[PATCH 15/17] Added mappings against AC-17*

Shawn Wells shawn.d.wells at gmail.com
Tue Jan 1 17:06:09 UTC 2013


-------------- next part --------------
>From b4bd23955545e67b58de83288f510dc67b81ff8d Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 29 Dec 2012 05:22:16 -0500
Subject: [PATCH 15/17] Added mappings against AC-17*
 Added serveral mappings against the AC-17* requirements,
 broke them down into sup compartments AC-17(1), AC-17(a), etc

---
 RHEL6/input/auxiliary/nist_support.xml |   13 ++++-
 RHEL6/input/profiles/nist-CL-IL-AL.xml |   87 ++++++++++++++++++++++++--------
 RHEL6/input/services/base.xml          |   37 ++++++-------
 RHEL6/input/services/obsolete.xml      |   27 +++++-----
 RHEL6/input/services/ssh.xml           |    4 +-
 RHEL6/input/system/auditing.xml        |   68 ++++++++++++------------
 6 files changed, 142 insertions(+), 94 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 20f4994..cdbc751 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -1,4 +1,4 @@
-<Group id="srg_support" hidden="true">
+<Group id="nist_support" hidden="true">
 <title>Documentation to Support NIST 800-53 Mapping</title>
 <description>These groups exist to document how the Red Hat Enterprise Linux
 product meets (or does not meet) requirements listed in NIST 800-53, for
@@ -14,7 +14,14 @@ automated means.</rational>
 <description>This requirement is procedural, and can not be met
 through automated means.</description>
 </description>
-<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14" \>
+<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6)" \>
+</Rule>
+
+<Rule id="nist_not_OS_applicable">
+<title>Not Applicable to Operating System</title>
+<rationale>This requirement is not applicable to an operating system.</rational>
+<description>This requirement is not applicable to an operating system.</rational>
+<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3)" \>
 </Rule>
 
 <Rule id="nist_met_inherently">
@@ -28,7 +35,7 @@ compliance. This is a permanent not a finding.
 <description>
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref nist="AC-3(4)" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e)" \>
 </Rule>
 
 
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index fb30e5f..5127db4 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -115,6 +115,7 @@ assurance."</description>
 <select idref="enable_iptables" selected="true" \>
 
 <!-- AC-6 -->
+<select idref="audit_config_immutable" selected="true" \>
 <select idref="service_oddjobd_disabled" selected="true" \>
 <select idref="rpm_verify_permissions" selected="true" \>
 <select idref="audit_logs_permissions" selected="true" \>
@@ -171,17 +172,69 @@ assurance."</description>
 <!-- AC-11(1) -->
 <select idref="set_blank_screensaver" selected="true" \>
 
