[PATCH 2/2] Added remediation from create_services_enabled template

Shawn Wells shawn.d.wells at gmail.com
Sun Jul 7 08:39:31 UTC 2013


-------------- next part --------------
>From ee3b5e345747f56243e3b0dfebf1adef50de60eb Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 04:30:48 -0400
Subject: [PATCH 2/2] Added remediation from create_services_enabled template

- Added bash scripts to mainline RHEL6/input/fixes/bash directory
- Updated XCCDF naming to create consistency between XCCDF->OVAL->remediation
- Updated various XCCDF profiles, incl STIG overlay and transition notes
---
 RHEL6/input/auxiliary/stig_overlay.xml             |   44 ++++++++++----------
 RHEL6/input/auxiliary/transition_notes.xml         |    2 +-
 RHEL6/input/fixes/bash/service_auditd_enabled.sh   |    9 ++++
 RHEL6/input/fixes/bash/service_crond_enabled.sh    |    9 ++++
 .../input/fixes/bash/service_ip6tables_enabled.sh  |    9 ++++
 RHEL6/input/fixes/bash/service_iptables_enabled.sh |    9 ++++
 .../input/fixes/bash/service_irqbalance_enabled.sh |    9 ++++
 RHEL6/input/fixes/bash/service_ntpd_enabled.sh     |    9 ++++
 RHEL6/input/fixes/bash/service_postfix_enabled.sh  |    9 ++++
 RHEL6/input/fixes/bash/service_psacct_enabled.sh   |    9 ++++
 .../fixes/bash/service_restorecond_enabled.sh      |    9 ++++
 RHEL6/input/fixes/bash/service_rsyslog_enabled.sh  |    9 ++++
 RHEL6/input/profiles/common.xml                    |   10 ++--
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |   10 ++--
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |   10 ++--
 RHEL6/input/profiles/stig-rhel6-server.xml         |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |   10 ++--
 RHEL6/input/services/cron.xml                      |    2 +-
 RHEL6/input/services/mail.xml                      |    2 +-
 RHEL6/input/services/ntp.xml                       |    2 +-
 RHEL6/input/system/auditing.xml                    |    2 +-
 RHEL6/input/system/network/iptables.xml            |    4 +-
 22 files changed, 140 insertions(+), 50 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/service_auditd_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_crond_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_iptables_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_ntpd_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_postfix_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_psacct_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_restorecond_enabled.sh
 create mode 100644 RHEL6/input/fixes/bash/service_rsyslog_enabled.sh

