[PATCH 2/2] deleting files for imprecise and obsolete OVAL checks, manual remediation

Jeffrey Blank blank at eclipse.ncsc.mil
Tue May 7 13:24:33 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/checks/iptables_smtp_enabled.xml       |   51 ----
 RHEL6/input/checks/postfix_certificate_files.xml   |  242 --------------------
 .../checks/postfix_server_denial_of_service.xml    |  140 -----------
 ...tfix_server_mail_relay_for_trusted_networks.xml |   28 ---
 ...server_mail_relay_require_tls_for_smtp_auth.xml |  117 ----------
 ...tfix_server_mail_relay_set_trusted_networks.xml |   64 -----
 RHEL6/input/profiles/manual_remediation.xml        |   31 ---
 7 files changed, 0 insertions(+), 673 deletions(-)
 delete mode 100644 RHEL6/input/checks/iptables_smtp_enabled.xml
 delete mode 100644 RHEL6/input/checks/postfix_certificate_files.xml
 delete mode 100644 RHEL6/input/checks/postfix_server_denial_of_service.xml
 delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
 delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
 delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
 delete mode 100644 RHEL6/input/profiles/manual_remediation.xml

diff --git a/RHEL6/input/checks/iptables_smtp_enabled.xml b/RHEL6/input/checks/iptables_smtp_enabled.xml
deleted file mode 100644
index 430da42..0000000
--- a/RHEL6/input/checks/iptables_smtp_enabled.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="iptables_smtp_enabled" version="1">
-    <metadata>
-      <title>If Postfix is installed and running as a server, the firewall should allow access to the postfix service.</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>If LDAP is installed, the firewall should allow or reject access to
-      the ldap service.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Package Postfix is installed" test_ref="test_package_postfix_installed" />
-      <criterion comment="Test ipv4 25 Accept" test_ref="test_iptables_smtp_enabled_ipv4" />
-      <criterion comment="Test ipv6 25 Accept" test_ref="test_iptables_smtp_enabled_ipv6" />
-    </criteria>
-  </definition>
-
-  <linux:rpminfo_test check="all" check_existence="all_exist" id="test_package_postfix_installed" version="1"
-  comment="Package Postfix is installed">
-    <linux:object object_ref="obj_package_postfix" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_postfix" version="1">
-    <linux:name>postfix</linux:name>
-  </linux:rpminfo_object>
-
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist" comment="Test for 25 access over ipv4"
-  id="test_iptables_smtp_enabled_ipv4" version="1">
-    <ind:object object_ref="obj_iptables_smtp_enabled_ipv4" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object comment="Test for 25 access over ipv4"
-  id="obj_iptables_smtp_enabled_ipv4" version="1">
-    <ind:path>/etc/sysconfig</ind:path>
-    <ind:filename>iptables</ind:filename>
-    <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist" comment="Test for 25 access over ipv6"
-  id="test_iptables_smtp_enabled_ipv6" version="1">
-    <ind:object object_ref="obj_iptables_smtp_enabled_ipv6" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object comment="Test for 25 access over ipv6"
-  id="obj_iptables_smtp_enabled_ipv6" version="1">
-    <ind:path>/etc/sysconfig</ind:path>
-    <ind:filename>ip6tables</ind:filename>
-    <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/postfix_certificate_files.xml b/RHEL6/input/checks/postfix_certificate_files.xml
deleted file mode 100644
index 73957c3..0000000
--- a/RHEL6/input/checks/postfix_certificate_files.xml
+++ /dev/null
@@ -1,242 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_certificate_files" version="1">
-    <metadata>
-      <title>Protect Postfix Certificate Files.</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Protect LDAP certificate files.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Test key file ownership"            test_ref="test_postfix_certificate_files_key_owner" />
-      <criterion comment="Test key file group ownership"      test_ref="test_postfix_certificate_files_key_gowner" />
-      <criterion comment="Test key file permissions"          test_ref="test_postfix_certificate_files_key_perm" />
-      <criterion comment="Test cert file ownership"           test_ref="test_postfix_certificate_files_cert_owner" />
-      <criterion comment="Test cert file group ownership"     test_ref="test_postfix_certificate_files_cert_gowner" />
-      <criterion comment="Test cert file permissions"         test_ref="test_postfix_certificate_files_cert_perm" />
-      <criterion comment="Test pki directory ownership"       test_ref="test_postfix_certificate_files_pki_owner" />
-      <criterion comment="Test pki directory group ownership" test_ref="test_postfix_certificate_files_pki_gowner" />
-      <criterion comment="Test pki directory permissions"     test_ref="test_postfix_certificate_files_pki_perm" />
-      <criterion comment="Test CA cert ownership"             test_ref="test_postfix_certificate_files_cacert_owner" />
-      <criterion comment="Test CA cert group ownership"       test_ref="test_postfix_certificate_files_cacert_gowner" />
-      <criterion comment="Test CA cert permissions"           test_ref="test_postfix_certificate_files_cacert_perm" />
-    </criteria>
-  </definition>
- 
-
-  <!--start key file-->
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing ownership of private key file"
-  id="test_postfix_certificate_files_key_owner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_key_owner" />