-<!-- TODO: 
-     AC-17
-     AC-17(1)
-     AC-17(2)
-     AC-17(3)
-     AC-17(4)
-     AC-17(5)
-     AC-17(6)
-     AC-17(7)
-     AC-17(8)
-     AC-18
+<!-- AC-17(1) -->
+<select idref="enable_auditd_service" selected="true" \>
+<select idref="enable_auditd_bootloader" selected="true" \>
+
+<!--  AC-17(7) -->
+<select idref="audit_rules_time_adjtimex" selected="true" \>
+<select idref="audit_rules_time_settimeofday" selected="true" \>
+<select idref="audit_rules_time_stime" selected="true" \>
+<select idref="audit_rules_time_clock_settime" selected="true" \>
+<select idref="audit_rules_time_watch_localtime" selected="true" \>
+<select idref="audit_account_changes" selected="true" \>
+<select idref="audit_network_modifications" selected="true" \>
+<select idref="audit_mac_changes" selected="true" \>
+<select idref="audit_rules_dac_modification_chmod" selected="true" \>
+<select idref="audit_rules_dac_modification_chown" selected="true" \>
+<select idref="audit_rules_dac_modification_fchmod" selected="true" \>
+<select idref="audit_rules_dac_modification_fchmodat" selected="true" \>
+<select idref="audit_rules_dac_modification_fchown" selected="true" \>
+<select idref="audit_rules_dac_modification_fchownat" selected="true" \>
+<select idref="audit_rules_dac_modification_fremovexattr" selected="true" \>
+<select idref="audit_rules_dac_modification_fsetxattr" selected="true" \>
+<select idref="audit_rules_dac_modification_lchown" selected="true" \>
+<select idref="audit_rules_dac_modification_lremovexattr" selected="true" \>
+<select idref="audit_rules_dac_modification_lsetxattr" selected="true" \>
+<select idref="audit_rules_dac_modification_removexattr" selected="true" \>
+<select idref="audit_rules_dac_modification_setxattr" selected="true" \>
+<select idref="audit_manual_logon_edits" selected="true" \>
+<select idref="audit_manual_session_edits" selected="true" \>
+<select idref="audit_file_access" selected="true" \>
+<select idref="audit_privileged_commands" selected="true" \>
+<select idref="audit_media_exports" selected="true" \>
+<select idref="audit_file_deletions" selected="true" \>
+<select idref="audit_sysadmin_actions" selected="true" \>
+<select idref="audit_kernel_module_loading" selected="true" \>
+
+<!-- AC-17(8) -->
+<select idref="disable_xinetd" selected="true" \>
+<select idref="uninstall_xinetd" selected="true" \>
+<select idref="disable_telnet_service" selected="true" \>
+<select idref="uninstall_telnet_server" selected="true" \>
+<select idref="uninstall_rsh" selected="true" \>
+<select idref="disable_rexec" selected="true" \>
+<select idref="disable_rsh" selected="true" \>
+<select idref="disable_rlogin" selected="true" \>
+<select idref="no_rsh_trust_files" selected="true" \>
+<select idref="uninstall_ypserv" selected="true" \>
+<select idref="disable_ypbind" selected="true" \>
+<select idref="disable_tftp" selected="true" \>
+<select idref="uninstall_tftp" selected="true" \>
+<select idref="tftpd_uses_secure_mode" selected="true" \>
+<select idref="service_abrtd_disabled" selected="true" \>
+<select idref="service_kdump_disabled" selected="true" \>
+<select idref="service_netconsole_disabled" selected="true" \>
+<select idref="service_ntpdate_disabled" selected="true" \>
+<select idref="service_portreserve_disabled" selected="true" \>
+<select idref="service_qpidd_disabled" selected="true" \>
+<select idref="service_rdisc_disabled" selected="true" \>
+<select idref="service_rhnsd_disabled" selected="true" \>
+<select idref="service_saslauthd_disabled" selected="true" \>
+<select idref="sshd_allow_only_protocol2" selected="true" \>
+
+ AC-18
+
      AC-18(1)
      AC-18(2)
      AC-18(3)
@@ -474,17 +527,7 @@ assurance."</description>
      SI-9
      SI-11
      SI-12
-     PM-1
-     PM-2
-     PM-3
-     PM-4
-     PM-5
-     PM-6
-     PM-7
-     PM-8
-     PM-9
-     PM-10
-     PM-11 -->
+     -->
 
 
 </Profile>
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index ed12562..a5b757d 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -22,7 +22,7 @@ vulnerabilities in software executing on the local machine, as well as sensitive
 information from within a process's address space or registers.</rationale>
 <ident cce="TODO" />
 <oval id="service_abrtd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="AC-17(8),CM-6,CM-7" disa="382" />
 </Rule>
 
 
@@ -40,7 +40,7 @@ accidental or trivially achievable denial of service situations and disabling
 it is appropriate.</rationale>
 <ident cce="27061-1" />
 <oval id="service_acpid_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 
@@ -62,7 +62,7 @@ accountability. Furthermore, the need to schedule tasks with <tt>at</tt> or
 </rationale>
 <ident cce="TODO" />
 <oval id="service_atd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="CM-6,CM-7" disa="382" />
 </Rule>
 