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 2c553bd..3dd40c8 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -237,40 +237,40 @@
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000099" disa="366" severity="medium">
 		<title>The system must ignore ICMPv6 redirects by default.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000103" disa="1118" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000105" disa="1117" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000105" disa="1117" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000106" disa="1098" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000106" disa="1098" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000107" disa="1100" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000107" disa="1100" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000108" disa="1097" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000108" disa="1097" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ip6tables" ownerid="RHEL-06-000109" disa="1414" severity="medium">
+	<overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000109" disa="1414" severity="medium">
 		<title>The system must employ a local IPv6 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000113" disa="1118" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000113" disa="1118" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000115" disa="1117" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000115" disa="1117" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000116" disa="1098" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000116" disa="1098" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000117" disa="1100" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000117" disa="1100" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000118" disa="1097" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000118" disa="1097" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_iptables" ownerid="RHEL-06-000119" disa="1414" severity="medium">
+	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="RHEL-06-000119" disa="1414" severity="medium">
 		<title>The system must employ a local IPv4 firewall.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="set_iptables_default_rule" ownerid="RHEL-06-000120" disa="66" severity="medium">
@@ -312,31 +312,31 @@
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000138" disa="366" severity="low">
 		<title>System logs must be rotated daily.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000139" disa="347" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000139" disa="347" severity="medium">
 		<title>Auditing must be implemented.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="met_inherently_auditing" ownerid="RHEL-06-000140" disa="157" severity="medium">
 		<title>The operating system audit records must be able to be used by a report generation capability.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000142" disa="880" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000142" disa="880" severity="medium">
 		<title>The operating system must audit nonlocal maintenance and diagnostic sessions.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000143" disa="1353" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000143" disa="1353" severity="medium">
 		<title>The operating system must produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. </title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000145" disa="1487" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000145" disa="1487" severity="medium">
 		<title>The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000148" disa="67" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000148" disa="67" severity="medium">
 		<title>The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000149" disa="158" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000149" disa="158" severity="medium">
 		<title>The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria. </title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000151" disa="1190" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000151" disa="1190" severity="medium">
 		<title>The operating system must fail to an organization defined known state for organization defined types of failures. </title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_auditd_service" ownerid="RHEL-06-000154" disa="130" severity="medium">
+	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="RHEL-06-000154" disa="130" severity="medium">
 		<title>The operating system must produce audit records containing sufficient information to establish what type of events occurred.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="enable_auditd_bootloader" ownerid="RHEL-06-000157" disa="1464" severity="low">
@@ -480,7 +480,7 @@
 	<overlay owner="disastig" ruleid="disable_tftp" ownerid="RHEL-06-000223" disa="1436" severity="medium">
 		<title>The TFTP service must not be running.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_cron" ownerid="RHEL-06-000224" disa="366" severity="medium">
+	<overlay owner="disastig" ruleid="service_crond_enabled" ownerid="RHEL-06-000224" disa="366" severity="medium">
 		<title>The cron service must be running.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="sshd_allow_only_protocol2" ownerid="RHEL-06-000227" disa="774" severity="high">
@@ -525,7 +525,7 @@
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000246" disa="366" severity="low">
 		<title>The avahi service must be disabled.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_ntpd" ownerid="RHEL-06-000247" disa="160" severity="medium">
+	<overlay owner="disastig" ruleid="service_ntpd_enabled" ownerid="RHEL-06-000247" disa="160" severity="medium">
 		<title>The system clock must be synchronized continuously, or at least daily.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="ntpd_specify_remote_server" ownerid="RHEL-06-000248" disa="160" severity="medium">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 42e0226..4db8b9a 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -3,7 +3,7 @@
      will be migrated to consensus for RHEL 6. -->
 
 
-<note ref="811" auth="GG" rule="enable_auditd_service">This is covered in RHEL 6 content</note>
+<note ref="811" auth="GG" rule="service_auditd_enabled">This is covered in RHEL 6 content</note>
 
 <note ref="778" auth="GG" rule="restrict_root_console_logins">This is covered in RHEL 6 content</note>
 
