<div dir="ltr">Right, I recently pushed a fix for this bug, it just hasn't made the current build yet. Good catch though, false positives stink.<div><br></div><div>Andrew</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Jul 31, 2013 at 9:15 AM, Stuart Green <span dir="ltr"><<a href="mailto:stuart.green@doccentrics.com" target="_blank">stuart.green@doccentrics.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Greetings All,<br>
<br>
New to this list!<br>
<br>
I think I might have found an issue with the SSG policy content.<br>
<br>
Summary: If you do not have telnet installed on the system it causes Rule ID: disable_telnet_service to fail.<br>
<br>
<br>
<br>
In no place in this rule does it consider that telnet might not be installed at all, so it fails (rather than errors, or even better does a check as a precursor to see if its installed at all and if not passes!)<br>
<br>
<br>
grep 'id="oval:ssg:tst:231"' ssg-rhel6-oval.xml.result.xml<br>
<ind-def:textfilecontent54_<u></u>test id="oval:ssg:tst:231" version="1" check_existence="all_exist" check="all" comment="Disable Telnet Service"><br>
<test test_id="oval:ssg:tst:231" version="1" check_existence="all_exist" check="all" result="false"/><br>
<br>
<br>
<Rule id="disable_telnet_service" selected="false" severity="high"><br>
<title xml:lang="en-US">Disable telnet Service</title><br>
<description xmlns:xhtml="<a href="http://www.w3.org/1999/xhtml" target="_blank">http://www.w3.<u></u>org/1999/xhtml</a>" xml:lang="en-US"><br>
<br>
The <xhtml:code>telnet</xhtml:<u></u>code> service can be disabled with the following command:<br>
<br>
<xhtml:pre># chkconfig telnet off</xhtml:pre><br>
</description><br>
<reference href="<a href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf" target="_blank">http://csrc.nist.gov/<u></u>publications/nistpubs/800-53-<u></u>Rev3/sp800-53-rev3-final.pdf</a>"><u></u>AC-17(8)</reference><br>
<reference href="<a href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf" target="_blank">http://csrc.nist.gov/<u></u>publications/nistpubs/800-53-<u></u>Rev3/sp800-53-rev3-final.pdf</a>"><u></u>CM-7</reference><br>
<reference href="<a href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf" target="_blank">http://csrc.nist.gov/<u></u>publications/nistpubs/800-53-<u></u>Rev3/sp800-53-rev3-final.pdf</a>"><u></u>IA-5(1)(c)</reference><br>
<reference href="<a href="http://iase.disa.mil/cci/index.html" target="_blank">http://iase.disa.mil/<u></u>cci/index.html</a>">68</reference><br>
<reference href="<a href="http://iase.disa.mil/cci/index.html" target="_blank">http://iase.disa.mil/<u></u>cci/index.html</a>">1436</<u></u>reference><br>
<reference href="<a href="http://iase.disa.mil/cci/index.html" target="_blank">http://iase.disa.mil/<u></u>cci/index.html</a>">197</<u></u>reference><br>
<reference href="<a href="http://iase.disa.mil/cci/index.html" target="_blank">http://iase.disa.mil/<u></u>cci/index.html</a>">877</<u></u>reference><br>
<reference href="<a href="http://iase.disa.mil/cci/index.html" target="_blank">http://iase.disa.mil/<u></u>cci/index.html</a>">888</<u></u>reference><br>
<reference xmlns:dc="<a href="http://purl.org/dc/elements/1.1/" target="_blank">http://purl.org/dc/<u></u>elements/1.1/</a>" href="test_attestation"><br>
<dc:contributor>DS</dc:<u></u>contributor><br>
<dc:date>20121026</dc:date><br>
</reference><br>
<br>
<rationale xmlns:xhtml="<a href="http://www.w3.org/1999/xhtml" target="_blank">http://www.w3.<u></u>org/1999/xhtml</a>" xml:lang="en-US"><br>
<br>
The telnet protocol uses unencrypted network communication, which<br>
means that data from the login session, including passwords and<br>
all other information transmitted during the session, can be<br>
stolen by eavesdroppers on the network. The telnet protocol is also<br>
subject to man-in-the-middle attacks.<br>
<br>
</rationale><br>
<br>
<ident system="<a href="http://cce.mitre.org" target="_blank">http://cce.mitre.org</a>"><u></u>CCE-26836-7</ident><br>
<check system="<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5" target="_blank">http://oval.mitre.org/<u></u>XMLSchema/oval-definitions-5</a>"><br>
<check-content-ref name="oval:ssg:def:230" href="ssg-rhel6-oval.xml"/><br>
</check><br>
<br>
<check system="ocil-transitional"><br>
<check-export export-name="the service is running" value-id="conditional_clause"/<u></u>><br>
<check-content xmlns:xhtml="<a href="http://www.w3.org/1999/xhtml" target="_blank">http://www.w3.<u></u>org/1999/xhtml</a>"><br>
<br>
To check that the <xhtml:code>telnet</xhtml:<u></u>code> service is disabled in system boot configuration, run the following command:<br>
<xhtml:pre># chkconfig <xhtml:code>telnet</xhtml:<u></u>code> --list</xhtml:pre><br>
Output should indicate the <xhtml:code>telnet</xhtml:<u></u>code> service has either not been installed,<br>
or has been disabled at all runlevels, as shown in the example below:<br>
<xhtml:pre># chkconfig <xhtml:code>telnet</xhtml:<u></u>code> --list<br>
<xhtml:code>telnet</xhtml:<u></u>code> 0:off 1:off 2:off 3:off 4:off 5:off 6:off</xhtml:pre><br>
<br>
<br>
Run the following command to verify <xhtml:code>telnet</xhtml:<u></u>code> is disabled through current runtime configuration:<br>
<br>
<xhtml:pre># service telnet status</xhtml:pre><br>
<br>
If the service is disabled the command will return the following output:<br>
<br>
<xhtml:pre>telnet is stopped</xhtml:pre><br>
</check-content><br>
</check><br>
</Rule><br>
<br>
<br>
<br>
Cheers,<br>
Stu<br>
<br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</blockquote></div><br></div>