[PATCH 17/20] Mapped CM-7

Shawn Wells shawn.d.wells at gmail.com
Sat Jan 12 18:19:42 UTC 2013


-------------- next part --------------
>From dad807682de5dac7b61613be7004e5da896dc3ef Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 11 Jan 2013 02:19:40 -0500
Subject: [PATCH 17/20] Mapped CM-7
 CM-7 calls for the system to provide only essential capabilities, and restrict defined functions,
 ports, protocols, and services. Removed a few existing CM-7 mappings to follow the above interpretation,
 added others.

---
 RHEL6/input/auxiliary/nist_support.xml             |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |   95 +++++++++++++++++++-
 RHEL6/input/services/avahi.xml                     |    9 --
 RHEL6/input/services/base.xml                      |   17 +---
 RHEL6/input/services/cron.xml                      |    4 +-
 RHEL6/input/services/dhcp.xml                      |   11 +--
 RHEL6/input/services/dns.xml                       |   16 ++--
 RHEL6/input/services/ldap.xml                      |   10 +-
 RHEL6/input/services/mail.xml                      |    5 +-
 RHEL6/input/services/obsolete.xml                  |   30 +++----
 RHEL6/input/services/printing.xml                  |    3 +-
 RHEL6/input/system/accounts/physical.xml           |   17 ++--
 .../accounts/restrictions/password_expiration.xml  |    7 +-
 .../system/accounts/restrictions/root_logins.xml   |    6 +-
 RHEL6/input/system/accounts/session.xml            |   12 ++--
 RHEL6/input/system/network/iptables.xml            |   16 ++--
 RHEL6/input/system/network/ipv6.xml                |    6 +-
 RHEL6/input/system/network/kernel.xml              |   30 +++----
 RHEL6/input/system/network/network.xml             |    2 +-
 RHEL6/input/system/network/uncommon.xml            |    3 -
 RHEL6/input/system/permissions/execution.xml       |    7 +-
 RHEL6/input/system/permissions/files.xml           |    4 +-
 RHEL6/input/system/permissions/mounting.xml        |   16 ++--
 RHEL6/input/system/permissions/partitions.xml      |    2 +-
 RHEL6/input/system/selinux.xml                     |    2 +-
 25 files changed, 190 insertions(+), 142 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 538c443..e33cb7b 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -14,7 +14,7 @@ automated means.</rational>
 <description>This requirement is procedural, and can not be met
 through automated means.</description>
 </description>
-<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AU-2(b),AU-2(3),AU-6(a),AU-6(b),AU-6(3),CA-1(a),CA-1(b),CA-2(a),CA-2(b),CA-2(c),CA-2(d),CA-2(1)CA-2(2),CA-3(a),CA-3(b),CA-3(c),CA-3(1),CA-3(2),CA-5(a),CA-5(b),CA-6(a),CA-6(b),CA-6(c),CA-7(a),CA-7(b),CA-7(c),CA-7(d),CA-7(1),CA-7(2),CM-1(a),CM-1(b),CM-2,CM-2(1)(a),CM-2(1)(b),CM-2(1)(c),CM-2(2),CM-2(5)(a),CM-2(5)(b),CM-3(a),CM-3(b),CM-3(c),CM-3(d),CM-3(e),CM-3(f),CM-3(4),CM-4,CM-4(2),CM-5,CM-5(2),CM-5(5)(b),CM-6(b),CM-6(c),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5,AU-1(a)" \>
+<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AU-2(b),AU-2(3),AU-6(a),AU-6(b),AU-6(3),CA-1(a),CA-1(b),CA-2(a),CA-2(b),CA-2(c),CA-2(d),CA-2(1)CA-2(2),CA-3(a),CA-3(b),CA-3(c),CA-3(1),CA-3(2),CA-5(a),CA-5(b),CA-6(a),CA-6(b),CA-6(c),CA-7(a),CA-7(b),CA-7(c),CA-7(d),CA-7(1),CA-7(2),CM-1(a),CM-1(b),CM-2,CM-2(1)(a),CM-2(1)(b),CM-2(1)(c),CM-2(2),CM-2(5)(a),CM-2(5)(b),CM-3(a),CM-3(b),CM-3(c),CM-3(d),CM-3(e),CM-3(f),CM-3(4),CM-4,CM-4(2),CM-5,CM-5(2),CM-5(5)(b),CM-6(b),CM-6(c),CM-7(1),CM-7(3),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5,AU-1(a)" \>
 </Rule>
 
 <Rule id="nist_not_OS_applicable">
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 52091f0..2b703ec 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -25,6 +25,12 @@ assurance."</description>
 <refine-value idref="var_selinux_state_name" selector="enforcing" \>
 <refine-value idref="var_selinux_policy_name" selector="targeted" \>
 
+<!--	AC-4:	TBD 
+
+	-->
+<refine-value idref="sysctl_net_ipv4_conf_all_secure_redirects_value" selector="1" \>
+
+
 <!--	AC-6: Least privilege
 
 	Optional values for the umask are "022" or "027" -->
@@ -79,6 +85,13 @@ assurance."</description>
 <!-- --------------------------------------------------------------------------------- -->
 <!-- STATIC VARIABLES: DO NOT ALTER -->
 <refine-value idref="login_banner_text" selector="usgcb_default" \>
+<refine-value idref="sysctl_net_ipv4_conf_all_accept_source_route_value" selector="0" \>
+<refine-value idref="sysctl_net_ipv4_conf_all_accept_redirects_value" selector="0" \>
+<refine-value idref="sysctl_net_ipv4_conf_all_log_martians_value" selector="1" \>
+<refine-value idref="sysctl_net_ipv4_conf_default_secure_redirects_value" selector="1" \>
+<refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="1" \>
+<refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" selector="1" \>
+
 <!-- --------------------------------------------------------------------------------- -->
 
 
@@ -206,6 +219,8 @@ assurance."</description>
 <select idref="audit_file_deletions" selected="true" \>
 <select idref="audit_sysadmin_actions" selected="true" \>
 <select idref="audit_kernel_module_loading" selected="true" \>
+<select idref="iptables_log_and_drop_suspicious" selected="true" \>
+<select idref="set_sysctl_net_ipv4_conf_all_log_martians" selected="true" \>
 