diff --git a/RHEL6/input/fixes/bash/service_auditd_enabled.sh b/RHEL6/input/fixes/bash/service_auditd_enabled.sh
new file mode 100644
index 0000000..e5898e2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_auditd_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable auditd for all run levels
+#
+chkconfig --level 0123456 auditd on
+
+#
+# Stop auditd if currently running
+#
+service auditd start
diff --git a/RHEL6/input/fixes/bash/service_crond_enabled.sh b/RHEL6/input/fixes/bash/service_crond_enabled.sh
new file mode 100644
index 0000000..11339e6
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_crond_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable crond for all run levels
+#
+chkconfig --level 0123456 crond on
+
+#
+# Stop crond if currently running
+#
+service crond start
diff --git a/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh b/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
new file mode 100644
index 0000000..31fbc97
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_ip6tables_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable ip6tables for all run levels
+#
+chkconfig --level 0123456 ip6tables on
+
+#
+# Stop ip6tables if currently running
+#
+service ip6tables start
diff --git a/RHEL6/input/fixes/bash/service_iptables_enabled.sh b/RHEL6/input/fixes/bash/service_iptables_enabled.sh
new file mode 100644
index 0000000..c73a0d7
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_iptables_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable iptables for all run levels
+#
+chkconfig --level 0123456 iptables on
+
+#
+# Stop iptables if currently running
+#
+service iptables start
diff --git a/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh b/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
new file mode 100644
index 0000000..6e09fdb
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_irqbalance_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable irqbalance for all run levels
+#
+chkconfig --level 0123456 irqbalance on
+
+#
+# Stop irqbalance if currently running
+#
+service irqbalance start
diff --git a/RHEL6/input/fixes/bash/service_ntpd_enabled.sh b/RHEL6/input/fixes/bash/service_ntpd_enabled.sh
new file mode 100644
index 0000000..99c7f25
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_ntpd_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable ntpd for all run levels
+#
+chkconfig --level 0123456 ntpd on
+
+#
+# Stop ntpd if currently running
+#
+service ntpd start
diff --git a/RHEL6/input/fixes/bash/service_postfix_enabled.sh b/RHEL6/input/fixes/bash/service_postfix_enabled.sh
new file mode 100644
index 0000000..7853f5e
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_postfix_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable postfix for all run levels
+#
+chkconfig --level 0123456 postfix on
+
+#
+# Stop postfix if currently running
+#
+service postfix start
diff --git a/RHEL6/input/fixes/bash/service_psacct_enabled.sh b/RHEL6/input/fixes/bash/service_psacct_enabled.sh
new file mode 100644
index 0000000..f05a5a4
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_psacct_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable psacct for all run levels
+#
+chkconfig --level 0123456 psacct on
+
+#
+# Stop psacct if currently running
+#
+service psacct start
diff --git a/RHEL6/input/fixes/bash/service_restorecond_enabled.sh b/RHEL6/input/fixes/bash/service_restorecond_enabled.sh
new file mode 100644
index 0000000..ced1368
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_restorecond_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable restorecond for all run levels
+#
+chkconfig --level 0123456 restorecond on
+
+#
+# Stop restorecond if currently running
+#
+service restorecond start
diff --git a/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh b/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh
new file mode 100644
index 0000000..f293c27
--- /dev/null
+++ b/RHEL6/input/fixes/bash/service_rsyslog_enabled.sh
@@ -0,0 +1,9 @@
+#
+# Enable rsyslog for all run levels
+#
+chkconfig --level 0123456 rsyslog on
+
+#
+# Stop rsyslog if currently running
+#
+service rsyslog start
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 64145d8..a8d7385 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -91,8 +91,8 @@
 <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
 <select idref="disable_ipv6_module_loading" selected="true"/>
 <select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true"/>
-<select idref="enable_ip6tables" selected="true"/>
-<select idref="enable_iptables" selected="true"/>
+<select idref="service_ip6tables_enabled" selected="true"/>
+<select idref="service_iptables_enabled" selected="true"/>
 <select idref="set_iptables_default_rule" selected="true"/>
 <select idref="disable_protocol_dccp" selected="true"/>
 <select idref="disable_protocol_sctp" selected="true"/>
@@ -106,7 +106,7 @@
 <select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
 <select idref="ensure_logrotate_activated" selected="true"/>
-<select idref="enable_auditd_service" selected="true"/>
+<select idref="service_auditd_enabled" selected="true"/>
 <select idref="enable_auditd_bootloader" selected="true"/>
 
 <select idref="configure_auditd_num_logs" selected="true"/>
@@ -160,7 +160,7 @@
 <select idref="disable_ypbind" selected="true"/>
 <select idref="uninstall_tftp-server" selected="true"/>
 <select idref="disable_tftp" selected="true"/>
-<select idref="enable_cron" selected="true"/>
+<select idref="service_crond_enabled" selected="true"/>
 <select idref="sshd_allow_only_protocol2" selected="true"/>
 <select idref="sshd_set_idle_timeout" selected="true"/>
 <select idref="sshd_set_keepalive" selected="true"/>
@@ -175,7 +175,7 @@
 <select idref="disable_avahi" selected="true"/>
 <!-- <select idref="disable_dhcp_server" selected="true"/> -->
 <!-- <select idref="uninstall_dhcp_server" selected="true"/> -->
-<select idref="enable_ntpd" selected="true"/>
+<select idref="service_ntpd_enabled" selected="true"/>
 <select idref="ntpd_specify_remote_server" selected="true"/>
 <select idref="postfix_network_listening" selected="true"/>
 <select idref="ldap_client_start_tls" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index a488c16..1440301 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -32,8 +32,8 @@
 <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true" />
 <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
 <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
-<select idref="enable_ip6tables" selected="true" />
-<select idref="enable_iptables" selected="true" />
+<select idref="service_ip6tables_enabled" selected="true" />
+<select idref="service_iptables_enabled" selected="true" />
 
 <!--	AC-6 -->
 <refine-value idref="var_umask_for_daemons" selector="022"/>
@@ -103,7 +103,7 @@
 <select idref="package_screen_installed" selected="true" />
 
