[PATCH 2/3] updated 800-53 control references (services)
David Smith
dsmith at secure-innovations.net
Thu Jul 17 18:21:31 UTC 2014
Signed-off-by: David Smith <dsmith at secure-innovations.net>
---
RHEL/6/input/services/base.xml | 18 +++++++++---------
RHEL/6/input/services/obsolete.xml | 28 ++++++++++++++--------------
RHEL/6/input/services/ssh.xml | 4 ++--
3 files changed, 25 insertions(+), 25 deletions(-)
diff --git a/RHEL/6/input/services/base.xml b/RHEL/6/input/services/base.xml
index 489a4a2..5bb36e0 100644
--- a/RHEL/6/input/services/base.xml
+++ b/RHEL/6/input/services/base.xml
@@ -22,7 +22,7 @@ vulnerabilities in software executing on the local machine, as well as sensitive
information from within a process's address space or registers.</rationale>
<ident cce="27247-6" />
<oval id="service_abrtd_disabled" />
-<ref nist="AC-17(8),CM-7" disa="381" />
+<ref nist="CM-7" disa="381" />
</Rule>
<Rule id="service_acpid_disabled">
@@ -153,7 +153,7 @@ crash, which can load information from the crashed kernel for analysis.
is little need to run the kdump service.</rationale>
<ident cce="26850-8" />
<oval id="service_kdump_disabled" />
-<ref nist="AC-17(8),CM-7" />
+<ref nist="CM-7" />
</Rule>
@@ -205,7 +205,7 @@ kernel panics, which is not common.
</rationale>
<ident cce="27254-2" />
<oval id="service_netconsole_disabled" />
-<ref nist="AC-17(8),CM-7" disa="381" />
+<ref nist="CM-7" disa="381" />
</Rule>
<Rule id="service_ntpdate_disabled">
@@ -224,7 +224,7 @@ reboots. In any event, the functionality of the ntpdate service is now
available in the ntpd program and should be considered deprecated.</rationale>
<ident cce="27256-7" />
<oval id="service_ntpdate_disabled" />
-<ref nist="AC-17(8),CM-7" disa="382" />
+<ref nist="CM-7" disa="382" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -260,7 +260,7 @@ preventing conflicting usage of ports in the reserved port range, but it can be
disabled if not needed.</rationale>
<ident cce="27258-3" />
<oval id="service_portreserve_disabled" />
-<ref nist="AC-17(8),CM-7" />
+<ref nist="CM-7" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -298,7 +298,7 @@ the system is not intended to receive AMQP traffic, then the <tt>qpidd</tt>
service is not needed and should be disabled or removed.</rationale>
<ident cce="26928-2" />
<oval id="service_qpidd_disabled" />
-<ref nist="AC-17(8),CM-7" disa="382" />
+<ref nist="CM-7" disa="382" />
</Rule>
<Rule id="service_quota_nld_disabled">
@@ -337,7 +337,7 @@ some special-purpose systems often use DHCP (instead of IRDP) to retrieve
dynamic network configuration information.</rationale>
<ident cce="27261-7" />
<oval id="service_rdisc_disabled" />
-<ref nist="AC-17(8),AC-4,CM-7" disa="382" />
+<ref nist="AC-4,CM-7" disa="382" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -356,7 +356,7 @@ desirable for some environments. However, if the system is being managed by RHN
RHN Satellite Server the <tt>rhnsd</tt> daemon can remain on. </rationale>
<ident cce="26846-6" />
<oval id="service_rhnsd_disabled" />
-<ref nist="AC-17(8),CM-7" disa="382" />
+<ref nist="CM-7" disa="382" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -395,7 +395,7 @@ use Kerberos and LDAP. For others, however, in which only local files may be
consulted, it is not necessary and should be disabled.</rationale>
<ident cce="27263-3" />
<oval id="service_saslauthd_disabled" />
-<ref nist="AC-17(8),CM-7" />
+<ref nist="CM-7" />
<tested by="DS" on="20121024"/>
</Rule>
diff --git a/RHEL/6/input/services/obsolete.xml b/RHEL/6/input/services/obsolete.xml
index 3a2b7c9..82f8a78 100644
--- a/RHEL/6/input/services/obsolete.xml
+++ b/RHEL/6/input/services/obsolete.xml
@@ -41,7 +41,7 @@ attacks against xinetd itself.
</rationale>
<ident cce="27046-2" />
<oval id="service_xinetd_disabled" />
-<ref nist="AC-17(8),CM-7" disa="305"/>
+<ref nist="CM-7" disa="305"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -60,7 +60,7 @@ xinetd service's accidental (or intentional) activation.
