[PATCH 1/3] removed alt-titles-stig file, which is superseded by the stig-overlay file

Jeffrey Blank scapafterhours at gmail.com
Thu May 2 03:49:57 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/alt-titles-stig.xml |  758 -----------------------------
 1 files changed, 0 insertions(+), 758 deletions(-)
 delete mode 100644 RHEL6/input/auxiliary/alt-titles-stig.xml

diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
deleted file mode 100644
index 6f4a59a..0000000
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ /dev/null
@@ -1,758 +0,0 @@
-<?xml version="1.0"?>
-<titles xmlns="http://checklists.nist.gov/xccdf/1.1" id="stig">
-<!-- This file can be used to specify alternative titles.
-     The rule attribute is used to identify the Rule with which to associate the title.
-     The shorttitle attribute is provided as an aide to data entry. 
-     The xccdf-alt-titles.xslt transform can be used to synchronize the rule and
-     shorttitle attributes with a particular XCCDF profile automatically. -->
-<title rule="partition_for_tmp" shorttitle="Ensure /tmp Located On Separate Partition">
-The system must use a separate file system for /tmp.
-</title>
-<title rule="partition_for_var" shorttitle="Ensure /var Located On Separate Partition">
-The system must use a separate file system for /var.
-</title>
-<title rule="partition_for_var_log" shorttitle="Ensure /var/log Located On Separate Partition">
-The system must use a separate file system for /var/log.
-</title>
-<title rule="partition_for_var_log_audit" shorttitle="Ensure /var/log/audit Located On Separate Partition">
-The system must use a separate file system for the system audit data path.
-</title>
-<title rule="partition_for_home" shorttitle="Ensure /home Located On Separate Partition">
-The system must use a separate file system for user home directories.
-</title>
-<title rule="ensure_redhat_gpgkey_installed" shorttitle="Ensure Red Hat GPG Key Installed">
-Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.
-</title>
-<title rule="security_patches_up_to_date" shorttitle="Ensure Software Patches Installed">
-Vendor-recommended software patches and updates, and system security patches and updates, must be installed and up-to-date.
-</title>
-<title rule="ensure_gpgcheck_globally_activated" shorttitle="Ensure gpgcheck Enabled In Main Yum Configuration">
-The system package management tool must cryptographically verify the authenticity of system software packages during installation.
-</title>
-<title rule="ensure_gpgcheck_never_disabled" shorttitle="Ensure gpgcheck Enabled For All Yum Package Repositories">
-The system package management tool must cryptographically verify the authenticity of all software packages during installation.
-</title>
-<title rule="package_aide_installed" shorttitle="Install AIDE">
-A file integrity tool must be installed.
-</title>
-<title rule="aide_periodic_cron_checking" shorttitle="Configure Periodic Execution of AIDE">
-A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries.
-</title>
-<title rule="rpm_verify_hashes" shorttitle="Verify File Hashes with RPM">
-The system package management tool must verify contents of all files associated with packages.
-</title>
-<title rule="rpm_verify_permissions" shorttitle="Verify File Permissions with RPM">
-The system package management tool must verify permissions on all file and directories associated with packages.
-</title>
-<title rule="kernel_module_usb-storage_disabled" shorttitle="Disable Modprobe Loading of USB Storage Driver">
-The system must have USB Mass Storage disabled unless needed.
-</title>
-<title rule="service_autofs_disabled" shorttitle="Disable the Automounter">
-Automated file system mounting tools must not be enabled unless needed.
-</title>
-<title rule="userowner_shadow_file" shorttitle="Verify User Who Owns shadow File">
-The /etc/shadow file must be owned by root.
-</title>
-<title rule="groupowner_shadow_file" shorttitle="Verify Group Who Owns shadow File">
-The /etc/shadow file must be group-owned by root.
-</title>
-<title rule="perms_shadow_file" shorttitle="Verify Permissions on shadow File">
-The /etc/shadow file must have mode 0000.
-</title>
-<title rule="userowner_gshadow_file" shorttitle="Verify User Who Owns gshadow File">
-The /etc/gshadow file must be owned by root.
-</title>
-<title rule="groupowner_gshadow_file" shorttitle="Verify Group Who Owns gshadow File">
-The /etc/gshadow file must be group-owned by root.
-</title>
-<title rule="perms_gshadow_file" shorttitle="Verify Permissions on gshadow File">
-The /etc/gshadow file must have mode 0000.
-</title>
-<title rule="userowner_passwd_file" shorttitle="Verify User Who Owns passwd File">
-The /etc/passwd file must be owned by root.
-</title>
-<title rule="groupowner_passwd_file" shorttitle="Verify Group Who Owns passwd File">
-The /etc/passwd file must be group-owned by root.
-</title>
-<title rule="file_permissions_etc_passwd" shorttitle="Verify Permissions on passwd File">
-The /etc/passwd file must have mode 0644 or less permissive.
-</title>
-<title rule="file_permissions_library_dirs" shorttitle="Verify that Shared Library Files Have Restrictive Permissions">
-Library files must have mode 0755 or less permissive.
-</title>
-<title rule="file_ownership_library_dirs" shorttitle="Verify that Shared Library Files Have Root Ownership">
-Library files must be owned by root.
-</title>
-<title rule="file_permissions_binary_dirs" shorttitle="Verify that System Executables Have Restrictive Permissions">
-All system command files must have mode 0755 or less permissive.
