[PATCH 2/2] copy-editing for prose publication
Shawn Wells
shawn at redhat.com
Sat Jul 12 04:26:03 UTC 2014
Ack to this patch. Comments below were just my notes to ensure a review
of individual changes.
On 7/10/14, 8:53 AM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at secure-innovations.net>
> ---
> RHEL/6/input/intro/intro.xml | 2 +-
> RHEL/6/input/system/accounts/physical.xml | 18 +++++++-------
> RHEL/6/input/system/network/iptables.xml | 24 ++++++++++----------
> RHEL/6/input/system/network/ipv6.xml | 10 ++++----
> RHEL/6/input/system/network/wireless.xml | 8 +++---
> RHEL/6/input/system/permissions/partitions.xml | 22 +++++++++---------
> RHEL/6/input/system/software/disk_partitioning.xml | 2 +-
> 7 files changed, 43 insertions(+), 43 deletions(-)
>
> diff --git a/RHEL/6/input/intro/intro.xml b/RHEL/6/input/intro/intro.xml
> index 6b34ec3..28b82f1 100644
> --- a/RHEL/6/input/intro/intro.xml
> +++ b/RHEL/6/input/intro/intro.xml
> @@ -146,7 +146,7 @@ by a dollar sign ($) prompt.
> <title>Formatting Conventions</title>
> <description>
> Commands intended for shell execution, as well as configuration file text,
> -are featured in a <tt>monospace font</tt>. <i>Italics</i> are used
> +are featured in a <tt>monospaced font</tt>. <i>Italics</i> are used
ack
> to indicate instances where the system administrator must substitute
> the appropriate information into a command or configuration file.
> </description>
> diff --git a/RHEL/6/input/system/accounts/physical.xml b/RHEL/6/input/system/accounts/physical.xml
> index e36056e..c9d1958 100644
> --- a/RHEL/6/input/system/accounts/physical.xml
> +++ b/RHEL/6/input/system/accounts/physical.xml
> @@ -168,7 +168,7 @@ prompted before any action is taken.
>
> NOTE: When updating the <tt>initscripts</tt> package on a Red Hat Enterprise
> Linux 6 system, custom changes to <tt>/etc/init/control-alt-delete.conf</tt>
> -may be overwritten. Refer tohttps://access.redhat.com/site/solutions/70464
> +may be overwritten. Refer to <b>https://access.redhat.com/site/solutions/70464</b>
> for additional information.
Are links bolded elsewhere?
> </rationale>
> <ident cce="27567-7"/>
> @@ -221,14 +221,14 @@ by choosing <b>Lock Screen</b> from the <b>System</b> menu.
> The <tt>gconftool-2</tt> program can be used to enforce mandatory
> screen locking settings for the default GNOME environment.
> The
> -following sections detail commands to enforce idle activation of the screen saver,
> +following sections detail commands to enforce idle activation of the screensaver,
ack
> screen locking, a blank-screen screensaver, and an idle
> activation time.
>
> <br /><br />
> Because users should be trained to lock the screen when they
> step away from the computer, the automatic locking feature is only
> -meant as a backup. The Lock Screen icon from the System menu can
> +meant as a backup. The <b>Lock Screen</b> icon from the <b>System</b> menu can
fine. ack.
> also be dragged to the taskbar in order to facilitate even more
> convenient screen-locking.
> <br /><br />
> @@ -238,9 +238,9 @@ to log into an X Windows environment, and should only be used to
> for direct login via console in emergency circumstances.
> <br /><br />
> For more information about configuring GNOME screensaver, see
> -http://live.gnome.org/GnomeScreensaver. For more information about
> +<b>http://live.gnome.org/GnomeScreensaver</b>. For more information about
ack
> enforcing preferences in the GNOME environment using the GConf
> -configuration system, seehttp://projects.gnome.org/gconf and
> +configuration system, see <b>http://projects.gnome.org/gconf</b> and
ack
> the man page <tt>gconftool-2(1)</tt>.</description>
>
> <Value id="inactivity_timeout_value" type="number" operator="equals">
> @@ -293,7 +293,7 @@ in the GNOME desktop after a period of inactivity:
> If properly configured, the output should be <tt>true</tt>.
> </ocil>
> <rationale>
> -Enabling idle activation of the screen saver ensures the screensaver will
> +Enabling idle activation of the screensaver ensures the screensaver will
ack
> be activated after the idle delay. Applications requiring continuous,
> real-time screen display (such as network management products) require the
> login session does not have administrator rights and the display station is located in a
> @@ -330,7 +330,7 @@ access the system, preventing access by passersby.
