[PATCH 2/2] Added remediation from create_services_enabled template
Shawn Wells
shawn.d.wells at gmail.com
Sun Jul 7 08:39:31 UTC 2013
-------------- next part --------------
>From ee3b5e345747f56243e3b0dfebf1adef50de60eb Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 04:30:48 -0400
Subject: [PATCH 2/2] Added remediation from create_services_enabled template
- Added bash scripts to mainline RHEL6/input/fixes/bash directory
- Updated XCCDF naming to create consistency between XCCDF->OVAL->remediation
- Updated various XCCDF profiles, incl STIG overlay and transition notes
---
RHEL6/input/auxiliary/stig_overlay.xml | 44 ++++++++++----------
RHEL6/input/auxiliary/transition_notes.xml | 2 +-
RHEL6/input/fixes/bash/service_auditd_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_crond_enabled.sh | 9 ++++
.../input/fixes/bash/service_ip6tables_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_iptables_enabled.sh | 9 ++++
.../input/fixes/bash/service_irqbalance_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_ntpd_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_postfix_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_psacct_enabled.sh | 9 ++++
.../fixes/bash/service_restorecond_enabled.sh | 9 ++++
RHEL6/input/fixes/bash/service_rsyslog_enabled.sh | 9 ++++
RHEL6/input/profiles/common.xml | 10 ++--
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 10 ++--
RHEL6/input/profiles/nist-CL-IL-AL.xml | 10 ++--
RHEL6/input/profiles/stig-rhel6-server.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 10 ++--
RHEL6/input/services/cron.xml | 2 +-
RHEL6/input/services/mail.xml | 2 +-
RHEL6/input/services/ntp.xml | 2 +-
RHEL6/input/system/auditing.xml | 2 +-
RHEL6/input/system/network/iptables.xml | 4 +-
22 files changed, 140 insertions(+), 50 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/service_auditd_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_crond_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_iptables_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_ntpd_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_postfix_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_psacct_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_restorecond_enabled.sh
create mode 100644 RHEL6/input/fixes/bash/service_rsyslog_enabled.sh
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 2c553bd..3dd40c8 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -237,40 +237,40 @@
<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000099" disa="366" severity="medium">
<title>The system must ignore ICMPv6 redirects by default.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000103" disa="1118" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000105" disa="1117" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000105" disa="1117" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000106" disa="1098" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000106" disa="1098" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000107" disa="1100" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000107" disa="1100" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000108" disa="1097" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000108" disa="1097" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000109" disa="1414" severity="medium">
+ <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000109" disa="1414" severity="medium">
<title>The system must employ a local IPv6 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000113" disa="1118" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000113" disa="1118" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000115" disa="1117" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000115" disa="1117" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000116" disa="1098" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000116" disa="1098" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000117" disa="1100" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000117" disa="1100" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000118" disa="1097" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000118" disa="1097" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000119" disa="1414" severity="medium">
+ <overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000119" disa="1414" severity="medium">
<title>The system must employ a local IPv4 firewall.</title>
</overlay>
<overlay owner="disastig" ruleid="set_iptables_default_rule" ownerid="RHEL-06-000120" disa="66" severity="medium">
@@ -312,31 +312,31 @@
<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000138" disa="366" severity="low">
