[PATCH] Change CS2 idrefs to match benchmarks

Shawn Wells shawn at redhat.com
Wed Nov 13 01:19:16 UTC 2013


On 11/12/13, 2:46 PM, Matt Micene wrote:
>
> Running the CS2 profile in a test system I noted that there are a few 
> idrefs that don’t match the benchmark names, this patch renames those 
> to match the benchmark name.
>
> Pardon any inconsistencies in formatting, first patch.
>
> Matt Micene
>
> Solution Architect, Platforms
>
> RHCA #100-002-435
>
> DLT Solutions
>
> Direct 703-773-1195
>
>
> From 05df1004ad8a90032413147837721f96f4ee36b3 Mon Sep 17 00:00:00 2001
> From: Matt Micene <nzwulfin at gmail.com>
> Date: Tue, 12 Nov 2013 14:43:49 -0500
> Subject: [PATCH] Multiple CS2 profile typos
>
>
> Signed-off-by: Matt Micene <nzwulfin at gmail.com>
> ---
>  RHEL6/input/profiles/CS2.xml |   12 ++++++------
>  1 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
> index 0099b0a..ae050db 100644
> --- a/RHEL6/input/profiles/CS2.xml
> +++ b/RHEL6/input/profiles/CS2.xml
> @@ -6,8 +6,8 @@
>  <refine-value idref="var_accounts_password_minlen_login_defs" 
> selector="14"/>
>  <select idref="accounts_minimum_age_login_defs" selected="true"/>
>  <refine-value idref="var_accounts_minimum_age_login_defs" selector="1"/>
> -<select idref="acounts_maximum_age_login_defs" selected="true"/>
> -<refine-value idref="var_acounts_maximum_age_login_defs" selector="180"/>
> +<select idref="accounts_maximum_age_login_defs" selected="true"/>
> +<refine-value idref="var_accounts_maximum_age_login_defs" 
> selector="180"/>
>  <select idref="password_require_digits" selected="true"/>
>  <select idref="password_require_uppercases" selected="true"/>
>  <select idref="password_require_specials" selected="true"/>
> @@ -145,7 +145,7 @@
>  <select idref="audit_media_exports" selected="true"/>
>  <select idref="audit_file_deletions" selected="true"/>
>
> -<select idref="securety_root_login_console_only" selected="true" />
> +<select idref="securetty_root_login_console_only" selected="true" />
>  <select idref="no_direct_root_logins" selected="true" />
>
>  <select idref="userowner_shadow_file" selected="true"/>
> @@ -194,14 +194,14 @@
>  <select idref="gconf_gnome_disable_automount" selected="true"/>
>
>  <select idref="network_disable_zeroconf" selected="true" />
> -<select idref="disable_sysctl_ipv4_default_send_redirects" 
> selected="true"/>
> -<select idref="disable_sysctl_ipv4_all_send_redirects" selected="true"/>
> -<select idref="disable_sysctl_ipv4_ip_forward" selected="true"/>
> +<select idref="sysctl_ipv4_all_send_redirects" selected="true"/>
> +<select idref="sysctl_ipv4_ip_forward" selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_all_accept_source_route" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_all_accept_redirects" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_all_secure_redirects" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_default_accept_source_route" 
> selected="true"/>
> +<select idref="sysctl_net_ipv4_conf_default_send_redirects" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_default_secure_redirects" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_conf_default_accept_redirects" 
> selected="true"/>
>  <select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" 
> selected="true"/>
> -- 
> 1.7.1
>

Nice touch putting _default_send_redirects down with the other _net_ipv4 
checks.

Ack.

Note this addresses Calab's identification of the 
acounts_maximum_age_login_defs.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131112/01403c2a/attachment-0001.html>


More information about the scap-security-guide mailing list