[PATCH 2/2] removal of unused OVAL checks
Jeffrey Blank
blank at eclipse.ncsc.mil
Fri May 17 05:13:24 UTC 2013
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
.../accounts_no_nis_inclusions_etc_shadow.xml | 23 -----
.../checks/accounts_passwords_pam_tally2_deny.xml | 31 ------
.../console_device_restrict_access_server.xml | 41 --------
.../checks/file_groupowner_ldap_server_files.xml | 31 ------
RHEL6/input/checks/iptables_avahi_disabled.xml | 43 ---------
.../input/checks/package_initscripts_installed.xml | 26 -----
RHEL6/input/checks/package_lvm2_installed.xml | 25 -----
RHEL6/input/checks/package_samba_removed.xml | 25 -----
RHEL6/input/checks/postfix_logging.xml | 99 --------------------
...sctl_net_ipv6_conf_default_accept_ra_defrtr.xml | 31 ------
...ysctl_net_ipv6_conf_default_accept_ra_pinfo.xml | 31 ------
.../sysctl_net_ipv6_conf_default_autoconf.xml | 31 ------
.../sysctl_net_ipv6_conf_default_dad_transmits.xml | 31 ------
.../sysctl_net_ipv6_conf_default_max_addresses.xml | 31 ------
..._net_ipv6_conf_default_router_solicitations.xml | 31 ------
RHEL6/input/checks/templates/packages_removed.csv | 1 -
RHEL6/input/checks/templates/services_enabled.csv | 1 -
17 files changed, 0 insertions(+), 532 deletions(-)
delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
delete mode 100644 RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
delete mode 100644 RHEL6/input/checks/console_device_restrict_access_server.xml
delete mode 100644 RHEL6/input/checks/file_groupowner_ldap_server_files.xml
delete mode 100644 RHEL6/input/checks/iptables_avahi_disabled.xml
delete mode 100644 RHEL6/input/checks/package_initscripts_installed.xml
delete mode 100644 RHEL6/input/checks/package_lvm2_installed.xml
delete mode 100644 RHEL6/input/checks/package_samba_removed.xml
delete mode 100644 RHEL6/input/checks/postfix_logging.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml
diff --git a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml b/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
deleted file mode 100644
index 10828a8..0000000
--- a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
- <definition class="compliance" id="accounts_no_nis_inclusions_etc_shadow" version="1">
- <metadata>
- <title>Remove Legacy + Entries From /etc/shadow</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>NIS file inclusions should be set appropriately in the /etc/shadow file.</description>
- </metadata>
- <criteria>
- <criterion comment="tests for reg exp '^\+' in /etc/shadow" test_ref="test_accounts_no_nis_inclusions_etc_shadow" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp '^\+' in /etc/shadow" id="test_accounts_no_nis_inclusions_etc_shadow" version="1">
- <ind:object object_ref="obj_20075" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20075" version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>shadow</ind:filename>
- <ind:pattern operation="pattern match">^\+</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml b/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
deleted file mode 100644
index ca48f35..0000000
--- a/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="accounts_passwords_pam_tally2_deny" version="1">
- <metadata>
- <title>Set deny for Failed Password Attempts</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The "account deny" policy should meet minimum
- requirements.</description>
- </metadata>
- <criteria>
- <criterion comment="check that deny for pam_tally2 account module is configured correctly"
- test_ref="test_200801" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="only_one_exists"
- comment="check system-auth pam_tally2 deny"
- id="test_200801" version="1">
- <ind:object object_ref="obj_200801" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_200801"
- version="1">
- <ind:path>/etc/pam.d</ind:path>
- <ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern match">^\s*auth\s+required\s+pam_tally2\.so\s+deny=5\s+onerr=fail$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">
- 1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/console_device_restrict_access_server.xml b/RHEL6/input/checks/console_device_restrict_access_server.xml
deleted file mode 100644
index 6016236..0000000
--- a/RHEL6/input/checks/console_device_restrict_access_server.xml
+++ /dev/null
@@ -1,41 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="console_device_restrict_access_server" version="1">
- <metadata>