<title>System logs must be rotated daily.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000139" disa="347" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000139" disa="347" severity="medium">
<title>Auditing must be implemented.</title>
</overlay>
<overlay owner="disastig" ruleid="met_inherently_auditing" ownerid="RHEL-06-000140" disa="157" severity="medium">
<title>The operating system audit records must be able to be used by a report generation capability.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000142" disa="880" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000142" disa="880" severity="medium">
<title>The operating system must audit nonlocal maintenance and diagnostic sessions.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000143" disa="1353" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000143" disa="1353" severity="medium">
<title>The operating system must produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. </title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000145" disa="1487" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000145" disa="1487" severity="medium">
<title>The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000148" disa="67" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000148" disa="67" severity="medium">
<title>The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000149" disa="158" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000149" disa="158" severity="medium">
<title>The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria. </title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000151" disa="1190" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000151" disa="1190" severity="medium">
<title>The operating system must fail to an organization defined known state for organization defined types of failures. </title>
</overlay>
- <overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000154" disa="130" severity="medium">
+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000154" disa="130" severity="medium">
<title>The operating system must produce audit records containing sufficient information to establish what type of events occurred.</title>
</overlay>
<overlay owner="disastig" ruleid="enable_auditd_bootloader" ownerid="RHEL-06-000157" disa="1464" severity="low">
@@ -480,7 +480,7 @@
<overlay owner="disastig" ruleid="disable_tftp" ownerid="RHEL-06-000223" disa="1436" severity="medium">
<title>The TFTP service must not be running.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_cron" ownerid="RHEL-06-000224" disa="366" severity="medium">
+ <overlay owner="disastig" ruleid="service_crond_enabled" ownerid="RHEL-06-000224" disa="366" severity="medium">
<title>The cron service must be running.</title>
</overlay>
<overlay owner="disastig" ruleid="sshd_allow_only_protocol2" ownerid="RHEL-06-000227" disa="774" severity="high">
@@ -525,7 +525,7 @@
<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000246" disa="366" severity="low">
<title>The avahi service must be disabled.</title>
</overlay>
- <overlay owner="disastig" ruleid="enable_ntpd" ownerid="RHEL-06-000247" disa="160" severity="medium">
+ <overlay owner="disastig" ruleid="service_ntpd_enabled" ownerid="RHEL-06-000247" disa="160" severity="medium">
<title>The system clock must be synchronized continuously, or at least daily.</title>
</overlay>
<overlay owner="disastig" ruleid="ntpd_specify_remote_server" ownerid="RHEL-06-000248" disa="160" severity="medium">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 42e0226..4db8b9a 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -3,7 +3,7 @@
will be migrated to consensus for RHEL 6. -->
-<note ref="811" auth="GG" rule="enable_auditd_service">This is covered in RHEL 6 content</note>
+<note ref="811" auth="GG" rule="service_auditd_enabled">This is covered in RHEL 6 content</note>
<note ref="778" auth="GG" rule="restrict_root_console_logins">This is covered in RHEL 6 content</note>
diff --git a/RHEL6/input/fixes/bash/service_auditd_enabled.sh b/RHEL6/input/fixes/bash/service_auditd_enabled.sh
new file mode 100644
index 0000000..e5898e2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_auditd_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable auditd for all run levels
+#
+chkconfig --level 0123456 auditd on
+
+#
+# Stop auditd if currently running
+#
+service auditd start
diff --git a/RHEL6/input/fixes/bash/service_crond_enabled.sh b/RHEL6/input/fixes/bash/service_crond_enabled.sh
new file mode 100644
index 0000000..11339e6
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_crond_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable crond for all run levels
