disable_telnet_service
Shawn Wells
shawn at redhat.com
Tue May 14 04:47:08 UTC 2013
On 5/13/13 10:27 AM, peake at hipkllc.com wrote:
>
> Shawn & Crew.
> First, wish to thank all for your efforts. It was very helpful for me, as I used the SSG to help me ensure I was ready and also as a sanity check after updates are done. We just went through our IV&V and my RHEL6 box did very well.
That's awesome to hear, thanks for the feedback!
> Wanted to give some feedback after latest scan regarding the disable_telnet_service check. It is now failing with the latest SSG content w/ openscap 0.9.3 from RH. telnet is not even installed on this box (removing telnet is another STIG). I know I can ignore this, but would think a check would be done to see if it is even installed first, and only do the disable check if telnet is in fact installed.
That's alarming. And repeatable:
> [shawn at rhel6 checks]$ chkconfig --list | grep telnet
> telnet: off
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledBBCvVg.xml
> Definition oval:scap-security-guide.testing:def:157: true
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo chkconfig telnet on
>
> [shawn at rhel6 checks]$ chkconfig --list | grep telnet
> telnet: on
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledvbLE5A.xml
> Definition oval:scap-security-guide.testing:def:157: false
> Evaluation done.
>
> [shawn at rhel6 checks]$ sudo yum remove telnet-server
>
> [shawn at rhel6 checks]$ ./testcheck.py service_telnetd_disabled.xml
> Evaluating with OVAL tempfile : /tmp/service_telnetd_disabledtEug69.xml
> Definition oval:scap-security-guide.testing:def:157: false
> Evaluation done.
It should be trivial to perform a package check first. Thanks for
reporting this bug!
I likely won't be able to look at this until Fri... anyone else want to
take a stab?
More information about the scap-security-guide
mailing list