[PATCH 2/2] deleting files for imprecise and obsolete OVAL checks, manual remediation
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue May 7 13:24:33 UTC 2013
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/checks/iptables_smtp_enabled.xml | 51 ----
RHEL6/input/checks/postfix_certificate_files.xml | 242 --------------------
.../checks/postfix_server_denial_of_service.xml | 140 -----------
...tfix_server_mail_relay_for_trusted_networks.xml | 28 ---
...server_mail_relay_require_tls_for_smtp_auth.xml | 117 ----------
...tfix_server_mail_relay_set_trusted_networks.xml | 64 -----
RHEL6/input/profiles/manual_remediation.xml | 31 ---
7 files changed, 0 insertions(+), 673 deletions(-)
delete mode 100644 RHEL6/input/checks/iptables_smtp_enabled.xml
delete mode 100644 RHEL6/input/checks/postfix_certificate_files.xml
delete mode 100644 RHEL6/input/checks/postfix_server_denial_of_service.xml
delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
delete mode 100644 RHEL6/input/profiles/manual_remediation.xml
diff --git a/RHEL6/input/checks/iptables_smtp_enabled.xml b/RHEL6/input/checks/iptables_smtp_enabled.xml
deleted file mode 100644
index 430da42..0000000
--- a/RHEL6/input/checks/iptables_smtp_enabled.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="iptables_smtp_enabled" version="1">
- <metadata>
- <title>If Postfix is installed and running as a server, the firewall should allow access to the postfix service.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If LDAP is installed, the firewall should allow or reject access to
- the ldap service.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Package Postfix is installed" test_ref="test_package_postfix_installed" />
- <criterion comment="Test ipv4 25 Accept" test_ref="test_iptables_smtp_enabled_ipv4" />
- <criterion comment="Test ipv6 25 Accept" test_ref="test_iptables_smtp_enabled_ipv6" />
- </criteria>
- </definition>
-
- <linux:rpminfo_test check="all" check_existence="all_exist" id="test_package_postfix_installed" version="1"
- comment="Package Postfix is installed">
- <linux:object object_ref="obj_package_postfix" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_postfix" version="1">
- <linux:name>postfix</linux:name>
- </linux:rpminfo_object>
-
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 25 access over ipv4"
- id="test_iptables_smtp_enabled_ipv4" version="1">
- <ind:object object_ref="obj_iptables_smtp_enabled_ipv4" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 25 access over ipv4"
- id="obj_iptables_smtp_enabled_ipv4" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist" comment="Test for 25 access over ipv6"
- id="test_iptables_smtp_enabled_ipv6" version="1">
- <ind:object object_ref="obj_iptables_smtp_enabled_ipv6" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="Test for 25 access over ipv6"
- id="obj_iptables_smtp_enabled_ipv6" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/postfix_certificate_files.xml b/RHEL6/input/checks/postfix_certificate_files.xml
deleted file mode 100644
index 73957c3..0000000
--- a/RHEL6/input/checks/postfix_certificate_files.xml
+++ /dev/null
@@ -1,242 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_certificate_files" version="1">
- <metadata>
- <title>Protect Postfix Certificate Files.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Protect LDAP certificate files.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Test key file ownership" test_ref="test_postfix_certificate_files_key_owner" />
- <criterion comment="Test key file group ownership" test_ref="test_postfix_certificate_files_key_gowner" />
- <criterion comment="Test key file permissions" test_ref="test_postfix_certificate_files_key_perm" />
- <criterion comment="Test cert file ownership" test_ref="test_postfix_certificate_files_cert_owner" />
- <criterion comment="Test cert file group ownership" test_ref="test_postfix_certificate_files_cert_gowner" />
- <criterion comment="Test cert file permissions" test_ref="test_postfix_certificate_files_cert_perm" />
- <criterion comment="Test pki directory ownership" test_ref="test_postfix_certificate_files_pki_owner" />
- <criterion comment="Test pki directory group ownership" test_ref="test_postfix_certificate_files_pki_gowner" />
- <criterion comment="Test pki directory permissions" test_ref="test_postfix_certificate_files_pki_perm" />
- <criterion comment="Test CA cert ownership" test_ref="test_postfix_certificate_files_cacert_owner" />
- <criterion comment="Test CA cert group ownership" test_ref="test_postfix_certificate_files_cacert_gowner" />
- <criterion comment="Test CA cert permissions" test_ref="test_postfix_certificate_files_cacert_perm" />
- </criteria>
- </definition>
-
-
- <!--start key file-->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of private key file"
- id="test_postfix_certificate_files_key_owner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_key_owner" />
- <unix:state state_ref="state_postfix_certificate_files_key_owner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_key_owner" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem" id="obj_postfix_certificate_files_key_owner" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of private key file"
- id="test_postfix_certificate_files_key_gowner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_key_gowner" />
- <unix:state state_ref="state_postfix_certificate_files_key_gowner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_key_gowner" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem" id="obj_postfix_certificate_files_key_gowner" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of private key file"
- id="test_postfix_certificate_files_key_perm" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_key_perm" />
- <unix:state state_ref="state_postfix_certificate_files_key_perm" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_key_perm" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">false</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem"