 
@@ -80,7 +80,7 @@ fulfilling some roles a PKI infrastructure, but its functionality is not necessa
 for many other use cases.</rationale>
 <ident cce="TODO" />
 <oval id="service_certmonger_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 
@@ -97,7 +97,7 @@ service is not necessary.
 </rationale>
 <ident cce="TODO" />
 <oval id="service_cgconfig_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 <Rule id="service_cgred_disabled">
@@ -112,7 +112,7 @@ service is not necessary.
 </rationale>
 <ident cce="TODO" />
 <oval id="service_cgred_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 <Rule id="service_cpuspeed_disabled">
@@ -129,7 +129,7 @@ highly desirable or necessary.
 </rationale>
 <ident cce="26973-8" />
 <oval id="service_cpuspeed_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 
@@ -149,7 +149,7 @@ that do not require these.
 </rationale>
 <ident cce="27086-8" />
 <oval id="service_haldaemon_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 
@@ -165,7 +165,7 @@ multiple processors.
 provides potential speedups for handling interrupt requests.</rationale>
 <ident cce="26990-2" />
 <oval id="service_irqbalance_enabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="CM-6,CM-7" />
 </Rule>
 
 <Rule id="service_kdump_disabled">
@@ -180,7 +180,7 @@ crash, which can load information from the crashed kernel for analysis.
 is little need to run the kdump service.</rationale>
 <ident cce="26850-8" />
 <oval id="service_kdump_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="AC-17(8),CM-6,CM-7" />
 </Rule>
 
 <!--
@@ -252,7 +252,7 @@ kernel panics, which is not common.
 </rationale>
 <ident cce="TODO" />
 <oval id="service_netconsole_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="AC-17(8),CM-6,CM-7" disa="382" />
 </Rule>
 
 
@@ -272,7 +272,7 @@ reboots. In any event, the functionality of the ntpdate service is now
 available in the ntpd program and should be considered deprecated.</rationale>
 <ident cce="TODO" />
 <!--<oval id="service_ntpdate_disabled" /> -->
-<ref nist="AU-8, CM-6" disa="382" />
+<ref nist="AC-17(8),AU-8,CM-6" disa="382" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -295,7 +295,6 @@ been a source of privilege escalation security issues.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_portreserve_disabled">
 <title>Disable Portreserve (portreserve)</title>
 <description>The <tt>portreserve</tt> service is a TCP port reservation utility that can
@@ -309,12 +308,10 @@ preventing conflicting usage of ports in the reserved port range, but it can be
 disabled if not needed.</rationale>
 <ident cce="TODO" />
 <oval id="service_portreserve_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="AC-17(8),CM-6, CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
-
 <Rule id="service_psacct_enabled">
 <title>Enable Process Accounting (psacct)</title>
 <description>The process accounting service (<tt>psacct</tt>) works with programs
@@ -349,7 +346,7 @@ the system is not intended to receive AMQP traffic then the <tt>qpidd</tt>
 service is not needed and should be disabled or removed.</rationale>
 <ident cce="26928-2" />
 <oval id="service_qpidd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="AC-17(8),CM-6,CM-7" disa="382" />
 </Rule>
 
