diff --git a/dist/bash_completion.d/oscap b/dist/bash_completion.d/oscap index 8ed4905d1b0..8627e851c6c 100644 --- a/dist/bash_completion.d/oscap +++ b/dist/bash_completion.d/oscap @@ -18,7 +18,7 @@ function _oscap { cmds[oscap:oval:generate]="report" cmds[oscap:xccdf]="eval remediate resolve validate export-oval-variables generate" cmds[oscap:xccdf:generate]="report guide fix custom" - cmds[oscap:ds]="sds-add sds-compose sds-split sds-validate rds-create rds-split rds-validate" + cmds[oscap:ds]="sds-validate rds-validate" cmds[oscap:cpe]="check match validate" # command options @@ -39,11 +39,6 @@ function _oscap { opts[oscap:xccdf:generate:guide]="-o --output --hide-profile-info --profile --benchmark-id --xccdf-id --tailoring-file --tailoring-id --skip-signature-validation --enforce-signature" opts[oscap:xccdf:generate:fix]="-o --output --template --profile --result-id --profile --fix-type --xccdf-id --benchmark-id --tailoring-file --tailoring-id --skip-signature-validation --enforce-signature" opts[oscap:xccdf:generate:custom]="-o --output --stylesheet" - opts[oscap:ds:sds-add]="--datastream-id --skip-validation" - opts[oscap:ds:sds-compose]="--skip-validation" - opts[oscap:ds:sds-split]="--datastream-id --xccdf-id --skip-validation --fetch-remote-resources --local-files" - opts[oscap:ds:rds-create]="--skip-validation" - opts[oscap:ds:rds-split]="--report-id --skip-validation" opts[oscap:info]="--fetch-remote-resources --local-files --profile --profiles" # local variables diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc index b87143c37e4..45c6c3f4cd4 100644 --- a/docs/manual/manual.adoc +++ b/docs/manual/manual.adoc @@ -516,24 +516,6 @@ can open it in a text editor. You can use `oscap info` with source data stream files as well. Source data stream will often reference OVAL files that are bundled in it. -It is also possible to extract OVAL files from source data stream using -`oscap ds sds-split`. - ----- -$ oscap ds sds-split ssg-rhel7-ds.xml extracted/ -$ ls -1 extracted/ -scap_org.open-scap_cref_output--ssg-rhel7-cpe-dictionary.xml -scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml -ssg-rhel7-cpe-oval.xml -ssg-rhel7-ocil.xml -ssg-rhel7-oval.xml ----- - -After splitting the source data stream you can inspect OVAL and XCCDF files -individually using a text editor. Keep in mind that this is only an example and -file names depend on contents of the source data stream you are splitting and -that you can also inspect XCCDF and OVAL content directly in a source data -stream or a result data stream. === Evaluating XCCDF @@ -1522,61 +1504,6 @@ multiset evaluation. ---- - -=== Evaluating XCCDF rules with multiple checks - -Normally, each XCCDF rule references to a single check with a specified name. -However, if `@name` attribute of `xccdf:check-content-ref` of a given rule is omitted, -multiple checks can be executed to evaluate the rule. -This is common for `security_patches_up_to_date` check. -By default, only a single result is produced for an XCCDF rule in such case, and the -result is computed from all results of checks in the referenced location. -In case user wants to see separate results for each check (one `xccdf:check-result` element -in results document for each check evaluated), then `multi-check` attribute -of `xccdf:check` element must be set to *true*. - ----- - - Security Patches Up-To-Date - All known security patches have been installed. - - - - - - ----- - -In XCCDF specification older than 1.2, the `multi-check` element is not defined, -which means that only a single result is always produced. -To produce separate results for each check from the content older than XCCDF version 1.2, -you need to convert it first into XCCDF 1.2 using the following command: - ----- -$ xsltproc --stringparam reverse_DNS com.example.www /usr/share/openscap/xsl/xccdf_1.1_to_1.2.xsl xccdf.xml > xccdf-1.2.xml ----- - -And then patch the content using a text editor, adding `multi-check` as -shown in the example Rule snippet above. - -To create a source data stream from the patched content, the following command can be used: - ----- -$ oscap ds sds-compose xccdf-1.2.xml source_ds.xml ----- - -If the original XCCDF file referenced a custom CPE dictionary, you also have to inject -the CPE dictionary into the source data stream in order to create a valid source data stream. -To add a CPE dictionary component into your data stream in place, use this command: - ----- -$ oscap ds sds-add cpe_dictionary.xml source_ds.xml ----- - -Now the `source_ds.xml` data stream can be evaluated as usual. - === Identifying SWID tags OpenSCAP identifies SWID tags using OVAL inventory class definitions that are @@ -1654,7 +1581,7 @@ If OpenSCAP is executed with verbosity level INFO or DEVEL their runtime values * `OSCAP_PCRE_EXEC_RECURSION_LIMIT` - Set recursion limit of regular expression matching using `pcre_exec`/`pcre2_match` functions. * `OSCAP_PROBE_ROOT` - Path to a directory which contains mounted filesystem to be evaluated. Used for offline scanning. * `SEXP_VALIDATE_DISABLE` - If set, `oscap` will not validate SEXP expressions during its execution. -* `SOURCE_DATE_EPOCH` - Timestamp in seconds since epoch. This timestamp will be used instead of the current time to populate `timestamp` attributes in SCAP source data streams created by `oscap ds sds-compose` sub-module. This is used for reproducible builds of data streams. +* `SOURCE_DATE_EPOCH` - Timestamp in seconds since epoch. This timestamp will be used instead of the current time to populate `timestamp` attributes in SCAP source data streams. This is used for reproducible builds of data streams. * `OSCAP_PROBE_MEMORY_USAGE_RATIO` - maximum memory usage ratio (used/total) for OpenSCAP probes, default: 0.1 * `OSCAP_PROBE_MAX_COLLECTED_ITEMS` - maximal count of collected items by OpenSCAP probe for a single OVAL object evaluation * `OSCAP_PROBE_IGNORE_PATHS` - Skip given paths during evaluation. If multiple paths should be skipped they need to be separated by a colon. The paths should be absolute canonical paths. diff --git a/src/DS/ds_common.c b/src/DS/ds_common.c index 7f60058fc5d..dd25f06af7b 100644 --- a/src/DS/ds_common.c +++ b/src/DS/ds_common.c @@ -28,7 +28,6 @@ #include "common/_error.h" #include "common/list.h" #include "common/oscap_acquire.h" -#include "source/oscap_source_priv.h" #include "source/public/oscap_source.h" #include "oscap_helpers.h" diff --git a/src/DS/ds_rds_session.c b/src/DS/ds_rds_session.c index fc0324ae10e..e62a5b6c2bd 100644 --- a/src/DS/ds_rds_session.c +++ b/src/DS/ds_rds_session.c @@ -174,15 +174,3 @@ int ds_rds_session_replace_report_with_source(struct ds_rds_session *session, st return ds_rds_create_report(doc, reports_node, oscap_source_get_xmlDoc(source), session->report_id) == NULL; } -char *ds_rds_session_get_html_report(struct ds_rds_session *rds_session) -{ - const char *params[] = { - "show", "", - "verbosity", "", - "hide-profile-info", NULL, - "oscap-version", oscap_get_version(), - "pwd", NULL, - NULL - }; - return oscap_source_apply_xslt_path_mem(rds_session->source, "xccdf-report.xsl", params, oscap_path_to_xslt()); -} diff --git a/src/DS/ds_sds_session.c b/src/DS/ds_sds_session.c index 3a720e8131f..b8a27db86e3 100644 --- a/src/DS/ds_sds_session.c +++ b/src/DS/ds_sds_session.c @@ -26,7 +26,6 @@ #include "common/debug_priv.h" #include "common/oscap_acquire.h" -#include "common/elements.h" #include "common/_error.h" #include "common/list.h" #include "common/oscapxml.h" @@ -345,11 +344,6 @@ void ds_sds_session_configure_remote_resources(struct ds_sds_session *session, b session->progress = (callback != NULL) ? callback : download_progress_empty_calllback; } -void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback) -{ - ds_sds_session_configure_remote_resources(session, allowed, NULL, callback); -} - const char *ds_sds_session_local_files(struct ds_sds_session *session) { return session->local_files; @@ -370,21 +364,3 @@ download_progress_calllback_t ds_sds_session_remote_resources_progress(struct ds return session->progress; } -char *ds_sds_session_get_html_guide(struct ds_sds_session *session, const char *profile_id) -{ - const char *params[] = { - "show", "", - "verbosity", "", - "hide-profile-info", NULL, - "oscap-version", oscap_get_version(), - "pwd", NULL, - "profile_id", profile_id, - NULL - }; - struct oscap_source *xccdf = oscap_htable_get(session->component_sources, session->checklist_id); - if (xccdf == NULL) { - oscap_seterr(OSCAP_EFAMILY_OSCAP, "Internal error: Could not acquire handle to '%s' source.", session->checklist_id); - return NULL; - } - return oscap_source_apply_xslt_path_mem(xccdf, "xccdf-guide.xsl", params, oscap_path_to_xslt()); -} diff --git a/src/DS/public/ds_rds_session.h b/src/DS/public/ds_rds_session.h index afa2d42ef24..0469e6cc6de 100644 --- a/src/DS/public/ds_rds_session.h +++ b/src/DS/public/ds_rds_session.h @@ -120,6 +120,5 @@ OSCAP_API int ds_rds_session_replace_report_with_source(struct ds_rds_session *s * @param rds_session The ds_rds_session to build HTML from * @returns a buffer of HTML content that should be freed by the caller */ -OSCAP_API char *ds_rds_session_get_html_report(struct ds_rds_session *rds_session); #endif diff --git a/src/DS/public/ds_sds_session.h b/src/DS/public/ds_sds_session.h index 83e7feadba1..10523569144 100644 --- a/src/DS/public/ds_sds_session.h +++ b/src/DS/public/ds_sds_session.h @@ -192,16 +192,6 @@ OSCAP_API int ds_sds_session_set_target_dir(struct ds_sds_session *session, cons */ OSCAP_API void ds_sds_session_reset(struct ds_sds_session *session); -/** - * Set property of remote content. - * @memberof ds_sds_session - * @param session The Source DataStream Session - * @param allowed Whether is download of remote resources allowed in this session (defaults to false) - * @param callback used to notify user about download proceeds. This might be safely set - * to NULL -- ignoring user notification. - */ -OSCAP_API OSCAP_DEPRECATED(void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback)); - /** * Set property of remote content. * @memberof ds_sds_session @@ -216,14 +206,4 @@ OSCAP_API OSCAP_DEPRECATED(void ds_sds_session_set_remote_resources(struct ds_sd */ OSCAP_API void ds_sds_session_configure_remote_resources(struct ds_sds_session *session, bool allowed, const char *local_files, download_progress_calllback_t callback); -/** - * Returns HTML representation of selected checklist in form of OpenSCAP guide. - * @memberof ds_sds_session - * @param session The Source DataStream session to generate guide from - * @param profile_id ID of XCCDF profile within selected checklist to - * generate guide for - * @returns a buffer of HTML content that should be freed by the caller - */ -OSCAP_API char *ds_sds_session_get_html_guide(struct ds_sds_session *session, const char *profile_id); - #endif diff --git a/src/DS/public/scap_ds.h b/src/DS/public/scap_ds.h index 575d6e52aef..ce8e98402f5 100644 --- a/src/DS/public/scap_ds.h +++ b/src/DS/public/scap_ds.h @@ -165,7 +165,6 @@ OSCAP_API struct oscap_string_iterator* ds_stream_index_get_dictionaries(struct * * @memberof ds_stream_index */ -OSCAP_API struct oscap_string_iterator* ds_stream_index_get_extended_components(struct ds_stream_index* s); /** * @struct ds_sds_index diff --git a/src/DS/rds.c b/src/DS/rds.c index 346d3f77284..af3ae006fda 100644 --- a/src/DS/rds.c +++ b/src/DS/rds.c @@ -26,7 +26,6 @@ #include "public/scap_ds.h" #include "public/oscap_text.h" -#include "public/oscap.h" #include "common/_error.h" #include "common/util.h" diff --git a/src/DS/rds_asset_index.c b/src/DS/rds_asset_index.c index 2c677d958c8..985ec28e18a 100644 --- a/src/DS/rds_asset_index.c +++ b/src/DS/rds_asset_index.c @@ -24,13 +24,11 @@ #include #endif -#include "public/oscap.h" #include "public/scap_ds.h" #include "public/oscap_text.h" #include "common/list.h" #include "common/_error.h" -#include "common/elements.h" #include "rds_index_priv.h" #include diff --git a/src/DS/rds_index.c b/src/DS/rds_index.c index cc0e2bbed5f..bb2986556b2 100644 --- a/src/DS/rds_index.c +++ b/src/DS/rds_index.c @@ -31,8 +31,7 @@ #include "common/elements.h" #include "common/debug_priv.h" #include "rds_index_priv.h" -#include "source/oscap_source_priv.h" -#include "source/public/oscap_source.h" + #include #include diff --git a/src/DS/rds_report_index.c b/src/DS/rds_report_index.c index 3b3c1af9102..4d04033c593 100644 --- a/src/DS/rds_report_index.c +++ b/src/DS/rds_report_index.c @@ -27,10 +27,8 @@ #include "public/scap_ds.h" #include "common/list.h" #include "common/_error.h" -#include "common/elements.h" #include "rds_index_priv.h" -#include "source/oscap_source_priv.h" -#include "source/public/oscap_source.h" + #include #include diff --git a/src/DS/rds_report_request_index.c b/src/DS/rds_report_request_index.c index d3f23c8bc09..62ce27d5d19 100644 --- a/src/DS/rds_report_request_index.c +++ b/src/DS/rds_report_request_index.c @@ -27,10 +27,8 @@ #include "public/scap_ds.h" #include "common/list.h" #include "common/_error.h" -#include "common/elements.h" #include "rds_index_priv.h" -#include "source/oscap_source_priv.h" -#include "source/public/oscap_source.h" + #include #include diff --git a/src/DS/sds.c b/src/DS/sds.c index 8b747a94a40..c7c5c75b0de 100644 --- a/src/DS/sds.c +++ b/src/DS/sds.c @@ -24,10 +24,8 @@ #include #endif -#include "public/ds_sds_session.h" #include "public/scap_ds.h" -#include "public/xccdf_benchmark.h" -#include "public/oval_definitions.h" + #include "public/oscap.h" #include "public/oscap_text.h" diff --git a/src/DS/sds_index.c b/src/DS/sds_index.c index 675afc0839f..ac40210e43a 100644 --- a/src/DS/sds_index.c +++ b/src/DS/sds_index.c @@ -29,8 +29,7 @@ #include "common/_error.h" #include "common/elements.h" #include "sds_index_priv.h" -#include "source/oscap_source_priv.h" -#include "source/public/oscap_source.h" + #include #include @@ -113,11 +112,6 @@ struct oscap_string_iterator* ds_stream_index_get_dictionaries(struct ds_stream_ return oscap_iterator_new((struct oscap_list*)s->dictionary_components); } -struct oscap_string_iterator* ds_stream_index_get_extended_components(struct ds_stream_index* s) -{ - return oscap_iterator_new((struct oscap_list*)s->extended_components); -} - static struct ds_stream_index* ds_stream_index_parse(xmlTextReaderPtr reader) { // sanity check diff --git a/tests/API/XCCDF/applicability/test_remediate_fix_processing.sds.xml b/tests/API/XCCDF/applicability/test_remediate_fix_processing.sds.xml new file mode 100644 index 00000000000..af8e2bbbc67 --- /dev/null +++ b/tests/API/XCCDF/applicability/test_remediate_fix_processing.sds.xml @@ -0,0 +1,82 @@ + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + PASSEnsure that test_file is not executable + + + + + + + + + + + + ./ + test_file + + + + + false + + + + accepted + 1.0 + + + Ensure that file exists and it is not executable + + + touch wrong_test_file + + + + touch wrong_test_file + + + + touch test_file + + + + touch test_file_cpe_na + + + + touch test_file + + + + touch wrong_test_file + + + + + + + OSCAP Scan Result + x.x.example.com + 127.0.0.1 + 0:0:0:0:0:0:0:1 + + 00:00:00:00:00:00 + + + fail + + + + + 0.000000 + + diff --git a/tests/API/XCCDF/applicability/test_remediate_fix_processing_ds.sh b/tests/API/XCCDF/applicability/test_remediate_fix_processing_ds.sh index 37ec393d8df..6043a6f0cc8 100755 --- a/tests/API/XCCDF/applicability/test_remediate_fix_processing_ds.sh +++ b/tests/API/XCCDF/applicability/test_remediate_fix_processing_ds.sh @@ -5,8 +5,7 @@ set -e set -o pipefail name=$(basename $0 .sh) -sds=$(make_temp_file /tmp ${name}.sds) -xccdf=test_remediate_fix_processing.xccdf.xml +sds=$srcdir/test_remediate_fix_processing.xccdf.xml stderr=$(make_temp_file /tmp ${name}.out) resultx=$(make_temp_file /tmp ${name}.xccdf) arf=$(make_temp_file /tmp ${name}.arf) @@ -15,7 +14,6 @@ echo "stderr file: $stderr" echo "results file: $result" rm -f test_file test_file_cpe_na wrong_test_file -$OSCAP ds sds-compose $srcdir/$xccdf $sds 2>&1 > $stderr [ -f $stderr ]; [ ! -s $stderr ] $OSCAP ds sds-validate $sds diff --git a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/fail/oval.xml b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/fail/oval.xml new file mode 100644 index 00000000000..7d8ed4f4f83 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/fail/oval.xml @@ -0,0 +1,50 @@ + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + FAILBla. + + + + PASSBla. + + + + FAILBla. + + + + PASSBla. + + + + + + + + + + + + + + + + ./ + not_executable + + + + + false + + + true + + + diff --git a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/pass/oval.xml b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/pass/oval.xml new file mode 100644 index 00000000000..85776ab0247 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/oval/pass/oval.xml @@ -0,0 +1,50 @@ + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + PASSBla. + + + + FAILBla. + + + + PASSBla. + + + + FAILBla. + + + + + + + + + + + + + + + + ./ + not_executable + + + + + false + + + true + + + diff --git a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/scap_org.open-scap_cref_test_multiple_oval_files_with_same_basename.xccdf.xml b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/scap_org.open-scap_cref_test_multiple_oval_files_with_same_basename.xccdf.xml new file mode 100644 index 00000000000..3e852415c34 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.split/scap_org.open-scap_cref_test_multiple_oval_files_with_same_basename.xccdf.xml @@ -0,0 +1,47 @@ + + + incomplete + 1.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.xml b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.xml new file mode 100644 index 00000000000..e8b272f145b --- /dev/null +++ b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sds.xml @@ -0,0 +1,143 @@ + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + PASSBla. + + + + FAILBla. + + + + PASSBla. + + + + FAILBla. + + + + + + + + + + + + + + + + ./ + not_executable + + + + + false + + + true + + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + FAILBla. + + + + PASSBla. + + + + FAILBla. + + + + PASSBla. + + + + + + + + + + + + + + + + ./ + not_executable + + + + + false + + + true + + + + incomplete + 1.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sh b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sh index 9fbdb70a1f1..98987bae643 100755 --- a/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sh +++ b/tests/API/XCCDF/unittests/test_multiple_oval_files_with_same_basename.sh @@ -39,10 +39,8 @@ assert_exists 1 '//TestResult/score[@system="urn:xccdf:scoring:flat"][text()="8. # sds=$(mktemp -t ${name}.ds.XXXXXX) -echo "Creating SDS file = $sds" - -$OSCAP ds sds-compose $srcdir/${name}.xccdf.xml $sds 2> $stderr -[ -f $stderr ]; [ ! -s $stderr ] +echo "Copying SDS file = $sds" +cp $srcdir/test_multiple_oval_files_with_same_basename.sds.xml $sds $OSCAP ds sds-validate $sds 2> $stderr $OSCAP info $sds 2> $stderr @@ -73,9 +71,9 @@ assert_exists 1 '//TestResult/score[@system="urn:xccdf:scoring:flat"][text()="8. rm $result split=$(mktemp -d -t ${name}.sds.XXXXXX) -echo "Creating SDS split = $split" +echo "Copying SDS split = $split" -$OSCAP ds sds-split $sds $split 2> $stderr +cp -r $srcdir/test_multiple_oval_files_with_same_basename.sds.split/* $split [ -f $stderr ]; [ ! -s $stderr ] rm $sds diff --git a/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sds.xml b/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sds.xml new file mode 100644 index 00000000000..5eebc4c8493 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sds.xml @@ -0,0 +1,91 @@ + + + + Text Editors + 5.8 + 2010-06-08T12:00:00-04:00 + + + + + + + + + + + + + + ./ + not_executable + + + + + false + + + true + + + + accepted + 1.0 + + + Some arbitrary hardening profile for anaconda testing + + + + + Ensure /tmp Located On Separate Partition + CCE-14161-4 + + + part /tmp + + + + + + + Add nodev Option to /tmp + CCE-14412-1 + + part /tmp --mountoptions=nodev + + + + grep -e '^[^#].*/tmp.