-    <unix:state state_ref="state_postfix_certificate_files_key_owner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_key_owner" version="1">
-    <unix:user_id datatype="int">0</unix:user_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem" id="obj_postfix_certificate_files_key_owner" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>serverkey.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership of private key file"
-  id="test_postfix_certificate_files_key_gowner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_key_gowner" />
-    <unix:state state_ref="state_postfix_certificate_files_key_gowner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_key_gowner" version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem" id="obj_postfix_certificate_files_key_gowner" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>serverkey.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing permissions of private key file"
-  id="test_postfix_certificate_files_key_perm" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_key_perm" />
-    <unix:state state_ref="state_postfix_certificate_files_key_perm" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_key_perm" version="1">
-    <unix:uread datatype="boolean">true</unix:uread>
-    <unix:uwrite datatype="boolean">true</unix:uwrite>
-    <unix:uexec datatype="boolean">false</unix:uexec>
-    <unix:gread datatype="boolean">false</unix:gread>
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">false</unix:gexec>
-    <unix:oread datatype="boolean">false</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">false</unix:oexec>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/serverkey.pem"
-  id="obj_postfix_certificate_files_key_perm" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>serverkey.pem</unix:filename>
-  </unix:file_object>
-  <!--end key file -->
-
-  <!--start cert file-->
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing ownership of cert file"
-  id="test_postfix_certificate_files_cert_owner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cert_owner" />
-    <unix:state state_ref="state_postfix_certificate_files_cert_owner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cert_owner" version="1">
-    <unix:user_id datatype="int">0</unix:user_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/servercert.pem" id="obj_postfix_certificate_files_cert_owner" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>servercert.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership of cert file"
-  id="test_postfix_certificate_files_cert_gowner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cert_gowner" />
-    <unix:state state_ref="state_postfix_certificate_files_cert_gowner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cert_gowner" version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/servercert.pem" id="obj_postfix_certificate_files_cert_gowner" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>servercert.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing permissions of cert file"
-  id="test_postfix_certificate_files_cert_perm" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cert_perm" />
-    <unix:state state_ref="state_postfix_certificate_files_cert_perm" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cert_perm" version="1">
-    <unix:uread datatype="boolean">true</unix:uread>
-    <unix:uwrite datatype="boolean">true</unix:uwrite>
-    <unix:uexec datatype="boolean">false</unix:uexec>
-    <unix:gread datatype="boolean">true</unix:gread>
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">false</unix:gexec>
-    <unix:oread datatype="boolean">true</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">false</unix:oexec>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/servercert.pem"
-  id="obj_postfix_certificate_files_cert_perm" version="1">
-    <unix:path>/etc/pki/tls/mail</unix:path>
-    <unix:filename>servercert.pem</unix:filename>
-  </unix:file_object>
-  <!-- end cert file -->
-
-
-  <!-- start pki directory -->
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing ownership of the  pki directory"
-  id="test_postfix_certificate_files_pki_owner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_pki_owner" />
-    <unix:state state_ref="state_postfix_certificate_files_pki_owner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_pki_owner" version="1">
-    <unix:user_id datatype="int">0</unix:user_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/" id="obj_postfix_certificate_files_pki_owner" version="1">
-    <unix:path>/etc/pki/tls</unix:path>
-    <unix:filename>mail</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership of the pki directory"
-  id="test_postfix_certificate_files_pki_gowner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_pki_gowner" />
-    <unix:state state_ref="state_postfix_certificate_files_pki_gowner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_pki_gowner" version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/" id="obj_postfix_certificate_files_pki_gowner" version="1">
-    <unix:path>/etc/pki/tls</unix:path>
-    <unix:filename>mail</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing permissions of the pki directory"
-  id="test_postfix_certificate_files_pki_perm" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_pki_perm" />
-    <unix:state state_ref="state_postfix_certificate_files_pki_perm" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_pki_perm" version="1">
-    <unix:uread datatype="boolean">true</unix:uread>
-    <unix:uwrite datatype="boolean">true</unix:uwrite>
-    <unix:uexec datatype="boolean">true</unix:uexec>