 <Rule id="service_quota_nld_disabled">
@@ -389,7 +386,7 @@ some special-purpose systems often use DHCP (instead of IRDP) to retrieve
 dynamic network configuration information.</rationale>
 <ident cce="TODO" />
 <oval id="service_rdisc_disabled" />
-<ref nist="AC-4, CM-6, CM-7" disa="382" />
+<ref nist="AC-17(8),AC-4,CM-6,CM-7" disa="382" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -409,7 +406,7 @@ desirable for some environments.  However, if the system is being managed by RHN
  RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale>
 <ident cce="26846-6" />
 <oval id="service_rhnsd_disabled" />
-<ref nist="CM-6, CM-7" disa="382" />
+<ref nist="AC-17(8),CM-6,CM-7" disa="382" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -450,7 +447,7 @@ use Kerberos and LDAP. For others, however, in which only local files may be
 consulted, it is not necessary and should be disabled.</rationale>
 <ident cce="TODO" />
 <oval id="service_saslauthd_disabled" />
-<ref nist="CM-6, CM-7" />
+<ref nist="AC-17(8),CM-6,CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 3ed4dcc..d944d39 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -38,7 +38,7 @@ attacks against xinetd itself.
 </rationale>
 <ident cce="27046-2" />
 <oval id="service_xinetd_disabled" />
-<ref disa="305"/>
+<ref nist="AC-17(8)" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -54,7 +54,7 @@ xinetd service's accidental (or intentional) activation.
 </rationale>
 <ident cce="27005-8" />
 <oval id="package_xinetd_removed" />
-<ref disa="305"/>
+<ref nist="AC-17(8)" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -81,7 +81,7 @@ subject to man-in-the-middle attacks.
 </rationale>
 <ident cce="26836-7" />
 <oval id="service_telnetd_disabled" />
-<ref disa="68,1436,197,877,888" />
+<ref nist="AC-17(8)" disa="68,1436,197,877,888" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -97,7 +97,7 @@ telnet service's accidental (or intentional) activation.
 </rationale>
 <ident cce="27073-6" />
 <oval id="package_telnet-server_removed" />
-<ref disa="305,381"/>
+<ref nist="AC-17(8)" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
@@ -124,7 +124,7 @@ activation.
 </rationale>
 <ident cce="27062-9" />
 <oval id="package_rsh-server_removed" />
-<ref disa="305,381"/>
+<ref nist="AC-17(8)" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -143,7 +143,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="27208-8" />
 <oval id="service_rexec_disabled" />
-<ref disa="68,1436"/>
+<ref nist="AC-17(8)" disa="68,1436"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -162,7 +162,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="26994-4" />
 <oval id="service_rsh_disabled" />
-<ref disa="68,1436" />
+<ref nist="AC-17(8)" disa="68,1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -181,7 +181,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="26865-6" />
 <oval id="service_rlogin_disabled" />
-<ref disa="1436" />
+<ref nist="AC-17(8)" disa="1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -204,6 +204,7 @@ of an Rsh trust relationship.
 used in conjunction with the R-services, they can allow
 unauthenticated access to a system.</rationale>
 <ident cce="TODO" />
+<ref nist="AC-17(8)" disa="1436" \>
 <oval id="no_rsh_trusted_host_files" />
 <tested by="DS" on="20121026"/>
 </Rule>
@@ -230,7 +231,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
 </rationale>
 <ident cce="27079-3" />
 <oval id="package_ypserv_removed" />
-<ref disa="305,381"/>
+<ref nist="AC-17(8)" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -247,7 +248,7 @@ as a client in a NIS or NIS+ domain.
 </rationale>
 <ident cce="26894-6" />
 <oval id="service_ypbind_disabled" />
-<ref disa="305"/>
+<ref nist="AC-17(8)" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
@@ -275,7 +276,7 @@ as a tftp server, which does not provide encryption or authentication.
 </rationale>
 <ident cce="27055-3" />
 <oval id="service_tftp_disabled" />
-<ref disa="1436" />
+<ref nist="AC-17(8)" disa="1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -293,7 +294,7 @@ accidental (or intentional) activation of tftp services.
 </rationale>
 <ident cce="26946-4" />
 <oval id="package_tftp-server_removed" />
-<ref disa="305"/>
+<ref nist="AC-17(8)" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -319,7 +320,7 @@ server_args = -s /var/lib/tftpboot</pre>
 </ocil>
 <ident cce="TODO" />
 <oval id="tftpd_uses_secure_mode" />
-<ref disa="366"/>
+<ref nist="AC-17(8)" disa="366"/>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index ad56317..1039793 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -80,7 +80,7 @@ should not be used.
 </rationale>
 <ident cce="27072-8" />
 <oval id="sshd_protocol_2" />
-<ref disa="776,774,1436" />
+<ref nist="AC-17(8) disa="776,774,1436" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -360,7 +360,7 @@ implementation. These are also required for compliance.
 </rationale>
 <ident cce="26555-3" />
 <oval id="sshd_use_approved_ciphers" />
-<ref nist="AC-3" disa="803,1144,1145,1146" />
+<ref nist="AC-3,AC-17(2)" disa="803,1144,1145,1146" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 847a3cb..85b5055 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="27058-7" />
 <oval id="service_auditd_enabled" />
-<ref nist="AU-1, CM-6" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
+<ref nist="AC-17(1),AU-1, CM-6" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -118,7 +118,7 @@ process during boot.
 </rationale>
 <ident cce="26785-6" />
 <oval id="bootloader_audit_argument" />
-<ref nist="AU-2" disa="1464,130" />
+<ref nist="AC-17(1),AU-2" disa="1464,130" />
 </Rule>
 
