[PATCH 16/16] changed wide-ranging discussion about IPtables rules to Group

David Smith dsmith at eclipse.ncsc.mil
Fri Sep 21 22:11:17 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/system/network/iptables.xml |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index dc3a584..31237b7 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -161,7 +161,7 @@ accepted.</rationale>
 <ref nist="AC-4, CM-6" disa="1109" />
 </Rule>
 
-<Rule id="iptables_icmp_disabled">
+<Group id="iptables_icmp_disabled">
 <title>Restrict ICMP Message Types</title>
 <description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages types can be restricted. To accept only ICMP echo reply, destination unreachable, and time exceeded messages, remove the line:<br />
 <pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT</pre>
@@ -179,14 +179,14 @@ If you are going to statically configure the machine’s address, it should igno
 could add another IPv6 address to the interface or alter important network settings:
 <pre>-A RH-Firewall-1-INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
 </description>
+<ref nist="AC-4, CM-6" />
 <rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the oper-
 ation of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
 <!--<ident cce="14264-6" />-->
-<oval id="iptables_icmp_disabled" />
-<ref nist="AC-4, CM-6" />
-</Rule>
+<!--<oval id="iptables_icmp_disabled" />-->
+</Group>
 
-<Rule id="iptables_log_and_drop_suspicious">
+<Group id="iptables_log_and_drop_suspicious">
 <title>Log and Drop Packets with Suspicious Source Addresses</title>
 <description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
 modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
@@ -232,7 +232,7 @@ The following rule will log all traffic originating from a site-local address, w
 <!--<ident cce="14264-6" />-->
 <!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
 <ref nist="AC-4, AC-17, CM-6" />
-</Rule>
+</Group>
 
 </Group><!--<Group id="ruleset_modifications">-->
 </Group><!--<Group id="network-iptables">-->
-- 
1.7.1



More information about the scap-security-guide mailing list