 <!-- AC-17(8) -->
 <select idref="disable_xinetd" selected="true" \>
@@ -269,6 +284,8 @@ assurance."</description>
 <select idref="ntpd_specify_remote_server" selected="true" \>
 <select idref="ntpd_specify_multiple_servers" selected="true" \>
 
+<!-- AU-12 -->
+<select idref="service_psacct_enabled" selected="true" \>
 
 <!-- CM-3
      	At some point we should look at creating prose for this 
@@ -282,12 +299,84 @@ assurance."</description>
 <select idref="aide_periodic_cron_checking" selected="true" \>
 <select idref="rpm_verify_hashes" selected="true" \>
 
+<!-- CM-7 -->
+<select idref="disable_ipv6_module_loading" selected="true" \>
+<select idref="network_ipv6_disable_interfaces" selected="true" \>
+<select idref="network_ipv6_disable_rpc" selected="true" \>
+<select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" \>
+<select idref="set_sysctl_ipv6_default_accept_redirects" selected="true" \>
+<!-- network_ipv6_limit_requests should likely be broken up into individual
+     rules at some point -->
+<select idref="network_ipv6_limit_requests" selected="true" \>
+<select idref="network_disable_unused_interfaces" selected="true" \>
+<select idref="network_disable_zeroconf" selected="true" \>
+<select idref="network_sniffer_disabled" selected="true" \>
+<select idref="disable_protocol_dccp" selected="true" \>
+<select idref="disable_protocol_sctp" selected="true" \>
+<select idref="disable_protocol_rds" selected="true" \>
+<select idref="disable_protocol_tipc" selected="true" \>
+<select idref="set_iptables_default_rule" selected="true" \>
+<select idref="set_iptables_default_rule_forward" selected="true" \>
+<select idref="iptables_icmp_disabled" selected="true" \>
+<select idref="disable_sysctl_ipv4_all_send_redirects" selected="true" \>
+<select idref="disable_sysctl_ipv4_ip_forward" selected="true" \>
+<select idref="set_sysctl_net_ipv4_conf_all_accept_source_route" selected="true" \>
+<select idref="set_sysctl_net_ipv4_conf_all_accept_redirects" selected="true" \>
+<select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true" \>
+<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" \>
+<select idref="disable_module_cramfs" selected="true" \>
+<select idref="disable_module_freevxfs" selected="true" \>
+<select idref="disable_module_jffs2" selected="true" \>
+<select idref="disable_module_hfs" selected="true" \>
+<select idref="disable_module_hfsplus" selected="true" \>
+<select idref="disable_module_squashfs" selected="true" \>
+<select idref="disable_module_udf" selected="true" \>
+<select idref="disable_gnome_thumbnailers" selected="true" \>
+<select idref="mountopt_nodev_on_nonroot_partitions" selected="true" \>
+<select idref="mount_option_tmp_nodev" selected="true" \>
+<select idref="mount_option_tmp_noexec" selected="true" \>
+<select idref="mount_option_tmp_nosuid" selected="true" \>
+<select idref="mount_option_dev_shm_nodev" selected="true" \>
+<select idref="mount_option_dev_shm_noexec" selected="true" \>
+<select idref="mount_option_dev_shm_nosuid" selected="true" \>
+<select idref="mount_option_var_tmp_bind_var" selected="true" \>
+<select idref="service_cups_disabled" selected="true" \>
+<select idref="iptables_cupsd_disabled" selected="true" \>
+<select idref="cups_disable_browsing" selected="true" \>
+<select idref="cups_disable_printserver" selected="true" \>
+<select idref="disable_dhcp_server" selected="true" \>
+<select idref="uninstall_dhcp_server" selected="true" \>
+<select idref="disable_dhcp_client" selected="true" \>
+<select idref="disable_avahi" selected="true" \>
+<select idref="enable_cron" selected="true" \>
+<select idref="disable_anacron" seleted="true" \>
+<select idref="disable_at" selected="true" \>
+<select idref="disable_dns_server" selected="true" \>
+<select idref="uninstall_bind" selected="true" \>
+<select idref="package_openldap-servers_removed" selected="true" \>
+<select idref="package_sendmail_removed" selected="true" \>
+<select idref="service_acpid_disabled" selected="true" \>
+<select idref="service_atd_disabled" selected="true" \>
+<select idref="service_certmonger_disabled" selected="true" \>
+<select idref="service_cgconfig_disabled" selected="true" \>
+<select idref="service_cgred_disabled" selected="true" \>
+<select idref="service_cpuspeed_disabled" selected="true" \>
+<select idref="service_haldaemon_disabled" selected="true" \>
+<select idref="service_irqbalance_enabled" selected="true" \>
+<select idref="service_mdmonitor_disabled" selected="true" \>
+<select idref="service_messagebus_disabled" selected="true" \>
+<select idref="service_oddjobd_disabled" selected="true" \>
+<select idref="service_quota_nld_disabled" selected="true" \>
+<select idref="service_rhsmcertd_disabled" selected="true" \>
+<select idref="service_smartd_disabled" selected="true" \>
+<select idref="service_sysstat_disabled" selected="true" \>
+<select idref="disable_httpd" selected="true" \>
+<select idref="uninstall_httpd" selected="true" \>
+<select idref="disabling_vsftpd" selected="true" \>
+<select idref="uninstall_vsftpd" selected="true" \>
 
 
 <!-- REMAINING MAPPINGS
-     CM-7
-     CM-7(1)
-     CM-7(3)
      CM-8
      CM-8(1)
      CM-8(4)
diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
index 9ef1360..a8cf18b 100644
--- a/RHEL6/input/services/avahi.xml
+++ b/RHEL6/input/services/avahi.xml
@@ -7,7 +7,6 @@ identify resources on the network, such as printers or web servers.
 This capability is also known as mDNSresponder and is a major part
 of Zeroconf networking. </description>
 
-
 <Group id="disable_avahi_group">
 <title>Disable Avahi Server if Possible</title>
 <description>Because the Avahi daemon service keeps an open network
@@ -31,10 +30,8 @@ can be trusted.
 <oval id="service_avahi-daemon_disabled" />
 <ref nist="CM-7" disa="366"/>
 </Rule>
-
 </Group>
 