 <Group id="configure_auditd_data_retention">
@@ -494,7 +494,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="26242-8" />
 <oval id="audit_rules_time_adjtimex" />
-<ref nist="AU-2" />
+<ref nist="AU-2,AC-17(7)" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -522,7 +522,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27203-9" />
 <oval id="audit_rules_time_settimeofday" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -548,7 +548,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27169-2" />
 <oval id="audit_rules_time_stime" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -576,7 +576,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27170-0" />
 <oval id="audit_rules_time_clock_settime" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -601,7 +601,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27172-6" />
 <oval id="audit_rules_time_watch_localtime" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 </Group><!--End <Group id="audit_time_rules"> -->
@@ -630,7 +630,7 @@ unexpected users, groups, or modifications should be investigated for
 legitimacy.</rationale>
 <ident cce="26664-3" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AC-2(4),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
+<ref nist="AC-2(4),AC-17(7),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
 </Rule>
 
 <Rule id="audit_network_modifications">
@@ -656,7 +656,7 @@ than administrator action. Any change to network parameters should be
 audited.</rationale>
 <ident cce="26648-6" />
 <oval id="audit_rules_networkconfig_modification" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 </Rule>
 
 <Rule id="audit_logs_permissions">
@@ -674,7 +674,7 @@ Audit logs must be mode 0640 or less permissive.
 If users can write to audit logs, audit trails can be modified or destroyed.
 </rationale>
 <oval id="file_permissions_var_log_audit" />
-<ref nist="AC-6, AU-9" disa="166" />
+<ref nist="AC-6,AU-9" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -689,7 +689,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 <rationale>Failure to give ownership of the audit log file(s) to root allows the designated 
 owner, and unauthorized users, potential access to sensitive information.</rationale>
 <oval id="file_ownership_var_log_audit" />
-<ref nist="AC-6, AU-9" disa="166" />
+<ref nist="AC-6,AU-9" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -711,7 +711,7 @@ arbitrarily changed by anything other than administrator action. All changes to
 MAC policy should be audited.</rationale>
 <ident cce="26657-7" />
 <oval id="audit_rules_mac_modification" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 </Rule>
 