- <title>Restrict Console Device Access - server</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Prevent remote users from gaining access to devices and restricted applications on the machine.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="Restrict access - console" test_ref="test_console_device_restrict_access_server_console" />
- <criterion comment="Restrict access - xconsole" test_ref="test_console_device_restrict_access_server_xconsole" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Restrict access to the console, testing that console is set to tty[0-9][0-9]* vc/[0-9][0-9]*"
- id="test_console_device_restrict_access_server_console" version="1">
- <ind:object object_ref="obj_console_device_restrict_access_server_console" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_console_device_restrict_access_server_console" version="1">
- <ind:path>/etc/security</ind:path>
- <ind:filename>console.perms</ind:filename>
- <ind:pattern operation="pattern match">^.console.=tty\[0-9\]\[0-9\]\*\s+vc\/\[0-9]\[0-9]\*\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="none_exist"
- comment="Restrict access - xconsole, testing that xconsole is set to tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0"
- id="test_console_device_restrict_access_server_xconsole" version="1">
- <ind:object object_ref="obj_console_device_restrict_access_server_xconsole" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_console_device_restrict_access_server_xconsole" version="1">
- <ind:path>/etc/security</ind:path>
- <ind:filename>console.perms</ind:filename>
- <ind:pattern operation="pattern match">^.xconsole.=.*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/file_groupowner_ldap_server_files.xml b/RHEL6/input/checks/file_groupowner_ldap_server_files.xml
deleted file mode 100644
index e3d1022..0000000
--- a/RHEL6/input/checks/file_groupowner_ldap_server_files.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="file_groupowner_ldap_server_files" version="1">
- <metadata>
- <title>Verify Group Ownership of LDAP Server Data Files</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The /var/lib/ldap/* files should be owned by the
- appropriate group.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_20142" />
- </criteria>
- </definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership to be root"
- id="test_20142" version="1">
- <unix:object object_ref="obj_20142" />
- <unix:state state_ref="state_20142" />
- </unix:file_test>
- <unix:file_state id="state_20142"
- version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/var/lib/ldap/*"
- id="obj_20142" version="1">
- <unix:path>/var/lib/ldap</unix:path>
- <unix:filename operation="pattern match">*</unix:filename>
- </unix:file_object>
-</def-group>
diff --git a/RHEL6/input/checks/iptables_avahi_disabled.xml b/RHEL6/input/checks/iptables_avahi_disabled.xml
deleted file mode 100644
index 3a7ce11..0000000
--- a/RHEL6/input/checks/iptables_avahi_disabled.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="iptables_avahi_disabled" version="1">
- <metadata>
- <title>The firewall should allow or reject access to the
- avahi service.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The firewall should allow or reject access to
- the avahi service.</description>
- </metadata>
- <criteria operator="AND">
- <criterion comment="TODO::INSERT"
- test_ref="test_180370" />
- <criterion test_ref="test_180371" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist" comment="TODO::INSERT"
- id="test_180370" version="1">
- <ind:object object_ref="obj_180370" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="TODO::INSERT"
- id="obj_180370" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>iptables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist" comment="TODO::INSERT"
- id="test_180371" version="1">
- <ind:object object_ref="obj_180371" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="TODO::INSERT"
- id="obj_180371" version="1">
- <ind:path>/etc/sysconfig</ind:path>
- <ind:filename>ip6tables</ind:filename>
- <ind:pattern operation="pattern match">^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_initscripts_installed.xml b/RHEL6/input/checks/package_initscripts_installed.xml
deleted file mode 100644
index 5b1e7c6..0000000
--- a/RHEL6/input/checks/package_initscripts_installed.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="package_initscripts_installed" version="1">
- <metadata>
- <title>Package initscripts Installed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The package initscripts should be installed.