- id="obj_postfix_certificate_files_key_perm" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>serverkey.pem</unix:filename>
- </unix:file_object>
- <!--end key file -->
-
- <!--start cert file-->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of cert file"
- id="test_postfix_certificate_files_cert_owner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cert_owner" />
- <unix:state state_ref="state_postfix_certificate_files_cert_owner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cert_owner" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/servercert.pem" id="obj_postfix_certificate_files_cert_owner" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of cert file"
- id="test_postfix_certificate_files_cert_gowner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cert_gowner" />
- <unix:state state_ref="state_postfix_certificate_files_cert_gowner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cert_gowner" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/servercert.pem" id="obj_postfix_certificate_files_cert_gowner" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of cert file"
- id="test_postfix_certificate_files_cert_perm" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cert_perm" />
- <unix:state state_ref="state_postfix_certificate_files_cert_perm" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cert_perm" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">true</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/servercert.pem"
- id="obj_postfix_certificate_files_cert_perm" version="1">
- <unix:path>/etc/pki/tls/mail</unix:path>
- <unix:filename>servercert.pem</unix:filename>
- </unix:file_object>
- <!-- end cert file -->
-
-
- <!-- start pki directory -->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of the pki directory"
- id="test_postfix_certificate_files_pki_owner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_pki_owner" />
- <unix:state state_ref="state_postfix_certificate_files_pki_owner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_pki_owner" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/" id="obj_postfix_certificate_files_pki_owner" version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>mail</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of the pki directory"
- id="test_postfix_certificate_files_pki_gowner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_pki_gowner" />
- <unix:state state_ref="state_postfix_certificate_files_pki_gowner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_pki_gowner" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/" id="obj_postfix_certificate_files_pki_gowner" version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>mail</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of the pki directory"
- id="test_postfix_certificate_files_pki_perm" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_pki_perm" />
- <unix:state state_ref="state_postfix_certificate_files_pki_perm" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_pki_perm" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">true</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">true</unix:gexec>
- <unix:oread datatype="boolean">true</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">true</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/mail/"
- id="obj_postfix_certificate_files_pki_perm" version="1">
- <unix:path>/etc/pki/tls</unix:path>
- <unix:filename>mail</unix:filename>
- </unix:file_object>
- <!-- end pki directory -->
-
-
- <!-- start ca cert -->
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of the ca cert"
- id="test_postfix_certificate_files_cacert_owner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cacert_owner" />
- <unix:state state_ref="state_postfix_certificate_files_cacert_owner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cacert_owner" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem" id="obj_postfix_certificate_files_cacert_owner" version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of the ca cert file"
- id="test_postfix_certificate_files_cacert_gowner" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cacert_gowner" />
- <unix:state state_ref="state_postfix_certificate_files_cacert_gowner" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cacert_gowner" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem" id="obj_postfix_certificate_files_cacert_gowner" version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing permissions of the ca cert file"
- id="test_postfix_certificate_files_cacert_perm" version="1">
- <unix:object object_ref="obj_postfix_certificate_files_cacert_perm" />
- <unix:state state_ref="state_postfix_certificate_files_cacert_perm" />
- </unix:file_test>
- <unix:file_state id="state_postfix_certificate_files_cacert_perm" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">true</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">true</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/pki/tls/CA/cacert.pem"
- id="obj_postfix_certificate_files_cacert_perm" version="1">
- <unix:path>/etc/pki/tls/CA</unix:path>
- <unix:filename>cacert.pem</unix:filename>
- </unix:file_object>
- <!-- end ca cert -->
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_denial_of_service.xml b/RHEL6/input/checks/postfix_server_denial_of_service.xml
deleted file mode 100644
index f863800..0000000
--- a/RHEL6/input/checks/postfix_server_denial_of_service.xml
+++ /dev/null
@@ -1,140 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_server_denial_of_service" version="1">
- <metadata>
- <title>Configure Postfix to Protect Against Denial of Service Attacks</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Protect against attempts to reduce availability of network resources.</description>
- </metadata>
- <criteria comment="Postfix installed and service is configured to start" operator="AND">
- <!-- NOTE: The package install check is inherited from service_postfix_enabled -->