*nodev' /etc/fstab + if [ "$?" -ne 0 ]; then + new_fstab=$(cat /etc/fstab | sed -e 's%^[^#]([^ ]+)\s+/tmp([^ ]+)\s+([^ ]+)\s+(\d)\s+(\d)%\1\t/tmp\2\t\3,nodev\t\4 \5' + echo $new_fstab > /etc/fstab + fi + + + + + Minimal password length + 8 + 14 + 18 + + + Set Password Minimum Length in login.defs + + + passwd --minlen= + + + + + + + + diff --git a/tests/API/XCCDF/unittests/test_report_anaconda_fixes_ds.sh b/tests/API/XCCDF/unittests/test_report_anaconda_fixes_ds.sh index 7c6c94ffb06..e9ef8fc3d2a 100755 --- a/tests/API/XCCDF/unittests/test_report_anaconda_fixes_ds.sh +++ b/tests/API/XCCDF/unittests/test_report_anaconda_fixes_ds.sh @@ -9,7 +9,9 @@ xccdf=${name}.xccdf.xml sds=$(make_temp_file /tmp ${name}.sds) stderr=$(make_temp_file /tmp ${name}_ds.err) result=$(make_temp_file /tmp ${name}_ds.out) +cp $srcdir/test_report_anaconda_fixes.sds.xml $sds +echo "name: $name" echo "sds file: $sds" echo "Stderr file = $stderr" echo "Results file = $result" @@ -18,8 +20,6 @@ line1='^\W*part /tmp$' line2='^\W*part /tmp --mountoptions=nodev$' line3='^\W*passwd --minlen=14$' -$OSCAP ds sds-compose $srcdir/$xccdf $sds 2>&1 > $stderr -[ -f $stderr ]; [ ! -s $stderr ] $OSCAP ds sds-validate $sds datastream_id=scap_org.open-scap_datastream_from_xccdf_test_report_anaconda_fixes.xccdf.xml diff --git a/tests/DS/CMakeLists.txt b/tests/DS/CMakeLists.txt index aac089cab51..11f74a19b08 100644 --- a/tests/DS/CMakeLists.txt +++ b/tests/DS/CMakeLists.txt @@ -1,6 +1,5 @@ add_oscap_test("test_ds_misc.sh") add_oscap_test("test_rds.sh") -add_oscap_test("test_sds_compose_split.sh") add_oscap_test("test_sds_eval.sh") add_oscap_test("test_sds_fix_from_results.sh") add_oscap_test("test_sds_fix_from_source.sh") diff --git a/tests/DS/rds_simple/results-oval.xml b/tests/DS/rds_simple/results-oval.xml deleted file mode 100644 index a4ed94982b6..00000000000 --- a/tests/DS/rds_simple/results-oval.xml +++ /dev/null @@ -1,12920 +0,0 @@ - - - - cpe:/a:open-scap:oscap - 5.10 - 2012-07-17T15:50:44 - - - - - - - - - - - - vim, emacs - 5.5 - 2010-08-30T12:00:00-04:00 - - - - - Disable SNMP Server if Possible - - The net-snmp package should be uninstalled. - - - - - - - - Disable SNMP Server if Possible - - The snmpd service should be disabled. - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http-mgmt traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid proxy access to localhost should be denied (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow filemaker traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gopher traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow ftp traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow multiling http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow wais traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow https traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gss-http traffic (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to log HTTP MIME headers should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to show proxy client IP addresses in HTTP headers should be disabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to suppress the httpd version string should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to allow underscores in hostnames should be disabled (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to ignore unknown nameservers should be enabled (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid GUID should be set to an appropriate group (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid EUID should be set to an appropriate user (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max reply HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max request HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to check for RFC compliant hostnames should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to perform FTP sanity checks should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to force FTP passive connections should be enabled (and dependencies are met) - - - - - - - - - Disable Squid if Possible - - The squid package should be uninstalled. - - - - - - - - Disable Squid if Possible - - The squid service should be disabled. - - - - - - - - - Disable Guest Access and Local Login Support - - Do not allow guest users to access local file or printer shares. - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - - Require Client SMB Packet Signing, if using smbclient - - Require samba clients running smbclient to use packet signing. A Samba client should only communicate with servers who can support SMB packet signing. - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to spawn a new login process per connection should be enabled (and dependencies are met) - - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to drop privileges to user before executing mail process should be enabled (and dependencies are met) - - - - - - - - - Disable Plaintext Authentication - - Dovecot plaintext authentication of clients should be disabled as necessary (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imap protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3 (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3s protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imaps protocol (and dependencies are met) - - - - - - - - - Disable Dovecot if Possible - - The dovecot package should be uninstalled. - - - - - - - - Disable Dovecot if Possible - - The dovecot service should be disabled. - - - - - - - - - Restrict File and Directory Access - - File permissions for /var/log/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - The /etc/httpd/conf/* files should be owned by the appropriate group. - - - - - - - - - Restrict File and Directory Access - - File permissions for /usr/sbin/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf/* should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf should be set correctly. (and dependencies are met) - - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerSignature value should be set appropriately (and dependencies are met) - - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerTokens value should be set appropriately (and dependencies are met) - - - - - - - - - Uninstall Apache if Possible - - The httpd package should be uninstalled. - - - - - - - - Disable Apache if Possible - - The httpd service should be disabled. - - - - - - - - - Disable FTP Uploads if Possible - - File uploads via vsftpd should be disabled (and dependencies are met) - - - - - - - - - Restrict Access to Anonymous Users if Possible - - Local user login to the vsftpd service should be disabled (and dependencies are met) - - - - - - - - - Create Warning Banners for All FTP Users - - A warning banner for all FTP users should be enabled (and dependencies are met) - - - - - - - - - Enable Logging of All FTP Transactions - - Logging of vsftpd transactions should be enabled (and dependencies are met) - - - - - - - - - Uninstall vsftpd if Possible - - The vsftpd service should be uninstalled. - - - - - - - - Disable vsftpd if Possible - - The vsftpd service should be disabled. - - - - - - - - - Disable Dynamic Updates if Possible - - LDAP's dynamic updates feature should be disabled as appropriate (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - File permissions for /var/named/chroot/etc/named.conf should be set correctly. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate user. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate group. (and dependencies are met) - - - - - - - - - Disable DNS Server if Possible - - The bind package should be uninstalled. - - - - - - - - Disable DNS Server if Possible - - The named service should be disabled. - - - - - - - - - Export Filesystems Read-Only if Possible - - Write access to NFS shares should be disabled - - - - - - - - Restrict NFS Clients to Privileged Ports - - Restriction of NFS clients to privileged ports should be enabled - - - - - - - - - Use Root-Squashing on All Exports - - Root squashing should be enabled for all NFS shares - - - - - - - - - Mount Remote Filesystems with noexec - - The noexec option should be enabled for all NFS mounts - - - - - - - - Mount Remote Filesystems with nosuid - - The nosuid option should be enabled for all NFS mounts - - - - - - - - Disable NFS Server Daemons - - The rpcsvcgssd service should be disabled - - - - - - - - Disable NFS Server Daemons - - The nfs service should be disabled - - - - - - - - Configure NFS Services to Use Fixed Ports - - The rquotad service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The mountd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for UDP - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use an outgoing static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for TCP - - - - - - - - Disable RPC Portmapper if Possible - - The portmap service should be disabled. - - - - - - - - Disable netfs if Possible - - The netfs service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcidmapd service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcgssd service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The nfslock service should be disabled. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate user. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate group. - - - - - - - - Install OpenLDAP Server RPM - - The ldap service should be disabled. - - - - - - - - Configure LDAP to Use TLS for All Transactions - - Clients require LDAP servers to provide valid certificates for SSL communications. - - - - - - - - Disable the Listening Sendmail Daemon - - The listening sendmail daemon should be disabled. (and dependencies are met) - - - - - - - - - Mail Transfer Agent - - The sendmail service should be disabled. - - - - - - - - Configure the Client NTP Daemon to Use the Local Server - - The ntp daemon synchronization server should be set appropriately (and dependencies are met) - - - - - - - - - Enable the NTP Daemon - - The ntp daemon should be enabled (and dependencies are met) - - - - - - - - - - Obtain NTP Software - - OpenNTPD should be installed - - - - - - - - Specify a Remote NTP Server for Time Data - - A remote NTP Server for time synchronization should be specified (and dependencies are met) - - - - - - - - - Deny All Access to ntpd by Default - - Network access to ntpd should be denied (and dependencies are met) - - - - - - - - - Enable the NTP Daemon - - The ntpd service should be enabled. - - - - - - - - Configure DHCP Logging - - dhcpd logging should be enabled. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NTP servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Time offset should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS domain should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Default routers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name server information should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Deny BOOTP Queries - - BOOTP queries should be accepted or denied by the DHCP server as appropriate (and dependencies are met) - - - - - - - - - Deny Decline Messages - - DHCPDECLINE messages should be denied by the DHCP server (and dependencies are met) - - - - - - - - - Do Not Use Dynamic DNS - - The dynamic DNS feature of the DHCP server should be disabled (and dependencies are met) - - - - - - - - - Disable DHCP Server if possible - - The dhcp package should be uninstalled. - - - - - - - - Disable DHCP Server if possible - - The dhcpd service should be enabled or disabled as appropriate. - - - - - - - - - Disable DHCP Client if Possible - - The dhcp client service should be disabled for each interface. - - - - - - - - Disable HPLIP Service if Possible - - The hplip service should be disabled. - - - - - - - - Disable Printer Browsing Entirely if Possible - - CUPS should be allowed or denied the ability to listen for Incoming printer information as appropriate (and dependencies are met) - - - - - - - - - Disable Printer Browsing Entirely if Possible - - Remote print browsing should be disabled (and dependencies are met) - - - - - - - - - Disable Firewall Access to Printing Service over IPv6 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable Firewall Access to Printing Service over IPv4 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable the CUPS Service if Possible - - The cups service should be disabled. - - - - - - - - Restrict Published Information - - Avahi publishing of domain name should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of IP addresses should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of workstation name should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of hardware information should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of local information by user applications should be disabled (and dependencies are met) - - - - - - - - - Disable Publishing if Possible - - Avahi publishing of local information should be disabled (and dependencies are met) - - - - - - - - - Prevent Other Programs from Using Avahi's Port - - Avahi should be configured to not allow other stacks from binding to port 5353 (and dependencies are met) - - - - - - - - - Check Responses' TTL Field - - Avahi should be configured to reject packets with a TTL field not equal to 255 (and dependencies are met) - - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv4 (and dependencies are met) - - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv6 (and dependencies are met) - - - - - - - - - Disable Avahi Server Software - - The avahi-daemon service should be disabled. - - - - - - - - Create Warning Banners for GUI Login Users - - Enable warning banner for GUI login - - - - - - - - Disable X Window System Listening - - Disable the ability to provide remote graphical display - - - - - - - - Remove X Windows from the System if Possible - - X Windows should be removed - - - - - - - - Disable X Windows at System Boot - - X Windows should be disabled at system boot - - - - - - - - Use Only Approved Ciphers - - Use only approved ciphers - - - - - - - - - Do Not Allow Users to Set Environment Options - - PermitUserEnvironment should be disabled - - - - - - - - - Enable a Warning Banner - - SSH warning banner should be enabled (and dependencies are met) - - - - - - - - - Disable Empty Passwords - - Remote connections from accounts with empty passwords should be disabled (and dependencies are met) - - - - - - - - - Disable root Login via SSH - - Root login via SSH should be disabled (and dependencies are met) - - - - - - - - - Disable Host-Based Authentication - - SSH host-based authentication should be disabled (and dependencies are met) - - - - - - - - - Disable .rhosts Files - - Emulation of the rsh command through the ssh server should be disabled (and dependencies are met) - - - - - - - - - Set ClientAliveCountMax for User Logins - - The SSH ClientAliveCountMax should be set to an appropriate value (and dependencies are met) - - - - - - - - - Set Idle Timeout Interval for User Logins - - The SSH idle timout interval should be set to an appropriate value (and dependencies are met) - - - - - - - - - Ensure Only Protocol 2 Connections Allowed - - SSH version 1 protocol support should be disabled. (and dependencies are met) - - - - - - - - - Remove SSH Server ip6tables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Remove SSH Server iptables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Remove OpenSSH Software - - SSH should be uninstalled - - - - - - - - Disable OpenSSH Software - - The sshd service should be disabled. - - - - - - - - - Remove /etc/at.deny - - /etc/at.deny file should not exist. - - - - - - - - Remove /etc/cron.deny - - /etc/cron.deny file should not exist. - - - - - - - - Restrict Permissions on /var/spool/cron file - - File permissions for /var/spool/cron should be set correctly. - - - - - - - - Restrict user owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate user. - - - - - - - - Restrict group owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.d should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.monthly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.weekly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.daily should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.hourly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/anacrontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/crontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate group. - - - - - - - - Disable anacron if Possible - - The anacron package should be uninstalled. - - - - - - - - Disable anacron if Possible - - The anacron service should be disabled. - - - - - - - - At Daemons package is installed - - The at package should be removed. - - - - - - - - At Daemon running state - - The atd service should be disabled. - - - - - - - - - Cron Daemon running state - - The crond service should be enabled. - - - - - - - - CPU Throttling (cpuspeed) - - The cpuspeed service should be disabled. - - - - - - - - Advanced Configuration and Power Interface (acpid) - - The acpid service should be disabled. - - - - - - - - Advanced Power Management Subsystem (apmd) - - The apmd service should be disabled. - - - - - - - - Disable Bluetooth Kernel Modules - - Prevent loading of the Bluetooth module. - - - - - - - - - Bluetooth Input Devices (hidd) - - The hidd service should be disabled. - - - - - - - - Bluetooth Host Controller Interface Daemon (bluetooth) - - The bluetooth service should be disabled. - - - - - - - - HAL Daemon (haldaemon) - - The haldaemon service should be disabled. - - - - - - - - D-Bus IPC Service (messagebus) - - The messagebus service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_later service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_early service should be disabled. - - - - - - - - SMART Disk Monitoring Support (smartd) - - The smartd service should be disabled. - - - - - - - - Smart Card Support (pcscd) - - The pcscd service should be disabled. - - - - - - - - Disable Zeroconf Networking - - Disable Zeroconf automatic route assignment in the 169.245.0.0 subnet. - - - - - - - - Disable All External Network Interfaces if Not Needed - - All files of the form ifcfg-interface except - for ifcfg-lo in /etc/sysconfig/network-scripts should be removed - - - - - - - - Disable All Networking if Not Needed - - The network service should be disabled. - - - - - - - - IA32 Microcode Utility(microcodectl) - - The microcode_ctl service should be disabled. - - - - - - - - Software RAID Monitor (mdmonitor) - - The mdmonitor service should be disabled. - - - - - - - - Kudzu Hardware Probing Utility (kudzu) - - The kudzu service should be disabled. - - - - - - - - Kdump Kernel Crash Analyzer (kdump) - - The kdump service should be disabled. - - - - - - - - ISDN Support (isdn) - - The isdn service should be disabled. - - - - - - - - Interrupt Distribution on Multiprocessor Systems (irqbalance) - - The irqbalance service should be disabled. - - - - - - - - Console Mouse Service (gpm) - - The gpm service should be disabled. - - - - - - - - Installation Helper Service (firstboot) - - The firstboot service should be disabled. - - - - - - - - Disable TFTP Server - - The tftp service should be disabled. - - - - - - - - - Uninstall TFTP Server - - The tftp-server package should be uninstalled. - - - - - - - - NIS - - The ypbind service should be disabled. - - - - - - - - - NIS - - The ypserv package should be uninstalled. - - - - - - - - Remove the Rsh Client Commands from the System - - The rsh package, which contains client programs for many of r-commands should be uninstalled. - - - - - - - - Remove .rhosts Support from PAM Configuration Files - - Check that pam rhosts authentication is not used by any PAM services. - - - - - - - - disable rlogin - - The rlogin service should be disabled. - - - - - - - - - disable rsh - - The rsh service should be disabled. - - - - - - - - - disable rcp - - The rcp service should be disabled. - - - - - - - - - Remove the Rsh Server Commands from the System - - The rsh-server package should be uninstalled. - - - - - - - - Telnet kerberos client - - The krb5-workstation package should be uninstalled. - - - - - - - - Telnet Client installation - - The telnet package should be uninstalled. - - - - - - - - Disable Telnet service - - The telnet service should be disabled. - - - - - - - - - Telnet - - The telnet-server package should be uninstalled. - - - - - - - - Inetd and Xinetd - - The xinetd package should be uninstalled. - - - - - - - - Inetd and Xinetd - - The inetd package should be uninstalled. - - - - - - - - Inetd and Xinetd - - The xinetd service should be disabled. - - - - - - - - - Inetd and Xinetd - - The inetd service should be disabled. - - - - - - - - - Make the auditd Configuration Immutable - - Force a reboot to change audit rules is enabled - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - - Audit rules about the Information on Kernel Module Loading and Unloading. - - - - - - - - - - Ensure auditd Collects System Administrator Actions - - Audit rules about the System Administrator Actions are enabled - - - - - - - - Ensure auditd Collects Files Deletion Events by User (successful and unsuccessful) - - Audit rules about the Files Deletion Events by User (successful and unsuccessful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects Information on Exporting to Media (successful) - - Audit rules about the Information on Exporting to Media (successful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - - Audit rules about the Information on the Use of Privileged Commands are enabled - - - - - - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - - Audit rules about the Unauthorized Access Attempts to Files (unsuccessful) are enabled - - - - - - - - - - - - - - - - - Ensure auditd Collects Discretionary Access Control Permission Modification Events - - Audit rules about the Discretionary Access Control Permission Modification Events