-
 <Group id="avahi_configuration">
 <title>Configure Avahi if Necessary</title>
 <description>
@@ -58,7 +55,6 @@ Similarly, if you are using only IPv6, disable IPv4 sockets with the line.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="avahi_check_ttl">
 <title>Check Avahi Responses' TTL Field</title>
 <description>
@@ -78,7 +74,6 @@ are not permitted.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="avahi_prevent_port_sharing">
 <title>Prevent Other Programs from Using Avahi's Port</title>
 <description>
@@ -93,7 +88,6 @@ that port on the system.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="avahi_disable_publishing">
 <title>Disable Avahi Publishing</title>
 <description>
@@ -108,7 +102,6 @@ that port on the system.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Group id="avahi_restrict_published_information">
 <title>Restrict Information Published by Avahi</title>
 <description>
@@ -137,7 +130,5 @@ must be published.
 </rationale>
 <ref nist="CM-7" />
 </Group>
-
 </Group>
-
 </Group>
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 4dcca02..b0ebf16 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -25,7 +25,6 @@ information from within a process's address space or registers.</rationale>
 <ref nist="AC-17(8),CM-7" disa="381" />
 </Rule>
 
-
 <Rule id="service_acpid_disabled">
 <title>Disable Advanced Configuration and Power Interface (acpid)</title>
 <description>The Advanced Configuration and Power Interface Daemon (<tt>acpid</tt>)
@@ -43,7 +42,6 @@ it is appropriate.</rationale>
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="service_atd_disabled">
 <title>Disable At Service (atd)</title>
 <description>The <tt>at</tt> and <tt>batch</tt> commands can be used to
@@ -82,7 +80,6 @@ for many other use cases.</rationale>
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="service_cgconfig_disabled">
 <title>Disable Control Group Config (cgconfig)</title>
 <description>Control groups allow an administrator to allocate system resources (such as CPU,
@@ -131,7 +128,6 @@ highly desirable or necessary.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="service_haldaemon_disabled">
 <title>Disable Hardware Abstraction Layer Service (haldaemon)</title>
 <description>The Hardware Abstraction Layer Daemon (<tt>haldaemon</tt>) collects
@@ -151,7 +147,6 @@ that do not require these.
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="service_irqbalance_enabled">
 <title>Enable IRQ Balance (irqbalance)</title>
 <description>The <tt>irqbalance</tt> service optimizes the balance between
@@ -216,7 +211,6 @@ there is no need to run the service.</rationale>
 <ref nist="CM-7" />
 </Rule>
 
-
 <Rule id="service_messagebus_disabled">
 <title>Disable D-Bus IPC Service (messagebus)</title>
 <description>D-Bus provides an IPC mechanism used by 
@@ -270,7 +264,7 @@ reboots. In any event, the functionality of the ntpdate service is now
 available in the ntpd program and should be considered deprecated.</rationale>
 <ident cce="TODO" />
 <!--<oval id="service_ntpdate_disabled" /> -->
-<ref nist="AC-17(8),AU-8" disa="382" />
+<ref nist="AC-17(8),AU-8,CM-7" disa="382" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -306,7 +300,7 @@ preventing conflicting usage of ports in the reserved port range, but it can be
 disabled if not needed.</rationale>
 <ident cce="TODO" />
 <oval id="service_portreserve_disabled" />
-<ref nist="AC-17(8), CM-7" />
+<ref nist="AC-17(8),CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -324,7 +318,7 @@ system and its audit records provide more authoritative and comprehensive
 records.</rationale>
 <ident cce="TODO" />
 <oval id="service_psacct_enabled" />
-<ref nist="AU-12" />
+<ref nist="AU-12,CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -368,7 +362,6 @@ service.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_rdisc_disabled">
 <title>Disable Network Router Discovery Daemon (rdisc)</title>
 <description>The <tt>rdisc</tt> service implements the client side of the ICMP
@@ -388,7 +381,6 @@ dynamic network configuration information.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_rhnsd_disabled">
 <title>Disable Red Hat Network Service (rhnsd)</title>
 <description>The Red Hat Network service automatically queries Red Hat Network
@@ -408,7 +400,6 @@ desirable for some environments.  However, if the system is being managed by RHN
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_rhsmcertd_disabled">
 <title>Disable Red Hat Subscription Manager Daemon (rhsmcertd)</title>
 <description>The Red Hat Subscription Manager (rhsmcertd) periodically checks for
@@ -428,7 +419,6 @@ unnecessary and can be disabled.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_saslauthd_disabled">
 <title>Disable Cyrus SASL Authentication Daemon (saslauthd)</title>
 <description>The saslauthd service handles plaintext authentication requests on
@@ -449,7 +439,6 @@ consulted, it is not necessary and should be disabled.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="service_smartd_disabled">
 <title>Disable SMART Disk Monitoring Service (smartd)</title>
 <description>SMART (Self-Monitoring, Analysis, and Reporting Technology) is a
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index 15038b7..d4e03bc 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -23,7 +23,6 @@ enabling the cron daemon is essential.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="disable_anacron">
 <title>Disable anacron Service</title>
 <description>The <tt>cronie-anacron</tt> package which provides anacron
@@ -36,6 +35,7 @@ such as laptops and workstations that may be shut down during the normal times
 that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this
 additional functionality, <tt>anacron</tt> could needlessly increase the possible
 attack surface for an intruder.</description>
+<ref nist="CM-7" />
 </Rule>
 
 <!--
@@ -128,7 +128,6 @@ daemon can be provided through the cron daemon instead.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Group id="restrict_at_cron_users">
 <title>Restrict at and cron to Authorized Users if Necessary</title>
 <description>
@@ -154,4 +153,3 @@ To restrict at and cron to only authorized users:
 </Group>
 
 </Group>
-
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 15cbcfa..ca414d7 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -102,7 +102,7 @@ ddns-update-style setting on the client is harmless (but should be fixed as a
 best practice).</warning>
 <ident cce="27049-6" />
 <!--<oval id="dhcp_server_disable_ddns" /> -->
-<!--<ref nist="CM-7" /> -->
+<ref nist="CM-7" />
 </Rule>
 