- <extend_definition comment="postfix configured to start" definition_ref="service_postfix_enabled" />
-
- <criteria operator="AND">
- <criterion comment="Limit smtp recipients" test_ref="test_postfix_server_denial_of_service_smtpd_recipient_limit" />
- <criterion comment="Limit message size" test_ref="test_postfix_server_denial_of_service_message_size_limit" />
- <criterion comment="Limit header size" test_ref="test_postfix_server_denial_of_service_header_size_limit" />
- <criterion comment="Limit queue" test_ref="test_postfix_server_denial_of_service_queue_minfree" />
- <criterion comment="Limit connection rate" test_ref="test_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" />
- <criterion comment="Limit connection count" test_ref="test_postfix_server_denial_of_service_smtpd_client_connection_count_limit" />
- <criterion comment="Limit proc count" test_ref="test_postfix_server_denial_of_service_default_process_limit" />
- </criteria>
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set smtpd_recipient_limit"
- id="test_postfix_server_denial_of_service_smtpd_recipient_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_recipient_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_recipient_limit"
- version="1">
- <ind:subexpression operation="equals">100</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_recipient_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_recipient_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set message size limits"
- id="test_postfix_server_denial_of_service_message_size_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_message_size_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_message_size_limit"
- version="1">
- <ind:subexpression operation="equals">10485760</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_message_size_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*message_size_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set header size limits"
- id="test_postfix_server_denial_of_service_header_size_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_header_size_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_header_size_limit"
- version="1">
- <ind:subexpression operation="equals">51200</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_header_size_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*header_size_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set queue minfree limits"
- id="test_postfix_server_denial_of_service_queue_minfree" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_queue_minfree" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_queue_minfree"
- version="1">
- <ind:subexpression operation="equals">20971520</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_queue_minfree" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*queue_minfree[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set smtpd connection rate limits"
- id="test_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_client_connection_rate_limit"
- version="1">
- <ind:subexpression operation="equals">30</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_client_connection_rate_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set smtpd connection limits"
- id="test_postfix_server_denial_of_service_smtpd_client_connection_count_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_client_connection_count_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_client_connection_count_limit"
- version="1">
- <ind:subexpression operation="equals">10</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_client_connection_count_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_client_connection_count_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Set process limits"
- id="test_postfix_server_denial_of_service_default_process_limit" version="1">
- <ind:object object_ref="obj_postfix_server_denial_of_service_default_process_limit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_default_process_limit"
- version="1">
- <ind:subexpression operation="equals">100</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_default_process_limit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*default_process_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml b/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
deleted file mode 100644
index b323538..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_server_mail_relay_for_trusted_networks" version="1">
- <metadata>
- <title>Configure Postfix to Relay for Trusted Networks</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Ensure trusted networks are able to use MTA.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Restrict relaying to trusted nets" test_ref="test_postfix_server_mail_relay_for_trusted_networks_permit" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Restrict relaying to trusted nets"
- id="test_postfix_server_mail_relay_for_trusted_networks_permit" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_for_trusted_networks_permit" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_for_trusted_networks_permit" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">[\s]*smtpd_recipient_restrictions[\s]*=[\n\s]*([\s]+\S*[\n\s])*permit_mynetworks,[\n\s]*reject_unauth_destination,*[\n\s]*</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml b/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
deleted file mode 100644
index 5c39483..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
+++ /dev/null
@@ -1,117 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_server_mail_relay_require_tls_for_smtp_auth" version="1">
- <metadata>
- <title>Require TLS before SMTP AUTH</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Ensure system uses STARTTLS before SMTP AUTH.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Test for ca path" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" />
- <criterion comment="Test for ca file" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" />