are enabled - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Process and Session Initiation Information - - Audit rules about the Process and Session Initiation Information are enabled - - - - - - - - - - Ensure auditd Collects Logon and Logout Events - - Audit rules about the Logon and Logout Events are enabled - - - - - - - - - Record Events that Modify the System’s Mandatory Access Controls - - Audit rules about the System’s Mandatory Access Controls are enabled - - - - - - - - Record Events that Modify the System’s Network Environment - - Audit rules about the System’s Network Environment are enabled - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - - Audit rules about User/Group Information are enabled - - - - - - - - - - - - Records Events that Modify Date and Time Information - - Audit rules about time are enabled - - - - - - - - - - - - - - - - - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - - Look for argument audit=1 in the kernel line in /etc/grub.conf - - - - - - - - Enable the auditd Service - - The auditd service should be enabled. - - - - - - - - Monitor Suspicious Log Messages using Logwatch - - The logwatch service should be enabled or disabled as appropriate - - - - - - - - Disable syslogd from Accepting Remote Messages on Loghosts Only - - Syslogd should reject remote messages - - - - - - - - Send Logs to a Remote Loghost - - Syslog logs should be sent to a remote loghost - - - - - - - - Confirm Existence and Permissions of System Log Files - - File permissions for all syslog log files should be set correctly. - - - - - - - - Confirm Existence and Permissions of System Log Files - - All syslog log files should be owned by the appropriate group. - - - - - - - - - Confirm Existence and Permissions of System Log Files - - All mandatory log files should be owned by root user. - - - - - - - - - Configure Syslog - - The syslog service should be enabled or disabled as appropriate. - - - - - - - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain. - - - - - - - - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain. - - - - - - - - - Inspect and Activate Default Rules - - The iptables service should be enabled. - - - - - - - - Verify ip6tables is enabled - - The ip6tables service should be enabled. - - - - - - - - Limit Network-Transmitted Configuration - - The default number of global unicast IPv6 addresses allowed per network interface should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 duplicate address detection solicitations for network interfaces to send per configured address should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for autoconfiguring network interfaces using prefix information in IPv6 router advertisements should be enabled or disabled as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting a default router via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting prefix information via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting router preference via IPv6 router advertisement should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 router solicitations for network interfaces to send should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Use Privacy Extensions for Address if Necessary - - IPv6 privacy extensions should be configured appropriately for all interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting redirects from IPv6 routers should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - Accepting redirects from IPv6 routers should be disabled as appropriate for all network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting IPv6 router advertisements should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - Accepting IPv6 router advertisements should be disabled for all network interfaces. - - - - - - - - - Disable Interface Usage of IPv6 - - IPv6 configuration should be disabled for all interfaces. - - - - - - - - - Disable Interface Usage of IPv6 - - Global IPv6 initialization should be disabled. - - - - - - - - - Disable Interface Usage of IPv6 - - The default setting for IPv6 configuration should be disabled for network interfaces. - - - - - - - - - Disable Automatic Loading of IPv6 Kernel Module - - Automatic loading of the IPv6 kernel module should be disabled. - - - - - - - - Disable Wireless Drivers - - Device drivers for wireless devices should be excluded from the kernel. - - - - - - - - Deactivate Wireless Interfaces - - All wireless interfaces should be disabled. - - - - - - - - Disable Wireless in BIOS - - All wireless devices should be disabled in the BIOS. - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for performing source validation by reverse path should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Performing source validation by reverse path should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Sending TCP syncookies should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring bogus ICMP responses to broadcasts should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring ICMP echo requests (pings) sent to broadcast / multicast addresses should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting ICMP redirects should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting source routed packets should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Logging of "martian" packets (those with impossible addresses) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting ICMP redirects should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting source routed packets should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts Only - - IP forwarding should be disabled. - - - - - - - - - - - - - Network Parameters for Hosts Only - - Sending ICMP redirects should be disabled for all interfaces. - - - - - - - - - - - - - Network Parameters for Hosts Only - - The default setting for sending ICMP redirects should be disabled for network interfaces. - - - - - - - - - - - - - Check for Unconfined Daemons - - Check for device file that is not labeled. - - - - - - - - Restorecon Service (restorecond) - - The restorecond service should be disabled. - - - - - - - - Disable MCS Translation Service (mcstrans) if Possible - - The mcstrans service should be disabled. - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot service should be disabled. - - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot package should be uninstalled. - - - - - - - - Enable SELinux - - The SELinux policy should be set appropriately. - - - - - - - - Enable SELinux state - - The SELinux state should be set appropriately. - - - - - - - - Enable SELinux enforcing - - SELinux should be enforcing in the bootloader - - - - - - - - Enable SELinux - - SELinux should be enabled - - - - - - - - Ensure SELinux is Properly Enabled - - Check output of /usr/sbin/sestatus. - - - - - - - - Implement a GUI Warning Banner - - The direct gnome login warning banner should be set correctly. - - - - - - - - Modify the System Login Banner - - The system login banner text should be set correctly. - - - - - - - - Configure GUI Screen Locking - - The vlock package should be installed - - - - - - - - Implement blank screen saver - - The screen saver should be blank. - - - - - - - - Implement idle activation of screen lock - - Idle activation of the screen lock should be enabled. - - - - - - - - Implement idle activation of screen saver - - Idle activation of the screen saver should be enabled. - - - - - - - - Configure GUI Screen Locking - - The allowed period of inactivity gnome desktop lockout should be configured correctly. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/bash shell should meet the minimum requirements. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/tcsh shell should meet the minimum requirements. - - - - - - - - Disable Interactive Boot - - The ability for users to perform interactive startups should be disabled. - - - - - - - - Require Authentication for Single-User Mode - - The requirement for a password to boot into single-user mode should be configured correctly. - - - - - - - - Set Boot Loader Password - - The grub boot loader should have password protection enabled - - - - - - - - Set Boot Loader Password - - File permissions for /etc/grub.conf should be set correctly. - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate group. - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate user. - - - - - - - - Check for existance of .netrc file - - No user directory should contain file .netrc - - - - - - - - Ensure that Users Have Sensible Umask Values set for csh - - The default umask for all users should be set correctly for the csh shell - - - - - - - - Ensure that Users Have Sensible Umask Values set for bash - - The default umask for all users should be set correctly for the bash shell - - - - - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - - File permissions should be set correctly for the home directories for all user accounts. - - - - - - - - - Write permissions are disabled for group and other in all directories in Root's Path - - Check each directory in root's path and make use it does not grant write permission to group and other - - - - - - - - Ensure that No Dangerous Directories Exist in Root's Path - - The PATH variable should be set correctly for user root - - - - - - - - - - Limit password reuse - - The passwords to remember should be set correctly. - - - - - - - - - - - - - - Set Password hashing algorithm - - The password hashing algorithm should be set correctly. - - - - - - - - - - - - - - - - - - Restrict Execution of userhelper to Console Users - - File permissions for /usr/sbin/userhelper should be set correctly. - - - - - - - - Restrict Execution of userhelper to Console Users - - The /usr/sbin/userhelper file should be owned by the appropriate group. - - - - - - - - - Do not log authorization failures and successes - - Remove pam_succeed_if module with quiet option and remove auth pam_deny line. - - - - - - - - - Do not leak information on authorization failure - - Authorization failures should not alert attackers as to what went wrong. - - - - - - - - Set Lockouts for Failed Password Attempts - - The "account lockout threshold" policy should meet minimum requirements. - - - - - - - - - - - - - - - - - - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_passwdqc - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_cracklib - - - - - - - - - - - - - - Remove Legacy + Entries from Password Files - - NIS file inclusions should be set appropriately in the /etc/passwd file - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/group file - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/shadow file - - - - - - - - Set Password Expiration Parameters - - The password warn age should be set appropriately - - - - - - - - Set Password Expiration Parameters - - The "maximum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The "minimum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The password minimum length should be set appropriately - - - - - - - - Verify that No Non-Root Accounts Have UID 0 - - Anonymous root logins are disabled - - - - - - - - Verify that All Account Password Hashes are Shadowed - - Check that passwords are shadowed - - - - - - - - Verify that No Accounts Have Empty Password Fields - - Login access to accounts without passwords should be disabled - - - - - - - - Block Shell and Login Access for Non-Root System Accounts - - Login access to non-root system accounts should be disabled - - - - - - - - Configure sudo to Improve Auditing of Root Access - - Sudo privileges should be granted to the wheel group - - - - - - - - Limit command Access to the Root Account - Command access to the root account should be restricted to the wheel group. - - - - - - - - Limit su Access to the wheel group - The wheel group should exist - - - - - - - - Restrict Root Logins to System Console - - Login prompts on serial ports should be disabled. - - - - - - - - Restrict Root Logins to System Console - - Logins through the primary console device should be disabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console device should be enabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console interface should be enabled - - - - - - - - Enable XD/NX processor support in the BIOS - - The XD/NX processor feature should be enabled in the BIOS - - - - - - - - Enable ExecShield randomized placement of virtual memory regions - - ExecShield randomized placement of virtual memory regions should be enabled - - - - - - - - Enable ExecShield - - ExecShield should be enabled - - - - - - - - Disable Core Dumps for setuid programs - - Core dumps for setuid programs should be disabled - - - - - - - - Disable Core Dumps - - Core dumps for all users should be disabled - - - - - - - - Set Daemon umask - - The daemon umask should be set as appropriate - - - - - - - - Find world writable directories not owned by a system account - - All world writable directories should be owned by a system user - - - - - - - - Find files unowned by a group - - All files should be owned by a group - - - - - - - - Find files unowned by a user - - All files should be owned by a user - - - - - - - - Find Unauthorized SUID System Executables - - The suid bit should be not set for all files. - - - - - - - - Find Unauthorized SGID System Executables - - The sgid bit should be not set for all executable files. - - - - - - - - Find Unauthorized World-Writable Files - - The world-write permission should be disabled for all files. - - - - - - - - Verify that All World-Writable Directories Have Sticky Bits Set - - The sticky bit should be set for all world-writable directories. - - - - - - - - Verify permissions on 'passwd' file - - File permissions for /etc/passwd should be set correctly. - - - - - - - - Verify permissions on 'gshadow' file - - File permissions for /etc/gshadow should be set correctly. - - - - - - - - Verify permissions on 'group' file - - File permissions for /etc/group should be set correctly. - - - - - - - - Verify permissions on 'shadow' file - - File permissions for /etc/shadow should be set correctly. - - - - - - - - Verify group who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'group' file - - The /etc/group file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'group' file - - The /etc/group file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate user. - - - - - - - - Disable Mounting of udf - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of squashfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfsplus - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of jffs2 - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of freevxfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of cramfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable GNOME Automounting if Possible - - The GNOME automounter (gnome-volume-manager) should be disabled - - - - - - - - Disable the Automounter if Possible - - The autofs service is disabled. - - - - - - - - Disable Booting from USB Devices in the BIOS - - The ability to boot from USB devices should be disabled - - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - - USB kernel support should be disabled. - - - - - - - - Remove USB Storage Driver - - The USB device support module should not be installed. - - - - - - - - Disable Modprobe Loading of USB Storage Driver - - The USB device support module should not be loaded - - - - - - - - Restrict Console Device Access - - Console device ownership should be restricted to root-only as appropriate. - - - - - - - - Add nosuid Option to Removable Media Partitions - - The nosuid option should be enabled for all removable media. - - - - - - - - Add noexec Option to Removable Media Partitions - - The noexec option should be enabled for all removable media. - - - - - - - - Add nodev Option to Removable Media Partitions - - The nodev option should be enabled for all removable media. - - - - - - - - Add nodev Option to Non-Root Local Partitions - - The nodev option should be enabled for all non-root partitions. - - - - - - - - - Verify Package Integrity Using RPM - - >Verify the integrity of installed packages by comparing the installed files with - information about the files taken from the package metadata stored in the RPM - database. - - - - - - - - Run AIDE periodically - - >Setup cron to run AIDE periodically using cron. - - - - - - - - Install AIDE - - The AIDE package should be installed - - - - - - - - Ensure Repodata Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere: - - - - - - - - Ensure Repodata Signature Checking is Globally Activated - - The repo_gpgcheck option should be used to ensure that checking of a signature on repodata is performed prior - to using it. - - - - - - - - Ensure Package Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere - - - - - - - - Ensure gpgcheck is Globally Activated - - The gpgcheck option should be used to ensure that checking of an RPM package’s signature always occurs prior - to its installation./ - - - - - - - - Automatic Update Retrieval should be scheduled with Cron - - Place the yum.cron script somewhere in /etc/cron.*/ - - - - - - - - yum-updatesd service should be disabled - - The yum-updatesd service should be disabled - - - - - - - - Ensure that GPG Key for Fedora is installed - - The GPG key should be installed. - - - - - - - - Ensure that /home has its own partition or logical volume - - If user home directories will be stored locally, create a separate - partition for /home. If /home will be mounted from another system such as an NFS server, then - creating a separate partition is not necessary at this time, and the mountpoint can - instead be configured later. - - - - - - - - Ensure that /var/log/audit has its own partition or logical volume - - Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make absolutely certain - that it is large enough to store all audit logs that will be created by the auditing - daemon. - - - - - - - - Ensure that /var/log has its own partition or logical volum - - System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume. - - - - - - - - Ensure that /var is of adequate size - - Because the yum package manager and other software uses /var to temporarily store - large files, ensure that it is of adequate size. For a modern, general-purpose system, - 10GB should be adequate. - - - - - - - - Ensure that /var has its own partition or logical volume - - The /var directory is used by daemons and other system - services to store frequently-changing data. It is not uncommon for the /var directory - to contain world-writable directories, installed by other software packages. - Ensure that /var has its own partition or logical volume. - - - - - - - - Ensure that /tmp is of adequate size - - Because software may need to use /tmp to temporarily store large files, ensure that it is of adequate size. - - - - - - - - Ensure that /tmp has its own partition or logical volume - - The /tmp directory is a world-writable directory used for temporary file storage. Verify that it has its own partition or logical volume. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This will enumerate all directories on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all world writable files on local partitions - - - - - - This will enumerate all world writable directories on local partitions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /etc - inittab - ~~:S:wait:/sbin/sulogin - 1 - - - /etc - vsftpd.conf - write_enable[\s]*=[\s]*([^#]*) - 1 - - - /etc - vsftpd.conf - local_enable[\s]*=[\s]*([^#]*) - 1 - - - /etc - dhcpd.conf - option[\s]+ntp-servers - 1 - - - /etc - dhcpd.conf - option[\s]+time-offset - 1 - - - /etc - dhcpd.conf - option[\s]+nis-servers - 1 - - - /etc - dhcpd.conf - option[\s]+nis-domain - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name - 1 - - - /etc - dhcpd.conf - option[\s]+routers - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name-servers - 1 - - - oval:org.open-scap.f14:var:20267 - - - net-snmp - - - snmpd - .* - - - /etc/squid - squid.conf - ^[[:space:]]*log_mime_hdrs[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*forwarded_for[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*httpd_suppress_version_string[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*allow_underscore[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ignore_unknown_nameservers[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_group[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_user[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*reply_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*request_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*check_hostnames[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_sanitycheck[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_passive[[:space:]]+([^#]*) - 1 - - - squid - - - squid - .