 <Rule id="dhcp_server_deny_decline">
@@ -117,7 +117,7 @@ server's pool of IP addresses, causing the DHCP server to forget old address
 allocations.</rationale>
 <ident cce="27106-4" />
 <!--<oval id="dhcp_server_deny_decline" /> -->
-<!--<ref nist="CM-7" /> -->
+<ref nist="CM-7" />
 </Rule>
 
 <Rule id="dhcp_server_deny_bootp">
@@ -132,7 +132,7 @@ vectors against the DHCP server.
 </rationale>
 <ident cce="27077-7" />
 <!--<oval id="dhcp_server_deny_bootp" /> -->
-<!--<ref nist="CM-7" /> -->
+<ref nist="CM-7" />
 </Rule>
 
 <Group id="dhcp_server_minimize_served_info">
@@ -167,7 +167,7 @@ usually static across machines at a given site.</warning>
 <ident cce="27064-5" />
 <ident cce="27065-2" />-->
 <!--<oval id="dhcp_server_minimize_served_info" /> -->
-<!--<ref nist="CM-7" /> -->
+<ref nist="CM-7" />
 </Group>
 
 <Rule id="dhcp_server_configure_logging">
@@ -182,7 +182,7 @@ daemon messages to a dedicated log file is part of the syslog configuration
 outlined in the Logging and Auditing section</rationale>
 <ident cce="26898-7" />
 <!--<oval id="dhcp_server_configure_logging" /> -->
-<!--<ref nist="CM-7" /> -->
+<ref nist="" />
 </Rule>
 
 </Group> <!-- <Group id="dhcp_server_configuration"> -->
@@ -293,5 +293,4 @@ service.</warning>
 </Group>
 
 </Group> <!-- <Group id="dhcp_client_configuration"> -->
-
 </Group> <!-- <Group id="dhcp"> -->
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index b8534c2..6afc4ca 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -101,7 +101,7 @@ configuration file. That is, when this guide recommends editing
 <ident cce="27127-0" />
 <ident cce="26961-3" />
 <!--<oval id="dns_server_chroot" />-->
-<!--<ref nist="CM-7" />-->
+<ref nist="CM-7" />
 </Rule>
 
 <Group id="dns_server_firewall">
@@ -118,7 +118,7 @@ it may be appropriate to insert a -s flag into this rule to allow traffic only
 from packets on the local network.</rationale>
 <!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
 <!--<oval id="dns_server_firewall" />-->
-<!--<ref nist="CM-7" />-->
+<ref nist="CM-7" />
 </Group>
 
 </Group> <!--<Group id="dns_server_isolation">-->
@@ -231,7 +231,7 @@ this server as a general-purpose nameserver.</warning>
 <!--<ref nist="CM-7" />-->
 </Group>
 
-<Group id="dns_server_disable_zone_transfers">
+<Rule id="dns_server_disable_zone_transfers">
 <title>Disable Zone Transfers from the Nameserver</title>
 <description>Is it necessary for a secondary nameserver to receive zone data
 via zone transfer from the primary server?  If not, follow the instructions in
@@ -250,10 +250,10 @@ is not necessary to allow zone transfers within BIND itself, so they should be
 disabled to avoid the potential for abuse.</rationale>
 <!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
 <!--<oval id="dns_server_disable_zone_transfers" />-->
-<!--<ref nist="CM-7" />-->
-</Group>
+<ref nist="CM-7" />
+</Rule>
 
-<Group id="dns_server_authenticate_zone_transfers">
+<Rule id="dns_server_authenticate_zone_transfers">
 <title>Authenticate Zone Transfers</title>
 <description>If it is necessary for a secondary nameserver to receive zone data
 via zone transfer from the primary server, follow the instructions here.  Use
@@ -307,8 +307,8 @@ key files Kdns.example.com .+NNN +MMMMM .key and Kdns.example.com .+NNN +MMMMM
 .private are no longer needed, and may safely be deleted.</warning>
 <!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
 <!--<oval id="dns_server_authenticate_zone_transfers" />-->
-<!--<ref nist="CM-7" />-->
-</Group>
+<ref nist="CM-7" />
+</Rule>
 
 <Rule id="dns_server_disable_dynamic_updates">
 <title>Disable Dynamic Updates</title>
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index e6c54cc..a9eadf1 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -39,7 +39,7 @@ To ensure LDAP is configured to use TLS for all transactions, run the following
 <rationale>The ssl directive specifies whether to use ssl or not. If
 not specified it will default to no. It should be set to start_tls rather
 than doing LDAP over SSL.</rationale>
-<ref disa="776,778,1453" />
+<ref nist="CM-7" disa="776,778,1453" />
 <ident cce="26690-8" />
 <oval id="ldap_client_start_tls" />
 <tested by="DS" on="20121024"/>
@@ -64,7 +64,7 @@ To ensure TLS is configured with trust certificates, run the following command:
 tls_checkpeer is configured (which is the default for openldap versions 2.1 and
 up). These directives define the path to the trust certificates signed by the
 site CA.</rationale>
-<ref disa="776,778,1453" />
+<ref nist="CM-7" disa="776,778,1453" />
 <ident cce="27189-0" />
 <oval id="ldap_client_tls_cacertpath" />
 <tested by="DS" on="20121024"/>
@@ -120,7 +120,7 @@ These are basic LDAP configuration directives. The suffix parameter gives the ro
 </description>
 <ident cce="27191-6" />
 <oval id="ldap_server_config_olcsuffix" />
-<ref nist="AC-2, CM-7" />
+<ref nist="AC-2,CM-7" />
 </Rule>
 
 <Rule id="ldap_server_config_bdb_file_security">
@@ -138,7 +138,7 @@ Protect configuration files containing the hashed password the same way you woul
 </description>
 <!--<ident cce="TODO:CCE" />-->
 <oval id="ldap_server_config_bdb_file_security" />
-<ref nist="AC-6, CM-7" />
+<ref nist="AC-6,CM-7" />
 </Rule>
 
 <Rule id="ldap_server_config_olcrootpw">
@@ -204,7 +204,7 @@ LDAP server process would need to be restarted manually whenever the server rebo
 <ident cce="26989-4" />
 <ident cce="26895-3" />
 <oval id="ldap_server_config_certificate_files" />
-<ref nist="AC-6, CM-7, SC-11, SC-12, SC-13, SC-17" />
+<ref nist="AC-6,SC-11,SC-12,SC-13,SC-17" />
 </Rule>
 
