<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 7/31/13 2:24 PM, Brian Peake wrote:<br>
</div>
<blockquote cite="mid:CE1ECDF4.7808%25PEAKE@HIPKLLC.COM" type="cite">
<pre wrap="">On 7/31/13 1:36 PM, "Shawn Wells" <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:shawn@redhat.com"><shawn@redhat.com></a> wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">></span>On 7/31/13 11:31 AM, Stuart Green wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">>></span>
<span class="moz-txt-citetags">>> </span>Ah-ha!! Thanks, I was looking for the buglist actually and couldn't
<span class="moz-txt-citetags">>> </span>find it!
<span class="moz-txt-citetags">>></span>
<span class="moz-txt-citetags">>></span>
<span class="moz-txt-citetags">>> </span>Glad to be aboard <span class="moz-smiley-s1" title=":)"><span>:)</span></span>
</pre>
</blockquote>
<pre wrap=""><span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">></span>Hm. Perhaps this whole thing can be simplified.
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">></span>Right now we have two checks:
<span class="moz-txt-citetags">> </span> - package_telnet-server_removed.xml
<span class="moz-txt-citetags">> </span> - service_telnetd_disabled.xml
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">></span>They seem redundant, and I'm failing to find reasons against just
<span class="moz-txt-citetags">></span>deleting service_telnetd_disabled. There's no way telnet can be enabled
<span class="moz-txt-citetags">></span>if the package isn't installed, right?
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">></span>Is there a reason to continue maintaining both checks?
</pre>
</blockquote>
<pre wrap="">Shawn,
I don't think so. I believe there are other checks that have the same
redundancy also</pre>
</blockquote>
<br>
<br>
Everything in the 'Obsolete Services' can trivially be migrated away
to a 'uninstall' rule:<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete">http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete</a><br>
<br>
These would be:<br>
- xinetd<br>
- telnet-server<br>
- rsh-server<br>
- ypserv<br>
- tftp-server<br>
<br>
I'd wager much of the 'Base Services' fall under this too:<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base">http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base</a><br>
- abrt<br>
- acpid<br>
- certmonger<br>
- cgconfig<br>
- cgred<br>
- cpuspeed<br>
- haldaemon<br>
- irqbalance <br>
- kdump<br>
- mdmonitor<br>
- messagebus<br>
- netconsole<br>
- ntpdate<br>
- oddjobd<br>
- portreserve<br>
- psacct<br>
- quota_nld<br>
- rdisc<br>
- rhnsd<br>
- rhsmcertd<br>
- saslauthd<br>
- smartd<br>
- sysstat<br>
<br>
Can anyone think of why we'd want to have checks for<b> both</b>
uninstall and disabled?<br>
</body>
</html>