disable_telnet_service

Shawn Wells shawn at redhat.com
Tue May 14 04:47:08 UTC 2013


On 5/13/13 10:27 AM, peake at hipkllc.com wrote:
>
>   Shawn & Crew.
>   First, wish to thank all for your efforts. It was very helpful for me, as I used the SSG to help me ensure I was ready and also as a sanity check after updates are done. We just went through our IV&V and my RHEL6 box did very well.
That's awesome to hear, thanks for the feedback!


>   Wanted to give some feedback after latest scan regarding the disable_telnet_service check. It is now failing with the latest SSG content w/ openscap 0.9.3 from RH. telnet is not even installed on this box (removing telnet is another STIG). I know I can ignore this, but would think a check would be done to see if it is even installed first, and only do the disable check if telnet is in fact installed.

That's alarming. And repeatable:
> [shawn at rhel6 checks]$ chkconfig --list | grep telnet
>     telnet:            off
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledBBCvVg.xml
> Definition oval:scap-security-guide.testing:def:157: true
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo chkconfig telnet on
>
> [shawn at rhel6 checks]$ chkconfig --list | grep telnet
>     telnet:            on
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledvbLE5A.xml
> Definition oval:scap-security-guide.testing:def:157: false
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo yum remove telnet-server
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledtEug69.xml
> Definition oval:scap-security-guide.testing:def:157: false
> Evaluation done.

It should be trivial to perform a package check first. Thanks for 
reporting this bug!

I likely won't be able to look at this until Fri... anyone else want to 
take a stab?






More information about the scap-security-guide mailing list