[PATCH] [bugfix] Ticket 168 - iptables_smtp_enabled false positive

Shawn Wells shawn at redhat.com
Thu Apr 25 05:33:05 UTC 2013


On 4/19/13 11:39 PM, Shawn Wells wrote:
>
> 0001-bugfix-Ticket-168-iptables_smtp_enabled-false-positi.patch
>
>
>  From ff769fddff246376939d6b2812442aab79206c05 Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Fri, 19 Apr 2013 23:37:34 -0400
> Subject: [PATCH] [bugfix] Ticket 168 - iptables_smtp_enabled false positive
>   The test did not first check if Postfix is installed and running, so this was a false positive on most scans.
>   Added OVAL to check for existence of Postfix
>
> NOTE: Logic needs to be added to detect if IPv6 in use. But that's ticket 398 (aka, for another time).
> ---
>   RHEL6/input/checks/iptables_smtp_enabled.xml |   10 ++++++++++
>   1 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/checks/iptables_smtp_enabled.xml b/RHEL6/input/checks/iptables_smtp_enabled.xml
> index a84d2b0..430da42 100644
> --- a/RHEL6/input/checks/iptables_smtp_enabled.xml
> +++ b/RHEL6/input/checks/iptables_smtp_enabled.xml
> @@ -10,10 +10,20 @@
>         the ldap service.</description>
>       </metadata>
>       <criteria operator="AND">
> +      <criterion comment="Package Postfix is installed" test_ref="test_package_postfix_installed" />
>         <criterion comment="Test ipv4 25 Accept" test_ref="test_iptables_smtp_enabled_ipv4" />
>         <criterion comment="Test ipv6 25 Accept" test_ref="test_iptables_smtp_enabled_ipv6" />
>       </criteria>
>     </definition>
> +
> +  <linux:rpminfo_test check="all" check_existence="all_exist" id="test_package_postfix_installed" version="1"
> +  comment="Package Postfix is installed">
> +    <linux:object object_ref="obj_package_postfix" />
> +  </linux:rpminfo_test>
> +  <linux:rpminfo_object id="obj_package_postfix" version="1">
> +    <linux:name>postfix</linux:name>
> +  </linux:rpminfo_object>
> +
>     <ind:textfilecontent54_test check="all"
>     check_existence="all_exist" comment="Test for 25 access over ipv4"
>     id="test_iptables_smtp_enabled_ipv4" version="1">
> -- 1.7.1

pushed as bugfix

[shawn at rhel6 scap-security-guide]$ git push
Counting objects: 11, done.
Compressing objects: 100% (6/6), done.
Writing objects: 100% (6/6), 878 bytes, done.
Total 6 (delta 5), reused 0 (delta 0)
To ssh://git.fedorahosted.org/git/scap-security-guide.git
    908e826..3d5c7ff  master -> master
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130425/0d5d5aba/attachment-0001.html>


More information about the scap-security-guide mailing list