-</title>
-<title rule="file_ownership_binary_dirs" shorttitle="Verify that System Executables Have Root Ownership">
-All system command files must be owned by root.
-</title>
-<title rule="sticky_world_writable_dirs" shorttitle="Verify that All World-Writable Directories Have Sticky Bits Set">
-The sticky bit must be set on all public directories.
-</title>
-<title rule="no_files_unowned_by_user" shorttitle="Ensure All Files Are Owned by a User">
-All files and directories must have a valid owner.
-</title>
-<title rule="world_writable_files_system_ownership" shorttitle="Ensure All World-Writable Directories Are Owned by a System Account">
-All public directories must be owned by a system account.
-</title>
-<title rule="disable_users_coredumps" shorttitle="Disable Core Dumps for All Users">
-Process core dumps must be disabled unless needed.
-</title>
-<title rule="enable_execshield" shorttitle="Enable ExecShield">
-The system must limit the ability of processes to have simultaneous write and execute access to memory.
-</title>
-<title rule="enable_randomize_va_space" shorttitle="Enable Randomized Layout of Virtual Address Space">
-The system must implement virtual address space randomization.
-</title>
-<title rule="enable_selinux_bootloader" shorttitle="Ensure SELinux Not Disabled in /etc/grub.conf">
-The system must use SELinux at boot time.
-</title>
-<title rule="set_selinux_state" shorttitle="Ensure SELinux State is Enforcing">
-The system must use SELinux configured to enforce limits on system services.
-</title>
-<title rule="set_selinux_policy" shorttitle="Configure SELinux Policy">
-The system must use SELinux configured to limit the privileges of system services.
-</title>
-<title rule="selinux_unlabeled_device_files" shorttitle="Ensure No Device Files are Unlabeled by SELinux">
-All device files must be monitored by SELinux.
-</title>
-<title rule="restrict_root_console_logins" shorttitle="Restrict Virtual Console Root Logins">
-The system must prevent the root account from logging in from virtual consoles.
-</title>
-<title rule="restrict_serial_port_logins" shorttitle="Restrict Serial Port Root Logins">
-The system must prevent the root account from logging in from serial consoles.
-</title>
-<title rule="no_shelllogin_for_systemaccounts" shorttitle="Ensure that System Accounts Do Not Run a Shell Upon Login">
-System accounts must not have a working shell, unless needed.
-</title>
-<title rule="no_uidzero_except_root" shorttitle="Verify Only Root Has UID 0">
-The root account must be the only account having a UID of 0.
-</title>
-<title rule="no_empty_passwords" shorttitle="Prevent Log In to Accounts With Empty Password">
-The system must not have accounts configured with blank or null passwords.
-</title>
-<title rule="no_hashes_outside_shadow" shorttitle="Verify All Account Password Hashes are Shadowed">
-The /etc/passwd file must not contain password hashes.
-</title>
-<title rule="no_netrc_files" shorttitle="Verify No netrc Files Exist">
-There must be no .netrc files on the system.
-</title>
-<title rule="password_min_len" shorttitle="Set Password Minimum Length in login.defs">
-The system must require passwords to contain a minimum of 14 characters.
-</title>
-<title rule="password_min_age" shorttitle="Set Password Minimum Age">
-Users must not be able to change passwords more than once every 24 hours.
-</title>
-<title rule="password_max_age" shorttitle="Set Password Maximum Age">
-User passwords must be changed at least every 60 days.
-</title>
-<title rule="password_warn_age" shorttitle="Set Password Warning Age">
-Users must be warned 7 days in advance of password expiration.
-</title>
-<title rule="account_disable_post_pw_expiration" shorttitle="Set Account Expiration Following Inactivity">
-Accounts must be locked upon 35 days of inactivity.
-</title>
-<title rule="no_nis_inclusions_shadow" shorttitle="Remove Legacy + Entries From /etc/shadow">
-The /etc/shadow file must not contain a plus (+) entry.
-</title>
-<title rule="no_nis_inclusions_group" shorttitle="Remove Legacy + Entries From /etc/group">
-The /etc/group file must not contain a plus (+) entry.
-</title>
-<title rule="no_nis_inclusions_passwd" shorttitle="Remove Legacy + Entries From /etc/passwd">
-The /etc/passwd file must not contain a plus (+) entry.
-</title>
-<title rule="password_retry" shorttitle="Set Password Retry Prompts Permitted Per-Session">
-The system must reject session authentication after three consecutive failed authentication attempts.
-</title>
-<title rule="password_require_digits" shorttitle="Set Password Strength Minimum Digit Characters">
-The system must require passwords to contain at least one numeric character.
-</title>
-<title rule="password_require_uppercases" shorttitle="Set Password Strength Minimum Uppercase Characters">
-The system must require passwords to contain at least one uppercase alphabetic character.
-</title>
-<title rule="password_require_specials" shorttitle="Set Password Strength Minimum Special Characters">
-The system must require passwords to contain at least one special character.
-</title>
-<title rule="password_require_lowercases" shorttitle="Set Password Strength Minimum Lowercase Characters">
-The system must require passwords to contain at least one lowercase alphabetic character.
-</title>
-<title rule="password_require_diffchars" shorttitle="Set Password Strength Minimum Different Characters">
-The system must require at least four characters be changed between the old and new passwords during a password change.
