<br><br><div class="gmail_quote">On Thu, Jan 31, 2013 at 9:49 AM, Mike Palmiotto <span dir="ltr">&lt;<a href="mailto:mpalmiotto@tresys.com" target="_blank">mpalmiotto@tresys.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 1/31/2013 9:38 AM, Brian Millett wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I&#39;m really interested in adding fixes, or having a set of fixes I can apply to<br>
the xccdf for rhel6.  I&#39;ve looked at the line in the Makefile:<br>
<br>
xsltproc -stringparam fixes &quot;../$(IN)/fixes/bash-ks.xml&quot; -o<br>
$(OUT)/unlinked-rhel6-xccdf.<u></u>xml $(TRANS)/xccdf-addfixes.xslt<br>
$(OUT)/unlinked-rhel6-xccdf.<u></u>xml<br>
<br>
and it looks like, following the bas-ks.xml, I can create a file with each fix<br>
as long as each fix-id is the same as the rule-id so that the fix can be<br>
merged with the appropriate rule into a final xccdf.xml file.<br>
</blockquote>
<br></div>
When you say fix-id, do you mean the rule attribute for each fix tag?<br clear="all"></blockquote><div><br>Ok, silly me, I went back and looked at the bash-ks.xml and I had totally miss read the fix.<br><br>In the bash-ks.xml a fix is as<br>
<br> &lt;fix rule=&quot;disable_vsftp&quot;&gt;service vsftpd stop&lt;/fix&gt;<br><br>while in a xccdf Rule tag, the fix is as<br><br>&lt;fix id=&quot;service_restorecond_enabled&quot; reboot=&quot;false&quot; platform=&quot;&quot; system=&quot;&quot;&gt;chkconfig restorecond on&lt;/fix&gt;<br>
</div></div><br><br>So, I didn&#39;t grok the &quot;id=&quot; vs the &quot;rule=&quot;.  <br><br>That makes sense.<br><br>So the bash-ks.xml is<br><br>&lt;fix-group id=&quot;bash&quot; system=&quot;urn:xccdf:fix:script:bash&quot; xmlns=&quot;<a href="http://checklists.nist.gov/xccdf/1.1">http://checklists.nist.gov/xccdf/1.1</a>&quot;&gt;<br>
  &lt;fix rule=&quot;password_min_len&quot;&gt;##According to the OVAL check, there are two places to check for the MINLEN<br>  #1 in /etc/login.defs<br>  sed --follow-symlinks -i &#39;/^PASS_MIN_LEN/s/[0-9][0-9]*/14/&#39; /etc/login.defs<br>
  <br>  # and<br>  # 2 in  /etc/pam.d/system-auth<br>  grep -q minlen /etc/pam.d/system-auth<br>  if [ $? = &quot;0&quot; ]; then<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/minlen=[0-9]/minlen=14/">pam_cracklib.so/s/minlen=[0-9]/minlen=14/</a>&#39; /etc/pam.d/system-auth<br>
  else<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/pam_cracklib.so">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so minlen=14 /&#39; /etc/pam.d/system-auth<br>  fi&lt;/fix&gt;<br>  &lt;fix rule=&quot;password_min_age&quot;&gt;sed --follow-symlinks -i &#39;/^PASS_MIN_DAYS/s/[0-9][0-9]*/7/&#39; /etc/login.defs&lt;/fix&gt;<br>
  &lt;fix rule=&quot;password_max_age&quot;&gt;sed --follow-symlinks -i &#39;/^PASS_MAX/s/[0-9][0-9]*/90/&#39; /etc/login.defs&lt;/fix&gt;<br>  &lt;fix rule=&quot;password_warn_age&quot;&gt;sed --follow-symlinks -i &#39;/^PASS_WARN_AGE/s/[0-9][0-9]*/14/&#39; /etc/login.defs&lt;/fix&gt;<br>
  &lt;fix rule=&quot;account_disable_post_pw_expiration&quot;&gt;sed --follow-symlinks -i &#39;/^INACTIVE/s/[-]*[0-9][0-9]*/35/&#39; /etc/default/useradd&lt;/fix&gt;<br>  &lt;fix rule=&quot;account_unique_name&quot; /&gt;<br>
  &lt;fix rule=&quot;password_retry&quot;&gt;sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/retry=[0-9]/retry=3/">pam_cracklib.so/s/retry=[0-9]/retry=3/</a>&#39; /etc/pam.d/system-auth&lt;/fix&gt;<br>  &lt;fix rule=&quot;password_require_consecrepeat&quot;&gt;grep -q maxrepeat /etc/pam.d/system-auth<br>
  if [ $? = &quot;0&quot; ]; then<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/maxrepeat=[0-9]/maxrepeat=3/">pam_cracklib.so/s/maxrepeat=[0-9]/maxrepeat=3/</a>&#39; /etc/pam.d/system-auth<br>  else<br>
  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/pam_cracklib.so">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so maxrepeat=3 /&#39; /etc/pam.d/system-auth<br>  fi&lt;/fix&gt;<br>  &lt;fix rule=&quot;password_require_digits&quot;&gt;grep -q dcredit /etc/pam.d/system-auth<br>
  if [ $? = &quot;0&quot; ]; then<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/dcredit=[0-9]/dcredit=1/">pam_cracklib.so/s/dcredit=[0-9]/dcredit=1/</a>&#39; /etc/pam.d/system-auth<br>  else<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/pam_cracklib.so">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so dcredit=1 /&#39; /etc/pam.d/system-auth<br>
  fi&lt;/fix&gt;<br>  &lt;fix rule=&quot;password_require_uppercases&quot;&gt;grep -q ucredit /etc/pam.d/system-auth<br>  if [ $? = &quot;0&quot; ]; then<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/ucredit=[0-9]/ucredit=2/">pam_cracklib.so/s/ucredit=[0-9]/ucredit=2/</a>&#39; /etc/pam.d/system-auth<br>
  else<br>  sed --follow-symlinks -i &#39;/<a href="http://pam_cracklib.so/s/pam_cracklib.so">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so ucredit=2 /&#39; /etc/pam.d/system-auth<br>  fi&lt;/fix&gt;<br>&lt;/fix-group&gt;<br>
<br>-- <br>Brian Millett <br> &quot;Shifts in paradigms<br>             often cause nose bleeds.&quot;<br>Greg Glenn