 <!--	AC-17(1) -->
-<select idref="enable_auditd_service" selected="true" />
+<select idref="service_auditd_enabled" selected="true" />
 <select idref="enable_auditd_bootloader" selected="true" />
 
 <!--	AC-17(7) -->
@@ -203,7 +203,7 @@
 <select idref="partition_for_var_log_audit" selected="true" />
 
 <!--	AU-8 -->
-<select idref="enable_ntpd" selected="true" />
+<select idref="service_ntpd_enabled" selected="true" />
 <select idref="ntpd_specify_remote_server" selected="true" />
 <select idref="ntpd_specify_multiple_servers" selected="true" />
 
@@ -234,7 +234,7 @@
 <select idref="service_rhsmcertd_disabled" selected="true" />
 <select idref="service_smartd_disabled" selected="true" />
 <select idref="service_sysstat_disabled" selected="true" />
-<select idref="enable_cron" selected="true" />
+<select idref="service_crond_enabled" selected="true" />
 <select idref="disable_anacron" selected="true" />
 <select idref="service_atd_disabled" selected="true" />
 <select idref="disable_avahi" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 1188c4a..2744fc5 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -124,8 +124,8 @@ assurance."</description>
 <select idref="set_sysctl_net_ipv4_conf_default_secure_redirects" selected="true" \>
 <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true" \>
 <select idref"set_sysctl_net_ipv4_conf_default_rp_filter" selected="true" \>
-<select idref="enable_ip6tables" selected="true" \>
-<select idref="enable_iptables" selected="true" \>
+<select idref="service_ip6tables_enabled" selected="true" \>
+<select idref="service_iptables_enabled" selected="true" \>
 
 <!-- AC-6 -->
 <select idref="audit_config_immutable" selected="true" \>
@@ -186,7 +186,7 @@ assurance."</description>
 <select idref="set_blank_screensaver" selected="true" \>
 
 <!-- AC-17(1) -->
-<select idref="enable_auditd_service" selected="true" \>
+<select idref="service_auditd_enabled" selected="true" \>
 <select idref="enable_auditd_bootloader" selected="true" \>
 
 <!--  AC-17(7) -->
@@ -279,7 +279,7 @@ assurance."</description>
 <select idref="rsyslog_send_messages_to_logserver" selected="true" \>
 
 <!-- AU-8(1) -->
-<select idref="enable_ntpd" selected="true" \>
+<select idref="service_ntpd_enabled" selected="true" \>
 <select idref="ntpd_specify_remote_server" selected="true" \>
 <select idref="ntpd_specify_multiple_servers" selected="true" \>
 
@@ -341,7 +341,7 @@ assurance."</description>
 <select idref="uninstall_dhcp_server" selected="true" \>
 <select idref="disable_dhcp_client" selected="true" \>
 <select idref="disable_avahi" selected="true" \>
-<select idref="enable_cron" selected="true" \>
+<select idref="service_crond_enabled" selected="true" \>
 <select idref="disable_anacron" selected="true" \>
 <select idref="disable_dns_server" selected="true" \>
 <select idref="uninstall_bind" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 460143a..ac65f41 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -14,7 +14,7 @@
 
 <select idref="disable_ctrlaltdel_reboot" selected="true"/>
 
-<select idref="service_postfix_enable" selected="true"/>
+<select idref="service_postfix_enabled" selected="true"/>
 <select idref="package_sendmail_removed" selected="true"/>
 
