[PATCH 13/14] Created OCIL for set_iptables_default_rule_forward - Created OCIL for set_iptables_default_rule_forward

Shawn Wells shawn at redhat.com
Wed Sep 19 18:28:22 UTC 2012


---
 RHEL6/input/system/network/iptables.xml |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 31237b7..95016fa 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -157,6 +157,11 @@ the applicable rules in the table are examined for a match. Setting the
 default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
 any packets which are not explicitly permitted should not be
 accepted.</rationale>
+<ocil>Run the following command to ensure the default <tt>FORWARD</tt> policy is <tt>DROP</tt>:
+<pre>grep ":FORWARD" /etc/sysconfig/iptables</pre>
+The output should be simular to the following:
+<pre># grep ":FORWARD" /etc/sysconfig/iptables
+:FORWARD DROP [0:0</pre></ocil>
 <ident cce="14264-6" />
 <ref nist="AC-4, CM-6" disa="1109" />
 </Rule>
-- 
1.7.1


--IS0zKkzwUGydFO0o--


More information about the scap-security-guide mailing list