[PATCH 1/2] turned a Rule into a Group
David Smith
dsmith at eclipse.ncsc.mil
Thu Jan 17 13:09:31 UTC 2013
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
RHEL6/input/system/network/network.xml | 20 +++++++++-----------
1 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/RHEL6/input/system/network/network.xml b/RHEL6/input/system/network/network.xml
index d7e83e4..ba27915 100644
--- a/RHEL6/input/system/network/network.xml
+++ b/RHEL6/input/system/network/network.xml
@@ -14,9 +14,13 @@ hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</description>
-<!-- <Rule id="network_disable_unused_interfaces">
+<Group id="network_disable_unused_interfaces">
<title>Disable Unused Interfaces</title>
-<description>If the system does not require network communications but still
+<description>Network interfaces expand the attack surface of the
+system. Unused interfaces are not monitored or controlled, and
+should be disabled.
+<br /><br />
+If the system does not require network communications but still
needs to use the loopback interface, remove all files of the form
<tt>ifcfg-<i>interface</i></tt> except for <tt>ifcfg-lo</tt> from
<tt>/etc/sysconfig/network-scripts</tt>:
@@ -25,13 +29,7 @@ If the system is a standalone machine with no need for network access or even
communication over the loopback device, then disable this service.
<service-disable-macro service="network" />
</description>
-<rationale>The network interfaces expand the attack surface of a system.
-Although unusual, if they are not needed they should be disabled.
-</rationale>
-<ident cce="TODO" />
--TODO:MANUAL<oval id="network_disable_unused_interfaces" />
-<ref nist="CM-7" />
-</Rule> -->
+</Group>
<Rule id="network_disable_zeroconf">
<title>Disable Zeroconf Networking</title>
@@ -59,8 +57,8 @@ capture all traffic on the network to which it is connected. Run the following
to determine if any interface is running in promiscuous mode:
<pre>$ ip link | grep PROMISC</pre>
</description>
-<rationale>If any results are returned then a sniffing process (such as tcpdump
-or wireshark) is likely to be using the interface and this should be
+<rationale>If any results are returned, then a sniffing process (such as tcpdump
+or Wireshark) is likely to be using the interface and this should be
investigated.
</rationale>
<ident cce="27152-8" />
--
1.7.1
More information about the scap-security-guide
mailing list