 <Group id="ldap_server_config_directory_domain">
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index 3d482dd..261c57a 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -55,13 +55,10 @@ not installed by default.
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
 </rationale>
-<ref nist="" />
+<ref nist="CM-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
-
-
 <Group id="postfix_client">
 <title>Configure SMTP For Mail Clients</title>
 <description>This section discusses settings for Postfix in a submission-only
diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index e960648..88dcf9c 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -38,7 +38,7 @@ attacks against xinetd itself.
 </rationale>
 <ident cce="27046-2" />
 <oval id="service_xinetd_disabled" />
-<ref nist="AC-17(8)" disa="305"/>
+<ref nist="AC-17(8),CM-7" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -54,7 +54,7 @@ xinetd service's accidental (or intentional) activation.
 </rationale>
 <ident cce="27005-8" />
 <oval id="package_xinetd_removed" />
-<ref nist="AC-17(8)" disa="305"/>
+<ref nist="AC-17(8),CM-7" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -81,7 +81,7 @@ subject to man-in-the-middle attacks.
 </rationale>
 <ident cce="26836-7" />
 <oval id="service_telnetd_disabled" />
-<ref nist="AC-17(8)" disa="68,1436,197,877,888" />
+<ref nist="AC-17(8),CM-7" disa="68,1436,197,877,888" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -97,13 +97,11 @@ telnet service's accidental (or intentional) activation.
 </rationale>
 <ident cce="27073-6" />
 <oval id="package_telnet-server_removed" />
-<ref nist="AC-17(8)" disa="305,381"/>
+<ref nist="AC-17(8),CM-7" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
 
-
-
 <Group id="r_services">
 <title>Rlogin, Rsh, and Rexec</title>
 <description>The Berkeley r-commands are legacy services which
@@ -124,7 +122,7 @@ activation.
 </rationale>
 <ident cce="27062-9" />
 <oval id="package_rsh-server_removed" />
-<ref nist="AC-17(8)" disa="305,381"/>
+<ref nist="AC-17(8),CM-7" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -143,7 +141,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="27208-8" />
 <oval id="service_rexec_disabled" />
-<ref nist="AC-17(8)" disa="68,1436"/>
+<ref nist="AC-17(8),CM-7" disa="68,1436"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -162,7 +160,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="26994-4" />
 <oval id="service_rsh_disabled" />
-<ref nist="AC-17(8)" disa="68,1436" />
+<ref nist="AC-17(8),CM-7" disa="68,1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -181,7 +179,7 @@ stolen by eavesdroppers on the network.
 </rationale>
 <ident cce="26865-6" />
 <oval id="service_rlogin_disabled" />
-<ref nist="AC-17(8)" disa="1436" />
+<ref nist="AC-17(8),CM-7" disa="1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -204,7 +202,7 @@ of an Rsh trust relationship.
 used in conjunction with the R-services, they can allow
 unauthenticated access to a system.</rationale>
 <ident cce="TODO" />
-<ref nist="AC-17(8)" disa="1436" />
+<ref nist="AC-17(8),CM-7" disa="1436" />
 <oval id="no_rsh_trusted_host_files" />
 <tested by="DS" on="20121026"/>
 </Rule>
@@ -231,7 +229,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
 </rationale>
 <ident cce="27079-3" />
 <oval id="package_ypserv_removed" />
-<ref nist="AC-17(8)" disa="305,381"/>
+<ref nist="AC-17(8),CM-7" disa="305,381"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -248,7 +246,7 @@ as a client in a NIS or NIS+ domain.
 </rationale>
 <ident cce="26894-6" />
 <oval id="service_ypbind_disabled" />
-<ref nist="AC-17(8)" disa="305"/>
+<ref nist="AC-17(8),CM-7" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
@@ -276,7 +274,7 @@ as a tftp server, which does not provide encryption or authentication.
 </rationale>
 <ident cce="27055-3" />
 <oval id="service_tftp_disabled" />
-<ref nist="AC-17(8)" disa="1436" />
+<ref nist="AC-17(8),CM-7" disa="1436" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -294,7 +292,7 @@ accidental (or intentional) activation of tftp services.
 </rationale>
 <ident cce="26946-4" />
 <oval id="package_tftp-server_removed" />
-<ref nist="AC-17(8)" disa="305"/>
+<ref nist="AC-17(8),CM-7" disa="305"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -320,7 +318,7 @@ server_args = -s /var/lib/tftpboot</pre>
 </ocil>
 <ident cce="TODO" />
 <oval id="tftpd_uses_secure_mode" />
-<ref nist="AC-17(8)" disa="366"/>
+<ref nist="AC-17(8),CM-7" disa="366"/>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/services/printing.xml b/RHEL6/input/services/printing.xml
index 21e1339..351e020 100644
--- a/RHEL6/input/services/printing.xml
+++ b/RHEL6/input/services/printing.xml
@@ -59,6 +59,7 @@ capability, the machine will no longer generate or receive such broadcasts.
 </rationale>
 <ident cce="27108-0" />
 <oval id="cups_disable_browsing" />
+<ref nist="CM-7" \>
 </Rule>
 
 <Rule id="cups_disable_printserver">
@@ -82,7 +83,7 @@ a particular set of users, use the Policy directive.
 </rationale>
 <ident cce="27107-2" /> 
 <oval id="cups_disable_printserver" />
-<ref nist="TODO:NIST" />
+<ref nist="CM-7" />
 </Rule>
 </Group>
 