* - - - /etc/samba - smb.conf - ^[\s]*guest[\s]+ok[\s]*=[\s]yes - 1 - - - /etc - mtab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - /etc - fstab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - /etc/samba - smb.conf - ^[\s]*client[\s]+signing[\s]*=[\s]mandatory - 1 - - - smb - .* - - - /etc - dovecot.conf - login_process_per_connection[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - mail_drop_priv_before_exec[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - disable_plaintext_auth[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*imap - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3 - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3s - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*imaps - 1 - - - dovecot - - - dovecot - .* - - - /var/log/httpd - - - - /etc/httpd/conf - .* - - - /usr/sbin - httpd - - - /etc/httpd/conf - .* - - - /etc/httpd/conf - - - - /etc/httpd/conf - httpd.conf - ServerSignature[\s]+([^#]*) - 1 - - - /etc/httpd/conf - httpd.conf - ServerTokens[\s]+([^#]*) - 1 - - - httpd - - - httpd - .* - - - /etc - vsftpd.conf - banner_file[\s]*=[\s]*/etc/issue - 1 - - - vsftpd - - - vsftpd - .* - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - bind - - - named - .* - - - /etc - exports - rw - 1 - - - /etc - exports - insecure - 1 - - - /etc - exports - no_root_squash - 1 - - - rpcsvcgssd - .* - - - nfs - .* - - - /etc/sysconfig - nfs - RQUOTAD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - MOUNTD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - LOCKD_UDPPORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_OUTGOING_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - LOCKD_TCPPORT[\s]*=[\s]*[0-9] - 1 - - - portmap - .* - - - netfs - .* - - - rpcidmapd - .* - - - rpcgssd - .* - - - nfslock - .* - - - /var/lib/ldap - .* - - - /var/lib/ldap - .* - - - ldap - .* - - - /etc - ldap.conf - ^[\s]*tls_checkpeer[\s]+yes - 1 - - - /etc/sysconfig - sendmail - DAEMON[\s]*=[\s]*yes - 1 - - - sendmail - .* - - - /etc - rc.local - /usr/local/sbin/ntpd -s - 1 - - - /etc - ntp.conf - restrict[\s]+default[\s]+ignore - 1 - - - ntpd - .* - - - /etc - syslog.conf - daemon\.\*[\s]+/var/log/daemon\.log - 1 - - - /etc - dhcpd.conf - deny[\s]+bootp; - 1 - - - /etc - dhcpd.conf - deny[\s]+declines; - 1 - - - /etc - dhcpd.conf - ddns-update-style[\s]+none; - 1 - - - dhcp - - - dhcpd - .* - - - /etc/sysconfig/network-scripts - ifcfg-eth.* - ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) - 1 - - - hplip - .* - - - /etc/cups - cupsd.conf - BrowseAllow[\s]+none - 1 - - - /etc/cups - cupsd.conf - Browsing[\s]+([^#]*) - 1 - - - cups - .* - - - /etc/avahi - avahi-daemon.conf - publish-domain[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-addresses[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-workstation[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-hinfo[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-user-service-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disallow-other-stacks[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - check-response-ttl[\s]*=[\s]*([^#]*) - 1 - - - avahi-daemon - .* - - - /etc/gdm - custom.conf - ^[\s]*InfoMsgFile[\s]*=[\s]*/etc/issue - 1 - - - /etc/X11/xinit - xserverrc - ^[\s]*exec\sX\s:0\s\-nolisten\stcp\s\$@ - 1 - - - /etc - inittab - ^[\s]*id:([^:]*):initdefault: - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Ciphers[[:space:]]+([^ \t\r\n\v\f]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitUserEnvironment[[:space:]]+no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Banner[[:space:]]+/etc/issue$ - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitEmptyPasswords[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitRootLogin[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*HostbasedAuthentication[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*IgnoreRhosts[[:space:]]*yes - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveCountMax[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveInterval[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Protocol[[:space:]](2) - 1 - - - /etc/sysconfig - ip6tables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - openssh-server - - - sshd - .* - - - /etc - at.deny - - - /etc - cron.deny - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /var/spool/cron - - - - - /etc/cron.d - - - - /etc/cron.monthly - - - - /etc/cron.weekly - - - - /etc/cron.daily - - - - /etc/cron.hourly - - - - - /etc/cron.d - - - - /etc/cron.monthly - - - - /etc/cron.weekly - - - - /etc/cron.daily - - - - - - - /etc/cron.hourly - - - - - /etc/cron.d - - - - /etc/cron.monthly - - - - /etc/cron.weekly - - - - /etc/cron.daily - - - - /etc - group - - 1 - - - /etc/cron.hourly - - - - /etc - anacrontab - - - - - - /etc - anacrontab - - - /etc - group - - 1 - - - /etc - anacrontab - - - /etc - crontab - - - - - - /etc - crontab - - - /etc - group - - 1 - - - /etc - crontab - - - cronie-anacron - - - anacron - .* - - - at - - - atd - .* - - - crond - .* - - - cpuspeed - .* - - - acpid - .* - - - apmd - .* - - - /etc/modprobe.d - .*\.conf - alias[:space:]bluetooth[:space:]off - 1 - - - /etc/modprobe.d - .*\.conf - alias[:space:]net\-pf\-31[:space:]off - 1 - - - hidd - .* - - - bluetooth - .* - - - haldaemon - .* - - - messagebus - .* - - - readahead_later - .* - - - readahead_early - .* - - - smartd - .* - - - pcscd - .* - - - /etc/sysconfig - network - ^[:space:]*NOZEROCONF=yes - 1 - - - /etc/sysconfig/network-scripts - ifcfg-[^l][^o].* - - - network - .* - - - microcode_ctl - .* - - - mdmonitor - .* - - - kudzu - .* - - - kdump - .* - - - isdn - .* - - - irqbalance - .* - - - gpm - .* - - - firstboot - .* - - - /etc/xinetd.d - tftp - - 1 - - - tftp-server - - - ypbind - .* - - - ypserv - - - rsh - - - /etc/pam.d - .* - ^[[:space:]]*.*pam_rhosts - 1 - - - /etc/xinetd.d - rlogin - - 1 - - - /etc/xinetd.d - rsh - - 1 - - - /etc/xinetd.d - rcp - - 1 - - - rsh-server - - - krb5-workstation - - - telnet - - - /etc/xinetd.d - telnet - - 1 - - - telnet-server - - - xinetd - - - inetd - - - xinetd - .* - - - inetd - .* - - - /etc/audit - audit.rules - ^\-e[[:space:]]2 - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-S[[:space:]]init_module[[:space:]]\-S[[:space:]]delete_module[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/modprobe[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/rmmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/insmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sudoers[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]actions - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]-F[[:space:]]path=/bin/ping[[:space:]]-F perm=x[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]privileged - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/wtmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/btmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/run/utmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/lastlog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/faillog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/selinux/[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]MAC\-policy$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sysconfig/network[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/hosts[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue\.net[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/security/opasswd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/shadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/gshadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/passwd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/group[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/localtime[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc - grub.conf - ^[[:space:]]*kernel.+[[:space:]]audit=1 - 1 - - - auditd - .* - - - /etc/sysconfig - rsyslog - SYSLOGD_OPTIONS[[:space:]]*=[[:space:]]*.*-r.* - 1 - - - /etc - rsyslog.conf - ^[^#]*\*\.\*[[:space:]]+@ - 1 - - - /etc - group - - 1 - - - - - - - /var/log - - - - /etc - rsyslog.conf - ^[^\#][[:space:]]*[^[:space:]]+\.[^[:space:]]+[[:space:]]+[\-]?([^[:space:]]+) - 1 - - - rsyslog - .* - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+TIPC[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+RDS[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+SCTP[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+DCCP[[:space:]]+/bin/true - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]DROP[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]DROP[:space:]\[0:0\] - 1 - - - iptables - .* - - - ip6tables - .* - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.max_addresses[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - max_addresses - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.dad_transmits[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - dad_transmits - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.autoconf[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - autoconf - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_defrtr[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_defrtr - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_pinfo[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_pinfo - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_rtr_pref[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_rtr_pref - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.router_solicitations[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - router_solicitations - ^([0-9]+)$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig/network-scripts - ifcfg-.* - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*alias[[:space:]]+net-pf-10[[:space:]]+off[[:space:]]*(#.*)?$ - 1 - - - /lib/modules/.*/kernel/drivers/net/wireless$ - - - - /proc/net - wireless - ^[[:space:]]*([^[:space:]]*):.* - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.tcp_syncookies[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - tcp_syncookies - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_ignore_bogus_error_responses[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_ignore_bogus_error_responses - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_echo_ignore_broadcasts[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_echo_ignore_broadcasts - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.log_martians[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - log_martians - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.ip_forward[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - ip_forward - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - send_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - send_redirects - ^([01])$ - 1 - - - restorecond - .* - - - mcstrans - .* - - - setroubleshoot - .* - - - setroubleshoot - - - /etc/selinux - config - ^[[:space:]]*SELINUXTYPE[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - /etc/selinux - config - ^[[:space:]]*SELINUX[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - /etc - grub.conf - [[:space:]]enforcing=([^[:space:]]*) - 1 - - - /etc - grub.conf - [[:space:]]selinux=([^[:space:]]*) - 1 - - - /usr/share/gdm/themes/RHEL - RHEL.xml - /greeter/item[@id='banner']/box[1]/item[@id='DOD_Banner']/text[1] - - - /etc - issue - (.*) - 1 - - - vlock - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text() - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value - - - /etc/profile.d - autologout.csh - ^[\s]*set[\s]+-r[\s]+autologout[\s]+([^#]*) - 1 - - - /etc/sysconfig - init - PROMPT[\s]*=[\s]*([^#]*) - 1 - - - /boot/grub - grub.conf - password[[:space:]]+--md5[[:space:]]+.* - 1 - - - /boot/grub - grub.conf - - - /etc - grub.conf - - - /boot/grub - grub.conf - - - /etc - csh.cshrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - /etc - bashrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - - /home - - - - - oval:org.open-scap.f14:obj:200855 - oval:org.open-scap.f14:ste:2008551 - - - - - - - - PATH - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+)|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+) - 1 - - - oval:org.open-scap.f14:var:20084 - - - /etc - libuser.conf - ^crypt_style[[:space:]]+\=[[:space:]]+(sha256|sha512) - 1 - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)*|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)* - 1 - - - /etc - login.defs - ^ENCRYPT_METHOD[[:space:]]+(MD5|SHA256|SHA512) - 1 - - - /etc - login.defs - ^MD5_CRYPT_ENAB[[:space:]]+(yes|no) - 1 - - - oval:org.open-scap.f14:var:20083 - - - /etc - group - - 1 - - - /usr/sbin - userhelper - - - /etc/pam.d - system-auth - ^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_tally2\.so$ - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*unlock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*[^u][^n]lock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*deny=([[:digit:]]+) - 1 - - - oval:org.open-scap.f14:var:200803 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*difok=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*lcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ocredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ucredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*dcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*minlen=([1-9][[:digit:]]*) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*retry=([[:digit:]]+) - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc - group - ^\+: - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc - login.defs - ^PASS_WARN_AGE[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MAX_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MIN_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MIN_LEN[[:space:]]*(.*) - 1 - - - /etc - passwd - ^([^:]+):[^:]*:0:.* - 1 - - - .* - - - /etc - shadow - ^[^:]*:: - 1 - - - root - - - /etc - sudoers - ^[[:space:]]*%wheel[[:space:]]+ALL=\(ALL\)[[:space:]]+ALL - 1 - - - /etc/pam.d - su - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_wheel\.so[[:space:]]+use_uid([[[:space:]]#].*)?$ - 1 - - - /etc - group - ^[[:space:]]*wheel.*$ - 1 - - - /etc - securetty - ^[[:space:]]*ttyS[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*console[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*vc\/[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*tty[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /proc/sys/kernel - randomize_va_space - ^(.*)$ - 1 - - - /proc/sys/kernel - exec-shield - ^(.*)$ - 1 - - - /proc/sys/fs - suid_dumpable - ^(.*)$ - 1 - - - /etc/security - limits.conf - ^[[:space:]]*\*[[:space:]]+hard[[:space:]]+core[[:space:]]+([[:digit:]]+) - 1 - - - /etc/rc.d/init.d - functions - ^[[:space:]]*umask[[:space:]]+([[:digit:]]+).* - 1 - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:20052 - - - - /etc - group - ^[^:]+:[^:]*:([[:digit:]]+):[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20051 - - - - /etc - passwd - ^[^:]+:[^:]+:([[:digit:]]+):[[:digit:]]+:[^:]*:[^:]+:[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20050 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:2004901 - oval:org.open-scap.f14:ste:2004902 - oval:org.open-scap.f14:ste:2004903 - oval:org.open-scap.f14:ste:2004904 - oval:org.open-scap.f14:ste:2004905 - oval:org.open-scap.f14:ste:2004906 - oval:org.open-scap.f14:ste:2004907 - oval:org.open-scap.f14:ste:2004908 - oval:org.open-scap.f14:ste:2004909 - oval:org.open-scap.f14:ste:2004910 - oval:org.open-scap.f14:ste:2004911 - oval:org.open-scap.f14:ste:2004912 - oval:org.open-scap.f14:ste:2004913 - oval:org.open-scap.f14:ste:2004914 - oval:org.open-scap.f14:ste:2004915 - oval:org.open-scap.f14:ste:2004916 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200481 - oval:org.open-scap.f14:ste:200482 - oval:org.open-scap.f14:ste:200483 - oval:org.open-scap.f14:ste:200484 - oval:org.open-scap.f14:ste:200485 - oval:org.open-scap.f14:ste:200486 - oval:org.open-scap.f14:ste:200487 - oval:org.open-scap.f14:ste:200488 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200471 - oval:org.open-scap.f14:ste:200472 - - - - - / - .* - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:200462 - - - - - / - - - - /etc - passwd - - - /etc - gshadow - - - /etc - group - - - /etc - shadow - - - /etc/modprobe.d - denylist.conf - ^[^#]*denylist[[:space:]]+([^#]*)$ - 1 - - - /etc/gconf - gconf.xml.mandatory - /desktop/gnome/volume_manager/automount_(media)|(drives) - - - autofs - .* - - - /etc - grub.conf - ^[[:space:]]*kernel[^#]nousb - 1 - - - /lib/modules/.*/kernel/drivers/usb/storage - usb-storage.ko - - - /etc/security/console.perms.d - 50-default.perms - ^[\s]*(<console>|<xconsole>) - 1 - - - /etc - mtab - ^[^#]*\/[^[:space:]]*ext[234]([^#])? - 1 - - - /etc - fstab - ^[^#]*\/.+*ext[234]([^#]*) - 1 - - - aide - - - /etc/yum.repos.d - .* - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - yum.conf - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc/yum.repos.d - .* - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - yum.conf - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - ^/etc/cron\.(hourly|daily|weekly|monthly)$ - 0yum.cron - - - yum-updatesd - .* - - - gpg-pubkey - - - /etc - fstab - ^[[:space:]]*[^[:space:]]+[[:space:]]+([^[:space:]]+)[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+ - 1 - - - - redhat-release - - - - - - - - - - - - - - - - - - - - - - - on - - - - - - - - - - - - - - - on - - - on - - - on - - - 2 - sec=(krb5i|ntlmv2i) - - - 1 - cifs - - - yes - - - yes - - - yes - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - 0 - - - 0 - - - 0 - - - off - - - no - - - no - - - no - - - no - - - yes - - - yes - - - yes - - - yes - - - aes128-ctr,aes192-ctr,aes256-ctr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - yes - - - ^[2345]$ - true - - - false - true - - - ^x86_64$|^ia64$| - - - ^i386$|^i686$ - - - true - false - - - - - - - - - - - - - - - - - - - - ^[2345]$ - true - - - ^[35]$ - true - - - - - - - - - - - - - - - - - - - - - - - - - - - no - - - no - - - no - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - 0 - - - 1 - - - 0 - - - false - true - - - - - - - - - 1 - - - 1 - - - - - - - - - blank-only - - - true - - - true - - - - - - - - - no - - - - - - - - - - - - - - 0 - - - 0 - - - - - - /home - 1 - - - /home - 1 - - - 0 - 0 - - - :\.:|:: - - - :$|\.$ - - - ^:|^\. - - - - - - 0 - - - - - - yes - - - md5 - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - root - - - x - - - 500 - /sbin/nologin - - - 1 - - - 1 - - - 0 - - - 0 - - - - - - 500 - 0 - - - - - - - - - /usr/share/BackupPC/sbin - BackupPC_Admin - - - /usr/sbin - - - - /usr/libexec/pulse - proximity-helper - - - /usr/libexec - pt_chown - - - /usr/libexec/polkit-1 - polkit-agent-helper-1 - - - /usr/libexec/openssh - ssh-keysign - - - /usr/libexec/news - - - - /usr/libexec/kde4 - kpac_dhcp_helper - - - /usr/lib64/nspluginwrapper - plugin-config - - - /usr/lib/nspluginwrapper - plugin-config - - - /usr/bin - - - - /sbin - - - - /lib64/dbus-1 - dbus-daemon-launch-helper - - - /lib/dbus-1 - dbus-daemon-launch-helper - - - /bin - - - - regular - 0 - - - /usr/lib64/vte - gnome-pty-helper - - - /usr/lib/vte - gnome-pty-helper - - - /usr/libexec/utempter - utempter - - - /usr/bin - - - - /usr/sbin - - - - /var/cache/jwhois - jwhois.db - - - /sbin - netreport - - - regular - 0 - - - regular - - - 0 - - - 0 - - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - udf - - - squashfs - - - hfsplus - - - hfs - - - jffs2 - - - freevxfs - - - cramfs - - - false - - - usb_storage - - - .*,nodev.* - - - 0 - - - 1 - - - 0 - - - 1 - 1 - - - 4c49d6fe - 97a1071f - - - /home - - - /var/log/audit - - - /var/log - - - /var - - - /tmp - - - ^5\.[2-9] - - - unix - - - ^5[^\d] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - ^[[:space:]]+disable[[:space:]]*=[[:space:]]*(yes|no) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - cron - messages - secure - maillog - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - - - - - - - - - - - - - - - - ccreds_chkpwd - mtr - seunshare - suexec - userhelper - usernetctl - userisdnctl - - - innbind - rnews - - - Xorg - at - chage - chfn - chsh - crontab - gpasswd - ksu - newgrp - passwd - pkexec - rcp - rlogin - rsh - staprun - sudo - sudoedit - - - mount.nfs - pam_timestamp_check - unix_chkpwd - - - cgexec - fusermount - mount - ping - ping6 - su - umount - - - write - locate - ssh-agent - wall - screen - lockfile - gnomine - jwhois - iagno - crontab - - - lockdev - sendmail.sendmail - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - cpe:/a:open-scap:oscap - 5.10 - 2012-07-17T15:50:44 - - - Linux - Some Version String - x86_64 - some.target.somewhere.org - - - lo - 127.0.0.1 - 00:00:00:00:00:00 - - - - - - - diff --git a/tests/DS/rds_simple/results-xccdf.xml b/tests/DS/rds_simple/results-xccdf.xml deleted file mode 100644 index e008f128ec9..00000000000 --- a/tests/DS/rds_simple/results-xccdf.xml +++ /dev/null @@ -1,16850 +0,0 @@ - - - draft - Example of SCAP Security Guidance - This example security guidance has been created to demonstrate SCAP functionality -on Linux. - 0.1 - - - - Default install settings - This profile is an example policy that simply checks if some of Fedora 14 default -install settings have been modified. It is not comprehensive nor checks security hardening. It is just for testing -purposes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - OSCAP Scan Result - some.target.somewhere.org - 127.0.0.1 - aaa::aaa:11ba:a:1 - - 00:00:00:00:00:00 - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-4218-4 - # chkconfig yum-updatesd off - - - notselected - echo -e "/usr/bin/yum -R 120 -e 0 -d 0 -y update yum\n/usr/bin/yum -R 10 -e 0 -d 0 -y update" > /etc/cron.weekly/yum.cron - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-4209-3 - yum install aide - - - notselected - echo -e "/usr/sbin/aide --check" > /etc/cron.daily/aide.cron - - - notselected - - - notselected - CCE-4249-9 - - - notselected - CCE-3522-0 - - - notselected - CCE-4275-4 - - - notselected - CCE-4042-8 - - - notselected - CCE-4187-1 - echo -e "\ndenylist usb_storage" >> /etc/modprobe.d/denylist.conf - - - notselected - CCE-4006-3 - rm /lib/modules/2.6.