883-6" />
 <oval id="file_groupowner_etc_group" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="perms_group_file" severity="medium">
@@ -87,6 +92,7 @@ on the system. Protection of this file is important for system security.</ration
 <ident cce="3967-7" />
 <oval id="file_permissions_etc_group" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="userowner_gshadow_file" severity="medium">
@@ -98,6 +104,7 @@ is critical for system security.</rationale>
 <ident cce="4210-1" />
 <oval id="file_owner_etc_gshadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="groupowner_gshadow_file" severity="medium">
@@ -109,6 +116,7 @@ is critical for system security.</rationale>
 <ident cce="4064-2" />
 <oval id="file_groupowner_etc_gshadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="perms_gshadow_file" severity="medium">
@@ -120,6 +128,7 @@ is critical for system security.</rationale>
 <ident cce="3932-1" />
 <oval id="file_permissions_etc_gshadow" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="userowner_passwd_file" severity="medium">
@@ -131,6 +140,7 @@ the system. Protection of this file is critical for system security.</rationale>
 <ident cce="3958-6" />
 <oval id="file_owner_etc_passwd" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="groupowner_passwd_file" severity="medium">
@@ -142,6 +152,7 @@ the system. Protection of this file is critical for system security.</rationale>
 <ident cce="3495-9" />
 <oval id="file_groupowner_etc_passwd" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="file_permissions_etc_passwd" severity="medium">
@@ -155,6 +166,7 @@ is critical for system security.</rationale>
 <ident cce="3566-7" />
 <oval id="file_permissions_etc_passwd" />
 <ref nist="AC-3, CM-6" disa="225"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
@@ -200,6 +212,7 @@ space of processes (including privileged ones) or of the kernel itself at
 runtime. Restrictive permissions are necessary to protect the integrity of the system.
 </rationale>
 <ref disa="1499"/>
+<tested by="DS" on="20121026"/>
 </Rule>
 
 <Rule id="file_ownership_library_dirs" severity="medium">
-- 
1.7.1



More information about the scap-security-guide mailing list