-</title>
-<title rule="deny_password_attempts" shorttitle="Set Deny For Failed Password Attempts">
-The system must disable accounts after three consecutive unsuccessful login attempts.
-</title>
-<title rule="deny_password_attempts_unlock_time" shorttitle="Set Lockout Time For Failed Password Attempts">
-The system must require administrator action to unlock an account locked by excessive failed login attempts.
-</title>
-<title rule="deny_password_attempts_fail_interval" shorttitle="Set Interval For Counting Failed Password Attempts">
-The system must disable accounts after excessive login failures within a 15-minute interval.
-</title>
-<title rule="set_password_hashing_algorithm" shorttitle="Set Password Hashing Algorithm">
-The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.
-</title>
-<title rule="limiting_password_reuse" shorttitle="Limit Password Reuse">
-The system must prohibit the reuse of passwords within twenty-four iterations.
-</title>
-<title rule="max_concurrent_login_sessions" shorttitle="Limit the Number of Concurrent Login Sessions Allowed Per User">
-The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.
-</title>
-<title rule="user_umask_bashrc" shorttitle="Ensure the Default Bash Umask is Set Correctly">
-The system default umask for the bash shell must be 077.
-</title>
-<title rule="user_umask_cshrc" shorttitle="Ensure the Default C Shell Umask is Set Correctly">
-The system default umask for the csh shell must be 077.
-</title>
-<title rule="user_umask_profile" shorttitle="Ensure the Default Umask is Set Correctly in /etc/profile">
-The system default umask in /etc/profile must be 077.
-</title>
-<title rule="user_umask_logindefs" shorttitle="Ensure the Default Umask is Set Correctly in login.defs">
-The system default umask in /etc/login.defs must be 077.
-</title>
-<title rule="user_owner_grub_conf" shorttitle="Verify /etc/grub.conf User Ownership">
-The system boot loader configuration file(s) must be owned by root.
-</title>
-<title rule="group_owner_grub_conf" shorttitle="Verify /etc/grub.conf Group Ownership">
-The system boot loader configuration file(s) must be group-owned by root.
-</title>
-<title rule="permissions_grub_conf" shorttitle="Verify /etc/grub.conf Permissions">
-The system boot loader configuration file(s) must have mode 0600 or less permissive.
-</title>
-<title rule="bootloader_password" shorttitle="Set Boot Loader Password">
-The system boot loader must require authentication.
-</title>
-<title rule="require_singleuser_auth" shorttitle="Require Authentication for Single User Mode">
-The system must require authentication upon booting into single-user and maintenance modes.
-</title>
-<title rule="disable_interactive_boot" shorttitle="Disable Interactive Boot">
-The system must not permit interactive boot.
-</title>
-<title rule="set_screensaver_inactivity_timeout" shorttitle="Set GNOME Login Inactivity Timeout">
-The graphical desktop environment must set the idle timeout to no more than 15 minutes.
-</title>
-<title rule="enable_screensaver_after_idle" shorttitle="GNOME Desktop Screensaver Mandatory Use">
-The graphical desktop environment must automatically lock after 15 minutes of inactivity and the system must require user to re-authenticate to unlock the environment.
-</title>
-<title rule="enable_screensaver_password_lock" shorttitle="Enable Screen Lock Activation After Idle Period">
-The graphical desktop environment must have automatic lock enabled.
-</title>
-<title rule="set_blank_screensaver" shorttitle="Implement Blank Screen Saver">
-The system must display a publicly-viewable pattern during a graphical desktop environment session lock.
-</title>
-<title rule="package_screen_installed" shorttitle="Install the screen Package">
-The system must allow locking of the console screen.
-</title>
-<title rule="set_system_login_banner" shorttitle="Modify the System Login Banner">
-The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.
-</title>
-<title rule="enable_gdm_login_banner" shorttitle="Enable GUI Warning Banner">
-A login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts.
-</title>
-<title rule="set_gdm_login_banner_text" shorttitle="Set GUI Warning Banner Text">
-The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts.
-</title>
-<title rule="disable_sysctl_ipv4_default_send_redirects" shorttitle="Disable Kernel Parameter for Sending ICMP Redirects by Default">
-The system must not send ICMPv4 redirects by default.
-</title>
-<title rule="disable_sysctl_ipv4_all_send_redirects" shorttitle="Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces">
-The system must not send ICMPv4 redirects from any interface.
-</title>
-<title rule="disable_sysctl_ipv4_ip_forward" shorttitle="Disable Kernel Parameter for IP Forwarding">
-IP forwarding for IPv4 must not be enabled, unless the system is a router.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_all_accept_source_route" shorttitle="Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces">
-The system must not accept IPv4 source-routed packets on any interface.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_all_accept_redirects" shorttitle="Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces">
-The system must not accept ICMPv4 redirect packets on any interface.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_all_secure_redirects" shorttitle="Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces">
-The system must not accept ICMPv4 secure redirect packets on any interface.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_all_log_martians" shorttitle="Enable Kernel Parameter to Log Martian Packets">
-The system must log Martian packets.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_default_accept_source_route" shorttitle="Disable Kernel Parameter for Accepting Source-Routed Packets By Default">
-The system must not accept IPv4 source-routed packets by default.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_default_secure_redirects" shorttitle="Disable Kernel Parameter for Accepting Secure Redirects By Default">
-The system must not accept ICMPv4 secure redirect packets by default.