> </Rule>
>
> <Rule id="set_blank_screensaver">
> -<title>Implement Blank Screen Saver</title>
> +<title>Implement Blank Screensaver</title>
ack
> <description>
> Run the following command to set the screensaver mode
> in the GNOME desktop to a blank screen:
> @@ -391,7 +391,7 @@ for users who may need to suspend console logins.
> <title>Hardware Tokens for Authentication</title>
> <description>
> The use of hardware tokens such as smart cards for system login
> -provides stronger, two-factor authentication than using a username/password.
> +provides stronger, two-factor authentication than using a username and password.
ack
> In Red Hat Enterprise Linux servers and workstations, hardware token login
> is not enabled by default and must be enabled in the system settings.
> </description>
> @@ -419,7 +419,7 @@ smart card (CAC) authentication:
> </ul>
> </ocil>
> <rationale>Smart card login provides two-factor authentication stronger than
> -that provided by a username/password combination. Smart cards leverage a PKI
> +that provided by a username and password combination. Smart cards leverage PKI
ack
> (public key infrastructure) in order to provide and verify credentials.
> </rationale>
> <ident cce="27440-7"/>
> diff --git a/RHEL/6/input/system/network/iptables.xml b/RHEL/6/input/system/network/iptables.xml
> index bf31193..639b16e 100644
> --- a/RHEL/6/input/system/network/iptables.xml
> +++ b/RHEL/6/input/system/network/iptables.xml
> @@ -1,34 +1,34 @@
> <Group id="network-iptables">
> <title>iptables and ip6tables</title>
> -<description>A host-based firewall called Netfilter is included as
> +<description>A host-based firewall called <tt>netfilter</tt> is included as
ack
> part of the Linux kernel distributed with the system. It is
> activated by default. This firewall is controlled by the program
> -iptables, and the entire capability is frequently referred to by
> -this name. An analogous program called ip6tables handles filtering
> +<tt>iptables</tt>, and the entire capability is frequently referred to by
> +this name. An analogous program called <tt>ip6tables</tt> handles filtering
> for IPv6.
ack
> <br /><br />
> Unlike TCP Wrappers, which depends on the network server
> -program to support and respect the rules written, Netfilter
> +program to support and respect the rules written, <tt>netfilter</tt>
ack
> filtering occurs at the kernel level, before a program can even
> process the data from the network packet. As such, any program on
> the system is affected by the rules written.
> <br /><br />
> This section provides basic information about strengthening
> -the iptables and ip6tables configurations included with the system.
> +the <tt>iptables</tt> and <tt>ip6tables</tt> configurations included with the system.
ack
> For more complete information that may allow the construction of a
> sophisticated ruleset tailored to your environment, please consult
> the references at the end of this section.</description>
>
> <Group id="iptables_activation">
> <title>Inspect and Activate Default Rules</title>
> -<description>View the currently-enforced iptables rules by running
> +<description>View the currently-enforced <tt>iptables</tt> rules by running
ack
> the command:
> <pre># iptables -nL --line-numbers</pre>
> -The command is analogous for the ip6tables program.
> +The command is analogous for <tt>ip6tables</tt>.
ack
> <br /><br />
> If the firewall does not appear to be active (i.e., no rules
> appear), activate it and ensure that it starts at boot by issuing
> -the following commands (and analogously for ip6tables):
> +the following commands (and analogously for <tt>ip6tables</tt>):
ack
> <pre># service iptables restart</pre>
> The default iptables rules are:
> <pre>Chain INPUT (policy ACCEPT)
> @@ -81,7 +81,7 @@ Inspect the file <tt>/etc/sysconfig/ip6tables</tt> to determine
> the default policy for the INPUT chain. It should be set to DROP:
> <pre> # grep ":INPUT" /etc/sysconfig/ip6tables</pre>
> </ocil>
> -<rationale>In <tt>ip6tables</tt> the default policy is applied only after all
> +<rationale>In <tt>ip6tables</tt>, the default policy is applied only after all
ack
> the applicable rules in the table are examined for a match. Setting the
> default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
> any packets which are not explicitly permitted should not be
> @@ -111,7 +111,7 @@ capability for IPv4 and ICMP.