-    <unix:gread datatype="boolean">true</unix:gread>
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">true</unix:gexec>
-    <unix:oread datatype="boolean">true</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">true</unix:oexec>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/mail/"
-  id="obj_postfix_certificate_files_pki_perm" version="1">
-    <unix:path>/etc/pki/tls</unix:path>
-    <unix:filename>mail</unix:filename>
-  </unix:file_object>
-  <!-- end pki directory -->
-
-
-  <!-- start ca cert -->
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing ownership of the ca cert"
-  id="test_postfix_certificate_files_cacert_owner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cacert_owner" />
-    <unix:state state_ref="state_postfix_certificate_files_cacert_owner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cacert_owner" version="1">
-    <unix:user_id datatype="int">0</unix:user_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/CA/cacert.pem" id="obj_postfix_certificate_files_cacert_owner" version="1">
-    <unix:path>/etc/pki/tls/CA</unix:path>
-    <unix:filename>cacert.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership of the ca cert file"
-  id="test_postfix_certificate_files_cacert_gowner" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cacert_gowner" />
-    <unix:state state_ref="state_postfix_certificate_files_cacert_gowner" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cacert_gowner" version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/CA/cacert.pem" id="obj_postfix_certificate_files_cacert_gowner" version="1">
-    <unix:path>/etc/pki/tls/CA</unix:path>
-    <unix:filename>cacert.pem</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing permissions of the ca cert file"
-  id="test_postfix_certificate_files_cacert_perm" version="1">
-    <unix:object object_ref="obj_postfix_certificate_files_cacert_perm" />
-    <unix:state state_ref="state_postfix_certificate_files_cacert_perm" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_certificate_files_cacert_perm" version="1">
-    <unix:uread datatype="boolean">true</unix:uread>
-    <unix:uwrite datatype="boolean">true</unix:uwrite>
-    <unix:uexec datatype="boolean">false</unix:uexec>
-    <unix:gread datatype="boolean">true</unix:gread>
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">false</unix:gexec>
-    <unix:oread datatype="boolean">true</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">false</unix:oexec>
-  </unix:file_state>
-  <unix:file_object comment="/etc/pki/tls/CA/cacert.pem"
-  id="obj_postfix_certificate_files_cacert_perm" version="1">
-    <unix:path>/etc/pki/tls/CA</unix:path>
-    <unix:filename>cacert.pem</unix:filename>
-  </unix:file_object>
-  <!-- end ca cert -->
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_denial_of_service.xml b/RHEL6/input/checks/postfix_server_denial_of_service.xml
deleted file mode 100644
index f863800..0000000
--- a/RHEL6/input/checks/postfix_server_denial_of_service.xml
+++ /dev/null
@@ -1,140 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_server_denial_of_service" version="1">
-    <metadata>
-      <title>Configure Postfix to Protect Against Denial of Service Attacks</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Protect against attempts to reduce availability of network resources.</description>
-    </metadata>
-    <criteria comment="Postfix installed and service is configured to start" operator="AND">
-      <!-- NOTE: The package install check is inherited from service_postfix_enabled -->
-      <extend_definition comment="postfix configured to start" definition_ref="service_postfix_enabled" />
-
-      <criteria operator="AND">
-        <criterion comment="Limit smtp recipients"  test_ref="test_postfix_server_denial_of_service_smtpd_recipient_limit" />
-        <criterion comment="Limit message size"     test_ref="test_postfix_server_denial_of_service_message_size_limit" />
-        <criterion comment="Limit header size"      test_ref="test_postfix_server_denial_of_service_header_size_limit" />
-        <criterion comment="Limit queue"            test_ref="test_postfix_server_denial_of_service_queue_minfree" />
-        <criterion comment="Limit connection rate"  test_ref="test_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" />
-        <criterion comment="Limit connection count" test_ref="test_postfix_server_denial_of_service_smtpd_client_connection_count_limit" />
-        <criterion comment="Limit proc count"       test_ref="test_postfix_server_denial_of_service_default_process_limit" />
-      </criteria>
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set smtpd_recipient_limit" 
-  id="test_postfix_server_denial_of_service_smtpd_recipient_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_recipient_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_recipient_limit"
-  version="1">
-    <ind:subexpression operation="equals">100</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_recipient_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_recipient_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set message size limits" 
-  id="test_postfix_server_denial_of_service_message_size_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_message_size_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_message_size_limit"
-  version="1">
-    <ind:subexpression operation="equals">10485760</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_message_size_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*message_size_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set header size limits" 