-</title>
-<title rule="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" shorttitle="Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests">
-The system must not respond to ICMPv4 sent to a broadcast address.
-</title>
-<title rule="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" shorttitle="Enable Kernel Parameter to Ignore Bogus ICMP Error Responses">
-The system must ignore ICMPv4 bogus error responses.
-</title>
-<title rule="set_sysctl_net_ipv4_tcp_syncookies" shorttitle="Enable Kernel Parameter to Use TCP Syncookies">
-The system must be configured to use TCP syncookies when experiencing a TCP SYN flood.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_all_rp_filter" shorttitle="Enable Kernel Parameter to Use Reverse Path Filtering for All Interfaces">
-The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_default_rp_filter" shorttitle="Enable Kernel Parameter to Use Reverse Path Filtering by Default">
-The system must use a reverse-path filter for IPv4 network traffic when possible by default.
-</title>
-<title rule="service_bluetooth_disabled" shorttitle="Disable Bluetooth Service">
-The Bluetooth service must be disabled.
-</title>
-<title rule="kernel_module_bluetooth_disabled" shorttitle="Disable Bluetooth Kernel Modules">
-The Bluetooth kernel module must be disabled.
-</title>
-<title rule="disable_ipv6_module_loading" shorttitle="Disable IPv6 Networking Support Automatic Loading">
-The IPv6 protocol handler must not be bound to the network stack unless needed.
-</title>
-<title rule="set_sysctl_ipv6_default_accept_redirects" shorttitle="Disable Accepting IPv6 Redirects">
-The system must ignore ICMPv6 redirects by default.
-</title>
-<title rule="enable_ip6tables" shorttitle="Verify ip6tables Enabled">
-The system must employ a local IPv6 firewall.
-</title>
-<title rule="enable_iptables" shorttitle="Verify iptables Enabled">
-The system must employ a local IPv4 firewall.
-</title>
-<title rule="set_iptables_default_rule" shorttitle="Set Default Iptables Policy for Incoming Packets">
-The system's local firewall must implement a deny-all, allow-by-exception policy for inbound packets.
-</title>
-<title rule="set_iptables_default_rule_forward" shorttitle="Set Default Iptables Policy for Forwarded Packets">
-The system's local firewall must implement a deny-all, allow-by-exception policy for forwarded packets.
-</title>
-<title rule="disable_protocol_dccp" shorttitle="Disable DCCP Support">
-The Datagram Congestion Control Protocol (DCCP) must be disabled unless required.
-</title>
-<title rule="disable_protocol_sctp" shorttitle="Disable SCTP Support">
-The Stream Control Transmission Protocol (SCTP) must be disabled unless required.
-</title>
-<title rule="disable_protocol_rds" shorttitle="Disable RDS Support">
-The Reliable Datagram Sockets (RDS) protocol must be disabled unless required.
-</title>
-<title rule="disable_protocol_tipc" shorttitle="Disable TIPC Support">
-The Transparent Inter-Process Communication (TIPC) protocol must be disabled unless required.
-</title>
-<title rule="install_openswan" shorttitle="Install openswan Package">
-The system must provide VPN connectivity for communications over untrusted networks.
-</title>
-<title rule="package_rsyslog_installed" shorttitle="Ensure rsyslog is Installed">
-The system must provide system logging services.
-</title>
-<title rule="service_rsyslog_enabled" shorttitle="Enable rsyslog Service">
-The system's system logging services must be enabled.
-</title>
-<title rule="userowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate User">
-All rsyslog-generated log files must be owned by root.
-</title>
-<title rule="groupowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate Group">
-All rsyslog-generated log files must be group-owned by root.
-</title>
-<title rule="rsyslog_file_permissions" shorttitle="Ensure System Log Files Have Correct Permissions">
-All rsyslog-generated log files must have mode 0600 or less permissive.
-</title>
-<title rule="rsyslog_send_messages_to_logserver" shorttitle="Ensure Logs Sent To Remote Host">
-The system must use a remote syslog server (loghost).
-</title>
-<title rule="ensure_logrotate_activated" shorttitle="Ensure Logrotate Runs Periodically">
-Audit logs must be rotated daily.
-</title>
-<title rule="enable_auditd_service" shorttitle="Enable auditd Service">
-Auditing must be implemented.
-</title>
-<title rule="enable_auditd_bootloader" shorttitle="Enable Auditing for Processes Which Start Prior to the Audit Daemon">
-Auditing must be enabled at boot by setting a kernel parameter.
-</title>
-<title rule="configure_auditd_num_logs" shorttitle="Configure auditd Number of Logs Retained">
-The system must retain enough rotated audit logs to cover the required log retention period.
-</title>
-<title rule="configure_auditd_max_log_file" shorttitle="Configure auditd Max Log File Size">
-The system must set a maximum audit log file size.
-</title>
-<title rule="configure_auditd_max_log_file_action" shorttitle="Configure auditd max_log_file_action Upon Reaching Maximum Log Size">
-The system must rotate audit log files that reach the maximum file size.
-</title>
-<title rule="configure_auditd_space_left_action" shorttitle="Configure auditd space_left Action on Low Disk Space">
-The audit system must alert designated staff members when the audit storage volume approaches capacity.