> <title>Strengthen the Default Ruleset</title>
> <description>The default rules can be strengthened. The system
> scripts that activate the firewall rules expect them to be defined
> -in the configuration files iptables and ip6tables in the directory
> +in the configuration files <tt>iptables</tt> and <tt>ip6tables</tt> in the directory
ack
> <tt>/etc/sysconfig</tt>. Many of the lines in these files are similar
> to the command line arguments that would be provided to the programs
> <tt>/sbin/iptables</tt> or <tt>/sbin/ip6tables</tt> - but some are quite
> @@ -169,7 +169,7 @@ add or correct the following line in
> <tt>/etc/sysconfig/iptables</tt>:
> <pre>:FORWARD DROP [0:0]</pre>
> </description>
> -<rationale>In <tt>iptables</tt> the default policy is applied only after all
> +<rationale>In <tt>iptables</tt>, the default policy is applied only after all
ack
> the applicable rules in the table are examined for a match. Setting the
> default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
> any packets which are not explicitly permitted should not be
> @@ -221,7 +221,7 @@ general-purpose use cases and can also make troubleshooting more difficult.
> <description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
> modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
> logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious
> -traffic, add identical rules with a target of DROP after each LOG.
> +traffic, add identical rules with a target of <tt>DROP</tt> after each <i>LOG</i>.
ack
> To log and then drop these IPv4 packets, insert the following rules in <tt>/etc/sysconfig/iptables</tt> (excepting
> any that are intentionally used):
> <pre>-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
> diff --git a/RHEL/6/input/system/network/ipv6.xml b/RHEL/6/input/system/network/ipv6.xml
> index 22f496e..cf9a07f 100644
> --- a/RHEL/6/input/system/network/ipv6.xml
> +++ b/RHEL/6/input/system/network/ipv6.xml
> @@ -218,21 +218,21 @@ net.ipv6.conf.default.max_addresses = 1</pre>
> The <tt>router_solicitations</tt> setting determines how many router
> solicitations are sent when bringing up the interface. If addresses are
> statically assigned, there is no need to send any solicitations.
> -<br />
> +<br /><br />
ack
> The <tt>accept_ra_pinfo</tt> setting controls whether the system will accept
> prefix info from the router.
> -<br />
> +<br /><br />
ack
> The <tt>accept_ra_defrtr</tt> setting controls whether the system will accept
> Hop Limit settings from a router advertisement. Setting it to 0 prevents a
> router from changing your default IPv6 Hop Limit for outgoing packets.
> -<br />
> +<br /><br />
ack
> The <tt>autoconf</tt> setting controls whether router advertisements can cause
> the system to assign a global unicast address to an interface.
> -<br />
> +<br /><br />
ack
> The <tt>dad_transmits</tt> setting determines how many neighbor solicitations
> to send out per address (global and link-local) when bringing up an interface
> to ensure the desired address is unique on the network.
> -<br />
> +<br /><br />
ack
> The <tt>max_addresses</tt> setting determines how many global unicast IPv6
> addresses can be assigned to each interface. The default is 16, but it should
> be set to exactly the number of statically configured global addresses
> diff --git a/RHEL/6/input/system/network/wireless.xml b/RHEL/6/input/system/network/wireless.xml
> index 209b65c..703f8dd 100644
> --- a/RHEL/6/input/system/network/wireless.xml
> +++ b/RHEL/6/input/system/network/wireless.xml
> @@ -4,7 +4,7 @@
> (WiFi) and Bluetooth, can present a security risk to sensitive or
> classified systems and networks. Wireless networking hardware is
> much more likely to be included in laptop or portable systems than
> -desktops or servers.
> +in desktops or servers.
ack
> <br /><br />
> Removal of hardware provides the greatest assurance that the wireless
> capability remains disabled. Acquisition policies often include provisions to
> @@ -24,7 +24,7 @@ prevent malicious software or careless users from re-activating the
> devices.</description>
>
> <Rule id="wireless_disable_in_bios">
> -<title>Disable WiFi or Bluetooth BIOS</title>
> +<title>Disable WiFi or Bluetooth in BIOS</title>
ack
> <description>Some systems that include built-in wireless support offer the
> ability to disable the device through the BIOS. This is system-specific;
> consult your hardware manual or explore the BIOS setup during
> @@ -45,8 +45,8 @@ normal usage of the wireless capability.
> <br /><br />
> First, identify the interfaces available with the command:
> <pre># ifconfig -a</pre>
> -Additionally,the following command may also be used to
> -determine whether wireless support ('extensions') is included for a
> +Additionally, the following command may be used to
> +determine whether wireless support is included for a
ack
> particular interface, though this may not always be a clear
> indicator:
> <pre># iwconfig</pre>
> diff --git a/RHEL/6/input/system/permissions/partitions.xml b/RHEL/6/input/system/permissions/partitions.xml
> index 7b38b93..aff29b9 100644
> --- a/RHEL/6/input/system/permissions/partitions.xml
> +++ b/RHEL/6/input/system/permissions/partitions.xml
> @@ -76,15 +76,15 @@ in the output are not removable media.