-  id="test_postfix_server_denial_of_service_header_size_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_header_size_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_header_size_limit"
-  version="1">
-    <ind:subexpression operation="equals">51200</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_header_size_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*header_size_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set queue minfree limits" 
-  id="test_postfix_server_denial_of_service_queue_minfree" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_queue_minfree" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_queue_minfree"
-  version="1">
-    <ind:subexpression operation="equals">20971520</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_queue_minfree" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*queue_minfree[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set smtpd connection rate limits" 
-  id="test_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_client_connection_rate_limit"
-  version="1">
-    <ind:subexpression operation="equals">30</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_client_connection_rate_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_client_connection_rate_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set smtpd connection limits" 
-  id="test_postfix_server_denial_of_service_smtpd_client_connection_count_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_smtpd_client_connection_count_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_smtpd_client_connection_count_limit"
-  version="1">
-    <ind:subexpression operation="equals">10</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_smtpd_client_connection_count_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_client_connection_count_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
- 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Set process limits" 
-  id="test_postfix_server_denial_of_service_default_process_limit" version="1">
-    <ind:object object_ref="obj_postfix_server_denial_of_service_default_process_limit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_denial_of_service_default_process_limit"
-  version="1">
-    <ind:subexpression operation="equals">100</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_denial_of_service_default_process_limit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*default_process_limit[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml b/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
deleted file mode 100644
index b323538..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_for_trusted_networks.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_server_mail_relay_for_trusted_networks" version="1">
-    <metadata>
-      <title>Configure Postfix to Relay for Trusted Networks</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Ensure trusted networks are able to use MTA.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Restrict relaying to trusted nets" test_ref="test_postfix_server_mail_relay_for_trusted_networks_permit" />
-    </criteria>
-  </definition>
- 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Restrict relaying to trusted nets" 
-  id="test_postfix_server_mail_relay_for_trusted_networks_permit" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_for_trusted_networks_permit" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_for_trusted_networks_permit" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">[\s]*smtpd_recipient_restrictions[\s]*=[\n\s]*([\s]+\S*[\n\s])*permit_mynetworks,[\n\s]*reject_unauth_destination,*[\n\s]*</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml b/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
deleted file mode 100644
index 5c39483..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_require_tls_for_smtp_auth.xml
+++ /dev/null
@@ -1,117 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_server_mail_relay_require_tls_for_smtp_auth" version="1">
-    <metadata>
-      <title>Require TLS before SMTP AUTH</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Ensure system uses STARTTLS before SMTP AUTH.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Test for ca path"   test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" />
-      <criterion comment="Test for ca file"   test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" />
-      <criterion comment="Test for cert file" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" />
-      <criterion comment="Test for key file"  test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" />
-      <criterion comment="Test for sec level" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" />
-      <criterion comment="Test for auth only" test_ref="test_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for ca path" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path"
-  version="1">
-    <ind:subexpression operation="equals">/etc/pki/tls/CA</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_path" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_CApath[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for ca file" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file"
-  version="1">
-    <ind:subexpression operation="equals">/etc/pki/tls/CA/cacert.pem</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_ca_file" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_CAfile[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for cert file" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file"
