[PATCH 2/2] removal of unused OVAL checks

Jeffrey Blank blank at eclipse.ncsc.mil
Fri May 17 05:13:24 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../accounts_no_nis_inclusions_etc_shadow.xml      |   23 -----
 .../checks/accounts_passwords_pam_tally2_deny.xml  |   31 ------
 .../console_device_restrict_access_server.xml      |   41 --------
 .../checks/file_groupowner_ldap_server_files.xml   |   31 ------
 RHEL6/input/checks/iptables_avahi_disabled.xml     |   43 ---------
 .../input/checks/package_initscripts_installed.xml |   26 -----
 RHEL6/input/checks/package_lvm2_installed.xml      |   25 -----
 RHEL6/input/checks/package_samba_removed.xml       |   25 -----
 RHEL6/input/checks/postfix_logging.xml             |   99 --------------------
 ...sctl_net_ipv6_conf_default_accept_ra_defrtr.xml |   31 ------
 ...ysctl_net_ipv6_conf_default_accept_ra_pinfo.xml |   31 ------
 .../sysctl_net_ipv6_conf_default_autoconf.xml      |   31 ------
 .../sysctl_net_ipv6_conf_default_dad_transmits.xml |   31 ------
 .../sysctl_net_ipv6_conf_default_max_addresses.xml |   31 ------
 ..._net_ipv6_conf_default_router_solicitations.xml |   31 ------
 RHEL6/input/checks/templates/packages_removed.csv  |    1 -
 RHEL6/input/checks/templates/services_enabled.csv  |    1 -
 17 files changed, 0 insertions(+), 532 deletions(-)
 delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
 delete mode 100644 RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
 delete mode 100644 RHEL6/input/checks/console_device_restrict_access_server.xml
 delete mode 100644 RHEL6/input/checks/file_groupowner_ldap_server_files.xml
 delete mode 100644 RHEL6/input/checks/iptables_avahi_disabled.xml
 delete mode 100644 RHEL6/input/checks/package_initscripts_installed.xml
 delete mode 100644 RHEL6/input/checks/package_lvm2_installed.xml
 delete mode 100644 RHEL6/input/checks/package_samba_removed.xml
 delete mode 100644 RHEL6/input/checks/postfix_logging.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml

diff --git a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml b/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
deleted file mode 100644
index 10828a8..0000000
--- a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_shadow.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
-  <definition class="compliance" id="accounts_no_nis_inclusions_etc_shadow" version="1">
-    <metadata>
-      <title>Remove Legacy + Entries From /etc/shadow</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>NIS file inclusions should be set appropriately in the /etc/shadow file.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="tests for reg exp '^\+' in /etc/shadow" test_ref="test_accounts_no_nis_inclusions_etc_shadow" />
-    </criteria>
-  </definition>
-  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp '^\+' in /etc/shadow" id="test_accounts_no_nis_inclusions_etc_shadow" version="1">
-    <ind:object object_ref="obj_20075" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_20075" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>shadow</ind:filename>
-    <ind:pattern operation="pattern match">^\+</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml b/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
deleted file mode 100644
index ca48f35..0000000
--- a/RHEL6/input/checks/accounts_passwords_pam_tally2_deny.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="accounts_passwords_pam_tally2_deny" version="1">
-    <metadata>
-      <title>Set deny for Failed Password Attempts</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The "account deny" policy should meet minimum
-      requirements.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="check that deny for pam_tally2 account module is configured correctly"
-      test_ref="test_200801" />
-    </criteria>
-  </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="only_one_exists"
-  comment="check system-auth pam_tally2 deny"
-  id="test_200801" version="1">
-    <ind:object object_ref="obj_200801" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_200801"
-  version="1">
-    <ind:path>/etc/pam.d</ind:path>
-    <ind:filename>system-auth</ind:filename>
-    <ind:pattern operation="pattern match">^\s*auth\s+required\s+pam_tally2\.so\s+deny=5\s+onerr=fail$</ind:pattern>
-    <ind:instance datatype="int" operation="greater than or equal">
-    1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/console_device_restrict_access_server.xml b/RHEL6/input/checks/console_device_restrict_access_server.xml
deleted file mode 100644
index 6016236..0000000
--- a/RHEL6/input/checks/console_device_restrict_access_server.xml
+++ /dev/null
@@ -1,41 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="console_device_restrict_access_server" version="1">
-    <metadata>
