[PATCH 2/8] Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra
Shawn Wells
shawn.d.wells at gmail.com
Sun Jul 7 05:35:28 UTC 2013
-------------- next part --------------
>From ab5a3f69a46382b8bb3442df5a5519539304563d Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 01:20:08 -0400
Subject: [PATCH 2/8] Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra
Generated from templates
---
.../sysctl_net_ipv6_conf_default_accept_ra.xml | 15 ++++++---------
RHEL6/input/checks/templates/sysctl_values.csv | 1 +
.../set_sysctl_net_ipv6_conf_default_accept_ra.sh | 16 ++++++++++++++++
3 files changed, 23 insertions(+), 9 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
index 7589af0..b0f9ce5 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
@@ -1,22 +1,19 @@
<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
<definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra" version="1">
<metadata>
<title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra" Check</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to configured.</description>
+ <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to "0".</description>
</metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra is set"
- test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
+ <criteria>
+ <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set"
- id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
<unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra" />
<unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra" />
</unix:sysctl_test>
@@ -26,6 +23,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="equals">0</unix:value>
</unix:sysctl_state>
</def-group>
diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv
index 8cb8506..ae38b46 100644
--- a/RHEL6/input/checks/templates/sysctl_values.csv
+++ b/RHEL6/input/checks/templates/sysctl_values.csv
@@ -16,3 +16,4 @@ net.ipv4.icmp_ignore_bogus_error_responses,1
net.ipv4.ip_forward,0
net.ipv4.tcp_syncookies,1
net.ipv6.conf.default.accept_redirects,0
+net.ipv6.conf.default.accept_ra,0
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
new file mode 100644
index 0000000..be879c2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv6.conf.default.accept_ra
+#
+sysctl -q -n -w net.ipv6.conf.default.accept_ra=0
+
+#
+# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to "0"
+# else, add "net.ipv6.conf.default.accept_ra = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv6.conf.default.accept_ra /etc/sysctl.conf ; then
+ sed -i 's/^net.ipv6.conf.default.accept_ra.*/net.ipv6.conf.default.accept_ra = 0/g' /etc/sysctl.conf
+else
+ echo "" >> /etc/sysctl.conf
+ echo "# Set net.ipv6.conf.default.accept_ra to 0 per security requirements" >> /etc/sysctl.conf
+ echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf
+fi
--
1.7.1
More information about the scap-security-guide
mailing list