</rationale>
<ident cce="27005-8" />
<oval id="package_xinetd_removed" />
-<ref nist="AC-17(8),CM-7" disa="305"/>
+<ref nist="CM-7" disa="305"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -87,7 +87,7 @@ subject to man-in-the-middle attacks.
</rationale>
<ident cce="26836-7" />
<oval id="service_telnetd_disabled" />
-<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" />
+<ref nist="CM-7,IA-5(1)(c)" disa="68,1436,197,877,888" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -103,7 +103,7 @@ telnet service's accidental (or intentional) activation.
</rationale>
<ident cce="27073-6" />
<oval id="package_telnet-server_removed" />
-<ref nist="AC-17(8),CM-7" disa="305,381"/>
+<ref nist="CM-7" disa="305,381"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -143,7 +143,7 @@ activation.
</rationale>
<ident cce="27062-9" />
<oval id="package_rsh-server_removed" />
-<ref nist="AC-17(8),CM-7" disa="305,381"/>
+<ref nist="CM-7" disa="305,381"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -162,7 +162,7 @@ stolen by eavesdroppers on the network.
</rationale>
<ident cce="27208-8" />
<oval id="service_rexec_disabled" />
-<ref nist="AC-17(8),CM-7" disa="68,1436"/>
+<ref nist="CM-7" disa="68,1436"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -181,7 +181,7 @@ stolen by eavesdroppers on the network.
</rationale>
<ident cce="26994-4" />
<oval id="service_rsh_disabled" />
-<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="68,1436" />
+<ref nist="CM-7,IA-5(1)(c)" disa="68,1436" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -217,7 +217,7 @@ stolen by eavesdroppers on the network.
</rationale>
<ident cce="26865-6" />
<oval id="service_rlogin_disabled" />
-<ref nist="AC-17(8),CM-7,IA-5(1)(c)" disa="1436" />
+<ref nist="CM-7,IA-5(1)(c)" disa="1436" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -240,7 +240,7 @@ of an Rsh trust relationship.
used in conjunction with the R-services, they can allow
unauthenticated access to a system.</rationale>
<ident cce="27270-8" />
-<ref nist="AC-17(8),CM-7" disa="1436" />
+<ref nist="CM-7" disa="1436" />
<oval id="no_rsh_trust_files" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -267,7 +267,7 @@ accidental (or intentional) activation of NIS or NIS+ services.
</rationale>
<ident cce="27079-3" />
<oval id="package_ypserv_removed" />
-<ref nist="AC-17(8),CM-7" disa="305,381"/>
+<ref nist="CM-7" disa="305,381"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -284,7 +284,7 @@ as a client in a NIS or NIS+ domain.
</rationale>
<ident cce="26894-6" />
<oval id="service_ypbind_disabled" />
-<ref nist="AC-17(8),CM-7" disa="305"/>
+<ref nist="CM-7" disa="305"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -328,7 +328,7 @@ as a TFTP server, which does not provide encryption or authentication.
</rationale>
<ident cce="27055-3" />
<oval id="service_tftp_disabled" />
-<ref nist="AC-17(8),CM-7" disa="1436" />
+<ref nist="CM-7" disa="1436" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -346,7 +346,7 @@ accidental (or intentional) activation of tftp services.
</rationale>
<ident cce="26946-4" />
<oval id="package_tftp-server_removed" />
-<ref nist="AC-17(8),CM-7" disa="305"/>
+<ref nist="CM-7" disa="305"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -392,7 +392,7 @@ server_args = -s /var/lib/tftpboot</pre>
</ocil>
<ident cce="27272-4" />
<oval id="tftpd_uses_secure_mode" />
-<ref nist="AC-17(8),CM-7" disa="366"/>
+<ref nist="CM-7" disa="366"/>
</Rule>
</Group>
diff --git a/RHEL/6/input/services/ssh.xml b/RHEL/6/input/services/ssh.xml
index 695418a..9464256 100644
--- a/RHEL/6/input/services/ssh.xml
+++ b/RHEL/6/input/services/ssh.xml
@@ -83,7 +83,7 @@ should not be used.
</rationale>
<ident cce="27072-8" />
<oval id="sshd_allow_only_protocol2" />
-<ref nist="AC-17(7),IA-5(1)(c)" disa="776,774,1436" />
+<ref nist="AC-3(10),IA-5(1)(c)" disa="776,774,1436" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -365,7 +365,7 @@ implementation. These are also required for compliance.
</rationale>
<ident cce="26555-3" />
<oval id="sshd_use_approved_ciphers" />
-<ref nist="AC-3,AC-17(2),AU-10(5),IA-5(1)(c),IA-7" disa="803,1144,1145,1146" />
+<ref nist="AC-3,AC-17(2),SI-7,IA-5(1)(c),IA-7" disa="803,1144,1145,1146" />
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list