[PATCH 13/14] Created OCIL for set_iptables_default_rule_forward - Created OCIL for set_iptables_default_rule_forward
Shawn Wells
shawn at redhat.com
Wed Sep 19 18:28:22 UTC 2012
---
RHEL6/input/system/network/iptables.xml | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 31237b7..95016fa 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -157,6 +157,11 @@ the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
+<ocil>Run the following command to ensure the default <tt>FORWARD</tt> policy is <tt>DROP</tt>:
+<pre>grep ":FORWARD" /etc/sysconfig/iptables</pre>
+The output should be simular to the following:
+<pre># grep ":FORWARD" /etc/sysconfig/iptables
+:FORWARD DROP [0:0</pre></ocil>
<ident cce="14264-6" />
<ref nist="AC-4, CM-6" disa="1109" />
</Rule>
--
1.7.1
--IS0zKkzwUGydFO0o--
More information about the scap-security-guide
mailing list