[PATCH] OCIL clause tags added to 6 files in the /input dir
Michael McConachie
michael at redhat.com
Tue Sep 25 20:09:59 UTC 2012
---
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/system/accounts/restrictions/password_storage.xml | 6 +++---
RHEL6/input/system/accounts/restrictions/root_logins.xml | 6 +++---
RHEL6/input/system/selinux.xml | 8 ++++----
RHEL6/input/system/software/disk_partitioning.xml | 4 +---
RHEL6/input/system/software/updating.xml | 8 ++++----
6 files changed, 16 insertions(+), 18 deletions(-)
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 9484265..eaf853c 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -182,7 +182,7 @@ location:
<pre># rm /etc/hosts.equiv</pre>
<pre>$ rm ~/.rhosts</pre>
</description>
-<ocil>
+<ocil clause="these files exist">
The existence of the file <tt>/etc/hosts.equiv</tt> or a file named
<tt>.rhosts</tt> inside a user home directory indicates the presence
of an Rsh trust relationship.
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index b030ad4..415bfd2 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -24,7 +24,7 @@ into the account without authentication. Remove any instances of the <tt>nullok<
option in <tt>/etc/pam.d/system-auth-ac</tt> to
prevent logins with empty passwords.
</description>
-<ocil>
+<ocil clause="NULL passwords can be used">
To verify that null passwords cannot be used, run the following command:
<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
If this produces any output, it may be possible to log into accounts
@@ -49,7 +49,7 @@ instead of an <tt>x</tt>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.
</description>
-<ocil>
+<ocil clause="any stored hashes are found in /etc/passwd">
To check that no password hashes are stored in
<tt>/etc/passwd</tt>, run the following command:
<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
@@ -74,7 +74,7 @@ directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used. Any <tt>.netrc</tt> files should be removed.
</description>
-<ocil>
+<ocil clause="any .netrc files exist">
To check the system for the existence of any <tt>.netrc</tt> files,
run the following command:
<pre># find / -name .netrc</pre>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index f08b702..fee9a54 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -47,7 +47,7 @@ vc/3
vc/4</pre>
<!-- TODO: discussion/description of virtual consoles-->
</description>
-<ocil>To check for these entries from the command prompt, issue the
+<ocil clause="the user root hasn't been restricted from VCD's">To check for these entries from the command prompt, issue the
following command:
<pre># grep ^vc/[0-9] /etc/securetty</pre>
If any values are returned, you need to remove them by manipulating the file.
@@ -73,7 +73,7 @@ ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
ttyS1</pre>
<!-- TODO: discussion/description of serial port -->
</description>
-<ocil>To check for these entries from the command prompt,
+<ocil clause="the user root hasn't been restricted from Serial Ports">To check for these entries from the command prompt,
issue the following command:
<pre># grep ^ttyS/[0-9] /etc/securetty</pre>
If any values are returned, you need to remove them by manipulating
@@ -109,7 +109,7 @@ than root.
</description>
<!--For each identified system account SYSACCT, lock the account:
<pre># usermod -L SYSACCT</pre>-->
-<ocil>If any account <i>SYSACCT</i> has a login shell,
+<ocil clause="any SYSACCTs have a login shell">If any account <i>SYSACCT</i> has a login shell,
disable it with the command:
<pre># usermod -s /sbin/nologin SYSACCT</pre>
The RHEL6 default is <tt>/sbin/nologin</tt>, but any command which will
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 3d68315..b2c660d 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -89,7 +89,7 @@ and to protect the boot process.
Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
file to prevent SELinux from being being disabled at boot.
</description>
-<ocil>
+<ocil clause="SELinux is Disabled at boot time">
Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
in the kernel boot arguments. Presences of <tt>selinux=0</tt> indicates
that SELinux is disabled at boot time.
@@ -111,7 +111,7 @@ system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
line <tt>SELINUX=enforcing</tt> to configure the system to boot into enforcing
mode.
</description>
-<ocil>
+<ocil clause="SELINUX=enforcing is not set properly">
Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
<pre>SELINUX=enforcing</pre>
</ocil>
@@ -137,7 +137,7 @@ Other policies, such as <tt>mls</tt>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.
</description>
-<ocil>
+<ocil clause="SELINUX=targeted is not set properly">
Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
<pre>SELINUXTYPE=targeted</pre>
</ocil>
@@ -232,7 +232,7 @@ or allow privileges that the daemon does not require.
<description>Device files are used for communication with important system resources.
SELinux contexts should exist for these. By checking for <tt>unlabeled_t</tt> file
contexts, we can determine if the system is optimally configured.</description>
-<ocil>To check for unlabeled device files, run the following command in
+<ocil clause="unlabeled_t file contexts exist">To check for unlabeled device files, run the following command in
the directory that you want to check the SELinux contexts:
<pre># ls -Z | grep unlabeled_t</pre>
It should produce no output in a well-configured system.</ocil>
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index 1c4d260..e678d61 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -31,9 +31,7 @@ The <tt>/tmp</tt> directory is a world-writable directory used
for temporary file storage. Ensure that it has its own partition or
logical volume at installation time, or migrate it using LVM.
</description>
-<ocil clause="no line is returned">
-<partition-check-macro part="/tmp"/>
-</ocil>
+<ocil><partition-check-macro part="/tmp"/></ocil>
<rationale>
The <tt>/tmp</tt> partition is used as temporary storage by many programs.
Placing <tt>/tmp</tt> in its own partition enables the setting of more
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 99b6520..0ec2f32 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -28,7 +28,7 @@ Run the following command to install the Red Hat GPG key, of which Red Hat
uses to sign. To ensure that the GPG Key is isntalled, run:
<pre># rhn_register</pre>
</description>
-<ocil>To ensure that the GPG Key is isntalled, run:
+<ocil clause="the Red Hat GPG Key isn't installed">To ensure that the GPG Key is isntalled, run:
<pre>$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey</pre>
The command should return the string:
<pre>gpg(Red Hat, Inc. (release key <security at redhat.com>)</pre>
@@ -54,7 +54,7 @@ them, ensure that the following line appears in <tt>/etc/yum.conf</tt> in
the <tt>[main]</tt> section:
<pre>gpgcheck=1</pre>
</description>
-<ocil>
+<ocil clause="GPG checking isn't enabled">
To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
inspect <tt>/etc/yum.conf</tt> and ensure that the following appears in the
<tt>[main]</tt> section:
@@ -79,7 +79,7 @@ protects against malicious tampering.
any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
<pre>gpgcheck=0</pre>
</description>
-<ocil>
+<ocil clause="GPG checking is disabled">
To determine whether <tt>yum</tt> has been configured to disable
<tt>gpgcheck</tt> for any repos, inspect all files in
<tt>/etc/yum.repos.d</tt> and ensure that the following does not appear in any
@@ -105,7 +105,7 @@ need to be updated:
To actually install these updates, run:
<pre># yum update</pre>
</description>
-<ocil>
+<ocil clause="Updates are not installed">
After running the update command, invoking the update command again can be used
to determine success of the updates. If nothing is returned, the update was
successful.
--
1.7.11.4
--qMm9M+Fa2AknHoGS--
More information about the scap-security-guide
mailing list