*/kernel/drivers/usb/storage/usb-storage.ko - - - notselected - CCE-4173-1 - - - notselected - CCE-3944-6 - - - notselected - CCE-4072-5 - chkconfig autofs off - - - notselected - CCE-4231-7 - - - notselected - echo "denylist cramfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist freevxfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist jffs2" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist hfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist hfsplus" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist squashfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist udf" >> /etc/modprobe.d/denylist.conf - - - notselected - CCE-3918-0 - - - notselected - CCE-3988-3 - - - notselected - CCE-3276-3 - - - notselected - CCE-3883-6 - - - notselected - CCE-4210-1 - - - notselected - CCE-4064-2 - - - notselected - CCE-3958-6 - - - notselected - CCE-3495-9 - - - notselected - CCE-4130-1 - - - notselected - CCE-3967-7 - - - notselected - CCE-3932-1 - - - notselected - CCE-3566-7 - - - notselected - CCE-3399-3 - - - notselected - CCE-3795-2 - - - notselected - CCE-4178-0 - - - notselected - CCE-3324-1 - - - notselected - CCE-4223-4 - - - notselected - CCE-3573-3 - - - notselected - - - notselected - CCE-4220-0 - - - notselected - CCE-4225-9 - - - notselected - CCE-4247-3 - - - notselected - CCE-4168-1 - - - notselected - CCE-4146-7 - - - notselected - CCE-4177-2 - - - notselected - CCE-3820-8 - - - notselected - CCE-3485-0 - - - notselected - CCE-4111-1 - - - notselected - CCE-4256-4 - - - notselected - - - notselected - - - notselected - CCE-4044-4 - echo "%wheel ALL=(ALL) ALL" >> /etc/sudoers - - - notselected - CCE-3987-5 - - - notselected - CCE-4238-2 - - - notselected - - - notselected - CCE-4009-7 - - - notselected - CCE-4154-1 - - - notselected - CCE-4180-6 - - - notselected - CCE-4092-3 - - - notselected - CCE-4097-2 - - - notselected - - - notselected - - - notselected - CCE-4114-5 - - - notselected - CCE-3762-2 - - - notselected - CCE-3762-2 - - - notselected - CCE-3410-8 - - - notselected - - - notselected - - - notselected - CCE-4185-5 - # chgrp usergroup /usr/sbin/userhelper - - - notselected - CCE-3952-9 - # chmod 4710 /usr/sbin/userhelper - - - notselected - /usr/sbin/authconfig --passalgo=sha512 --update - - - notselected - - - notselected - CCE-3301-9 - - - notselected - - - notselected - CCE-4090-7 - - - notselected - CCE-3844-8 - - - notselected - CCE-4227-5 - - - notselected - rm .netrc - - - notselected - CCE-4144-2 - chown root /boot/grub/grub.conf - - - notselected - CCE-4197-0 - chown :root /boot/grub/grub.conf - - - notselected - CCE-3923-0 - chmod 600 /boot/grub/grub.conf - - - notselected - CCE-3818-2 - - - notselected - CCE-4241-6 - - - notselected - CCE-4245-7 - - - notselected - CCE-3689-7 - - - notselected - CCE-3707-7 - - - notselected - CCE-3315-9 - - - notselected - - - notselected - - - notselected - - - notselected - CCE-3910-7 - yum install vlock - - - notselected - CCE-4060-0 - - - notselected - CCE-4188-9 - - - notselected - - - notselected - CCE-3977-6 - - - notselected - - - notselected - - - notselected - CCE-3624-4 - - - notselected - CCE-4148-3 - - - notselected - CCE-4254-9 - - - notselected - CCE-3668-1 - - - notselected - CCE-4129-3 - - - notselected - - - notselected - CCE-4151-7 - - - notselected - CCE-4155-8 - - - notselected - CCE-3561-8 - - - notselected - CCE-4236-6 - - - notselected - CCE-4217-6 - - - notselected - CCE-3472-8 - - - notselected - CCE-4320-8 - - - notselected - CCE-4091-5 - - - notselected - CCE-4186-3 - - - notselected - CCE-3339-9 - - - notselected - CCE-3644-2 - - - notselected - CCE-4133-5 - - - notselected - CCE-4265-5 - - - notselected - CCE-4080-8 - - - notselected - CCE-3840-6 - - - notselected - CCE-3628-5 - - - notselected - CCE-4276-2 - - - notselected - CCE-4170-7 - - - notselected - CCE-3562-6 - - - notselected - CCE-3381-1 - - - notselected - CCE-3377-9 - - - notselected - CCE-4296-0 - - - notselected - CCE-4269-7 - - - notselected - CCE-4291-1 - - - notselected - CCE-4313-3 - - - notselected - CCE-4198-8 - - - notselected - CCE-3842-2 - - - notselected - CCE-4159-0 - - - notselected - CCE-4221-8 - - - notselected - CCE-4058-4 - - - notselected - CCE-4128-5 - - - notselected - CCE-4287-9 - - - notselected - CCE-3895-0 - - - notselected - CCE-4137-6 - - - notselected - CCE-4167-3 - chkconfig ip6tables on - - - notselected - CCE-4189-7 - chkconfig iptables on - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-3679-8 - chkconfig rsyslog on - - - notselected - CCE-4366-1 - - - notselected - CCE-3701-0 - - - notselected - CCE-4233-3 - - - notselected - CCE-4260-6 - - - notselected - CCE-3382-9 - - - notselected - CCE-4182-2 - - - notselected - CCE-4323-2 - - - notselected - CCE-4292-9 - - - notselected - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - CCE-4234-1 - - - notselected - CCE-4252-3 - - - notselected - CCE-4023-8 - # yum erase inetd - - - notselected - CCE-4164-0 - # yum erase xinetd - - - notselected - # yum erase telnet - - - notselected - # yum erase rsh-server - - - notselected - CCE-4330-7 - # yum erase telnet-server - - - notselected - CCE-3390-2 - - - notselected - CCE-4308-3 - # yum erase rsh-server - - - notselected - CCE-3974-3 - # chkconfig rcp off - - - notselected - CCE-4141-8 - # chkconfig rsh off - - - notselected - CCE-3537-8 - # chkconfig rlogin off - - - notselected - - - notselected - # yum erase rsh - - - notselected - CCE-4348-9 - # yum erase ypserv - - - notselected - CCE-3705-1 - # chkconfig ypbind off - - - notselected - CCE-3916-4 - # yum erase tftp-server - - - notselected - CCE-4273-9 - # chkconfig tftp off - - - notselected - CCE-3412-4 - # chkconfig firstboot off - - - notselected - CCE-4229-1 - # chkconfig gpm off - - - notselected - CCE-4123-6 - # chkconfig irqbalance off - - - notselected - CCE-4286-1 - # chkconfig isdn off - - - notselected - CCE-3425-6 - # chkconfig kdump off - - - notselected - CCE-4211-9 - # chkconfig kudzu off - - - notselected - CCE-3854-7 - # chkconfig mdmonitor off - - - notselected - CCE-4356-2 - # chkconfig microcode ctl off - - - notselected - CCE-4369-5 - # chkconfig network off - - - notselected - # rm /etc/sysconfig/network-scripts/ifcfg-interface - - - notselected - CCE-4369-5 - - - notselected - CCE-4100-4 - # chkconfig pcscd off - - - notselected - CCE-3455-3 - # chkconfig smartd off - - - notselected - CCE-4421-4 - # chkconfig readahead early off - - - notselected - CCE-4302-6 - # chkconfig readahead later off - - - notselected - CCE-3822-4 - # chkconfig messagebus off - - - notselected - CCE-4364-6 - # chkconfig haldaemon off - - - notselected - CCE-4355-4 - # chkconfig bluetooth off - - - notselected - CCE-4377-8 - # chkconfig hidd off - - - notselected - - - notselected - CCE-4289-5 - # chkconfig apmd off - - - notselected - CCE-4298-6 - - - notselected - CCE-4051-9 - - - notselected - CCE-4324-0 - - - notselected - CCE-4406-5 - - - notselected - CCE-4428-9 - # yum erase anacron - - - notselected - CCE-3626-9 - - - notselected - CCE-3851-3 - - - notselected - CCE-4388-5 - - - notselected - CCE-3604-6 - - - notselected - CCE-4379-4 - - - notselected - CCE-4304-2 - - - notselected - CCE-4054-3 - - - notselected - CCE-3481-9 - - - notselected - CCE-4331-5 - - - notselected - CCE-4322-4 - - - notselected - CCE-4212-7 - - - notselected - CCE-3983-4 - - - notselected - CCE-4022-0 - - - notselected - CCE-3833-1 - - - notselected - CCE-4441-2 - - - notselected - CCE-4380-2 - - - notselected - CCE-4106-1 - - - notselected - CCE-4450-3 - - - notselected - CCE-4203-6 - - - notselected - CCE-4251-5 - - - notselected - CCE-4250-7 - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - rm /etc/cron.deny - - - notselected - rm /etc/at.deny - - - notselected - CCE-4268-9 - # chkconfig sshd off - - - notselected - CCE-4272-1 - # yum erase openssh-server - - - notselected - CCE-4295-2 - - - notselected - - - notselected - CCE-4325-7 - - - notselected - CCE-3845-5 - - - notselected - - - notselected - CCE-4475-0 - - - notselected - CCE-4370-3 - - - notselected - CCE-4387-7 - - - notselected - CCE-3660-8 - - - notselected - CCE-4431-3 - - - notselected - - - notselected - - - notselected - CCE-4462-8 - - - notselected - CCE-4422-2 - # yum groupremove "X Window System" - - - notselected - CCE-4074-1 - echo "exec X :0 -nolisten tcp $@" > /etc/X11/xinit/xserverrc - - - notselected - CCE-3717-6 - - - notselected - CCE-4365-3 - # chkconfig avahi-daemon off - - - notselected - CCE-4136-8 - - - notselected - CCE-4409-9 - - - notselected - CCE-4426-3 - - - notselected - CCE-4193-9 - - - notselected - CCE-4444-6 - - - notselected - CCE-4352-1 - - - notselected - CCE-4433-9 - - - notselected - CCE-4451-1 - - - notselected - CCE-4341-4 - - - notselected - CCE-4358-8 - - - notselected - CCE-4112-9 - # chkconfig cups off - - - notselected - CCE-3649-1 - - - notselected - - - notselected - CCE-4420-6 - - - notselected - CCE-4407-3 - - - notselected - CCE-4425-5 - - - notselected - CCE-4191-3 - - - notselected - CCE-4336-4 - # chkconfig dhcpd off - - - notselected - CCE-4464-4 - # yum erase dhcp - - - notselected - CCE-4257-2 - - - notselected - CCE-4403-2 - - - notselected - CCE-4345-5 - - - notselected - CCE-3724-2 - - - notselected - CCE-4243-2 - - - notselected - CCE-4389-3 - - - notselected - CCE-3913-1 - - - notselected - CCE-4169-9 - - - notselected - CCE-4318-2 - - - notselected - CCE-4319-0 - - - notselected - CCE-3733-3 - - - notselected - CCE-4376-0 - # chkconfig ntpd on - - - notselected - CCE-4134-3 - - - notselected - CCE-4385-1 - - - notselected - CCE-4032-9 - - - notselected - CCE-4424-8 - - - notselected - CCE-3487-6 - - - notselected - CCE-4416-4 - - - notselected - CCE-4293-7 - - - notselected - - - notselected - CCE-3501-4 - - - notselected - CCE-4484-2 - - - notselected - CCE-4502-1 - - - notselected - CCE-4396-8 - - - notselected - CCE-3535-2 - - - notselected - CCE-3568-3 - - - notselected - CCE-4533-6 - - - notselected - CCE-4550-0 - - - notselected - CCE-4559-1 - - - notselected - CCE-4015-4 - - - notselected - CCE-3667-3 - - - notselected - CCE-4310-9 - - - notselected - CCE-4438-8 - - - notselected - CCE-3579-0 - - - notselected - CCE-4473-5 - - - notselected - CCE-4491-7 - - - notselected - CCE-4368-7 - - - notselected - CCE-4024-6 - - - notselected - CCE-4526-0 - - - notselected - CCE-4544-3 - - - notselected - CCE-4465-1 - - - notselected - CCE-4350-5 - - - notselected - CCE-3578-2 - - - notselected - CCE-4219-2 - - - notselected - CCE-3985-9 - - - notselected - CCE-4258-0 - - - notselected - CCE-4487-5 - - - notselected - CCE-4399-2 - - - notselected - CCE-3919-8 - - - notselected - CCE-3919-8 - - - notselected - CCE-4549-2 - - - notselected - CCE-4554-2 - - - notselected - CCE-4443-8 - - - notselected - CCE-4461-0 - - - notselected - CCE-4338-0 - - - notselected - CCE-4514-6 - - - notselected - CCE-4474-3 - - - notselected - CCE-3756-4 - - - notselected - CCE-4509-6 - - - notselected - CCE-4386-9 - - - notselected - CCE-4029-5 - - - notselected - CCE-3581-6 - - - notselected - CCE-4574-0 - - - notselected - CCE-3847-1 - - - notselected - CCE-4239-0 - - - notselected - CCE-4384-4 - - - notselected - CCE-3887-7 - - - notselected - CCE-4530-2 - - - notselected - CCE-4547-6 - - - notselected - CCE-4552-6 - - - notselected - CCE-4371-1 - - - notselected - CCE-4410-7 - - - notselected - CCE-4551-8 - - - notselected - - - notselected - CCE-4556-7 - - - notselected - CCE-4556-7 - - - notselected - CCE-4556-7 - - - notselected - CCE-4076-6 - - - notselected - CCE-4454-5 - - - notselected - CCE-4459-4 - - - notselected - CCE-4503-9 - - - notselected - CCE-4353-9 - - - notselected - CCE-4419-8 - - - notselected - CCE-3692-1 - - - notselected - CCE-4476-8 - - - notselected - CCE-3585-7 - - - notselected - CCE-4344-8 - - - notselected - CCE-4494-1 - - - notselected - CCE-4181-4 - - - notselected - CCE-4577-3 - - - notselected - CCE-4511-2 - - - notselected - CCE-4529-4 - - - notselected - CCE-3610-3 - - - notselected - CCE-4466-9 - - - notselected - CCE-4607-8 - - - notselected - CCE-4255-6 - - - notselected - CCE-4127-7 - - - notselected - CCE-4519-5 - - - notselected - CCE-4413-1 - - - notselected - CCE-4373-7 - - - notselected - CCE-3765-5 - - - notselected - CCE-4404-0 - - 0.000000 - 0.000000 - - diff --git a/tests/DS/rds_simple/sds.xml b/tests/DS/rds_simple/sds.xml deleted file mode 100644 index 0f248c47e68..00000000000 --- a/tests/DS/rds_simple/sds.xml +++ /dev/null @@ -1,26366 +0,0 @@ - - - - - - - - - - - - - - - - - draft - Example of SCAP Security Guidance - This example security guidance has been created to demonstrate SCAP functionality -on Linux. - 0.1 - - - - - - - - - - - - Default install settings - This profile is an example policy that simply checks if some of Fedora 14 default -install settings have been modified. It is not comprehensive nor checks security hardening. It is just for testing -purposes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - vim, emacs - 5.5 - 2010-08-30T12:00:00-04:00 - - - - - Ensure that /tmp has its own partition or logical volume - - The /tmp directory is a world-writable directory used for temporary file storage. Verify that it has its own partition or logical volume. - - - - - - - - Ensure that /tmp is of adequate size - - Because software may need to use /tmp to temporarily store large files, ensure that it is of adequate size. - - - - - - - - Ensure that /var has its own partition or logical volume - - The /var directory is used by daemons and other system - services to store frequently-changing data. It is not uncommon for the /var directory - to contain world-writable directories, installed by other software packages. - Ensure that /var has its own partition or logical volume. - - - - - - - - Ensure that /var is of adequate size - - Because the yum package manager and other software uses /var to temporarily store - large files, ensure that it is of adequate size. For a modern, general-purpose system, - 10GB should be adequate. - - - - - - - - Ensure that /var/log has its own partition or logical volum - - System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume. - - - - - - - - Ensure that /var/log/audit has its own partition or logical volume - - Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make absolutely certain - that it is large enough to store all audit logs that will be created by the auditing - daemon. - - - - - - - - Ensure that /home has its own partition or logical volume - - If user home directories will be stored locally, create a separate - partition for /home. If /home will be mounted from another system such as an NFS server, then - creating a separate partition is not necessary at this time, and the mountpoint can - instead be configured later. - - - - - - - - Ensure that GPG Key for Fedora is installed - - The GPG key should be installed. - - - - - - - - yum-updatesd service should be disabled - - The yum-updatesd service should be disabled - - - - - - - - Automatic Update Retrieval should be scheduled with Cron - - Place the yum.cron script somewhere in /etc/cron.*/ - - - - - - - - Ensure gpgcheck is Globally Activated - - The gpgcheck option should be used to ensure that checking of an RPM package’s signature always occurs prior - to its installation./ - - - - - - - - Ensure Package Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere - - - - - - - - Ensure Repodata Signature Checking is Globally Activated - - The repo_gpgcheck option should be used to ensure that checking of a signature on repodata is performed prior - to using it. - - - - - - - - Ensure Repodata Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere: - - - - - - - - Install AIDE - - The AIDE package should be installed - - - - - - - - Run AIDE periodically - - >Setup cron to run AIDE periodically using cron. - - - - - - - - Verify Package Integrity Using RPM - - >Verify the integrity of installed packages by comparing the installed files with - information about the files taken from the package metadata stored in the RPM - database. - - - - - - - - Add nodev Option to Non-Root Local Partitions - - The nodev option should be enabled for all non-root partitions. - - - - - - - - - Add nodev Option to Removable Media Partitions - - The nodev option should be enabled for all removable media. - - - - - - - - - Add noexec Option to Removable Media Partitions - - The noexec option should be enabled for all removable media. - - - - - - - - - Add nosuid Option to Removable Media Partitions - - The nosuid option should be enabled for all removable media. - - - - - - - - - Restrict Console Device Access - - Console device ownership should be restricted to root-only as appropriate. - - - - - - - - Disable Modprobe Loading of USB Storage Driver - - The USB device support module should not be loaded - - - - - - - - Remove USB Storage Driver - - The USB device support module should not be installed. - - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - - USB kernel support should be disabled. - - - - - - - - Disable Booting from USB Devices in the BIOS - - The ability to boot from USB devices should be disabled - - - - - - - - Disable the Automounter if Possible - - The autofs service is disabled. - - - - - - - - Disable GNOME Automounting if Possible - - The GNOME automounter (gnome-volume-manager) should be disabled - - - - - - - - Disable Mounting of cramfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of freevxfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of jffs2 - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfsplus - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of squashfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of udf - - prevents usage of this uncommon filesystems. - - - - - - - - Verify user who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'group' file - - The /etc/group file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'group' file - - The /etc/group file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate group. - - - - - - - - Verify permissions on 'shadow' file - - File permissions for /etc/shadow should be set correctly. - - - - - - - - Verify permissions on 'group' file - - File permissions for /etc/group should be set correctly. - - - - - - - - Verify permissions on 'gshadow' file - - File permissions for /etc/gshadow should be set correctly. - - - - - - - - Verify permissions on 'passwd' file - - File permissions for /etc/passwd should be set correctly. - - - - - - - - Verify that All World-Writable Directories Have Sticky Bits Set - - The sticky bit should be set for all world-writable directories. - - - - - - - - Find Unauthorized World-Writable Files - - The world-write permission should be disabled for all files. - - - - - - - - - Find Unauthorized SGID System Executables - - The sgid bit should be not set for all executable files. - - - - - - - - Find Unauthorized SUID System Executables - - The suid bit should be not set for all files. - - - - - - - - Find files unowned by a user - - All files should be owned by a user - - - - - - - - Find files unowned by a group - - All files should be owned by a group - - - - - - - - Find world writable directories not owned by a system account - - All world writable directories should be owned by a system user - - - - - - - - Set Daemon umask - - The daemon umask should be set as appropriate - - - - - - - - Disable Core Dumps - - Core dumps for all users should be disabled - - - - - - - - Disable Core Dumps for setuid programs - - Core dumps for setuid programs should be disabled - - - - - - - - Enable ExecShield - - ExecShield should be enabled - - - - - - - - Enable ExecShield randomized placement of virtual memory regions - - ExecShield randomized placement of virtual memory regions should be enabled - - - - - - - - Enable XD/NX processor support in the BIOS - - The XD/NX processor feature should be enabled in the BIOS - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console