-      <title>Restrict Console Device Access - server</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Prevent remote users from gaining access to devices and restricted applications on the machine.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Restrict access - console"   test_ref="test_console_device_restrict_access_server_console" />
-      <criterion comment="Restrict access - xconsole"  test_ref="test_console_device_restrict_access_server_xconsole" />
-    </criteria>
-  </definition>
- 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Restrict access to the console, testing that console is set to tty[0-9][0-9]* vc/[0-9][0-9]*" 
-  id="test_console_device_restrict_access_server_console" version="1">
-    <ind:object object_ref="obj_console_device_restrict_access_server_console" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_console_device_restrict_access_server_console" version="1">
-    <ind:path>/etc/security</ind:path>
-    <ind:filename>console.perms</ind:filename>
-    <ind:pattern operation="pattern match">^.console.=tty\[0-9\]\[0-9\]\*\s+vc\/\[0-9]\[0-9]\*\s*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="none_exist" 
-  comment="Restrict access - xconsole, testing that xconsole is set to tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0" 
-  id="test_console_device_restrict_access_server_xconsole" version="1">
-    <ind:object object_ref="obj_console_device_restrict_access_server_xconsole" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_console_device_restrict_access_server_xconsole" version="1">
-    <ind:path>/etc/security</ind:path>
-    <ind:filename>console.perms</ind:filename>
-    <ind:pattern operation="pattern match">^.xconsole.=.*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/file_groupowner_ldap_server_files.xml b/RHEL6/input/checks/file_groupowner_ldap_server_files.xml
deleted file mode 100644
index e3d1022..0000000
--- a/RHEL6/input/checks/file_groupowner_ldap_server_files.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="file_groupowner_ldap_server_files" version="1">
-    <metadata>
-      <title>Verify Group Ownership of LDAP Server Data Files</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The /var/lib/ldap/* files should be owned by the
-      appropriate group.</description>
-    </metadata>
-    <criteria>
-      <criterion test_ref="test_20142" />
-    </criteria>
-  </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership to be root"
-  id="test_20142" version="1">
-    <unix:object object_ref="obj_20142" />
-    <unix:state state_ref="state_20142" />
-  </unix:file_test>
-  <unix:file_state id="state_20142"
-  version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/var/lib/ldap/*"
-  id="obj_20142" version="1">
-    <unix:path>/var/lib/ldap</unix:path>
-    <unix:filename operation="pattern match">*</unix:filename>    
-  </unix:file_object>
-</def-group>
diff --git a/RHEL6/input/checks/iptables_avahi_disabled.xml b/RHEL6/input/checks/iptables_avahi_disabled.xml
deleted file mode 100644
index 3a7ce11..0000000
--- a/RHEL6/input/checks/iptables_avahi_disabled.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="iptables_avahi_disabled" version="1">
-    <metadata>
-      <title>The firewall should allow or reject access to the
-      avahi service.</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The firewall should allow or reject access to
-      the avahi service.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="TODO::INSERT"
-      test_ref="test_180370" />
-      <criterion test_ref="test_180371" />
-    </criteria>
-  </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="none_exist" comment="TODO::INSERT"
-  id="test_180370" version="1">
-    <ind:object object_ref="obj_180370" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object comment="TODO::INSERT"
-  id="obj_180370" version="1">
-    <ind:path>/etc/sysconfig</ind:path>
-    <ind:filename>iptables</ind:filename>
-    <ind:pattern operation="pattern match">^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-  <ind:textfilecontent54_test check="all"
-  check_existence="none_exist" comment="TODO::INSERT"
-  id="test_180371" version="1">
-    <ind:object object_ref="obj_180371" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object comment="TODO::INSERT"
-  id="obj_180371" version="1">
-    <ind:path>/etc/sysconfig</ind:path>
-    <ind:filename>ip6tables</ind:filename>
-    <ind:pattern operation="pattern match">^-A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_initscripts_installed.xml b/RHEL6/input/checks/package_initscripts_installed.xml
deleted file mode 100644
index 5b1e7c6..0000000
--- a/RHEL6/input/checks/package_initscripts_installed.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="package_initscripts_installed" version="1">
-    <metadata>
-      <title>Package initscripts Installed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The package initscripts should be installed.