> <!-- investigate: this is like obsoleted by gvfs/DeviceKit-based mounting now -->
> <Rule id="mountopt_nosuid_on_removable_partitions">
> <title>Add nosuid Option to Removable Media Partitions</title>
> -<description>The <tt>nosuid</tt> mount option prevents set-user-identifier (suid)
> -and set-group-identifier (sgid) permissions from taking effect. These permissions
> +<description>The <tt>nosuid</tt> mount option prevents set-user-identifier (SUID)
> +and set-group-identifier (SGID) permissions from taking effect. These permissions
ack
> allow users to execute binaries with the same permissions as the owner and group
> -of the file respectively. Users should not be allowed to introduce suid and guid
> +of the file respectively. Users should not be allowed to introduce SUID and SGID
ack
> files into the system via partitions mounted from removeable media.
> <mount-desc-macro option="nosuid" part="any removable media partitions" />
> </description>
> -<rationale>The presence of suid and sgid executables should be tightly controlled. Allowing
> -users to introduce suid or sgid binaries from partitions mounted off of
> +<rationale>The presence of SUID and SGID executables should be tightly controlled. Allowing
> +users to introduce SUID or SGID binaries from partitions mounted off of
ack
> removable media would allow them to introduce their own highly-privileged programs.</rationale>
> <ident cce="27056-1" />
> <oval id="mount_option_nosuid_removable_partitions" value="var_removable_partition" />
> @@ -124,12 +124,12 @@ can expose the system to potential compromise.</rationale>
> <Rule id="mount_option_tmp_nosuid">
> <title>Add nosuid Option to /tmp</title>
> <description>The <tt>nosuid</tt> mount option can be used to prevent
> -execution of setuid programs in <tt>/tmp</tt>. The suid/sgid permissions
> +execution of setuid programs in <tt>/tmp</tt>. The SUID and SGID permissions
ack
> should not be required in these world-writable directories.
> <mount-desc-macro option="nosuid" part="/tmp" />
> </description>
> -<rationale>The presence of suid and sgid executables should be tightly controlled. Users
> -should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
> +<rationale>The presence of SUID and SGID executables should be tightly controlled. Users
> +should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
ack
> <ident cce="26762-5" />
> <oval id="mount_option_tmp_nosuid" />
> <ref nist="CM-7, MP-2"/>
> @@ -168,12 +168,12 @@ such as <tt>/dev/shm</tt> can expose the system to potential compromise.</ration
> <Rule id="mount_option_dev_shm_nosuid">
> <title>Add nosuid Option to /dev/shm</title>
> <description>The <tt>nosuid</tt> mount option can be used to prevent execution
> -of setuid programs in <tt>/dev/shm</tt>. The suid/sgid permissions should not
> +of setuid programs in <tt>/dev/shm</tt>. The SUID and SGID permissions should not
ack
> be required in these world-writable directories.
> <mount-desc-macro option="nosuid" part="/dev/shm" />
> </description>
> -<rationale>The presence of suid and sgid executables should be tightly controlled. Users
> -should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
> +<rationale>The presence of SUID and SGID executables should be tightly controlled. Users
> +should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
ack
> <ident cce="26486-1" />
> <oval id="mount_option_dev_shm_nosuid" />
> <ref nist="CM-7, MP-2"/>
> diff --git a/RHEL/6/input/system/software/disk_partitioning.xml b/RHEL/6/input/system/software/disk_partitioning.xml
> index a2c5914..c2f5ee2 100644
> --- a/RHEL/6/input/system/software/disk_partitioning.xml
> +++ b/RHEL/6/input/system/software/disk_partitioning.xml
> @@ -55,7 +55,7 @@ Ensuring that <tt>/var</tt> is mounted on its own partition enables the
> setting of more restrictive mount options. This helps protect
> system services such as daemons or other programs which use it.
> It is not uncommon for the <tt>/var</tt> directory to contain
> -world-writable directories, installed by other software packages.
> +world-writable directories installed by other software packages.
ack
> </rationale>
> <ident cce="26639-5"/>
> <oval id="partition_for_var" />
> -- 1.7.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140712/898e338f/attachment-0001.html>
More information about the scap-security-guide
mailing list