+#
+chkconfig --level 0123456 crond on
+
+#
+# Stop crond if currently running
+#
+service crond start
diff --git a/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh b/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
new file mode 100644
index 0000000..31fbc97
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable ip6tables for all run levels
+#
+chkconfig --level 0123456 ip6tables on
+
+#
+# Stop ip6tables if currently running
+#
+service ip6tables start
diff --git a/RHEL6/input/fixes/bash/service_iptables_enabled.sh b/RHEL6/input/fixes/bash/service_iptables_enabled.sh
new file mode 100644
index 0000000..c73a0d7
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_iptables_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable iptables for all run levels
+#
+chkconfig --level 0123456 iptables on
+
+#
+# Stop iptables if currently running
+#
+service iptables start
diff --git a/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh b/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
new file mode 100644
index 0000000..6e09fdb
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable irqbalance for all run levels
+#
+chkconfig --level 0123456 irqbalance on
+
+#
+# Stop irqbalance if currently running
+#
+service irqbalance start
diff --git a/RHEL6/input/fixes/bash/service_ntpd_enabled.sh b/RHEL6/input/fixes/bash/service_ntpd_enabled.sh
new file mode 100644
index 0000000..99c7f25
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_ntpd_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable ntpd for all run levels
+#
+chkconfig --level 0123456 ntpd on
+
+#
+# Stop ntpd if currently running
+#
+service ntpd start
diff --git a/RHEL6/input/fixes/bash/service_postfix_enabled.sh b/RHEL6/input/fixes/bash/service_postfix_enabled.sh
new file mode 100644
index 0000000..7853f5e
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_postfix_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable postfix for all run levels
+#
+chkconfig --level 0123456 postfix on
+
+#
+# Stop postfix if currently running
+#
+service postfix start
diff --git a/RHEL6/input/fixes/bash/service_psacct_enabled.sh b/RHEL6/input/fixes/bash/service_psacct_enabled.sh
new file mode 100644
index 0000000..f05a5a4
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_psacct_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable psacct for all run levels
+#
+chkconfig --level 0123456 psacct on
+
+#
+# Stop psacct if currently running
+#
+service psacct start
diff --git a/RHEL6/input/fixes/bash/service_restorecond_enabled.sh b/RHEL6/input/fixes/bash/service_restorecond_enabled.sh
new file mode 100644
index 0000000..ced1368
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_restorecond_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable restorecond for all run levels
+#
+chkconfig --level 0123456 restorecond on
+
+#
+# Stop restorecond if currently running
+#
+service restorecond start
diff --git a/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh b/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh
new file mode 100644
index 0000000..f293c27
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable rsyslog for all run levels
+#
+chkconfig --level 0123456 rsyslog on
+
+#
+# Stop rsyslog if currently running
+#
+service rsyslog start
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 64145d8..a8d7385 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -91,8 +91,8 @@
<select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
<select idref="disable_ipv6_module_loading" selected="true"/>
<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true"/>
-<select idref="enable_ip6tables" selected="true"/>
-<select idref="enable_iptables" selected="true"/>
+<select idref="service_ip6tables_enabled" selected="true"/>
+<select idref="service_iptables_enabled" selected="true"/>
<select idref="set_iptables_default_rule" selected="true"/>
<select idref="disable_protocol_dccp" selected="true"/>
<select idref="disable_protocol_sctp" selected="true"/>
@@ -106,7 +106,7 @@
<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver" selected="true"/>
<select idref="ensure_logrotate_activated" selected="true"/>
-<select idref="enable_auditd_service" selected="true"/>
+<select idref="service_auditd_enabled" selected="true"/>
<select idref="enable_auditd_bootloader" selected="true"/>
<select idref="configure_auditd_num_logs" selected="true"/>
@@ -160,7 +160,7 @@
<select idref="disable_ypbind" selected="true"/>
<select idref="uninstall_tftp-server" selected="true"/>
<select idref="disable_tftp" selected="true"/>
-<select idref="enable_cron" selected="true"/>