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 5349731..013bb0b 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -99,7 +99,7 @@ and whether to enter single-user mode.
 </rationale>
 <ident cce="26911-8" />
 <oval id="bootloader_password" />
-<ref nist="CM-7, IA-5" disa="213" />
+<ref nist="IA-5" disa="213" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -130,7 +130,7 @@ by configuring the bootloader password.
 </rationale>
 <ident cce="27040-5" />
 <oval id="singleuser_password" />
-<ref nist="CM-7,IA-5" disa="213" />
+<ref nist="IA-5" disa="213" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -187,11 +187,10 @@ services, weakening system security.
 </rationale>
 <ident cce="27043-9" />
 <oval id="interactive_boot_disable" />
-<ref nist="CM-7, IA-4, SC-2" disa="213"/>
+<ref nist="IA-4, SC-2" disa="213"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Group id="screen_locking">
 <title>Configure Screen Locking</title>
 <description>When a user must temporarily leave an account
@@ -265,7 +264,7 @@ screen locking to prevent access from passersby.
 </rationale>
 <ident cce="26828-4" />
 <oval id="gconf_gnome_screensaver_idle_delay" value="inactivity_timeout_value" />
-<ref nist="CM-7, AC-11(a)" disa="57"/>
+<ref nist="AC-11(a)" disa="57"/>
 </Rule>
 
 <Rule id="enable_screensaver_after_idle" severity="medium">
@@ -291,7 +290,7 @@ controlled-access area.
 </rationale>
 <ident cce="26600-7" />
 <oval id="gconf_gnome_screensaver_idle_activation_enabled" />
-<ref nist="CM-7,AC-11(a)" disa="57" />
+<ref nist="AC-11(a)" disa="57" />
 </Rule>
 
 <Rule id="enable_screensaver_password_lock" severity="medium">
@@ -316,7 +315,7 @@ access the system, preventing access by passersby.
 </rationale>
 <ident cce="26235-2" />
 <oval id="gconf_gnome_screensaver_lock_enabled" />
-<ref nist="CM-7, AC-11(a)" disa="57" />
+<ref nist="AC-11(a)" disa="57" />
 </Rule>
 
 <Rule id="set_blank_screensaver">
@@ -341,7 +340,7 @@ contents of the display from passersby.
 </rationale>
 <ident cce="26638-7" />
 <oval id="gconf_gnome_screensaver_mode_blank" />
-<ref nist="CM-7,AC-11(b)" disa="60" />
+<ref nist="AC-11(b)" disa="60" />
 </Rule>
 
 </Group>
@@ -372,7 +371,7 @@ Installing <tt>screen</tt> ensures a console locking capability is available
 for users who may need to suspend console logins.
 </rationale>
 <ident cce="26940-7" />
-<ref nist="CM-7" disa="58" />
+<ref nist="" disa="58" />
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 43c0ee0..72a3a9d 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -103,7 +103,7 @@ behavior that may result.
 </rationale>
 <ident cce="27002-5" />
 <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
-<ref nist="CM-7, IA-5" disa="205"/>
+<ref nist="IA-5" disa="205"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -158,11 +158,10 @@ increases the risk of users writing down the password in a convenient
 location subject to physical compromise.</rationale>
 <ident cce="26985-2" />
 <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
-<ref nist="CM-7, IA-5" disa="180,199" />
+<ref nist="IA-5" disa="180,199" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
-
 <Rule id="password_warn_age">
 <title>Set Password Warning Age</title>
 <description>To specify how many days prior to password
@@ -184,7 +183,7 @@ make the change at a practical time.
 </rationale>
 <ident cce="26988-6" />
 <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
-<ref nist="CM-7, IA-5" />
+<ref nist="IA-5" />
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index a657936..cc56c6d 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -59,7 +59,7 @@ using the root account.
 </rationale>
 <ident cce="26855-7" />
 <oval id="securetty_root_login_console_only" />
-<ref nist="AC-6(2),CM-7" disa="770" />
+<ref nist="AC-6(2)" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -84,7 +84,7 @@ using the root account.
 </rationale>
 <ident cce="27047-0" />
 <oval id="securetty_no_serial" />
-<ref nist="AC-6(2),CM-7" disa="770" />
+<ref nist="AC-6(2)" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -167,7 +167,7 @@ access to root privileges in an accountable manner.
 </rationale>
 <ident cce="26971-2" />
 <oval id="accounts_no_uid_except_zero" />
-<ref nist="AC-6,AC-11,CM-7" disa="366" />
+<ref nist="AC-6,AC-11" disa="366" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 6c26ddd..5ddd85e 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -89,7 +89,7 @@ execute code from an untrusted location.
 </rationale>
 <ident cce="26826-8" />
 <oval id="accounts_dangerous_path_for_root" />
-<ref nist="CM6, CM-7"/>
+<ref nist=""/>
 </Rule>
 
 <Rule id="root_path_no_groupother_writable">
@@ -112,7 +112,7 @@ and potentially malicious code.
 </rationale>
 <ident cce="26768-2" />
 <oval id="accounts_root_path_dirs_no_write" />
-<ref nist="CM6, CM-7"/>
+<ref nist=""/>
 </Rule>
 </Group>
 
@@ -227,7 +227,7 @@ umask 077</pre>
 
 <ident cce="26917-5" />
 <oval id="accounts_umask_bash_users" value="umask_user_value"/>
-<ref nist="CM-7" disa="366"/>
+<ref nist="" disa="366"/>
 <tested by="swells" on="20120929"/>
 </Rule>
 
@@ -251,7 +251,7 @@ umask 077</pre>
 </ocil>
 <ident cce="27034-8" />
 <oval id="accounts_umask_csh" value="umask_user_value"/>
-<ref nist="CM-7" disa="366"/>
+<ref nist="" disa="366"/>
 <tested by="swells" on="20120929"/>
 </Rule>
 
@@ -276,7 +276,7 @@ umask 077</pre>
 </ocil>
 <oval id="accounts_umask_etc_profile" value="umask_user_value" />
 <tested by="swells" on="20120929"/>
-<ref nist="CM-7" disa="366"/>
+<ref nist="" disa="366"/>
 </Rule>
 
 <Rule id="user_umask_logindefs">
@@ -299,7 +299,7 @@ umask 077</pre>
 </ocil>
 <ident cce="26371-5" />
 <oval id="accounts_umask_login_defs" value="umask_user_value" />
-<ref nist="CM-7" disa="366"/>
+<ref nist="" disa="366"/>
 <tested by="swells" on="20120929" />
 </Rule>
 
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 3ae0507..a19bfc9 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -130,7 +130,7 @@ any packets which are not explicitly permitted should not be
 accepted.</rationale>
 <ident cce="26444-0" />
 <oval id="iptables_default_policy_drop" />
-<ref nist="" disa="66,1109,1154,1414" />
+<ref nist="CM-7" disa="66,1109,1154,1414" />
 </Rule>
 