- This check was generated by the 'create_services_enabled.py'
- script in the templates directory.</description>
- </metadata>
- <criteria>
- <criterion comment="package initscripts is installed"
- test_ref="test_package_initscripts_installed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="all_exist"
- id="test_package_initscripts_installed" version="1"
- comment="package initscripts is installed">
- <linux:object object_ref="obj_package_initscripts" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_initscripts" version="1">
- <linux:name>initscripts</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_lvm2_installed.xml b/RHEL6/input/checks/package_lvm2_installed.xml
deleted file mode 100644
index 88e3785..0000000
--- a/RHEL6/input/checks/package_lvm2_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_lvm2_installed"
- version="1">
- <metadata>
- <title>Package lvm2 Installed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package lvm2 should be installed.</description>
- </metadata>
- <criteria>
- <criterion comment="package lvm2 is installed"
- test_ref="test_package_lvm2_installed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="all_exist"
- id="test_package_lvm2_installed" version="1"
- comment="package lvm2 is installed">
- <linux:object object_ref="obj_package_lvm2_installed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_lvm2_installed" version="1">
- <linux:name>lvm2</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_samba_removed.xml b/RHEL6/input/checks/package_samba_removed.xml
deleted file mode 100644
index cb59f4e..0000000
--- a/RHEL6/input/checks/package_samba_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_samba_removed"
- version="1">
- <metadata>
- <title>Package samba Removed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package samba should be removed.</description>
- </metadata>
- <criteria>
- <criterion comment="package samba is removed"
- test_ref="test_package_samba_removed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="none_exist"
- id="test_package_samba_removed" version="1"
- comment="package samba is removed">
- <linux:object object_ref="obj_package_samba_removed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_samba_removed" version="1">
- <linux:name>samba</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/postfix_logging.xml b/RHEL6/input/checks/postfix_logging.xml
deleted file mode 100644
index d0e498f..0000000
--- a/RHEL6/input/checks/postfix_logging.xml
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="postfix_logging" version="1">
- <metadata>
- <title>Postfix Should Log Relevant Events and Logs Shall Be Protected.</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Postfix Should Log Relevant Events and Logs Shall Be Protected.</description>
- </metadata>
- <criteria comment="Postfix installed and service is configured to start" operator="AND">
- <!-- NOTE: The package install check is inherited from service_postfix_enabled -->
- <extend_definition comment="postfix configured to start" definition_ref="service_postfix_enabled" />
- <criteria operator="AND">
- <criterion comment="Test log file ownership" test_ref="test_postfix_logging_ownership" />
- <criterion comment="Test log file group ownership" test_ref="test_postfix_logging_gownership" />
- <criterion comment="Test log file permissions" test_ref="test_postfix_logging_permissions" />
- <criterion comment="Test logs set for maillog" test_ref="test_postfix_logging_sent_to_maillog" />
- <criterion comment="Test logs are set to rotate" test_ref="test_postfix_logging_maillog_rotates" />
- </criteria>
- </criteria>
- </definition>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing ownership of maillog file"
- id="test_postfix_logging_ownership" version="1">
- <unix:object object_ref="obj_postfix_logging_ownership" />
- <unix:state state_ref="state_postfix_logging_ownership" />
- </unix:file_test>
- <unix:file_state id="state_postfix_logging_ownership" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
- </unix:file_state>
- <unix:file_object comment="/var/log" id="obj_postfix_logging_ownership" version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>maillog</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing /var/log/maillog group ownership"
- id="test_postfix_logging_gownership" version="1">
- <unix:object object_ref="obj_postfix_logging_gownership" />
- <unix:state state_ref="state_postfix_logging_gownership" />
- </unix:file_test>
- <unix:file_state id="state_postfix_logging_gownership" version="1">
- <unix:group_id datatype="int">0</unix:group_id>
- </unix:file_state>
- <unix:file_object comment="/var/log" id="obj_postfix_logging_gownership" version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>maillog</unix:filename>
- </unix:file_object>
-
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing /var/log/maillog permissions"
- id="test_postfix_logging_permissions" version="1">
- <unix:object object_ref="obj_postfix_logging_permissions" />
- <unix:state state_ref="state_postfix_logging_permissions" />
- </unix:file_test>
- <unix:file_state id="state_postfix_logging_permissions" version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">true</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">false</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/var/log/maillog"
- id="obj_postfix_logging_permissions" version="1">
- <unix:path>/var/log</unix:path>
- <unix:filename>maillog</unix:filename>
- </unix:file_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Direct postfix events to the maillog"
- id="test_postfix_logging_sent_to_maillog" version="1">
- <ind:object object_ref="obj_postfix_logging_sent_to_maillog" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_postfix_logging_sent_to_maillog" version="1">
- <ind:path>/var/log</ind:path>
- <ind:filename>syslog.conf</ind:filename>
- <ind:pattern operation="pattern match">^mail\.\*\s*-\/var\/log\/maillog$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Direct postfix events to the maillog"
- id="test_postfix_logging_maillog_rotates" version="1">
- <ind:object object_ref="obj_postfix_logging_maillog_rotates" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_postfix_logging_maillog_rotates" version="1">