- <criterion comment="Test for cert file" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" />
- <criterion comment="Test for key file" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" />
- <criterion comment="Test for sec level" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" />
- <criterion comment="Test for auth only" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for ca path"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path"
- version="1">
- <ind:subexpression operation="equals">/etc/pki/tls/CA</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_CApath[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for ca file"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file"
- version="1">
- <ind:subexpression operation="equals">/etc/pki/tls/CA/cacert.pem</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_CAfile[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for cert file"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file"
- version="1">
- <ind:subexpression operation="equals">/etc/pki/tls/mail/servercert.pem</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_cert_file[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for key file"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file"
- version="1">
- <ind:subexpression operation="equals">/etc/pki/tls/mail/serverkey.pem</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_key_file[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for sec level"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level"
- version="1">
- <ind:subexpression operation="equals">may</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_security_level[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for auth only"
- id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only"
- version="1">
- <ind:subexpression operation="equals">yes</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*smtpd_tls_auth_only[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml b/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
deleted file mode 100644
index 82e274e..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
+++ /dev/null
@@ -1,64 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_server_mail_relay_set_trusted_networks" version="1">
- <metadata>
- <title>Configure Postfix Against Being an Open Relay</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Ensure system cannot be used as an open relay by untrusted hosts.</description>
- </metadata>
- <criteria operator="OR">
- <criterion comment="Test for trusted network style for host"
- test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" />
- <criterion comment="Test for trusted network style for subnet"
- test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" />
- <criterion comment="Test for trusted network hosts" test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for mynetwork_style set to host"
- id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host"
- version="1">
- <ind:subexpression operation="equals">host</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*mynetworks_style[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for mynetwork_style set to subnet"
- id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet"
- version="1">
- <ind:subexpression operation="equals">subnet</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*mynetworks_style[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Test for mynetworks set to network blocks or ips"
- id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks" version="1">
- <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks" version="1">
- <ind:path>/etc/postfix</ind:path>
- <ind:filename>main.cf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*mynetworks[\s]*=[\s]*((\d{3}\.){3}\d+(\/\d+)*[\s]*,[\s]*)*(\d{3}\.){3}\d+(\/\d+)*[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/profiles/manual_remediation.xml b/RHEL6/input/profiles/manual_remediation.xml
deleted file mode 100644
index 6ac1df2..0000000
--- a/RHEL6/input/profiles/manual_remediation.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<Profile id="manual_audits" xmlns="http://checklists.nist.gov/xccdf/1.1" >
-<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
-<description>This profile contains items that require user interaction during audit.</description>
-<select idref="package_aide_installed" selected="true"/>
-<select idref="install_vsftpd" selected="true"/>
-<select idref="install_openswan" selected="true"/>
-<select idref="package_screen_installed" selected="true"/>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="bootloader_password" selected="true"/>
-<select idref="rsyslog_send_messages_to_logserver" selected="true"/>
-<select idref="disable_dhcp_client" selected="true"/>
-<select idref="enable_gdm_login_banner" selected="true"/>
-<select idref="set_gdm_login_banner_text" selected="true"/>
-<select idref="no_empty_passwords" selected="true"/>
-<select idref="no_uidzero_except_root" selected="true"/>
-<select idref="postfix_create_cert" selected="true"/>
-<select idref="postfix_install_ssl_cert" selected="true"/>
-<select idref="postfix_seperate_internal_external" selected="true"/>
-<select idref="network_ipv6_static_address" selected="true"/>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="enable_gdm_login_banner" selected="true"/>
-<select idref="aide_build_database" selected="true"/>
-<select idref="wireless_disable_in_bios" selected="true"/>
-<select idref="deactivate_wireless_interfaces" selected="true"/>
-<select idref="network_ipv6_default_gateway" selected="true"/>
-<select idref="no_files_unowned_by_user" selected="true"/>
-<select idref="no_files_unowned_by_group" selected="true"/>
-<select idref="world_writable_files_system_ownership" selected="true"/>
-<select idref="aide_verify_integrity-manually" selected="true"/>
-<select idref="iptables_ldap_enabled" selected="true"/>
-</Profile>
--
1.7.1
More information about the scap-security-guide
mailing list