 <Rule id="set_iptables_default_rule_forward" severity="medium">
@@ -153,10 +153,10 @@ The output should be similar to the following:
 <pre># grep ":FORWARD" /etc/sysconfig/iptables
 :FORWARD DROP [0:0</pre></ocil>
 <ident cce="27186-6" />
-<ref nist="" disa="1109" />
+<ref nist="CM-7" disa="1109" />
 </Rule>
 
-<Group id="iptables_icmp_disabled">
+<Rule id="iptables_icmp_disabled">
 <title>Restrict ICMP Message Types</title>
 <description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages types can be restricted. To accept only ICMP echo reply, destination unreachable, and time exceeded messages, remove the line:<br />
 <pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</pre>
@@ -174,14 +174,14 @@ If you are going to statically configure the machine's address, it should ignore
 could add another IPv6 address to the interface or alter important network settings:
 <pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
 </description>
-<ref nist="" />
+<ref nist="CM-7" />
 <rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the operation-
   of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
 <!--<ident cce="26444-0" />-->
 <!--<oval id="iptables_icmp_disabled" />-->
-</Group>
+</Rule>
 
-<Group id="iptables_log_and_drop_suspicious">
+<Rule id="iptables_log_and_drop_suspicious">
 <title>Log and Drop Packets with Suspicious Source Addresses</title>
 <description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
 modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
@@ -226,8 +226,8 @@ The following rule will log all traffic originating from a site-local address, w
 </description>
 <!--<ident cce="26444-0" />-->
 <!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
-<ref nist="AC-17" />
-</Group>
+<ref nist="AC-17,CM-7" />
+</Rule>
 
 </Group><!--<Group id="ruleset_modifications">-->
 </Group><!--<Group id="network-iptables">-->
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index 93bb608..6f2b9dd 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -170,7 +170,7 @@ from the network otherwise. The example address here is an IPv6 address
 reserved for documentation purposes, as defined by RFC3849.
 </description>
 <oval id="network_ipv6_static_address" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="network_ipv6_privacy_extensions">
@@ -187,7 +187,7 @@ applied.
 </description>
 <ident cce="27154-4" />
 <oval id="network_ipv6_privacy_extensions" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="network_ipv6_default_gateway">
@@ -200,7 +200,7 @@ Router addresses should be manually set and not accepted via any
 auto-configuration or router advertisement.
 </description>
 <oval id="network_ipv6_default_gateway" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="network_ipv6_limit_requests">
diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
index 8539bfe..dff93dd 100644
--- a/RHEL6/input/system/network/kernel.xml
+++ b/RHEL6/input/system/network/kernel.xml
@@ -24,7 +24,7 @@ to update their routing information.  The ability to send ICMP redirects is
 only appropriate for routers.</rationale>
 <ident cce="27001-7" />
 <oval id="sysctl_net_ipv4_conf_default_send_redirects" />
-<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -41,7 +41,7 @@ to update their routing information.  The ability to send ICMP redirects is
 only appropriate for routers.</rationale>
 <ident cce="27004-1" />
 <oval id="sysctl_net_ipv4_conf_all_send_redirects" />
-<ref nist="" disa="1551"/>
+<ref nist="CM-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -243,7 +243,7 @@ default gateways) has few legitimate uses. It should be disabled unless it is
 absolutely required.</rationale>
 <ident cce="26854-0" />
 <oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
-<ref nist="CM-7, AC-4" disa="1503,1551"/>
+<ref nist="AC-4,CM-7" disa="1503,1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -261,7 +261,7 @@ sign of nefarious network activity. Logging these packets enables this activity
 to be detected.</rationale>
 <ident cce="27066-0" />
 <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
-<ref nist="CM-7" disa="126"/>
+<ref nist="AC-17(7),CM-7" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -278,11 +278,10 @@ to be detected.</rationale>
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="26983-7" />
 <oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
-<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="set_sysctl_net_ipv4_conf_default_accept_redirects">
 <title>Disable Kernel Parameter for Accepting ICMP Redirects By Default</title>
 <description>
@@ -295,11 +294,10 @@ uses. It should be disabled unless it is absolutely required.</rationale>
 uses. It should be disabled unless it is absolutely required.</rationale>
 <ident cce="27015-7" />
 <oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
-<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="set_sysctl_net_ipv4_conf_default_secure_redirects" severity="medium">
 <title>Disable Kernel Parameter for Accepting Secure Redirects By Default</title>
 <description>
@@ -313,11 +311,10 @@ default gateways) has few legitimate uses. It should be disabled unless it is
 absolutely required.</rationale>
 <ident cce="26831-8" />
 <oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
-<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts">
 <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests</title>
 <description>
@@ -331,11 +328,10 @@ addresses makes the system slightly more difficult to enumerate on the network.
 </rationale>
 <ident cce="26883-9" />
 <oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
-<ref nist="CM-7, SC-5" disa="1551"/>
+<ref nist="CM-7,SC-5" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
 <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
 <description>
@@ -348,7 +344,7 @@ addresses makes the system slightly more difficult to enumerate on the network.
 log size, although some activity would not be logged.</rationale>
 <ident cce="26993-6" />
 <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
-<ref nist="CM-7, SC-5" />
+<ref nist="CM-7,SC-5" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -369,7 +365,7 @@ enables the system to continue servicing valid connection requests.
 </rationale>
 <ident cce="27053-8" />
 <oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
-<ref nist="CM-7" disa="1092, 1095" />
+<ref nist="AC-4" disa="1092, 1095" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -388,7 +384,7 @@ complicated networks, but is helpful for end hosts and routers serving small
 networks.</rationale>
 <ident cce="26979-5" />
 <oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" />
-<ref nist="AC-4, SC-5, SC-7" disa="1551"/>
+<ref nist="AC-4,SC-5,SC-7" disa="1551"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -407,11 +403,9 @@ complicated networks, but is helpful for end hosts and routers serving small
 networks.</rationale>
 <ident cce="26915-9" />
 <oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" />
-<ref nist="AC-4, SC-5, SC-7" />
+<ref nist="AC-4,SC-5,SC-7" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
 </Group>
-
 </Group>
-
diff --git a/RHEL6/input/system/network/network.xml b/RHEL6/input/system/network/network.xml
index f194e4f..8c1b171 100644
--- a/RHEL6/input/system/network/network.xml
+++ b/RHEL6/input/system/network/network.xml
@@ -65,7 +65,7 @@ investigated.
 </rationale>
 <ident cce="27152-8" />
 <oval id="network_sniffer_disabled" />
-<ref nist="CM-7, MA-3" />
+<ref nist="CM-7,MA-3" />
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
index 73daecf..ad6daf8 100644
--- a/RHEL6/input/system/network/uncommon.xml
+++ b/RHEL6/input/system/network/uncommon.xml
@@ -33,7 +33,6 @@ the system against exploitation of any flaws in its implementation.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="disable_protocol_sctp" severity="medium">
 <title>Disable SCTP Support</title>
 <description>
@@ -56,7 +55,6 @@ the system against exploitation of any flaws in its implementation.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="disable_protocol_rds">
 <title>Disable RDS Support</title>
 <description>
@@ -78,7 +76,6 @@ the system against exploitation of any flaws in its implementation.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="disable_protocol_tipc" severity="medium">
 <title>Disable TIPC Support</title>
 <description>
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 22a92fc..59b103c 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -7,8 +7,6 @@ These protections are applied at the system initialization or
 kernel level, and defend against certain types of badly-configured
 or compromised programs.</description>
 