-</title>
-<title rule="configure_auditd_admin_space_left_action" shorttitle="Configure auditd admin_space_left Action on Low Disk Space">
-The audit system must suspent, halt, or switch the system to single-user mode when available audit storage volume becomes dangerously low.
-</title>
-<title rule="configure_auditd_action_mail_acct" shorttitle="Configure auditd mail_acct Action on Low Disk Space">
-The audit system must identify staff members to receive notifications of audit log storage volume capacity issues.
-</title>
-<title rule="audit_rules_time_adjtimex" shorttitle="Record attempts to alter time through adjtimex">
-The audit system must be configured to audit all attempts to alter system time through adjtimex.
-</title>
-<title rule="audit_rules_time_settimeofday" shorttitle="Record attempts to alter time through settimeofday">
-The audit system must be configured to audit all attempts to alter system time through settimeofday.
-</title>
-<title rule="audit_rules_time_stime" shorttitle="Record Attempts to Alter Time Through stime">
-The audit system must be configured to audit all attempts to alter system time through stime.
-</title>
-<title rule="audit_rules_time_clock_settime" shorttitle="Record Attempts to Alter Time Through clock_settime">
-The audit system must be configured to audit all attempts to alter system time through clock_settime.
-</title>
-<title rule="audit_rules_time_watch_localtime" shorttitle="Record Attempts to Alter the localtime File">
-The audit system must be configured to audit all attempts to alter system time through /etc/localtime.
-</title>
-<title rule="audit_account_changes" shorttitle="Record Events that Modify User/Group Information">
-The audit system must be configured to audit account creation and modification.
-</title>
-<title rule="audit_network_modifications" shorttitle="Record Events that Modify the System's Network Environment">
-The audit system must be configured to audit modifications to the systems network configuration.
-</title>
-<title rule="audit_mac_changes" shorttitle="Record Events that Modify the System's Mandatory Access Controls">
-The audit system must be configured to audit modifications to the system's Mandatory Access Control (MAC) configuration (SELinux).
-</title>
-<title rule="audit_rules_dac_modification_chmod" shorttitle="Record Events that Modify the System's Discretionary Access Controls - chmod">
-The audit system must be configured to audit all discretionary access control permission modifications using chmod.
-</title>
-<title rule="audit_rules_dac_modification_chown" shorttitle="Record Events that Modify the System's Discretionary Access Controls - chown">
-The audit system must be configured to audit all discretionary access control permission modifications using chown.
-</title>
-<title rule="audit_rules_dac_modification_fchmod" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fchmod">
-The audit system must be configured to audit all discretionary access control permission modifications using fchmod.
-</title>
-<title rule="audit_rules_dac_modification_fchmodat" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fchmodat">
-The audit system must be configured to audit all discretionary access control permission modifications using fchmodat.
-</title>
-<title rule="audit_rules_dac_modification_fchown" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fchown">
-The audit system must be configured to audit all discretionary access control permission modifications using fchown.
-</title>
-<title rule="audit_rules_dac_modification_fchownat" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fchownat">
-The audit system must be configured to audit all discretionary access control permission modifications using fchownat.
-</title>
-<title rule="audit_rules_dac_modification_fremovexattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fremovexattr">
-The audit system must be configured to audit all discretionary access control permission modifications using fremovexattr.
-</title>
-<title rule="audit_rules_dac_modification_fsetxattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - fsetxattr">
-The audit system must be configured to audit all discretionary access control permission modifications using fsetxattr.
-</title>
-<title rule="audit_rules_dac_modification_lchown" shorttitle="Record Events that Modify the System's Discretionary Access Controls - lchown">
-The audit system must be configured to audit all discretionary access control permission modifications using lchown.
-</title>
-<title rule="audit_rules_dac_modification_lremovexattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - lremovexattr">
-The audit system must be configured to audit all discretionary access control permission modifications using lremovexattr.
-</title>
-<title rule="audit_rules_dac_modification_lsetxattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - lsetxattr">
-The audit system must be configured to audit all discretionary access control permission modifications using lsetxattr.
-</title>
-<title rule="audit_rules_dac_modification_removexattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - removexattr">
-The audit system must be configured to audit all discretionary access control permission modifications using removexattr.
-</title>
-<title rule="audit_rules_dac_modification_setxattr" shorttitle="Record Events that Modify the System's Discretionary Access Controls - setxattr">
-The audit system must be configured to audit all discretionary access control permission modifications using setxattr.
-</title>
-<title rule="audit_file_access" shorttitle="Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)">
-The audit system must be configured to audit failed attempts to access files and programs.
-</title>
-<title rule="audit_privileged_commands" shorttitle="Ensure auditd Collects Information on the Use of Privileged Commands">
-The audit system must be configured to audit all use of setuid programs.
-</title>
-<title rule="audit_media_exports" shorttitle="Ensure auditd Collects Information on Exporting to Media (successful)">
-The audit system must be configured to audit successful file system mounts.
-</title>
-<title rule="audit_file_deletions" shorttitle="Ensure auditd Collects File Deletion Events by User">
-The audit system must be configured to audit user deletions of files and programs.
-</title>
-<title rule="audit_sysadmin_actions" shorttitle="Ensure auditd Collects System Administrator Actions">
-The audit system must be configured to audit changes to the "/etc/sudoers" file.