interface should be enabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console device should be enabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the primary console device should be disabled - - - - - - - - Restrict Root Logins to System Console - - Login prompts on serial ports should be disabled. - - - - - - - - Limit su Access to the wheel group - The wheel group should exist - - - - - - - - Limit command Access to the Root Account - Command access to the root account should be restricted to the wheel group. - - - - - - - - Configure sudo to Improve Auditing of Root Access - - Sudo privileges should be granted to the wheel group - - - - - - - - Block Shell and Login Access for Non-Root System Accounts - - Login access to non-root system accounts should be disabled - - - - - - - - Verify that No Accounts Have Empty Password Fields - - Login access to accounts without passwords should be disabled - - - - - - - - Verify that All Account Password Hashes are Shadowed - - Check that passwords are shadowed - - - - - - - - Verify that No Non-Root Accounts Have UID 0 - - Anonymous root logins are disabled - - - - - - - - Set Password Expiration Parameters - - The password minimum length should be set appropriately - - - - - - - - Set Password Expiration Parameters - - The "minimum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The "maximum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The password warn age should be set appropriately - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/shadow file - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/group file - - - - - - - - Remove Legacy + Entries from Password Files - - NIS file inclusions should be set appropriately in the /etc/passwd file - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_cracklib - - - - - - - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_passwdqc - - - - - - - - Set Lockouts for Failed Password Attempts - - The "account lockout threshold" policy should meet minimum requirements. - - - - - - - - - - - - - - - - - - - - - - - - - Do not leak information on authorization failure - - Authorization failures should not alert attackers as to what went wrong. - - - - - - - - Do not log authorization failures and successes - - Remove pam_succeed_if module with quiet option and remove auth pam_deny line. - - - - - - - - - Restrict Execution of userhelper to Console Users - - The /usr/sbin/userhelper file should be owned by the appropriate group. - - - - - - - - - Restrict Execution of userhelper to Console Users - - File permissions for /usr/sbin/userhelper should be set correctly. - - - - - - - - Set Password hashing algorithm - - The password hashing algorithm should be set correctly. - - - - - - - - - - - - - - - - - - Limit password reuse - - The passwords to remember should be set correctly. - - - - - - - - - - - - - - Ensure that No Dangerous Directories Exist in Root's Path - - The PATH variable should be set correctly for user root - - - - - - - - - - Write permissions are disabled for group and other in all directories in Root's Path - - Check each directory in root's path and make use it does not grant write permission to group and other - - - - - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - - File permissions should be set correctly for the home directories for all user accounts. - - - - - - - - - Ensure that Users Have Sensible Umask Values set for bash - - The default umask for all users should be set correctly for the bash shell - - - - - - - - Ensure that Users Have Sensible Umask Values set for csh - - The default umask for all users should be set correctly for the csh shell - - - - - - - - Check for existance of .netrc file - - No user directory should contain file .netrc - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate user. - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate group. - - - - - - - - Set Boot Loader Password - - File permissions for /etc/grub.conf should be set correctly. - - - - - - - - Set Boot Loader Password - - The grub boot loader should have password protection enabled - - - - - - - - Require Authentication for Single-User Mode - - The requirement for a password to boot into single-user mode should be configured correctly. - - - - - - - - Disable Interactive Boot - - The ability for users to perform interactive startups should be disabled. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/tcsh shell should meet the minimum requirements. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/bash shell should meet the minimum requirements. - - - - - - - - Configure GUI Screen Locking - - The allowed period of inactivity gnome desktop lockout should be configured correctly. - - - - - - - - Implement idle activation of screen saver - - Idle activation of the screen saver should be enabled. - - - - - - - - Implement idle activation of screen lock - - Idle activation of the screen lock should be enabled. - - - - - - - - Implement blank screen saver - - The screen saver should be blank. - - - - - - - - Configure GUI Screen Locking - - The vlock package should be installed - - - - - - - - Modify the System Login Banner - - The system login banner text should be set correctly. - - - - - - - - Implement a GUI Warning Banner - - The direct gnome login warning banner should be set correctly. - - - - - - - - Ensure SELinux is Properly Enabled - - Check output of /usr/sbin/sestatus. - - - - - - - - Enable SELinux - - SELinux should be enabled - - - - - - - - Enable SELinux enforcing - - SELinux should be enforcing in the bootloader - - - - - - - - Enable SELinux state - - The SELinux state should be set appropriately. - - - - - - - - Enable SELinux - - The SELinux policy should be set appropriately. - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot package should be uninstalled. - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot service should be disabled. - - - - - - - - - Disable MCS Translation Service (mcstrans) if Possible - - The mcstrans service should be disabled. - - - - - - - - Check for Unconfined Daemons - - Check for device file that is not labeled. - - - - - - - - Restorecon Service (restorecond) - - The restorecond service should be disabled. - - - - - - - - - Network Parameters for Hosts Only - - The default setting for sending ICMP redirects should be disabled for network interfaces. - - - - - - - - - - - - - - Network Parameters for Hosts Only - - Sending ICMP redirects should be disabled for all interfaces. - - - - - - - - - - - - - Network Parameters for Hosts Only - - IP forwarding should be disabled. - - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting source routed packets should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting ICMP redirects should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Logging of "martian" packets (those with impossible addresses) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting source routed packets should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting ICMP redirects should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring ICMP echo requests (pings) sent to broadcast / multicast addresses should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring bogus ICMP responses to broadcasts should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Sending TCP syncookies should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Performing source validation by reverse path should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for performing source validation by reverse path should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Disable Wireless in BIOS - - All wireless devices should be disabled in the BIOS. - - - - - - - - Deactivate Wireless Interfaces - - All wireless interfaces should be disabled. - - - - - - - - Disable Wireless Drivers - - Device drivers for wireless devices should be excluded from the kernel. - - - - - - - - - Disable Automatic Loading of IPv6 Kernel Module - - Automatic loading of the IPv6 kernel module should be disabled. - - - - - - - - Disable Interface Usage of IPv6 - - The default setting for IPv6 configuration should be disabled for network interfaces. - - - - - - - - - Disable Interface Usage of IPv6 - - Global IPv6 initialization should be disabled. - - - - - - - - - Disable Interface Usage of IPv6 - - IPv6 configuration should be disabled for all interfaces. - - - - - - - - - Disable Automatic Configuration - - Accepting IPv6 router advertisements should be disabled for all network interfaces. - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting IPv6 router advertisements should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - Accepting redirects from IPv6 routers should be disabled as appropriate for all network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting redirects from IPv6 routers should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Use Privacy Extensions for Address if Necessary - - IPv6 privacy extensions should be configured appropriately for all interfaces. (and dependencies are met) - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 router solicitations for network interfaces to send should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting router preference via IPv6 router advertisement should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting prefix information via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting a default router via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for autoconfiguring network interfaces using prefix information in IPv6 router advertisements should be enabled or disabled as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 duplicate address detection solicitations for network interfaces to send per configured address should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of global unicast IPv6 addresses allowed per network interface should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Verify ip6tables is enabled - - The ip6tables service should be enabled. - - - - - - - - - Inspect and Activate Default Rules - - The iptables service should be enabled. - - - - - - - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain. - - - - - - - - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain. - - - - - - - - - - Configure Syslog - - The syslog service should be enabled or disabled as appropriate. - - - - - - - - Confirm Existence and Permissions of System Log Files - - All mandatory log files should be owned by root user. - - - - - - - - - Confirm Existence and Permissions of System Log Files - - All syslog log files should be owned by the appropriate group. - - - - - - - - - Confirm Existence and Permissions of System Log Files - - File permissions for all syslog log files should be set correctly. - - - - - - - - Send Logs to a Remote Loghost - - Syslog logs should be sent to a remote loghost - - - - - - - - Disable syslogd from Accepting Remote Messages on Loghosts Only - - Syslogd should reject remote messages - - - - - - - - - Monitor Suspicious Log Messages using Logwatch - - The logwatch service should be enabled or disabled as appropriate - - - - - - - - - Enable the auditd Service - - The auditd service should be enabled. - - - - - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - - Look for argument audit=1 in the kernel line in /etc/grub.conf - - - - - - - - Records Events that Modify Date and Time Information - - Audit rules about time are enabled - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - - Audit rules about User/Group Information are enabled - - - - - - - - - - - - Record Events that Modify the System’s Network Environment - - Audit rules about the System’s Network Environment are enabled - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System’s Mandatory Access Controls - - Audit rules about the System’s Mandatory Access Controls are enabled - - - - - - - - Ensure auditd Collects Logon and Logout Events - - Audit rules about the Logon and Logout Events are enabled - - - - - - - - - Ensure auditd Collects Process and Session Initiation Information - - Audit rules about the Process and Session Initiation Information are enabled - - - - - - - - - - Ensure auditd Collects Discretionary Access Control Permission Modification Events - - Audit rules about the Discretionary Access Control Permission Modification Events are enabled - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - - Audit rules about the Unauthorized Access Attempts to Files (unsuccessful) are enabled - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - - Audit rules about the Information on the Use of Privileged Commands are enabled - - - - - - - - Ensure auditd Collects Information on Exporting to Media (successful) - - Audit rules about the Information on Exporting to Media (successful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects Files Deletion Events by User (successful and unsuccessful) - - Audit rules about the Files Deletion Events by User (successful and unsuccessful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects System Administrator Actions - - Audit rules about the System Administrator Actions are enabled - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - - Audit rules about the Information on Kernel Module Loading and Unloading. - - - - - - - - - - - Make the auditd Configuration Immutable - - Force a reboot to change audit rules is enabled - - - - - - - - Inetd and Xinetd - - The inetd service should be disabled. - - - - - - - - - Inetd and Xinetd - - The xinetd service should be disabled. - - - - - - - - - Inetd and Xinetd - - The inetd package should be uninstalled. - - - - - - - - Inetd and Xinetd - - The xinetd package should be uninstalled. - - - - - - - - Telnet - - The telnet-server package should be uninstalled. - - - - - - - - Disable Telnet service - - The telnet service should be disabled. - - - - - - - - - Telnet Client installation - - The telnet package should be uninstalled. - - - - - - - - Telnet kerberos client - - The krb5-workstation package should be uninstalled. - - - - - - - - Remove the Rsh Server Commands from the System - - The rsh-server package should be uninstalled. - - - - - - - - disable rcp - - The rcp service should be disabled. - - - - - - - - - disable rsh - - The rsh service should be disabled. - - - - - - - - - disable rlogin - - The rlogin service should be disabled. - - - - - - - - - Remove .rhosts Support from PAM Configuration Files - - Check that pam rhosts authentication is not used by any PAM services. - - - - - - - - Remove the Rsh Client Commands from the System - - The rsh package, which contains client programs for many of r-commands should be uninstalled. - - - - - - - - NIS - - The ypserv package should be uninstalled. - - - - - - - - NIS - - The ypbind service should be disabled. - - - - - - - - - Uninstall TFTP Server - - The tftp-server package should be uninstalled. - - - - - - - - Disable TFTP Server - - The tftp service should be disabled. - - - - - - - - - Installation Helper Service (firstboot) - - The firstboot service should be disabled. - - - - - - - - Console Mouse Service (gpm) - - The gpm service should be disabled. - - - - - - - - Interrupt Distribution on Multiprocessor Systems (irqbalance) - - The irqbalance service should be disabled. - - - - - - - - ISDN Support (isdn) - - The isdn service should be disabled. - - - - - - - - Kdump Kernel Crash Analyzer (kdump) - - The kdump service should be disabled. - - - - - - - - Kudzu Hardware Probing Utility (kudzu) - - The kudzu service should be disabled. - - - - - - - - Software RAID Monitor (mdmonitor) - - The mdmonitor service should be disabled. - - - - - - - - IA32 Microcode Utility(microcodectl) - - The microcode_ctl service should be disabled. - - - - - - - - Disable All Networking if Not Needed - - The network service should be disabled. - - - - - - - - Disable All External Network Interfaces if Not Needed - - All files of the form ifcfg-interface except - for ifcfg-lo in /etc/sysconfig/network-scripts should be removed - - - - - - - - Disable Zeroconf Networking - - Disable Zeroconf automatic route assignment in the 169.245.0.0 subnet. - - - - - - - - Smart Card Support (pcscd) - - The pcscd service should be disabled. - - - - - - - - SMART Disk Monitoring Support (smartd) - - The smartd service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_early service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_later service should be disabled. - - - - - - - - D-Bus IPC Service (messagebus) - - The messagebus service should be disabled. - - - - - - - - HAL Daemon (haldaemon) - - The haldaemon service should be disabled. - - - - - - - - Bluetooth Host Controller Interface Daemon (bluetooth) - - The bluetooth service should be disabled. - - - - - - - - Bluetooth Input Devices (hidd) - - The hidd service should be disabled. - - - - - - - - Disable Bluetooth Kernel Modules - - Prevent loading of the Bluetooth module. - - - - - - - - - Advanced Power Management Subsystem (apmd) - - The apmd service should be disabled. - - - - - - - - Advanced Configuration and Power Interface (acpid) - - The acpid service should be disabled. - - - - - - - - CPU Throttling (cpuspeed) - - The cpuspeed service should be disabled. - - - - - - - - Cron Daemon running state - - The crond service should be enabled. - - - - - - - - At Daemon running state - - The atd service should be disabled. - - - - - - - - - At Daemons package is installed - - The at package should be removed. - - - - - - - - Disable anacron if Possible - - The anacron service should be disabled. - - - - - - - - Disable anacron if Possible - - The anacron package should be uninstalled. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/crontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/anacrontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.hourly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.daily should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.weekly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.monthly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.d should be set correctly. - - - - - - - - Restrict group owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate group. - - - - - - - - Restrict user owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on /var/spool/cron file - - File permissions for /var/spool/cron should be set correctly. - - - - - - - - Remove /etc/cron.deny - - /etc/cron.deny file should not exist. - - - - - - - - Remove /etc/at.deny - - /etc/at.deny file should not exist. - - - - - - - - Disable OpenSSH Software - - The sshd service should be disabled. - - - - - - - - - Remove OpenSSH Software - - SSH should be uninstalled - - - - - - - - Remove SSH Server iptables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Remove SSH Server ip6tables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Ensure Only Protocol 2 Connections Allowed - - SSH version 1 protocol support should be disabled. (and dependencies are met) - - - - - - - - - Set Idle Timeout Interval for User Logins - - The SSH idle timout interval should be set to an appropriate value (and dependencies are met) - - - - - - - - - Set ClientAliveCountMax for User Logins - - The SSH ClientAliveCountMax should be set to an appropriate value (and dependencies are met) - - - - - - - - - Disable .rhosts Files - - Emulation of the rsh command through the ssh server should be disabled (and dependencies are met) - - - - - - - - - Disable Host-Based Authentication - - SSH host-based authentication should be disabled (and dependencies are met) - - - - - - - - - Disable root Login via SSH - - Root login via SSH should be disabled (and dependencies are met) - - - - - - - - - Disable Empty Passwords - - Remote connections from accounts with empty passwords should be disabled (and dependencies are met) - - - - - - - - - Enable a Warning Banner - - SSH warning banner should be enabled (and dependencies are met) - - - - - - - - - Do Not Allow Users to Set Environment Options - - PermitUserEnvironment should be disabled - - - - - - - - - Use Only Approved Ciphers - - Use only approved ciphers - - - - - - - - - Disable X Windows at System Boot - - X Windows should be disabled at system boot - - - - - - - - Remove X Windows from the System if Possible - - X Windows should be removed - - - - - - - - Disable X Window System Listening - - Disable the ability to provide remote graphical display - - - - - - - - Create Warning Banners for GUI Login Users - - Enable warning banner for GUI login - - - - - - - - Disable Avahi Server Software - - The avahi-daemon service should be disabled. - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv6 (and dependencies are met) - - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv4 (and dependencies are met) - - - - - - - - - Check Responses' TTL Field - - Avahi should be configured to reject packets with a TTL field not equal to 255 (and dependencies are