-
-
 <Group id="daemon_umask">
 <title>Daemon Umask</title>
 <description>The umask is a per-process setting which limits
@@ -132,7 +130,7 @@ heap higher than this address, the hardware prevents execution in that
 address range.</rationale>
 <ident cce="27007-4" />
 <oval id="sysctl_kernel_exec_shield" />
-<ref nist="CM-7" />
+<ref nist="" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -153,7 +151,6 @@ in order to re-purpose it using return oriented programming (ROP) techniques.
 </Rule>
 </Group>
 
-
 <Group id="enable_nx">
 <title>Enable Execute Disable (XD) or No Execute (NX) Support on
 x86 Systems</title>
@@ -187,7 +184,7 @@ this may prevent them from booting.</warning>
 <rationale>On 32-bit systems that support the XD or NX bit, the vendor-supplied
 PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.</rationale>
 <ident cce="27010-8" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="bios_enable_execution_restrictions">
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index f23eff4..d2b94ab 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -376,7 +376,7 @@ unprivileged users to elevate privileges. The presence of these files should be
 strictly controlled on the system.</rationale>
 <ident cce="26769-0" />
 <oval id="file_permissions_unauthorized_sgid" />
-<ref nist="CM-7"/>
+<ref nist=""/>
 </Rule>
 
 <Rule id="no_unpackaged_suid_files">
@@ -397,7 +397,7 @@ unprivileged users to elevate privileges. The presence of these files should be
 strictly controlled on the system.</rationale>
 <ident cce="26497-8" />
 <oval id="file_permissions_unauthorized_suid" />
-<ref nist="CM-7"/>
+<ref nist=""/>
 </Rule>
 
 
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 1fe011a..85fa056 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -36,7 +36,7 @@ limited for non-root users. Review the man page for <tt>pam_console</tt> for
 more information</rationale>
 <ident cce="27192-4" />
 <oval id="console_device_restrict_access_desktop" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="console_device_restrict_access_server">
@@ -55,7 +55,7 @@ limited for non-root users. Review the man page for <tt>pam_console</tt> for
 more information</rationale>
 <ident cce="26892-0" />
 <oval id="console_device_restrict_access_server" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 
 <Rule id="kernel_module_usb-storage_disabled">
@@ -75,7 +75,7 @@ software and other vulnerabilities. Support for these devices should be disabled
 the devices themselves should be tightly controlled.</rationale>
 <ident cce="27016-5" />
 <oval id="kernel_module_usb-storage_disabled" />
-<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
 </Rule>
 <!-- Considering removal of this entirely, in favor of previous Rule
 
@@ -97,7 +97,7 @@ software and other vulnerabilities. Support for these devices should be disabled
 the devices themselves should be tightly controlled.</rationale>
 <ident cce="26970-4" />
 <oval id="kernel_module_usb-storage_removed" />
-<ref nist="CM-7" disa="1250,85" />
+<ref nist="" disa="1250,85" />
 </Rule>
 -->
 
@@ -116,7 +116,7 @@ disable USB storage devices if they are plugged into the system. Support for the
 should be disabled and the devices themselves should be tightly controlled.</rationale>
 <ident cce="27011-6" />
 <oval id="bootloader_nousb_argument" />
-<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
 </Rule>
 
 <Rule id="bios_disable_usb_boot">
@@ -131,7 +131,7 @@ any security measures offered by the native OS. Attackers could mount partitions
 configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale>
 <ident cce="26952-2" />
 <!-- <oval id="bios_disable_usb_boot" /> -->
-<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
 </Rule>
 
 <Rule id="service_autofs_disabled">
@@ -161,7 +161,7 @@ should be explicitly listed in /etc/fstab by and administrator. New filesystems
 not be arbitrarily introduced via the automounter.</rationale>
 <ident cce="26976-1" />
 <oval id="service_autofs_disabled" />
-<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
 </Rule>
 
 <Rule id="gconf_gnome_disable_automount">
@@ -190,7 +190,7 @@ DVDs.
 </rationale>
 <ident cce="27035-5" />
 <oval id="gconf_gnome_disable_automount" />
-<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
 </Rule>
 
 <Rule id="disable_module_cramfs">
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 72d83f1..c686c0c 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -194,7 +194,7 @@ necessary to meet requirements, the storage location /var/tmp should be bind mou
 /tmp and thus share the same protections.</rationale>
 <ident cce="26582-7" />
 <oval id="mount_option_var_tmp_bind" />
-<ref nist=""/>
+<ref nist="CM-7" />
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 2d02d65..3678784 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -201,7 +201,7 @@ which use category labelling.</description>
 <description>The MCS Translation Service (mcstrans) should be disabled.</description>
 <ident cce="26891-2" />
 <oval id="service_mcstrans_disabled" />
-<ref nist="CM-7" />
+<ref nist="" />
 </Rule>
 </Group>
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list