 <Group id="audit_dac_actions">
@@ -771,7 +771,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="26280-8" />
 <oval id="audit_rules_dac_modification_chmod" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_chown">
@@ -799,7 +799,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27173-4" />
 <oval id="audit_rules_dac_modification_chown" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmod">
@@ -827,7 +827,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27174-2" />
 <oval id="audit_rules_dac_modification_fchmod" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmodat">
@@ -855,7 +855,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27175-9" />
 <oval id="audit_rules_dac_modification_fchmodat" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchown">
@@ -883,7 +883,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27177-5" />
 <oval id="audit_rules_dac_modification_fchown" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchownat">
@@ -911,7 +911,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27178-3" />
 <oval id="audit_rules_dac_modification_fchownat" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fremovexattr">
@@ -939,7 +939,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27179-1" />
 <oval id="audit_rules_dac_modification_fremovexattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fsetxattr">
@@ -967,7 +967,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27180-9" />
 <oval id="audit_rules_dac_modification_fsetxattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lchown">
@@ -995,7 +995,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27181-7" />
 <oval id="audit_rules_dac_modification_lchown" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lremovexattr">
@@ -1023,7 +1023,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27182-5" />
 <oval id="audit_rules_dac_modification_lremovexattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lsetxattr">
@@ -1051,7 +1051,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27183-3" />
 <oval id="audit_rules_dac_modification_lsetxattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_removexattr">
@@ -1079,7 +1079,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27184-1" />
 <oval id="audit_rules_dac_modification_removexattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_setxattr">
@@ -1107,7 +1107,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27185-8" />
 <oval id="audit_rules_dac_modification_setxattr" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 </Group> <!-- <Group id="audit_dac_actions"> -->
@@ -1124,7 +1124,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26691-6" />
 <oval id="audit_rules_login_events" />
-<!--<ref nist="TODO" />-->
+<ref nist="AC-17(7)" \>
 </Rule>
 
 <Rule id="audit_manual_session_edits">
@@ -1141,7 +1141,7 @@ storing such process information, add the following to
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26610-6" />
 <oval id="audit_rules_session_events" />
-<ref nist="AU-2" />
+<ref nist="AC-17(7),AU-2" />
 </Rule>
 
 <Rule id="audit_file_access">
@@ -1164,7 +1164,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
 these events could serve as evidence of potential system compromise.</rationale>
 <ident cce="26712-0" />
 <oval id="audit_rules_unsuccessful_file_modification" />
-<ref nist="AU-2" disa="126" />
+<ref nist="AC-17(7),AU-2" disa="126" />
 </Rule>
 
 <Rule id="audit_privileged_commands">
@@ -1192,7 +1192,7 @@ unusual activity.
 </rationale>
 <ident cce="26457-2" />
 <oval id="audit_rules_privileged_commands" />
-<ref nist="AU-2" disa="40" />
+<ref nist="AC-17(7),AU-2" disa="40" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1214,7 +1214,7 @@ trail should be created each time a filesystem is mounted to help identify and g
 loss.</rationale>
 <ident cce="26573-6" />
 <oval id="audit_rules_media_export" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1238,7 +1238,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as
 malicious processes that attempt to delete log files to conceal their presence.</rationale>
 <ident cce="26651-0" />
 <oval id="audit_rules_file_deletion_events" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_sysadmin_actions">
@@ -1256,7 +1256,7 @@ To verify that auditing is configured for system administrator actions, run the
 of what was executed on the system, as well as, for accountability purposes.</rationale>
 <ident cce="26662-7" />
 <oval id="audit_rules_sysadmin_actions" />
-<ref nist="AC-2(7)(b),AU-2" disa="126"/>
+<ref nist="AC-2(7)(b),AC-17(7),AU-2" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1278,7 +1278,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp
 to have an audit trail of modules that have been introduced into the kernel.</rationale>
 <ident cce="26611-4" />
 <oval id="audit_rules_kernel_module_loading" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_config_immutable">
@@ -1294,7 +1294,7 @@ problematic if legitimate changes are needed during system
 operation</rationale>
 <ident cce="26612-2" />
 <oval id="audit_rules_immutable" />
-<ref nist="AU-2" />
+<ref nist="AC-6,AU-2" />
 </Rule>
 </Group>
 
-- 
1.7.1



More information about the scap-security-guide mailing list