<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 7/31/13 2:24 PM, Brian Peake wrote:<br>
    </div>
    <blockquote cite="mid:CE1ECDF4.7808%25PEAKE@HIPKLLC.COM" type="cite">
      <pre wrap="">On 7/31/13 1:36 PM, "Shawn Wells" <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:shawn@redhat.com">&lt;shawn@redhat.com&gt;</a> wrote:


</pre>
      <blockquote type="cite" style="color: #000000;">
        <pre wrap=""><span class="moz-txt-citetags">&gt;</span>On 7/31/13 11:31 AM, Stuart Green wrote:
</pre>
        <blockquote type="cite" style="color: #000000;">
          <pre wrap=""><span class="moz-txt-citetags">&gt;&gt;</span>
<span class="moz-txt-citetags">&gt;&gt; </span>Ah-ha!! Thanks, I was looking for the buglist actually and couldn't
<span class="moz-txt-citetags">&gt;&gt; </span>find it!
<span class="moz-txt-citetags">&gt;&gt;</span>
<span class="moz-txt-citetags">&gt;&gt;</span>
<span class="moz-txt-citetags">&gt;&gt; </span>Glad to be aboard <span class="moz-smiley-s1" title=":)"><span>:)</span></span>
</pre>
        </blockquote>
        <pre wrap=""><span class="moz-txt-citetags">&gt;</span>
<span class="moz-txt-citetags">&gt;</span>
<span class="moz-txt-citetags">&gt;</span>Hm. Perhaps this whole thing can be simplified.
<span class="moz-txt-citetags">&gt;</span>
<span class="moz-txt-citetags">&gt;</span>Right now we have two checks:
<span class="moz-txt-citetags">&gt; </span>    - package_telnet-server_removed.xml
<span class="moz-txt-citetags">&gt; </span>    - service_telnetd_disabled.xml
<span class="moz-txt-citetags">&gt;</span>
<span class="moz-txt-citetags">&gt;</span>They seem redundant, and I'm failing to find reasons against just
<span class="moz-txt-citetags">&gt;</span>deleting service_telnetd_disabled. There's no way telnet can be enabled
<span class="moz-txt-citetags">&gt;</span>if the package isn't installed, right?
<span class="moz-txt-citetags">&gt;</span>
<span class="moz-txt-citetags">&gt;</span>Is there a reason to continue maintaining both checks?
</pre>
      </blockquote>
      <pre wrap="">Shawn,
I don't think so. I believe there are other checks that have the same
redundancy alsoŠ</pre>
    </blockquote>
    <br>
    <br>
    Everything in the 'Obsolete Services' can trivially be migrated away
    to a 'uninstall' rule:<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete">http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete</a><br>
    <br>
    These would be:<br>
        - xinetd<br>
        - telnet-server<br>
        - rsh-server<br>
        - ypserv<br>
        - tftp-server<br>
    <br>
    I'd wager much of the 'Base Services' fall under this too:<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base">http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base</a><br>
        - abrt<br>
        - acpid<br>
        - certmonger<br>
        - cgconfig<br>
        - cgred<br>
        - cpuspeed<br>
        - haldaemon<br>
        - irqbalance <br>
        - kdump<br>
        - mdmonitor<br>
        - messagebus<br>
        - netconsole<br>
        - ntpdate<br>
        - oddjobd<br>
        - portreserve<br>
        - psacct<br>
        - quota_nld<br>
        - rdisc<br>
        - rhnsd<br>
        - rhsmcertd<br>
        - saslauthd<br>
        - smartd<br>
        - sysstat<br>
    <br>
    Can anyone think of why we'd want to have checks for<b> both</b>
    uninstall and disabled?<br>
  </body>
</html>