-</title>
-<title rule="audit_kernel_module_loading" shorttitle="Ensure auditd Collects Information on Kernel Module Loading and Unloading">
-The audit system must be configured to audit the loading and unloading of dynamic kernel modules.
-</title>
-<title rule="disable_xinetd" shorttitle="Disable xinetd Service">
-The xinetd service must be disabled if no network services utilizing it are enabled.
-</title>
-<title rule="uninstall_xinetd" shorttitle="Uninstall xinetd Package">
-The xinetd service must be uninstalled if no network services utilizing it are enabled.
-</title>
-<title rule="disable_telnet_service" shorttitle="Disable telnet Service">
-The telnet daemon must not be running.
-</title>
-<title rule="uninstall_telnet_server" shorttitle="Uninstall telnet-server Package">
-The telnet-server package must not be installed.
-</title>
-<title rule="uninstall_rsh-server" shorttitle="Uninstall rsh-server Package">
-The rsh-server package must not be installed.
-</title>
-<title rule="disable_rexec" shorttitle="Disable rexec Service">
-The rexecd service must not be running.
-</title>
-<title rule="disable_rsh" shorttitle="Disable rsh Service">
-The rshd service must not be running.
-</title>
-<title rule="disable_rlogin" shorttitle="Disable rlogin Service">
-The rlogind service must not be running.
-</title>
-<title rule="no_rsh_trust_files" shorttitle="Remove Rsh Trust Files">
-There must be no .rhosts or hosts.equiv files on the system.
-</title>
-<title rule="uninstall_ypserv" shorttitle="Uninstall ypserv Package">
-The ypserv package must not be installed.
-</title>
-<title rule="disable_ypbind" shorttitle="Disable ypbind Service">
-The ypbind service must not be running.
-</title>
-<title rule="disable_tftp" shorttitle="Disable tftp Service">
-The TFTP service must not be running.
-</title>
-<title rule="uninstall_tftp-server" shorttitle="Uninstall tftp-server Package">
-The tftp-server package must not be installed.
-</title>
-<title rule="tftpd_uses_secure_mode" shorttitle="Ensure tftp Daemon Uses Secure Mode">
-The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system.
-</title>
-<title rule="service_abrtd_disabled" shorttitle="Disable Automatic Bug Reporting Tool (abrtd)">
-The Automatic Bug Reporting Tool (abrtd) service must not be running.
-</title>
-<title rule="service_atd_disabled" shorttitle="Disable At Service (atd)">
-The atd service must be disabled.
-</title>
-<title rule="service_ntpdate_disabled" shorttitle="Disable ntpdate Service (ntpdate)">
-The ntpdate service must not be running.
-</title>
-<title rule="service_oddjobd_disabled" shorttitle="Disable Odd Job Daemon (oddjobd)">
-The oddjobd service must not be running.
-</title>
-<title rule="service_qpidd_disabled" shorttitle="Disable Apache Qpid (qpidd)">
-The qpidd service must not be running.
-</title>
-<title rule="service_rdisc_disabled" shorttitle="Disable Network Router Discovery Daemon (rdisc)">
-The rdisc service must not be running.
-</title>
-<title rule="service_rhnsd_disabled" shorttitle="Disable Red Hat Network Service (rhnsd)">
-The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite.
-</title>
-<title rule="service_sysstat_disabled" shorttitle="Disable System Statistics Reset Service (sysstat)">
-The sysstat service must not be running.
-</title>
-<title rule="enable_cron" shorttitle="Enable cron Service">
-The cron service must be running.
-</title>
-<title rule="sshd_allow_only_protocol2" shorttitle="Allow Only SSH Protocol 2">
-The SSH daemon must be configured to use only the SSHv2 protocol.
-</title>
-<title rule="sshd_set_idle_timeout" shorttitle="Set SSH Idle Timeout Interval">
-The SSH daemon must set a timeout interval on idle sessions.
-</title>
-<title rule="sshd_set_keepalive" shorttitle="Set SSH Client Alive Count">
-The SSH daemon must set a timeout count on idle sessions.
-</title>
-<title rule="sshd_disable_rhosts" shorttitle="Disable SSH Support for .rhosts Files">
-The SSH daemon must ignore .rhosts files.
-</title>
-<title rule="disable_host_auth" shorttitle="Disable Host-Based Authentication">
-The SSH daemon must not allow host-based authentication.
-</title>
-<title rule="sshd_disable_root_login" shorttitle="Disable SSH Root Login">
-The system must not permit root logins using remote access programs such as ssh.
-</title>
-<title rule="sshd_disable_empty_passwords" shorttitle="Disable SSH Access via Empty Passwords">
-The SSH daemon must not allow authentication using an empty password.
-</title>
-<title rule="sshd_enable_warning_banner" shorttitle="Enable SSH Warning Banner">
-The SSH daemon must be configured with the Department of Defense (DoD) login banner.
-</title>
-<title rule="sshd_do_not_permit_user_env" shorttitle="Do Not Allow SSH Environment Options">
-The SSH daemon must not permit user environment settings.
-</title>
-<title rule="sshd_use_approved_ciphers" shorttitle="Use Only Approved Ciphers">
-The SSH daemon must be configured to use only FIPS 140-2 approved ciphers.