-  version="1">
-    <ind:subexpression operation="equals">/etc/pki/tls/mail/servercert.pem</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_cert_file" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_cert_file[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for key file" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file"
-  version="1">
-    <ind:subexpression operation="equals">/etc/pki/tls/mail/serverkey.pem</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_key_file" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_key_file[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for sec level" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level"
-  version="1">
-    <ind:subexpression operation="equals">may</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_security_level" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_security_level[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for auth only" 
-  id="test_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only"
-  version="1">
-    <ind:subexpression operation="equals">yes</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_require_tls_for_smtp_auth_auth_only" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_tls_auth_only[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml b/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
deleted file mode 100644
index 82e274e..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_set_trusted_networks.xml
+++ /dev/null
@@ -1,64 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_server_mail_relay_set_trusted_networks" version="1">
-    <metadata>
-      <title>Configure Postfix Against Being an Open Relay</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Ensure system cannot be used as an open relay by untrusted hosts.</description>
-    </metadata>
-    <criteria operator="OR">
-      <criterion comment="Test for trusted network style for host"
-      test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" />
-      <criterion comment="Test for trusted network style for subnet"
-      test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" />
-      <criterion comment="Test for trusted network hosts"   test_ref="test_postfix_server_mail_relay_set_trusted_networks_mynetworks" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for mynetwork_style set to host" 
-  id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host"
-  version="1">
-    <ind:subexpression operation="equals">host</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_host" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*mynetworks_style[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for mynetwork_style set to subnet" 
-  id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet"
-  version="1">
-    <ind:subexpression operation="equals">subnet</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks_style_subnet" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*mynetworks_style[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for mynetworks set to network blocks or ips" 
-  id="test_postfix_server_mail_relay_set_trusted_networks_mynetworks" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_set_trusted_networks_mynetworks" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*mynetworks[\s]*=[\s]*((\d{3}\.){3}\d+(\/\d+)*[\s]*,[\s]*)*(\d{3}\.){3}\d+(\/\d+)*[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/profiles/manual_remediation.xml b/RHEL6/input/profiles/manual_remediation.xml
deleted file mode 100644
index 6ac1df2..0000000
--- a/RHEL6/input/profiles/manual_remediation.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<Profile id="manual_audits" xmlns="http://checklists.nist.gov/xccdf/1.1" >
-<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
-<description>This profile contains items that require user interaction during audit.</description>
-<select idref="package_aide_installed" selected="true"/>
-<select idref="install_vsftpd" selected="true"/>
-<select idref="install_openswan" selected="true"/>
-<select idref="package_screen_installed" selected="true"/>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="bootloader_password" selected="true"/>
-<select idref="rsyslog_send_messages_to_logserver" selected="true"/>
-<select idref="disable_dhcp_client" selected="true"/>
-<select idref="enable_gdm_login_banner" selected="true"/>
-<select idref="set_gdm_login_banner_text" selected="true"/>
-<select idref="no_empty_passwords" selected="true"/>
-<select idref="no_uidzero_except_root" selected="true"/>
-<select idref="postfix_create_cert" selected="true"/>
-<select idref="postfix_install_ssl_cert" selected="true"/>
-<select idref="postfix_seperate_internal_external" selected="true"/>
-<select idref="network_ipv6_static_address" selected="true"/>
-<select idref="bios_disable_usb_boot" selected="true"/>
-<select idref="enable_gdm_login_banner" selected="true"/>
-<select idref="aide_build_database" selected="true"/>
-<select idref="wireless_disable_in_bios" selected="true"/>
-<select idref="deactivate_wireless_interfaces" selected="true"/>
-<select idref="network_ipv6_default_gateway" selected="true"/>
-<select idref="no_files_unowned_by_user" selected="true"/>
-<select idref="no_files_unowned_by_group" selected="true"/>
-<select idref="world_writable_files_system_ownership" selected="true"/>
-<select idref="aide_verify_integrity-manually" selected="true"/>
-<select idref="iptables_ldap_enabled" selected="true"/>
-</Profile>
-- 
1.7.1



More information about the scap-security-guide mailing list