- <ind:path>/etc/logrotate.d</ind:path>
- <ind:filename>syslog</ind:filename>
- <ind:pattern operation="pattern match">/var\/log\/maillog</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
deleted file mode 100644
index 6fb035c..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra_defrtr" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra_defrtr" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr is set"
- test_ref="test_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set"
- id="test_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
- <unix:name>net.ipv6.conf.default.accept_ra_defrtr</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
- <unix:value datatype="int" operation="equals">0</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
deleted file mode 100644
index 84613e8..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra_pinfo" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra_pinfo" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo is set"
- test_ref="test_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set"
- id="test_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
- <unix:name>net.ipv6.conf.default.accept_ra_pinfo</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
- <unix:value datatype="int" operation="equals">0</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
deleted file mode 100644
index 748fb9b..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_autoconf" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.autoconf" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.autoconf" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.autoconf is set"
- test_ref="test_sysctl_net_ipv6_conf_default_autoconf" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set"
- id="test_sysctl_net_ipv6_conf_default_autoconf" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_autoconf" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_autoconf" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_autoconf" version="1">
- <unix:name>net.ipv6.conf.default.autoconf</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_autoconf" version="1">
- <unix:value datatype="int" operation="equals">0</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
deleted file mode 100644
index 033e3ab..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_dad_transmits" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.dad_transmits" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.dad_transmits" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.dad_transmits is set"
- test_ref="test_sysctl_net_ipv6_conf_default_dad_transmits" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.dad_transmits set"
- id="test_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_dad_transmits" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_dad_transmits" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
- <unix:name>net.ipv6.conf.default.dad_transmits</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
- <unix:value datatype="int" operation="equals">0</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
deleted file mode 100644
index c2559b4..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_max_addresses" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.max_addresses" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.max_addresses" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.max_addresses is set"
- test_ref="test_sysctl_net_ipv6_conf_default_max_addresses" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set"
- id="test_sysctl_net_ipv6_conf_default_max_addresses" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_max_addresses" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_max_addresses" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_max_addresses" version="1">
- <unix:name>net.ipv6.conf.default.max_addresses</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_max_addresses" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml
deleted file mode 100644
index c9d8439..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_conf_default_router_solicitations" version="1">
- <metadata>
- <title>Kernel Runtime Parameter "net.ipv6.conf.default.router_solicitations" Check</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel runtime parameter "net.ipv6.conf.default.router_solicitations" should be set to configured.</description>
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="IPv6 disabled or..."
- definition_ref="kernel_module_ipv6_option_disabled" />
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations is set"
- test_ref="test_sysctl_net_ipv6_conf_default_router_solicitations" />
- </criteria>
- </definition>
-
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set"
- id="test_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
- <unix:object object_ref="object_sysctl_net_ipv6_conf_default_router_solicitations" />
- <unix:state state_ref="state_sysctl_net_ipv6_conf_default_router_solicitations" />
- </unix:sysctl_test>
-
- <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
- <unix:name>net.ipv6.conf.default.router_solicitations</unix:name>
- </unix:sysctl_object>
-
- <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
- <unix:value datatype="int" operation="equals">0</unix:value>
- </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_removed.csv b/RHEL6/input/checks/templates/packages_removed.csv
index 7531835..40e2d89 100644
--- a/RHEL6/input/checks/templates/packages_removed.csv
+++ b/RHEL6/input/checks/templates/packages_removed.csv
@@ -28,7 +28,6 @@ rhnsd
rpcbind
rsh-server
samba-common
-samba
sendmail
smartmontools
squid
diff --git a/RHEL6/input/checks/templates/services_enabled.csv b/RHEL6/input/checks/templates/services_enabled.csv
index 10af819..bc6d1e6 100644
--- a/RHEL6/input/checks/templates/services_enabled.csv
+++ b/RHEL6/input/checks/templates/services_enabled.csv
@@ -3,7 +3,6 @@ crond,cronie
ip6tables,iptables-ipv6
iptables,iptables
irqbalance,irqbalance
-network,initscripts
ntpd,ntp
postfix,postfix
psacct,psacct
--
1.7.1
More information about the scap-security-guide
mailing list