-</title>
-<title rule="disable_xwindows_with_runlevel" shorttitle="Disable X Windows Startup By Setting Runlevel">
-X Windows must not be enabled unless required.
-</title>
-<title rule="packagegroup_xwindows_remove" shorttitle="Remove the X Windows Package Group">
-The xorg-x11-server-common (X Windows) package must not be installed, unless required.
-</title>
-<title rule="xwindows_remote_listening" shorttitle="Disable X Window System Listening">
-</title>
-<title rule="disable_avahi" shorttitle="Disable Avahi Server Software">
-The avahi service must be disabled.
-</title>
-<title rule="disable_dhcp_server" shorttitle="Disable DHCP Service">
-The DHCP server must be disabled.
-</title>
-<title rule="uninstall_dhcp_server" shorttitle="Uninstall DHCP Server Package">
-The DHCP server must be not be installed.
-</title>
-<title rule="disable_dhcp_client" shorttitle="Disable DHCP Client">
-The DHCP client must be disabled if not needed.
-</title>
-<title rule="enable_ntpd" shorttitle="Enable the NTP Daemon">
-The system clock must be synchronized continuously, or at least daily.
-</title>
-<title rule="ntpd_specify_remote_server" shorttitle="Specify a Remote NTP Server">
-The system clock must be synchronized to an authoritative DoD time source.
-</title>
-<title rule="postfix_network_listening" shorttitle="Disable Postfix Network Listening">
-Mail relaying must be restricted.
-</title>
-<title rule="ldap_client_start_tls" shorttitle="Configure LDAP to Use TLS For All Transactions">
-If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.
-</title>
-<title rule="ldap_client_tls_cacertpath" shorttitle="Configure Certificate Directives for LDAP Use of TLS">
-If the system is using LDAP for authentication or account information, the system must use a TLS connection using trust certificates signed by the site CA.
-</title>
-<title rule="package_openldap-servers_removed" shorttitle="Uninstall openldap-servers Package">
-The openldap-servers package must not be installed unless required.
-</title>
-<title rule="service_nfs_disabled" shorttitle="Disable Network File System (nfs)">
-The Network File System (nfs) service must be disabled unless required.
-</title>
-<title rule="service_rpcsvcgssd_disabled" shorttitle="Disable Secure RPC Server Service (rpcsvcgssd)">
-The Secure RPC Server Service (rpcsvcgssd) must be disabled unless required.
-</title>
-<title rule="use_nodev_option_on_nfs_mounts" shorttitle="Mount Remote Filesystems with nodev">
-Remote file systems must be mounted with the "nodev" option.
-</title>
-<title rule="use_nosuid_option_on_nfs_mounts" shorttitle="Mount Remote Filesystems with nosuid">
-Remote file systems must be mounted with the "nosuid" option.
-</title>
-<title rule="no_insecure_locks_exports" shorttitle="Ensure Insecure File Locking is Not Allowed">
-The NFS server must not have the insecure file locking option enabled.
-</title>
-<title rule="disable_dns_server" shorttitle="Disable DNS Server">
-The DNS (named) service must be disabled unless required.
-</title>
-<title rule="uninstall_bind" shorttitle="Uninstall bind Package">
-The bind package must not be installed unless required.
-</title>
-<title rule="disable_vsftpd" shorttitle="Disable vsftpd Service">
-The vsftpd service must be disabled unless required.
-</title>
-<title rule="uninstall_vsftpd" shorttitle="Uninstall vsftpd Package">
-The vsftpd package must not be installed unless required.
-</title>
-<title rule="ftp_present_banner" shorttitle="Create Warning Banners for All FTP Users">
-The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner.
-</title>
-<title rule="disable_httpd" shorttitle="Disable httpd Service">
-The httpd service must be disabled unless required.
-</title>
-<title rule="uninstall_httpd" shorttitle="Uninstall httpd Package">
-The httpd package must not be installed unless required.
-</title>
-<title rule="disable_dovecot" shorttitle="Disable Dovecot Service">
-The dovecot service must be disabled unless required.
-</title>
-<title rule="uninstall_dovecot" shorttitle="Uninstall dovecot Package">
-The dovecot package must not be installed unless required.
-</title>
-<title rule="disable_smb_server" shorttitle="Disable Samba">
-The smb service must be disabled unless required.
-</title>
-<title rule="require_smb_client_signing" shorttitle="Require Client SMB Packet Signing, if using smbclient">
-The system must use SMB client signing for connecting to samba servers using smbclient.
-</title>
-<title rule="require_smb_client_signing_mount.cifs" shorttitle="Require Client SMB Packet Signing, if using mount.cifs">
-The system must use SMB client signing for connecting to samba servers using mount.cifs.
-</title>
-<title rule="disable_squid" shorttitle="Disable Squid">
-The squid service must be disabled unless required.
-</title>
-<title rule="uninstall_squid" shorttitle="Uninstall squid Package">
-The squid package must not be installed unless required.
-</title>
-<title rule="disable_snmpd" shorttitle="Disable snmpd Service">
-The snmpd service must be disabled unless required.
-</title>
-<title rule="uninstall_net-snmp" shorttitle="Uninstall net-snmp Package">
-The net-snmp package must not be installed unless required.
-</title>
-<title rule="install_hids" shorttitle="Install Intrusion Detection Software">
-The system must have a host-based intrusion detection tool installed.