+<select idref="service_crond_enabled" selected="true"/>
<select idref="sshd_allow_only_protocol2" selected="true"/>
<select idref="sshd_set_idle_timeout" selected="true"/>
<select idref="sshd_set_keepalive" selected="true"/>
@@ -175,7 +175,7 @@
<select idref="disable_avahi" selected="true"/>
<!-- <select idref="disable_dhcp_server" selected="true"/> -->
<!-- <select idref="uninstall_dhcp_server" selected="true"/> -->
-<select idref="enable_ntpd" selected="true"/>
+<select idref="service_ntpd_enabled" selected="true"/>
<select idref="ntpd_specify_remote_server" selected="true"/>
<select idref="postfix_network_listening" selected="true"/>
<select idref="ldap_client_start_tls" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index a488c16..1440301 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -32,8 +32,8 @@
<select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true" />
<select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
<select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
-<select idref="enable_ip6tables" selected="true" />
-<select idref="enable_iptables" selected="true" />
+<select idref="service_ip6tables_enabled" selected="true" />
+<select idref="service_iptables_enabled" selected="true" />
<!-- AC-6 -->
<refine-value idref="var_umask_for_daemons" selector="022"/>
@@ -103,7 +103,7 @@
<select idref="package_screen_installed" selected="true" />
<!-- AC-17(1) -->
-<select idref="enable_auditd_service" selected="true" />
+<select idref="service_auditd_enabled" selected="true" />
<select idref="enable_auditd_bootloader" selected="true" />
<!-- AC-17(7) -->
@@ -203,7 +203,7 @@
<select idref="partition_for_var_log_audit" selected="true" />
<!-- AU-8 -->
-<select idref="enable_ntpd" selected="true" />
+<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="ntpd_specify_multiple_servers" selected="true" />
@@ -234,7 +234,7 @@
<select idref="service_rhsmcertd_disabled" selected="true" />
<select idref="service_smartd_disabled" selected="true" />
<select idref="service_sysstat_disabled" selected="true" />
-<select idref="enable_cron" selected="true" />
+<select idref="service_crond_enabled" selected="true" />
<select idref="disable_anacron" selected="true" />
<select idref="service_atd_disabled" selected="true" />
<select idref="disable_avahi" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 1188c4a..2744fc5 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -124,8 +124,8 @@ assurance."</description>
<select idref="set_sysctl_net_ipv4_conf_default_secure_redirects" selected="true" \>
<select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true" \>
<select idref"set_sysctl_net_ipv4_conf_default_rp_filter" selected="true" \>
-<select idref="enable_ip6tables" selected="true" \>
-<select idref="enable_iptables" selected="true" \>
+<select idref="service_ip6tables_enabled" selected="true" \>
+<select idref="service_iptables_enabled" selected="true" \>
<!-- AC-6 -->
<select idref="audit_config_immutable" selected="true" \>
@@ -186,7 +186,7 @@ assurance."</description>
<select idref="set_blank_screensaver" selected="true" \>
<!-- AC-17(1) -->
-<select idref="enable_auditd_service" selected="true" \>
+<select idref="service_auditd_enabled" selected="true" \>
<select idref="enable_auditd_bootloader" selected="true" \>
<!-- AC-17(7) -->
@@ -279,7 +279,7 @@ assurance."</description>
<select idref="rsyslog_send_messages_to_logserver" selected="true" \>
<!-- AU-8(1) -->
-<select idref="enable_ntpd" selected="true" \>
+<select idref="service_ntpd_enabled" selected="true" \>
<select idref="ntpd_specify_remote_server" selected="true" \>
<select idref="ntpd_specify_multiple_servers" selected="true" \>
@@ -341,7 +341,7 @@ assurance."</description>
<select idref="uninstall_dhcp_server" selected="true" \>
<select idref="disable_dhcp_client" selected="true" \>
<select idref="disable_avahi" selected="true" \>
-<select idref="enable_cron" selected="true" \>
+<select idref="service_crond_enabled" selected="true" \>
<select idref="disable_anacron" selected="true" \>
<select idref="disable_dns_server" selected="true" \>
<select idref="uninstall_bind" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 460143a..ac65f41 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -14,7 +14,7 @@
<select idref="disable_ctrlaltdel_reboot" selected="true"/>
-<select idref="service_postfix_enable" selected="true"/>
+<select idref="service_postfix_enabled" selected="true"/>
<select idref="package_sendmail_removed" selected="true"/>
<select idref="service_netconsole_disabled" selected="true"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 9790fe5..595cf62 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -152,8 +152,8 @@
