[PATCH] [corrected] OVAL signoff

Shawn Wells shawn at redhat.com
Sat Oct 26 18:08:06 UTC 2013


On 10/26/13, 1:49 PM, David Smith wrote:
> ---
>   .../checks/kernel_module_ipv6_option_disabled.xml  |    1 +
>   RHEL6/input/checks/ldap_client_start_tls.xml       |    1 +
>   RHEL6/input/checks/service_rexec_disabled.xml      |    1 +
>   RHEL6/input/checks/service_rlogin_disabled.xml     |    1 +
>   RHEL6/input/checks/service_rsh_disabled.xml        |    1 +
>   RHEL6/input/checks/service_telnetd_disabled.xml    |    1 +
>   RHEL6/input/checks/service_xinetd_disabled.xml     |    1 +
>   RHEL6/input/services/obsolete.xml                  |    8 ++++----
>   8 files changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/RHEL6/input/checks/kernel_module_ipv6_option_disabled.xml b/RHEL6/input/checks/kernel_module_ipv6_option_disabled.xml
> index a1203bf..cb61e74 100644
> --- a/RHEL6/input/checks/kernel_module_ipv6_option_disabled.xml
> +++ b/RHEL6/input/checks/kernel_module_ipv6_option_disabled.xml
> @@ -6,6 +6,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria>
>         <criterion test_ref="test_kernel_module_ipv6_option_disabled" comment="ipv6 disabled any modprobe conf file"/>
> diff --git a/RHEL6/input/checks/ldap_client_start_tls.xml b/RHEL6/input/checks/ldap_client_start_tls.xml
> index 75f636d..184b9c2 100644
> --- a/RHEL6/input/checks/ldap_client_start_tls.xml
> +++ b/RHEL6/input/checks/ldap_client_start_tls.xml
> @@ -7,6 +7,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>Require the use of TLS for ldap clients.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria comment="package pam_ldap is not present" operator="OR">
>         <extend_definition comment="pam_ldap not present or not in use"
> diff --git a/RHEL6/input/checks/service_rexec_disabled.xml b/RHEL6/input/checks/service_rexec_disabled.xml
> index 9e1ee78..205b567 100644
> --- a/RHEL6/input/checks/service_rexec_disabled.xml
> +++ b/RHEL6/input/checks/service_rexec_disabled.xml
> @@ -6,6 +6,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The rexec service should be disabled if possible.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria comment="package rsh-server removed or service rexec is not configured to start" operator="OR">
>         <extend_definition comment="rpm package rsh-server removed" definition_ref="package_rsh-server_removed" />
> diff --git a/RHEL6/input/checks/service_rlogin_disabled.xml b/RHEL6/input/checks/service_rlogin_disabled.xml
> index 6318c9a..ed95c27 100644
> --- a/RHEL6/input/checks/service_rlogin_disabled.xml
> +++ b/RHEL6/input/checks/service_rlogin_disabled.xml
> @@ -6,6 +6,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The rlogin service should be disabled if possible.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria comment="package rsh-server removed or service rlogin is not configured to start" operator="OR">
>         <extend_definition comment="rpm package rsh-server removed" definition_ref="package_rsh-server_removed" />
> diff --git a/RHEL6/input/checks/service_rsh_disabled.xml b/RHEL6/input/checks/service_rsh_disabled.xml
> index 71bc9ff..54e9136 100644
> --- a/RHEL6/input/checks/service_rsh_disabled.xml
> +++ b/RHEL6/input/checks/service_rsh_disabled.xml
> @@ -6,6 +6,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The rsh service should be disabled if possible.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria comment="package rsh-server removed or service rsh is not configured to start" operator="OR">
>         <extend_definition comment="rpm package rsh-server removed" definition_ref="package_rsh-server_removed" />
> diff --git a/RHEL6/input/checks/service_telnetd_disabled.xml b/RHEL6/input/checks/service_telnetd_disabled.xml
> index b02fe67..095f7ad 100644
> --- a/RHEL6/input/checks/service_telnetd_disabled.xml
> +++ b/RHEL6/input/checks/service_telnetd_disabled.xml
> @@ -7,6 +7,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>Disable telnet Service</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>       <criteria comment="package telnet-server removed or service telnetd is not configured to start" operator="OR">
>         <extend_definition comment="rpm package telnet-server removed" definition_ref="package_telnet-server_removed" />
> diff --git a/RHEL6/input/checks/service_xinetd_disabled.xml b/RHEL6/input/checks/service_xinetd_disabled.xml
> index 24ad0ef..c162e23 100644
> --- a/RHEL6/input/checks/service_xinetd_disabled.xml
> +++ b/RHEL6/input/checks/service_xinetd_disabled.xml
> @@ -8,6 +8,7 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The xinetd service should be disabled if possible.</description>
> +      <reference source="DS" ref_id="20131018" ref_url="test_attestation" />
>       </metadata>
>      <criteria comment="package xinetd removed or service xinetd is not configured to start" operator="OR">
>       <extend_definition comment="xinetd removed" definition_ref="package_xinetd_removed" />
> diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
> index 41ee480..1792120 100644
> --- a/RHEL6/input/services/obsolete.xml
> +++ b/RHEL6/input/services/obsolete.xml
> @@ -77,7 +77,7 @@ actively working to migrate to a more secure protocol.</description>
>   <description>
>   <service-disable-macro service="telnet" />
>   </description>
> -<ocil><service-disable-check-macro service="telnet" /></ocil>
> +<ocil><xinetd-service-disable-check-macro service="telnet" /></ocil>
>   <rationale>
>   The telnet protocol uses unencrypted network communication, which
>   means that data from the login session, including passwords and
> @@ -139,7 +139,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
>   should be disabled.
>   <service-disable-macro service="rexec" />
>   </description>
> -<ocil><service-disable-check-macro service="rexec" /></ocil>
> +<ocil><xinetd-service-disable-check-macro service="rexec" /></ocil>
>   <rationale>The rexec service uses unencrypted network communications, which
>   means that data from the login session, including passwords and
>   all other information transmitted during the session, can be
> @@ -158,7 +158,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
>   should be disabled.
>   <service-disable-macro service="rsh" />
>   </description>
> -<ocil><service-disable-check-macro service="rsh" /></ocil>
> +<ocil><xinetd-service-disable-check-macro service="rsh" /></ocil>
>   <rationale>The rsh service uses unencrypted network communications, which
>   means that data from the login session, including passwords and
>   all other information transmitted during the session, can be
> @@ -177,7 +177,7 @@ the <tt>rsh-server</tt> package and runs as a service through xinetd,
>   should be disabled.
>   <service-disable-macro service="rlogin" />
>   </description>
> -<ocil><service-disable-check-macro service="rlogin" /></ocil>
> +<ocil><xinetd-service-disable-check-macro service="rlogin" /></ocil>
>   <rationale>The rlogin service uses unencrypted network communications, which
>   means that data from the login session, including passwords and
>   all other information transmitted during the session, can be



ack, noting that patch 2 is now irrelevant (good find)


More information about the scap-security-guide mailing list