met) - - - - - - - - - Prevent Other Programs from Using Avahi's Port - - Avahi should be configured to not allow other stacks from binding to port 5353 (and dependencies are met) - - - - - - - - - Disable Publishing if Possible - - Avahi publishing of local information should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of local information by user applications should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of hardware information should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of workstation name should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of IP addresses should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of domain name should be disabled (and dependencies are met) - - - - - - - - - Disable the CUPS Service if Possible - - The cups service should be disabled. - - - - - - - - Disable Firewall Access to Printing Service over IPv4 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable Firewall Access to Printing Service over IPv6 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable Printer Browsing Entirely if Possible - - Remote print browsing should be disabled (and dependencies are met) - - - - - - - - - Disable Printer Browsing Entirely if Possible - - CUPS should be allowed or denied the ability to listen for Incoming printer information as appropriate (and dependencies are met) - - - - - - - - - Disable HPLIP Service if Possible - - The hplip service should be disabled. - - - - - - - - Disable DHCP Client if Possible - - The dhcp client service should be disabled for each interface. - - - - - - - - Disable DHCP Server if possible - - The dhcpd service should be enabled or disabled as appropriate. - - - - - - - - - Disable DHCP Server if possible - - The dhcp package should be uninstalled. - - - - - - - - Do Not Use Dynamic DNS - - The dynamic DNS feature of the DHCP server should be disabled (and dependencies are met) - - - - - - - - - Deny Decline Messages - - DHCPDECLINE messages should be denied by the DHCP server (and dependencies are met) - - - - - - - - - Deny BOOTP Queries - - BOOTP queries should be accepted or denied by the DHCP server as appropriate (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name server information should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Default routers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS domain should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Time offset should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NTP servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Configure DHCP Logging - - dhcpd logging should be enabled. (and dependencies are met) - - - - - - - - - Enable the NTP Daemon - - The ntpd service should be enabled. - - - - - - - - Deny All Access to ntpd by Default - - Network access to ntpd should be denied (and dependencies are met) - - - - - - - - - Specify a Remote NTP Server for Time Data - - A remote NTP Server for time synchronization should be specified (and dependencies are met) - - - - - - - - - Obtain NTP Software - - OpenNTPD should be installed - - - - - - - - Enable the NTP Daemon - - The ntp daemon should be enabled (and dependencies are met) - - - - - - - - - - Configure the Client NTP Daemon to Use the Local Server - - The ntp daemon synchronization server should be set appropriately (and dependencies are met) - - - - - - - - - Mail Transfer Agent - - The sendmail service should be disabled. - - - - - - - - Disable the Listening Sendmail Daemon - - The listening sendmail daemon should be disabled. (and dependencies are met) - - - - - - - - - Configure LDAP to Use TLS for All Transactions - - Clients require LDAP servers to provide valid certificates for SSL communications. - - - - - - - - Install OpenLDAP Server RPM - - The ldap service should be disabled. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate group. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate user. - - - - - - - - Disable Services Used Only by NFS - - The nfslock service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcgssd service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcidmapd service should be disabled. - - - - - - - - Disable netfs if Possible - - The netfs service should be disabled. - - - - - - - - Disable RPC Portmapper if Possible - - The portmap service should be disabled. - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for TCP - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use an outgoing static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for UDP - - - - - - - - Configure NFS Services to Use Fixed Ports - - The mountd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The rquotad service should be configured to use a static port - - - - - - - - Disable NFS Server Daemons - - The nfs service should be disabled - - - - - - - - Disable NFS Server Daemons - - The rpcsvcgssd service should be disabled - - - - - - - - - Mount Remote Filesystems with nosuid - - The nosuid option should be enabled for all NFS mounts - - - - - - - - Mount Remote Filesystems with noexec - - The noexec option should be enabled for all NFS mounts - - - - - - - - Use Root-Squashing on All Exports - - Root squashing should be enabled for all NFS shares - - - - - - - - - Restrict NFS Clients to Privileged Ports - - Restriction of NFS clients to privileged ports should be enabled - - - - - - - - - Export Filesystems Read-Only if Possible - - Write access to NFS shares should be disabled - - - - - - - - Disable DNS Server if Possible - - The named service should be disabled. - - - - - - - - - Disable DNS Server if Possible - - The bind package should be uninstalled. - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate group. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate user. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - File permissions for /var/named/chroot/etc/named.conf should be set correctly. (and dependencies are met) - - - - - - - - - Disable Dynamic Updates if Possible - - LDAP's dynamic updates feature should be disabled as appropriate (and dependencies are met) - - - - - - - - - Disable vsftpd if Possible - - The vsftpd service should be disabled. - - - - - - - - - Uninstall vsftpd if Possible - - The vsftpd service should be uninstalled. - - - - - - - - Enable Logging of All FTP Transactions - - Logging of vsftpd transactions should be enabled (and dependencies are met) - - - - - - - - - Create Warning Banners for All FTP Users - - A warning banner for all FTP users should be enabled (and dependencies are met) - - - - - - - - - Restrict Access to Anonymous Users if Possible - - Local user login to the vsftpd service should be disabled (and dependencies are met) - - - - - - - - - Disable FTP Uploads if Possible - - File uploads via vsftpd should be disabled (and dependencies are met) - - - - - - - - - Disable Apache if Possible - - The httpd service should be disabled. - - - - - - - - - Uninstall Apache if Possible - - The httpd package should be uninstalled. - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerTokens value should be set appropriately (and dependencies are met) - - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerSignature value should be set appropriately (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf/* should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /usr/sbin/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - The /etc/httpd/conf/* files should be owned by the appropriate group. - - - - - - - - - Restrict File and Directory Access - - File permissions for /var/log/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Disable Dovecot if Possible - - The dovecot service should be disabled. - - - - - - - - - Disable Dovecot if Possible - - The dovecot package should be uninstalled. - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imaps protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3s protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3 (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imap protocol (and dependencies are met) - - - - - - - - - Disable Plaintext Authentication - - Dovecot plaintext authentication of clients should be disabled as necessary (and dependencies are met) - - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to drop privileges to user before executing mail process should be enabled (and dependencies are met) - - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to spawn a new login process per connection should be enabled (and dependencies are met) - - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - Disable Guest Access and Local Login Support - - Do not allow guest users to access local file or printer shares. - - - - - - - - Require Client SMB Packet Signing, if using smbclient - - Require samba clients running smbclient to use packet signing. A Samba client should only communicate with servers who can support SMB packet signing. - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - - Disable Squid if Possible - - The squid service should be disabled. - - - - - - - - - Disable Squid if Possible - - The squid package should be uninstalled. - - - - - - - - Verify Default Secure Settings - - The Squid option to force FTP passive connections should be enabled (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to perform FTP sanity checks should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to check for RFC compliant hostnames should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max request HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max reply HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid EUID should be set to an appropriate user (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid GUID should be set to an appropriate group (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to ignore unknown nameservers should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to allow underscores in hostnames should be disabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to suppress the httpd version string should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to show proxy client IP addresses in HTTP headers should be disabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to log HTTP MIME headers should be enabled (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gss-http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow https traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow wais traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow multiling http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow ftp traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gopher traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow filemaker traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid proxy access to localhost should be denied (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http-mgmt traffic (and dependencies are met) - - - - - - - - - Disable SNMP Server if Possible - - The snmpd service should be disabled. - - - - - - - - - Disable SNMP Server if Possible - - The net-snmp package should be uninstalled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This will enumerate all world writable directories on local partitions - - - - - - - This will enumerate all world writable files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all directories on local partitions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /etc - fstab - ^[[:space:]]*[^[:space:]]+[[:space:]]+([^[:space:]]+)[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+ - - 1 - - - ^/etc/cron\.(hourly|daily|weekly|monthly)$ - 0yum.cron - - - /etc - yum.conf - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc/yum.repos.d - .* - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - yum.conf - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc/yum.repos.d - .* - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - fstab - ^[^#]*\/.+*ext[234]([^#]*) - 1 - - - /etc - mtab - ^[^#]*\/[^[:space:]]*ext[234]([^#])? - 1 - - - redhat-release - - - gpg-pubkey - - - - yum-updatesd - .* - - - aide - - - /etc/security/console.perms.d - 50-default.perms - ^[\s]*(<console>|<xconsole>) - 1 - - - /lib/modules/.*/kernel/drivers/usb/storage - usb-storage.ko - - - /etc - grub.conf - ^[[:space:]]*kernel[^#]nousb - 1 - - - autofs - .* - - - /etc/gconf - gconf.xml.mandatory - /desktop/gnome/volume_manager/automount_(media)|(drives) - - - /etc/modprobe.d - denylist.conf - ^[^#]*denylist[[:space:]]+([^#]*)$ - 1 - - - /etc - shadow - - - /etc - group - - - /etc - gshadow - - - /etc - passwd - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:200462 - - - - - / - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200471 - oval:org.open-scap.f14:ste:200472 - - - - - / - .* - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200481 - oval:org.open-scap.f14:ste:200482 - oval:org.open-scap.f14:ste:200483 - oval:org.open-scap.f14:ste:200484 - oval:org.open-scap.f14:ste:200485 - oval:org.open-scap.f14:ste:200486 - oval:org.open-scap.f14:ste:200487 - oval:org.open-scap.f14:ste:200488 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:2004901 - oval:org.open-scap.f14:ste:2004902 - oval:org.open-scap.f14:ste:2004903 - oval:org.open-scap.f14:ste:2004904 - oval:org.open-scap.f14:ste:2004905 - oval:org.open-scap.f14:ste:2004906 - oval:org.open-scap.f14:ste:2004907 - oval:org.open-scap.f14:ste:2004908 - oval:org.open-scap.f14:ste:2004909 - oval:org.open-scap.f14:ste:2004910 - oval:org.open-scap.f14:ste:2004911 - oval:org.open-scap.f14:ste:2004912 - oval:org.open-scap.f14:ste:2004913 - oval:org.open-scap.f14:ste:2004914 - oval:org.open-scap.f14:ste:2004915 - oval:org.open-scap.f14:ste:2004916 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20050 - - - - /etc - passwd - ^[^:]+:[^:]+:([[:digit:]]+):[[:digit:]]+:[^:]*:[^:]+:[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20051 - - - - /etc - group - ^[^:]+:[^:]*:([[:digit:]]+):[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:20052 - - - - /etc/rc.d/init.d - functions - ^[[:space:]]*umask[[:space:]]+([[:digit:]]+).* - 1 - - - /etc/security - limits.conf - ^[[:space:]]*\*[[:space:]]+hard[[:space:]]+core[[:space:]]+([[:digit:]]+) - 1 - - - /proc/sys/fs - suid_dumpable - ^(.*)$ - 1 - - - /proc/sys/kernel - randomize_va_space - ^(.*)$ - 1 - - - /proc/sys/kernel - exec-shield - ^(.*)$ - 1 - - - /etc - securetty - ^[[:space:]]*tty[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*vc\/[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*console[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*ttyS[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - group - ^[[:space:]]*wheel.*$ - 1 - - - /etc/pam.d - su - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_wheel\.so[[:space:]]+use_uid([[[:space:]]#].*)?$ - 1 - - - /etc - sudoers - ^[[:space:]]*%wheel[[:space:]]+ALL=\(ALL\)[[:space:]]+ALL - 1 - - - root - - - /etc - shadow - ^[^:]*:: - 1 - - - .* - - - /etc - passwd - ^([^:]+):[^:]*:0:.* - 1 - - - /etc - login.defs - ^PASS_MIN_LEN[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MIN_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MAX_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_WARN_AGE[[:space:]]*(.*) - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc - group - ^\+: - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*retry=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*minlen=([1-9][[:digit:]]*) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*dcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ucredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ocredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*lcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*difok=([[:digit:]]+) - 1 - - - oval:org.open-scap.f14:var:200803 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*deny=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*[^u][^n]lock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*unlock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_tally2\.so$ - 1 - - - /usr/sbin - userhelper - - - oval:org.open-scap.f14:var:20083 - - - /etc - login.defs - ^MD5_CRYPT_ENAB[[:space:]]+(yes|no) - 1 - - - /etc - login.defs - ^ENCRYPT_METHOD[[:space:]]+(MD5|SHA256|SHA512) - 1 - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)*|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)* - 1 - - - /etc - libuser.conf - ^crypt_style[[:space:]]+\=[[:space:]]+(sha256|sha512) - 1 - - - oval:org.open-scap.f14:var:20084 - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+)|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+) - 1 - - - PATH - - - - oval:org.open-scap.f14:obj:200855 - oval:org.open-scap.f14:ste:2008551 - - - - - - - - - /home - - - - /etc - bashrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - /etc - csh.cshrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - /boot/grub - grub.conf - - - /boot/grub - grub.conf - - - /boot/grub - grub.conf - password[[:space:]]+--md5[[:space:]]+.* - 1 - - - /etc - grub.conf - - - /etc - inittab - ~~:S:wait:/sbin/sulogin - 1 - - - /etc/sysconfig - init - PROMPT[\s]*=[\s]*([^#]*) - 1 - - - /etc/profile.d - autologout.csh - ^[\s]*set[\s]+-r[\s]+autologout[\s]+([^#]*) - 1 - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text() - - - vlock - - - /etc - issue - (.*) - 1 - - - /usr/share/gdm/themes/RHEL - RHEL.xml - /greeter/item[@id='banner']/box[1]/item[@id='DOD_Banner']/text[1] - - - /etc - grub.conf - [[:space:]]selinux=([^[:space:]]*) - 1 - - - /etc - grub.conf - [[:space:]]enforcing=([^[:space:]]*) - 1 - - - /etc/selinux - config - ^[[:space:]]*SELINUX[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - /etc/selinux - config - ^[[:space:]]*SELINUXTYPE[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - setroubleshoot - .* - - - setroubleshoot - - - mcstrans - .* - - - restorecond - .* - - - - /proc/sys/net/ipv4/conf/default - send_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - send_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - /proc/sys/net/ipv4 - ip_forward - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.ip_forward[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - log_martians - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.log_martians[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_echo_ignore_broadcasts - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_echo_ignore_broadcasts[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_ignore_bogus_error_responses - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_ignore_bogus_error_responses[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - tcp_syncookies - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.tcp_syncookies[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - /proc/net - wireless - ^[[:space:]]*([^[:space:]]*):.* - 1 - - - /lib/modules/.*/kernel/drivers/net/wireless$ - - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*alias[[:space:]]+net-pf-10[[:space:]]+off[[:space:]]*(#.*)?$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig/network-scripts - ifcfg-.* - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - - /proc/sys/net/ipv6/conf/default - accept_ra_rtr_pref - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_rtr_pref[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - max_addresses - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.max_addresses[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - router_solicitations - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.router_solicitations[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - dad_transmits - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.dad_transmits[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - autoconf - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.autoconf[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_pinfo - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_pinfo[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_defrtr - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_defrtr[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - ip6tables - .* - - - iptables - .* - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]DROP[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]DROP[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+DCCP[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+SCTP[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+RDS[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+TIPC[[:space:]]+/bin/true - 1 - - - rsyslog - .* - - - /etc - rsyslog.conf - ^[^\#][[:space:]]*[^[:space:]]+\.[^[:space:]]+[[:space:]]+[\-]?([^[:space:]]+) - 1 - - - - /var/log - - - - /etc - rsyslog.conf - ^[^#]*\*\.\*[[:space:]]+@ - 1 - - - /etc/sysconfig - rsyslog - SYSLOGD_OPTIONS[[:space:]]*=[[:space:]]*.*-r.* - 1 - - - - - auditd - .* - - - /etc - grub.conf - ^[[:space:]]*kernel.