[PATCH 15/15] Adding sysctl_net_ipv6_conf_all_accept_ra_value for XCCDF calls

Shawn Wells shawn at redhat.com
Fri Apr 18 03:33:54 UTC 2014


-------------- next part --------------
>From d81c48dee7148c236aad8cac522841782ce8a97c Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 23:07:38 -0400
Subject: [PATCH 15/15] Adding sysctl_net_ipv6_conf_all_accept_ra_value for XCCDF calls

---
 RHEL/6/input/system/network/ipv6.xml |   13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/RHEL/6/input/system/network/ipv6.xml b/RHEL/6/input/system/network/ipv6.xml
index 626f8e5..a23d54b 100644
--- a/RHEL/6/input/system/network/ipv6.xml
+++ b/RHEL/6/input/system/network/ipv6.xml
@@ -113,6 +113,15 @@ operator="equals" interactive="0">
 <value selector="disabled">0</value>
 </Value>
 
+<Value id="sysctl_net_ipv6_conf_all_accept_ra_value" type="string"
+operator="equals" interactive="0">
+<title>net.ipv6.conf.all.accept_ra</title>
+<description>Accept all router advertisements?</description>
+<value>0</value>
+<value selector="enabled">1</value>
+<value selector="disabled">0</value>
+</Value>
+
 <Value id="sysctl_net_ipv6_conf_default_accept_redirects_value" type="string"
 operator="equals" interactive="0">
 <title>net.ipv6.conf.default.accept_redirects</title>
@@ -146,11 +155,11 @@ An illicit router advertisement message could result in a man-in-the-middle atta
 <ocil>
 <sysctl-check-macro sysctl="net.ipv6.conf.all.accept_ra" value="0" />
 </ocil>
-<rational>
+<rationale>
 An illicit router advertizement message could result in a man-in-the-middle attack.
 </rationale>
 <ident cce="" />
-<oval id="sysctl_net_ipv6_conf_all_accept_ra" value="0" />
+<oval id="sysctl_net_ipv6_conf_all_accept_ra" value="sysctl_net_ipv6_conf_all_accept_ra_value" />
 <ref nist="CM-7" />
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list