[PATCH 2/4] OCIL clause changes for input/system/network/iptables.xml
Michael McConachie
michael at redhat.com
Wed Sep 26 17:51:51 UTC 2012
---
RHEL6/input/system/network/iptables.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 7bc17b9..0f2aa45 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -135,7 +135,7 @@ add or correct the following line in
<tt>/etc/sysconfig/iptables</tt>:
<pre>:INPUT DROP [0:0]</pre>
</description>
-<ocil>Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine
+<ocil clause="the default policy for the INPUT chain isn't set to DROP">Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine
the default policy for the INPUT chain. It should be set to DROP.
</ocil>
<rationale>In <tt>iptables</tt> the default policy is applied only after all
--
1.7.11.4
--3MwIy2ne0vdjdPXF--
More information about the scap-security-guide
mailing list