-      This check was generated by the 'create_services_enabled.py'
-      script in the templates directory.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package initscripts is installed"
-      test_ref="test_package_initscripts_installed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="all_exist"
-  id="test_package_initscripts_installed" version="1"
-  comment="package initscripts is installed">
-    <linux:object object_ref="obj_package_initscripts" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_initscripts" version="1">
-    <linux:name>initscripts</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_lvm2_installed.xml b/RHEL6/input/checks/package_lvm2_installed.xml
deleted file mode 100644
index 88e3785..0000000
--- a/RHEL6/input/checks/package_lvm2_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_lvm2_installed"
-  version="1">
-    <metadata>
-      <title>Package lvm2 Installed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package lvm2 should be installed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package lvm2 is installed"
-      test_ref="test_package_lvm2_installed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="all_exist"
-  id="test_package_lvm2_installed" version="1"
-  comment="package lvm2 is installed">
-    <linux:object object_ref="obj_package_lvm2_installed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_lvm2_installed" version="1">
-    <linux:name>lvm2</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_samba_removed.xml b/RHEL6/input/checks/package_samba_removed.xml
deleted file mode 100644
index cb59f4e..0000000
--- a/RHEL6/input/checks/package_samba_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_samba_removed"
-  version="1">
-    <metadata>
-      <title>Package samba Removed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package samba should be removed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package samba is removed"
-      test_ref="test_package_samba_removed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="none_exist"
-  id="test_package_samba_removed" version="1"
-  comment="package samba is removed">
-    <linux:object object_ref="obj_package_samba_removed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_samba_removed" version="1">
-    <linux:name>samba</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/postfix_logging.xml b/RHEL6/input/checks/postfix_logging.xml
deleted file mode 100644
index d0e498f..0000000
--- a/RHEL6/input/checks/postfix_logging.xml
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_logging" version="1">
-    <metadata>
-      <title>Postfix Should Log Relevant Events and Logs Shall Be Protected.</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Postfix Should Log Relevant Events and Logs Shall Be Protected.</description>
-    </metadata>
-    <criteria comment="Postfix installed and service is configured to start" operator="AND">
-      <!-- NOTE: The package install check is inherited from service_postfix_enabled -->
-      <extend_definition comment="postfix configured to start" definition_ref="service_postfix_enabled" />
-      <criteria operator="AND">
-        <criterion comment="Test log file ownership"       test_ref="test_postfix_logging_ownership" />
-        <criterion comment="Test log file group ownership" test_ref="test_postfix_logging_gownership" />
-        <criterion comment="Test log file permissions"     test_ref="test_postfix_logging_permissions" />
-        <criterion comment="Test logs set for maillog"     test_ref="test_postfix_logging_sent_to_maillog" />
-        <criterion comment="Test logs are set to rotate"   test_ref="test_postfix_logging_maillog_rotates" />
-      </criteria>
-    </criteria>
-  </definition>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing ownership of maillog file"
-  id="test_postfix_logging_ownership" version="1">
-    <unix:object object_ref="obj_postfix_logging_ownership" />
-    <unix:state state_ref="state_postfix_logging_ownership" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_logging_ownership" version="1">
-    <unix:user_id datatype="int">0</unix:user_id>
-  </unix:file_state>
-  <unix:file_object comment="/var/log" id="obj_postfix_logging_ownership" version="1">
-    <unix:path>/var/log</unix:path>
-    <unix:filename>maillog</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing /var/log/maillog group ownership"
-  id="test_postfix_logging_gownership" version="1">
-    <unix:object object_ref="obj_postfix_logging_gownership" />
-    <unix:state state_ref="state_postfix_logging_gownership" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_logging_gownership" version="1">
-    <unix:group_id datatype="int">0</unix:group_id>
-  </unix:file_state>
-  <unix:file_object comment="/var/log" id="obj_postfix_logging_gownership" version="1">
-    <unix:path>/var/log</unix:path>
-    <unix:filename>maillog</unix:filename>
-  </unix:file_object>
-
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing /var/log/maillog permissions"
-  id="test_postfix_logging_permissions" version="1">
-    <unix:object object_ref="obj_postfix_logging_permissions" />
-    <unix:state state_ref="state_postfix_logging_permissions" />
-  </unix:file_test>
-  <unix:file_state id="state_postfix_logging_permissions" version="1">
-    <unix:uread datatype="boolean">true</unix:uread>
-    <unix:uwrite datatype="boolean">true</unix:uwrite>
-    <unix:uexec datatype="boolean">false</unix:uexec>
-    <unix:gread datatype="boolean">false</unix:gread>
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">false</unix:gexec>
-    <unix:oread datatype="boolean">false</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">false</unix:oexec>
-  </unix:file_state>
-  <unix:file_object comment="/var/log/maillog"
-  id="obj_postfix_logging_permissions" version="1">
-    <unix:path>/var/log</unix:path>
-    <unix:filename>maillog</unix:filename>
-  </unix:file_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Direct postfix events to the maillog" 
-  id="test_postfix_logging_sent_to_maillog" version="1">
-    <ind:object object_ref="obj_postfix_logging_sent_to_maillog" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_postfix_logging_sent_to_maillog" version="1">
-    <ind:path>/var/log</ind:path>
-    <ind:filename>syslog.conf</ind:filename>
-    <ind:pattern operation="pattern match">^mail\.\*\s*-\/var\/log\/maillog$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Direct postfix events to the maillog" 
-  id="test_postfix_logging_maillog_rotates" version="1">