 <select idref="service_netconsole_disabled" selected="true"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 9790fe5..595cf62 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -152,8 +152,8 @@
 <refine-value idref="sysctl_net_ipv6_conf_default_accept_ra_value" selector="disabled" />
 <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
 <select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true" />
-<select idref="enable_ip6tables" selected="true" />
-<select idref="enable_iptables" selected="true" />
+<select idref="service_ip6tables_enabled" selected="true" />
+<select idref="service_iptables_enabled" selected="true" />
 <select idref="set_iptables_default_rule" selected="true" />
 <select idref="set_iptables_default_rule_forward" selected="true" />
 <select idref="disable_protocol_dccp" selected="true" />
@@ -168,7 +168,7 @@
 <select idref="rsyslog_send_messages_to_logserver" selected="true" />
 <select idref="rsyslog_accept_remote_messages_none" selected="true" />
 <select idref="ensure_logrotate_activated" selected="true" />
-<select idref="enable_auditd_service" selected="true" />
+<select idref="service_auditd_enabled" selected="true" />
 <select idref="enable_auditd_bootloader" selected="true" />
 <select idref="audit_rules_time_adjtimex" selected="true" />
 <select idref="audit_rules_time_settimeofday" selected="true" />
@@ -213,7 +213,7 @@
 <select idref="kernel_module_bluetooth_disabled" selected="true" />
 <select idref="service_kdump_disabled" selected="true" />
 <select idref="network_disable_zeroconf" selected="true" />
-<select idref="enable_cron" selected="true" />
+<select idref="service_crond_enabled" selected="true" />
 <select idref="disable_anacron" selected="true" />
 <!-- PLACEHOLDER: cron file perms go here when ready -->
 <select idref="sshd_allow_only_protocol2" selected="true" />
@@ -231,7 +231,7 @@
 <select idref="disable_avahi" selected="true" />
 <select idref="disable_dhcp_server" selected="true" />
 <select idref="uninstall_dhcp_server" selected="true" />
-<select idref="enable_ntpd" selected="true" />
+<select idref="service_ntpd_enabled" selected="true" />
 <select idref="ntpd_specify_remote_server" selected="true" />
 <select idref="package_sendmail_removed" selected="true" />
 <!-- postfix package installed goes here -->
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index c6e4e75..1f50d93 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -6,7 +6,7 @@ all systems to perform necessary maintenance tasks, while at may or
 may not be required on a given system. Both daemons should be
 configured defensively.</description>
 
-<Rule id="enable_cron" severity="medium">
+<Rule id="service_crond_enabled" severity="medium">
 <title>Enable cron Service</title>
 <description>The <tt>crond</tt> service is used to execute commands at
 preconfigured times. It is required by almost all systems to perform necessary
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index b2ad09a..5f8ee57 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -23,7 +23,7 @@ SELinux as its modular design has resulted in separate processes performing spec
 More information is available on its website, http://www.postfix.org.
 </description>
 
-<Rule id="service_postfix_enable">
+<Rule id="service_postfix_enabled">
 <title>Enable Postfix Service</title>
 <description>The Postfix mail transfer agent is used for local mail delivery
 within the system. The default configuration only listens for connections to
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
index eb5de54..3a8aba2 100644
--- a/RHEL6/input/services/ntp.xml
+++ b/RHEL6/input/services/ntp.xml
@@ -32,7 +32,7 @@ including configuration of cryptographic authentication for
 time data, is available at http://www.ntp.org.
 </description>
 
-<Rule id="enable_ntpd" severity="medium">
+<Rule id="service_ntpd_enabled" severity="medium">
 <title>Enable the NTP Daemon</title>
 <description>
 <service-enable-macro service="ntpd" />
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 1c907bd..85704b7 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -79,7 +79,7 @@ the process, which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
 </li></ul>
 </description>
 
-<Rule id="enable_auditd_service" severity="medium">
+<Rule id="service_auditd_enabled" severity="medium">
 <title>Enable auditd Service</title>
 <description>The <tt>auditd</tt> service is an essential userspace component of
 the Linux Auditing System, as it is responsible for writing audit records to
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index ff6fcd2..bf31193 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -48,7 +48,7 @@ num  target     prot opt source       destination</pre>
 The <tt>ip6tables</tt> default rules are essentially the same.</description>
 
 
-<Rule id="enable_ip6tables" severity="medium">
+<Rule id="service_ip6tables_enabled" severity="medium">
 <title>Verify ip6tables Enabled if Using IPv6</title>
 <description>
 <service-enable-macro service="ip6tables" />
@@ -90,7 +90,7 @@ accepted.</rationale>
 <ref nist="CM-7" disa="66,1109,1154,1414" />
 </Rule>
 
-<Rule id="enable_iptables" severity="medium">
+<Rule id="service_iptables_enabled" severity="medium">
 <title>Verify iptables Enabled</title>
 <description>
 <service-enable-macro service="iptables" />
-- 
1.7.1



More information about the scap-security-guide mailing list