[PATCH 2/8] Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra

Shawn Wells shawn.d.wells at gmail.com
Sun Jul 7 05:35:28 UTC 2013


-------------- next part --------------
>From ab5a3f69a46382b8bb3442df5a5519539304563d Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 01:20:08 -0400
Subject: [PATCH 2/8] Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra
  Generated from templates

---
 .../sysctl_net_ipv6_conf_default_accept_ra.xml     |   15 ++++++---------
 RHEL6/input/checks/templates/sysctl_values.csv     |    1 +
 .../set_sysctl_net_ipv6_conf_default_accept_ra.sh  |   16 ++++++++++++++++
 3 files changed, 23 insertions(+), 9 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh

diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
index 7589af0..b0f9ce5 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
@@ -1,22 +1,19 @@
 <def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
   <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra" version="1">
     <metadata>
       <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra" Check</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to configured.</description>
+      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to "0".</description>
     </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
+    <criteria>
+      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set" 
-  id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
     <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra" />
     <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra" />
   </unix:sysctl_test>
@@ -26,6 +23,6 @@
   </unix:sysctl_object>
 
   <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra" version="1">
-    <unix:value datatype="int" operation="equals">1</unix:value>
+    <unix:value datatype="int" operation="equals">0</unix:value>
   </unix:sysctl_state>
 </def-group>
diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv
index 8cb8506..ae38b46 100644
--- a/RHEL6/input/checks/templates/sysctl_values.csv
+++ b/RHEL6/input/checks/templates/sysctl_values.csv
@@ -16,3 +16,4 @@ net.ipv4.icmp_ignore_bogus_error_responses,1
 net.ipv4.ip_forward,0
 net.ipv4.tcp_syncookies,1
 net.ipv6.conf.default.accept_redirects,0
+net.ipv6.conf.default.accept_ra,0
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
new file mode 100644
index 0000000..be879c2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv6.conf.default.accept_ra
+#
+sysctl -q -n -w net.ipv6.conf.default.accept_ra=0
+
+#
+# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv6.conf.default.accept_ra = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv6.conf.default.accept_ra /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv6.conf.default.accept_ra.*/net.ipv6.conf.default.accept_ra = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv6.conf.default.accept_ra to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list