-</title>
-<title rule="install_antivirus" shorttitle="Install Virus Scanning Software">
-The system must use and update a DoD-approved virus scan program.
-</title>
-<title rule="ftp_log_transactions" shorttitle="Enable Logging of All FTP Transactions">
-The FTP daemon must be configured for logging or verbose mode.
-</title>
-<title rule="smartcard_auth" shorttitle="Enable Smart Card Login">
-The system, if capable, must be configured to require the use of a CAC, PIV
-compliant hardware token, or Alternate Logon Token (ALT) for authentication.
-</title>
-<title rule="package_sendmail_removed" shorttitle="Uninstall Sendmail Package">
-The sendmail package must be removed.
-</title>
-<title rule="disable_ctrlaltdel_reboot" shorttitle="Disable Ctrl-Alt-Del Reboot Activation">
-The x86 CTRL-ALT-DELETE key sequence must be disabled.
-</title>
-<title rule="set_password_hashing_algorithm_systemauth" shorttitle="Set Password Hashing Algorithm in /etc/pam.d/system-auth">
-The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (system-auth).
-</title>
-<title rule="set_password_hashing_algorithm_logindefs" shorttitle="Set Password Hashing Algorithm in /etc/login.defs">
-The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs).
-</title>
-<title rule="set_password_hashing_algorithm_libuserconf" shorttitle="Set Password Hashing Algorithm in /etc/libuser.conf">
-The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf).
-</title>
-<title rule="mountopt_noexec_on_removable_partitions" shorttitle="Add noexec Option to Removable Media Partitions">
-The noexec option must be added to removable media partitions.
-</title>
-<title rule="userowner_group_file" shorttitle="Verify User Who Owns group File">
-The /etc/group file must be owned by root.
-</title>
-<title rule="groupowner_group_file" shorttitle="Verify Group Who Owns group File">
-The /etc/group file must be group-owned by root, bin, or sys.
-</title>
-<title rule="perms_group_file" shorttitle="Verify Permissions on group File">
-The /etc/group file must have mode 0644 or less permissive.
-</title>
-<title rule="no_files_unowned_by_group" shorttitle="Ensure All Files Are Owned by a Group">
-All files must be owned by a group.
-</title>
-<title rule="gid_passwd_group_same" shorttitle="All GIDs referenced in /etc/passwd must be defined in /etc/group">
-All GIDs referenced in /etc/passwd must be defined in /etc/group
-</title>
-<title rule="account_unique_name" shorttitle="Ensure All Accounts on the System Have Unique Names">
-All accounts on the system must have unique user or account names
-</title>
-<title rule="password_require_consecrepeat" shorttitle="Set Password to Maximum of Three Consecutive Repeating Characters">
-The system must require passwords to contain no more than three consecutive repeating characters.
-</title>
-<title rule="set_sysctl_net_ipv4_conf_default_accept_redirects" shorttitle="Disable Kernel Parameter for Accepting ICMP Redirects By Default">
-The system must ignore IPv4 ICMP redirect messages.
-</title>
-<title rule="audit_logs_permissions" shorttitle="System Audit Logs Must Have Mode 0640 or Less Permissive">
-System log files must have mode 0640 or less permissive.
-</title>
-<title rule="service_netconsole_disabled" shorttitle="Disable Network Console (netconsole)">
-The netconsole service must be disabled unless required.
-</title>
-<title rule="world_writeable_files" shorttitle="Ensure No World-Writable Files Exist">
-There must be no world-writable files on the system.
-</title>
-<title rule="unmet_impractical_product" shorttitle="Product Does Not Meet this Requirement Due to Impracticality or Scope"> 
-This requirement must be satisfied via an external application or server. 
-</title>
-<title rule="unmet_impractical_guidance" shorttitle="Guidance Does Not Meet this Requirement Due to Impracticality or Scope"> 
-This requirement must be satisfied via an external application, policy, or service. 
-</title>
-<title rule="requirement_unclear" shorttitle="Implementation of the Requirement is Unclear"> 
-This requirement must be clarified. 
-</title>
-<title rule="met_inherently" shorttitle="Product Meets This Requirement"> 
-The system can not be configured not to meet this requirement. 
-</title>
-<title rule="encrypt_partitions" shorttitle="Encrypt Partitions">
-The operating system must employ cryptographic mechanisms to protect information in storage.
-</title>
-<title rule="set_daemon_umask" shorttitle="Set Daemon Umask">
-The system default umask for daemons must be 027 or 022.
-</title>
-<title rule="service_postfix_enable" shorttitle="Enable Postfix Service">
-The postfix service must be enabled for mail delivery.
-</title>
-<title rule="snmpd_use_newer_protocol" shorttitle="Configure SNMP Service to Use Only SNMPv3 or Newer ">
-The snmpd service must use only SNMP protocol version 3 or newer.
-</title>
-<title rule="snmpd_not_default_password" shorttitle="Ensure Default Password Is Not Used">
-The snmpd service must not use a default password.
-</title>
-<title rule="account_temp_expire_date" shorttitle="Assign Expiration Date to Temporary Accounts">
-Temporary and emergency accounts must be provisioned with an expiration date.
-</title>
-</titles>
-- 
1.7.1



More information about the scap-security-guide mailing list