[PATCH] [bugfix] Ticket 168 - iptables_smtp_enabled false positive

Shawn Wells shawn.d.wells at gmail.com
Sat Apr 20 03:39:55 UTC 2013


-------------- next part --------------
>From ff769fddff246376939d6b2812442aab79206c05 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 19 Apr 2013 23:37:34 -0400
Subject: [PATCH] [bugfix] Ticket 168 - iptables_smtp_enabled false positive
 The test did not first check if Postfix is installed and running, so this was a false positive on most scans.
 Added OVAL to check for existence of Postfix

NOTE: Logic needs to be added to detect if IPv6 in use. But that's ticket 398 (aka, for another time).
---
 RHEL6/input/checks/iptables_smtp_enabled.xml |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/checks/iptables_smtp_enabled.xml b/RHEL6/input/checks/iptables_smtp_enabled.xml
index a84d2b0..430da42 100644
--- a/RHEL6/input/checks/iptables_smtp_enabled.xml
+++ b/RHEL6/input/checks/iptables_smtp_enabled.xml
@@ -10,10 +10,20 @@
       the ldap service.</description>
     </metadata>
     <criteria operator="AND">
+      <criterion comment="Package Postfix is installed" test_ref="test_package_postfix_installed" />
       <criterion comment="Test ipv4 25 Accept" test_ref="test_iptables_smtp_enabled_ipv4" />
       <criterion comment="Test ipv6 25 Accept" test_ref="test_iptables_smtp_enabled_ipv6" />
     </criteria>
   </definition>
+
+  <linux:rpminfo_test check="all" check_existence="all_exist" id="test_package_postfix_installed" version="1"
+  comment="Package Postfix is installed">
+    <linux:object object_ref="obj_package_postfix" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_postfix" version="1">
+    <linux:name>postfix</linux:name>
+  </linux:rpminfo_object>
+
   <ind:textfilecontent54_test check="all"
   check_existence="all_exist" comment="Test for 25 access over ipv4"
   id="test_iptables_smtp_enabled_ipv4" version="1">
-- 
1.7.1



More information about the scap-security-guide mailing list