-    <ind:object object_ref="obj_postfix_logging_maillog_rotates" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_postfix_logging_maillog_rotates" version="1">
-    <ind:path>/etc/logrotate.d</ind:path>
-    <ind:filename>syslog</ind:filename>
-    <ind:pattern operation="pattern match">/var\/log\/maillog</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
deleted file mode 100644
index 6fb035c..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_defrtr.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra_defrtr" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra_defrtr" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set" 
-  id="test_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra_defrtr" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
-    <unix:name>net.ipv6.conf.default.accept_ra_defrtr</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra_defrtr" version="1">
-    <unix:value datatype="int" operation="equals">0</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
deleted file mode 100644
index 84613e8..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_pinfo.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_ra_pinfo" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra_pinfo" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set" 
-  id="test_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra_pinfo" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
-    <unix:name>net.ipv6.conf.default.accept_ra_pinfo</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_ra_pinfo" version="1">
-    <unix:value datatype="int" operation="equals">0</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
deleted file mode 100644
index 748fb9b..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_autoconf.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_autoconf" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.autoconf" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.autoconf" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.autoconf is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_autoconf" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set" 
-  id="test_sysctl_net_ipv6_conf_default_autoconf" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_autoconf" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_autoconf" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_autoconf" version="1">
-    <unix:name>net.ipv6.conf.default.autoconf</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_autoconf" version="1">
-    <unix:value datatype="int" operation="equals">0</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
deleted file mode 100644
index 033e3ab..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_dad_transmits.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_dad_transmits" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.dad_transmits" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.dad_transmits" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.dad_transmits is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_dad_transmits" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.dad_transmits set" 
-  id="test_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_dad_transmits" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_dad_transmits" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
-    <unix:name>net.ipv6.conf.default.dad_transmits</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_dad_transmits" version="1">
-    <unix:value datatype="int" operation="equals">0</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
deleted file mode 100644
index c2559b4..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_max_addresses.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_max_addresses" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.max_addresses" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.max_addresses" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.max_addresses is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_max_addresses" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set" 
-  id="test_sysctl_net_ipv6_conf_default_max_addresses" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_max_addresses" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_max_addresses" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_max_addresses" version="1">
-    <unix:name>net.ipv6.conf.default.max_addresses</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_max_addresses" version="1">
-    <unix:value datatype="int" operation="equals">1</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml
deleted file mode 100644
index c9d8439..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_router_solicitations.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_default_router_solicitations" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.default.router_solicitations" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.default.router_solicitations" should be set to configured.</description>
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..."
-      definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations is set"
-      test_ref="test_sysctl_net_ipv6_conf_default_router_solicitations" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set" 
-  id="test_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_default_router_solicitations" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_default_router_solicitations" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
-    <unix:name>net.ipv6.conf.default.router_solicitations</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_router_solicitations" version="1">
-    <unix:value datatype="int" operation="equals">0</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_removed.csv b/RHEL6/input/checks/templates/packages_removed.csv
index 7531835..40e2d89 100644
--- a/RHEL6/input/checks/templates/packages_removed.csv
+++ b/RHEL6/input/checks/templates/packages_removed.csv
@@ -28,7 +28,6 @@ rhnsd
 rpcbind
 rsh-server
 samba-common
-samba
 sendmail
 smartmontools
 squid
diff --git a/RHEL6/input/checks/templates/services_enabled.csv b/RHEL6/input/checks/templates/services_enabled.csv
index 10af819..bc6d1e6 100644
--- a/RHEL6/input/checks/templates/services_enabled.csv
+++ b/RHEL6/input/checks/templates/services_enabled.csv
@@ -3,7 +3,6 @@ crond,cronie
 ip6tables,iptables-ipv6
 iptables,iptables
 irqbalance,irqbalance
-network,initscripts
 ntpd,ntp
 postfix,postfix
 psacct,psacct
-- 
1.7.1



More information about the scap-security-guide mailing list