[PATCH 16/16] changed wide-ranging discussion about IPtables rules to Group
Michael J. McConachie
michael at redhat.com
Mon Sep 24 01:07:42 UTC 2012
ACK to all 16 -- looks like a good, long grind towards our common goal.
Thank you David!!
Can't wait to see it pushed, and download it / try it.
MM
On 09/21/2012 03:11 PM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/network/iptables.xml | 12 ++++++------
> 1 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
> index dc3a584..31237b7 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -161,7 +161,7 @@ accepted.</rationale>
> <ref nist="AC-4, CM-6" disa="1109" />
> </Rule>
>
> -<Rule id="iptables_icmp_disabled">
> +<Group id="iptables_icmp_disabled">
> <title>Restrict ICMP Message Types</title>
> <description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages types can be restricted. To accept only ICMP echo reply, destination unreachable, and time exceeded messages, remove the line:<br />
> <pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT</pre>
> @@ -179,14 +179,14 @@ If you are going to statically configure the machine’s address, it should igno
> could add another IPv6 address to the interface or alter important network settings:
> <pre>-A RH-Firewall-1-INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
> </description>
> +<ref nist="AC-4, CM-6" />
> <rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the oper-
> ation of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
> <!--<ident cce="14264-6" />-->
> -<oval id="iptables_icmp_disabled" />
> -<ref nist="AC-4, CM-6" />
> -</Rule>
> +<!--<oval id="iptables_icmp_disabled" />-->
> +</Group>
>
> -<Rule id="iptables_log_and_drop_suspicious">
> +<Group id="iptables_log_and_drop_suspicious">
> <title>Log and Drop Packets with Suspicious Source Addresses</title>
> <description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
> modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
> @@ -232,7 +232,7 @@ The following rule will log all traffic originating from a site-local address, w
> <!--<ident cce="14264-6" />-->
> <!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
> <ref nist="AC-4, AC-17, CM-6" />
> -</Rule>
> +</Group>
>
> </Group><!--<Group id="ruleset_modifications">-->
> </Group><!--<Group id="network-iptables">-->
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20120923/b8f06be9/attachment.html>
More information about the scap-security-guide
mailing list