<refine-value idref="sysctl_net_ipv6_conf_default_accept_ra_value" selector="disabled" />
<select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true" />
-<select idref="enable_ip6tables" selected="true" />
-<select idref="enable_iptables" selected="true" />
+<select idref="service_ip6tables_enabled" selected="true" />
+<select idref="service_iptables_enabled" selected="true" />
<select idref="set_iptables_default_rule" selected="true" />
<select idref="set_iptables_default_rule_forward" selected="true" />
<select idref="disable_protocol_dccp" selected="true" />
@@ -168,7 +168,7 @@
<select idref="rsyslog_send_messages_to_logserver" selected="true" />
<select idref="rsyslog_accept_remote_messages_none" selected="true" />
<select idref="ensure_logrotate_activated" selected="true" />
-<select idref="enable_auditd_service" selected="true" />
+<select idref="service_auditd_enabled" selected="true" />
<select idref="enable_auditd_bootloader" selected="true" />
<select idref="audit_rules_time_adjtimex" selected="true" />
<select idref="audit_rules_time_settimeofday" selected="true" />
@@ -213,7 +213,7 @@
<select idref="kernel_module_bluetooth_disabled" selected="true" />
<select idref="service_kdump_disabled" selected="true" />
<select idref="network_disable_zeroconf" selected="true" />
-<select idref="enable_cron" selected="true" />
+<select idref="service_crond_enabled" selected="true" />
<select idref="disable_anacron" selected="true" />
<!-- PLACEHOLDER: cron file perms go here when ready -->
<select idref="sshd_allow_only_protocol2" selected="true" />
@@ -231,7 +231,7 @@
<select idref="disable_avahi" selected="true" />
<select idref="disable_dhcp_server" selected="true" />
<select idref="uninstall_dhcp_server" selected="true" />
-<select idref="enable_ntpd" selected="true" />
+<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="package_sendmail_removed" selected="true" />
<!-- postfix package installed goes here -->
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index c6e4e75..1f50d93 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -6,7 +6,7 @@ all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</description>
-<Rule id="enable_cron" severity="medium">
+<Rule id="service_crond_enabled" severity="medium">
<title>Enable cron Service</title>
<description>The <tt>crond</tt> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index b2ad09a..5f8ee57 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -23,7 +23,7 @@ SELinux as its modular design has resulted in separate processes performing spec
More information is available on its website, http://www.postfix.org.
</description>
-<Rule id="service_postfix_enable">
+<Rule id="service_postfix_enabled">
<title>Enable Postfix Service</title>
<description>The Postfix mail transfer agent is used for local mail delivery
within the system. The default configuration only listens for connections to
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index eb5de54..3a8aba2 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -32,7 +32,7 @@ including configuration of cryptographic authentication for
time data, is available at http://www.ntp.org.
</description>
-<Rule id="enable_ntpd" severity="medium">
+<Rule id="service_ntpd_enabled" severity="medium">
<title>Enable the NTP Daemon</title>
<description>
<service-enable-macro service="ntpd" />
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 1c907bd..85704b7 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -79,7 +79,7 @@ the process, which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
</li></ul>
</description>
-<Rule id="enable_auditd_service" severity="medium">
+<Rule id="service_auditd_enabled" severity="medium">
<title>Enable auditd Service</title>
<description>The <tt>auditd</tt> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index ff6fcd2..bf31193 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -48,7 +48,7 @@ num target prot opt source destination</pre>
The <tt>ip6tables</tt> default rules are essentially the same.</description>
-<Rule id="enable_ip6tables" severity="medium">
+<Rule id="service_ip6tables_enabled" severity="medium">
<title>Verify ip6tables Enabled if Using IPv6</title>
<description>
<service-enable-macro service="ip6tables" />
@@ -90,7 +90,7 @@ accepted.</rationale>
<ref nist="CM-7" disa="66,1109,1154,1414" />
</Rule>
-<Rule id="enable_iptables" severity="medium">
+<Rule id="service_iptables_enabled" severity="medium">
<title>Verify iptables Enabled</title>
<description>
<service-enable-macro service="iptables" />
--
1.7.1
More information about the scap-security-guide
mailing list