+[[:space:]]audit=1 - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/localtime[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/group[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/passwd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/gshadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/shadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/security/opasswd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue\.net[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/hosts[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sysconfig/network[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/selinux/[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]MAC\-policy$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/faillog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/lastlog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/run/utmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/btmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/wtmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]-F[[:space:]]path=/bin/ping[[:space:]]-F perm=x[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]privileged - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sudoers[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]actions - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/insmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/rmmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/modprobe[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-S[[:space:]]init_module[[:space:]]\-S[[:space:]]delete_module[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/xinetd.d - telnet - - 1 - - - /etc/xinetd.d - rcp - - 1 - - - /etc/xinetd.d - rsh - - 1 - - - /etc/xinetd.d - rlogin - - 1 - - - /etc/xinetd.d - tftp - - 1 - - - /etc/pam.d - .* - ^[[:space:]]*.*pam_rhosts - 1 - - - /etc/audit - audit.rules - ^\-e[[:space:]]2 - 1 - - - inetd - .* - - - xinetd - .* - - - rsh - - - inetd - - - xinetd - - - telnet-server - - - telnet - - - krb5-workstation - - - rsh-server - - - ypbind - .* - - - ypserv - - - tftp-server - - - firstboot - .* - - - gpm - .* - - - irqbalance - .* - - - isdn - .* - - - kdump - .* - - - kudzu - .* - - - mdmonitor - .* - - - microcode_ctl - .* - - - network - .* - - - /etc/sysconfig/network-scripts - ifcfg-[^l][^o].* - - - /etc/sysconfig - network - ^[:space:]*NOZEROCONF=yes - 1 - - - pcscd - .* - - - smartd - .* - - - readahead_early - .* - - - readahead_later - .* - - - messagebus - .* - - - haldaemon - .* - - - bluetooth - .* - - - hidd - .* - - - /etc/modprobe.d - .*\.conf - alias[:space:]net\-pf\-31[:space:]off - 1 - - - /etc/modprobe.d - .*\.conf - alias[:space:]bluetooth[:space:]off - 1 - - - apmd - .* - - - acpid - .* - - - cpuspeed - .* - - - crond - .* - - - atd - .* - - - at - - - anacron - .* - - - cronie-anacron - - - /etc/cron.monthly - - - - /etc/cron.daily - - - - /etc/cron.weekly - - - - /etc - crontab - - - - - - /etc - anacrontab - - - - - - /etc - crontab - - - /etc/cron.hourly - - - - /etc/cron.monthly - - - - - /etc/cron.d - - - - - /etc/cron.d - - - - /etc/cron.weekly - - - - /etc - anacrontab - - - /etc/cron.hourly - - - - /etc/cron.hourly - - - - - - - - - - /etc - crontab - - - /etc/cron.daily - - - - /etc - anacrontab - - - /etc/cron.weekly - - - - /etc/cron.monthly - - - - /etc/cron.daily - - - - - /etc/cron.d - - - - /var/spool/cron - - - - /etc - cron.deny - - - /etc - at.deny - - - sshd - .* - - - openssh-server - - - /etc/sysconfig - iptables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - /etc/sysconfig - ip6tables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Protocol[[:space:]](2) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveInterval[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveCountMax[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*IgnoreRhosts[[:space:]]*yes - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*HostbasedAuthentication[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitRootLogin[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitEmptyPasswords[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Banner[[:space:]]+/etc/issue$ - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitUserEnvironment[[:space:]]+no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Ciphers[[:space:]]+([^ \t\r\n\v\f]+) - 1 - - - /etc - inittab - ^[\s]*id:([^:]*):initdefault: - 1 - - - /etc/X11/xinit - xserverrc - ^[\s]*exec\sX\s:0\s\-nolisten\stcp\s\$@ - 1 - - - /etc/gdm - custom.conf - ^[\s]*InfoMsgFile[\s]*=[\s]*/etc/issue - 1 - - - avahi-daemon - .* - - - /etc/avahi - avahi-daemon.conf - check-response-ttl[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disallow-other-stacks[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-user-service-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-hinfo[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-workstation[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-addresses[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-domain[\s]*=[\s]*([^#]*) - 1 - - - cups - .* - - - /etc/cups - cupsd.conf - Browsing[\s]+([^#]*) - 1 - - - /etc/cups - cupsd.conf - BrowseAllow[\s]+none - 1 - - - hplip - .* - - - /etc/sysconfig/network-scripts - ifcfg-eth.* - ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) - 1 - - - oval:org.open-scap.f14:var:20267 - - - dhcpd - .* - - - dhcp - - - /etc - dhcpd.conf - ddns-update-style[\s]+none; - 1 - - - /etc - dhcpd.conf - deny[\s]+declines; - 1 - - - /etc - dhcpd.conf - deny[\s]+bootp; - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name-servers - 1 - - - /etc - dhcpd.conf - option[\s]+routers - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name - 1 - - - /etc - dhcpd.conf - option[\s]+nis-domain - 1 - - - /etc - dhcpd.conf - option[\s]+nis-servers - 1 - - - /etc - dhcpd.conf - option[\s]+time-offset - 1 - - - /etc - dhcpd.conf - option[\s]+ntp-servers - 1 - - - /etc - syslog.conf - daemon\.\*[\s]+/var/log/daemon\.log - 1 - - - ntpd - .* - - - /etc - ntp.conf - restrict[\s]+default[\s]+ignore - 1 - - - /etc - rc.local - /usr/local/sbin/ntpd -s - 1 - - - sendmail - .* - - - /etc/sysconfig - sendmail - DAEMON[\s]*=[\s]*yes - 1 - - - /etc - ldap.conf - ^[\s]*tls_checkpeer[\s]+yes - 1 - - - ldap - .* - - - /var/lib/ldap - .* - - - /var/lib/ldap - .* - - - nfslock - .* - - - rpcgssd - .* - - - rpcidmapd - .* - - - netfs - .* - - - portmap - .* - - - /etc/sysconfig - nfs - LOCKD_TCPPORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_OUTGOING_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - LOCKD_UDPPORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - MOUNTD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - RQUOTAD_PORT[\s]*=[\s]*[0-9] - 1 - - - nfs - .* - - - rpcsvcgssd - .* - - - /etc - exports - no_root_squash - 1 - - - /etc - exports - insecure - 1 - - - /etc - exports - rw - 1 - - - named - .* - - - bind - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - vsftpd - .* - - - vsftpd - - - /etc - vsftpd.conf - banner_file[\s]*=[\s]*/etc/issue - 1 - - - /etc - vsftpd.conf - local_enable[\s]*=[\s]*([^#]*) - 1 - - - /etc - vsftpd.conf - write_enable[\s]*=[\s]*([^#]*) - 1 - - - httpd - .* - - - httpd - - - /etc/httpd/conf - httpd.conf - ServerTokens[\s]+([^#]*) - 1 - - - /etc/httpd/conf - httpd.conf - ServerSignature[\s]+([^#]*) - 1 - - - /etc/httpd/conf - - - - /etc/httpd/conf - .* - - - /usr/sbin - httpd - - - /etc/httpd/conf - .* - - - /var/log/httpd - - - - dovecot - .* - - - dovecot - - - /etc - dovecot.conf - protocols[\s]*=.*imaps - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3s - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3 - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*imap - 1 - - - /etc - dovecot.conf - disable_plaintext_auth[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - mail_drop_priv_before_exec[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - login_process_per_connection[\s]*=[\s]*([^#]*) - 1 - - - smb - .* - - - /etc/samba - smb.conf - ^[\s]*guest[\s]+ok[\s]*=[\s]yes - 1 - - - /etc/samba - smb.conf - ^[\s]*client[\s]+signing[\s]*=[\s]mandatory - 1 - - - /etc - fstab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - /etc - mtab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - squid - .* - - - squid - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_passive[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*request_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*check_hostnames[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ignore_unknown_nameservers[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*reply_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_user[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_sanitycheck[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_group[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*forwarded_for[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*log_mime_hdrs[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*allow_underscore[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*httpd_suppress_version_string[[:space:]]+([^#]*) - 1 - - - snmpd - .* - - - net-snmp - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - - - /tmp - - - /var - - - /var/log - - - /var/log/audit - - - /home - - - 1 - 1 - - - 0 - - - 1 - - - 0 - - - .*,nodev.* - - - ^5[^\d] - - - 4c49d6fe - 97a1071f - - - ^5\.[2-9] - - - unix - - - false - - - usb_storage - - - cramfs - - - freevxfs - - - jffs2 - - - hfs - - - hfsplus - - - squashfs - - - udf - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 1 - - - 0 - - - 0 - - - regular - - - regular - 0 - - - /sbin - netreport - - - /var/cache/jwhois - jwhois.db - - - /usr/sbin - - - - /usr/bin - - - - /usr/libexec/utempter - utempter - - - /usr/lib/vte - gnome-pty-helper - - - /usr/lib64/vte - gnome-pty-helper - - - regular - 0 - - - /bin - - - - /lib/dbus-1 - dbus-daemon-launch-helper - - - /lib64/dbus-1 - dbus-daemon-launch-helper - - - /sbin - - - - /usr/bin - - - - /usr/lib/nspluginwrapper - plugin-config - - - /usr/lib64/nspluginwrapper - plugin-config - - - /usr/libexec/kde4 - kpac_dhcp_helper - - - /usr/libexec/news - - - - /usr/libexec/openssh - ssh-keysign - - - /usr/libexec/polkit-1 - polkit-agent-helper-1 - - - /usr/libexec - pt_chown - - - /usr/libexec/pulse - proximity-helper - - - /usr/sbin - - - - /usr/share/BackupPC/sbin - BackupPC_Admin - - - - - - - - - 500 - 0 - - - - - - 0 - - - 0 - - - 1 - - - 1 - - - 500 - /sbin/nologin - - - x - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - md5 - - - yes - - - - - - 0 - - - - - - ^:|^\. - - - :$|\.$ - - - :\.:|:: - - - 0 - 0 - - - /home - 1 - - - /home - 1 - - - - - - 0 - - - - - - - - - - - - - - 0 - - - no - - - - - - - - - true - - - true - - - blank-only - - - - - - - - - 1 - - - 1 - - - - - - - - - false - true - - - false - true - - - ^[2345]$ - true - - - - 0 - - - 1 - - - - 0 - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - no - - - no - - - no - - - - - - - - - - - - - - - - - - - - - - - - - - - yes - - - ^[35]$ - true - - - ^[2345]$ - true - - - - - - - - - - - - - - - - - - - - true - false - - - ^i386$|^i686$ - - - ^x86_64$|^ia64$| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - aes128-ctr,aes192-ctr,aes256-ctr - - - yes - - - yes - - - yes - - - yes - - - no - - - no - - - no - - - no - - - off - - - 0 - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - yes - - - yes - - - yes - - - 1 - cifs - - - 2 - sec=(krb5i|ntlmv2i) - - - on - - - - - - on - - - on - - - - - - - - - on - - - - - - - - - - - - - - - - - - root - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - cron - messages - secure - maillog - - - - lockdev - sendmail.sendmail - - - write - locate - ssh-agent - wall - screen - lockfile - gnomine - jwhois - iagno - crontab - - - cgexec - fusermount - mount - ping - ping6 - su - umount - - - mount.nfs - pam_timestamp_check - unix_chkpwd - - - Xorg - at - chage - chfn - chsh - crontab - gpasswd - ksu - newgrp - passwd - pkexec - rcp - rlogin - rsh - staprun - sudo - sudoedit - - - innbind - rnews - - - ccreds_chkpwd - mtr - seunshare - suexec - userhelper - usernetctl - userisdnctl - - - ^[[:space:]]+disable[[:space:]]*=[[:space:]]*(yes|no) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - diff --git a/tests/DS/rds_split_simple/report-request.xml b/tests/DS/rds_split_simple/report-request.xml deleted file mode 100644 index aeb23950d04..00000000000 --- a/tests/DS/rds_split_simple/report-request.xml +++ /dev/null @@ -1,25749 +0,0 @@ - - - - - - - - - - - - - - - - - draft - Example of SCAP Security Guidance - This example security guidance has been created to demonstrate SCAP functionality -on Linux. - 0.1 - - - - - - - - - - - - Default install settings - This profile is an example policy that simply checks if some of Fedora 14 default -install settings have been modified. It is not comprehensive nor checks security hardening. It is just for testing -purposes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - vim, emacs - 5.5 - 2010-08-30T12:00:00-04:00 - - - - - Ensure that /tmp has its own partition or logical volume - - The /tmp directory is a world-writable directory used for temporary file storage. Verify that it has its own partition or logical volume. - - - - - - - - Ensure that /tmp is of adequate size - - Because software may need to use /tmp to temporarily store large files, ensure that it is of adequate size. - - - - - - - - Ensure that /var has its own partition or logical volume - - The /var directory is used by daemons and other system - services to store frequently-changing data. It is not uncommon for the /var directory - to contain world-writable directories, installed by other software packages. - Ensure that /var has its own partition or logical volume. - - - - - - - - Ensure that /var is of adequate size - - Because the yum package manager and other software uses /var to temporarily store - large files, ensure that it is of adequate size. For a modern, general-purpose system, - 10GB should be adequate. - - - - - - - - Ensure that /var/log has its own partition or logical volum - - System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume. - - - - - - - - Ensure that /var/log/audit has its own partition or logical volume - - Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make absolutely certain - that it is large enough to store all audit logs that will be created by the auditing - daemon. - - - - - - - - Ensure that /home has its own partition or logical volume - - If user home directories will be stored locally, create a separate - partition for /home. If /home will be mounted from another system such as an NFS server, then - creating a separate partition is not necessary at this time, and the mountpoint can - instead be configured later. - - - - - - - - Ensure that GPG Key for Fedora is installed - - The GPG key should be installed. - - - - - - - - yum-updatesd service should be disabled - - The yum-updatesd service should be disabled - - - - - - - - Automatic Update Retrieval should be scheduled with Cron - - Place the yum.cron script somewhere in /etc/cron.*/ - - - - - - - - Ensure gpgcheck is Globally Activated - - The gpgcheck option should be used to ensure that checking of an RPM package’s signature always occurs prior - to its installation./ - - - - - - - - Ensure Package Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere - - - - - - - - Ensure Repodata Signature Checking is Globally Activated - - The repo_gpgcheck option should be used to ensure that checking of a signature on repodata is performed prior - to using it. - - - - - - - - Ensure Repodata Signature Checking is Not Disabled For Any Repos - - To ensure that signature checking is not disabled for any repos, ensure that the following line DOES NOT - appear in any repo configuration files in /etc/yum.repos.d or elsewhere: - - - - - - - - Install AIDE - - The AIDE package should be installed - - - - - - - - Run AIDE periodically - - >Setup cron to run AIDE periodically using cron. - - - - - - - - Verify Package Integrity Using RPM - - >Verify the integrity of installed packages by comparing the installed files with - information about the files taken from the package metadata stored in the RPM - database. - - - - - - - - Add nodev Option to Non-Root Local Partitions - - The nodev option should be enabled for all non-root partitions. - - - - - - - - - Add nodev Option to Removable Media Partitions - - The nodev option should be enabled for all removable media. - - - - - - - - - Add noexec Option to Removable Media Partitions - - The noexec option should be enabled for all removable media. - - - - - - - - - Add nosuid Option to Removable Media Partitions - - The nosuid option should be enabled for all removable media. - - - - - - - - - Restrict Console Device Access - - Console device ownership should be restricted to root-only as appropriate. - - - - - - - - Disable Modprobe Loading of USB Storage Driver - - The USB device support module should not be loaded - - - - - - - - Remove USB Storage Driver - - The USB device support module should not be installed. - - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - - USB kernel support should be disabled. - - - - - - - - Disable Booting from USB Devices in the BIOS - - The ability to boot from USB devices should be disabled - - - - - - - - Disable the Automounter if Possible - - The autofs service is disabled. - - - - - - - - Disable GNOME Automounting if Possible - - The GNOME automounter (gnome-volume-manager) should be disabled - - - - - - - - Disable Mounting of cramfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of freevxfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of jffs2 - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of hfsplus - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of squashfs - - prevents usage of this uncommon filesystems. - - - - - - - - Disable Mounting of udf - - prevents usage of this uncommon filesystems. - - - - - - - - Verify user who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'shadow' file - - The /etc/shadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'group' file - - The /etc/group file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'group' file - - The /etc/group file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'gshadow' file - - The /etc/gshadow file should be owned by the appropriate group. - - - - - - - - Verify user who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate user. - - - - - - - - Verify group who owns 'passwd' file - - The /etc/passwd file should be owned by the appropriate group. - - - - - - - - Verify permissions on 'shadow' file - - File permissions for /etc/shadow should be set correctly. - - - - - - - - Verify permissions on 'group' file - - File permissions for /etc/group should be set correctly. - - - - - - - - Verify permissions on 'gshadow' file - - File permissions for /etc/gshadow should be set correctly. - - - - - - - - Verify permissions on 'passwd' file - - File permissions for /etc/passwd should be set correctly. - - - - - - - - Verify that All World-Writable Directories Have Sticky Bits Set - - The sticky bit should be set for all world-writable directories. - - - - - - - - Find Unauthorized World-Writable Files - - The world-write permission should be disabled for all files. - - - - - - - - - Find Unauthorized SGID System Executables - - The sgid bit should be not set for all executable files. - - - - - - - - Find Unauthorized SUID System Executables - - The suid bit should be not set for all files. - - - - - - - - Find files unowned by a user - - All files should be owned by a user - - - - - - - - Find files unowned by a group - - All files should be owned by a group - - - - - - - - Find world writable directories not owned by a system account - - All world writable directories should be owned by a system user - - - - - - - - Set Daemon umask - - The daemon umask should be set as appropriate - - - - - - - - Disable Core Dumps - - Core dumps for all users should be disabled - - - - - - - - Disable Core Dumps for setuid programs - - Core dumps for setuid programs should be disabled - - - - - - - - Enable ExecShield - - ExecShield should be enabled - - - - - - - - Enable ExecShield randomized placement of virtual memory regions - - ExecShield randomized placement of virtual memory regions should be enabled - - - - - - - - Enable XD/NX processor support in the BIOS - - The XD/NX processor feature should be enabled in the BIOS - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console interface should be enabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the specified virtual console device should be enabled - - - - - - - - Restrict Root Logins to System Console - - Logins through the primary console device should be disabled - - - - - - - - Restrict Root Logins to System Console - - Login prompts on serial ports should be disabled. - - - - - - - - Limit su Access to the wheel group - The wheel group should exist - - - - - - - - Limit command Access to the Root Account - Command access to the root account should be restricted to the wheel group. - - - - - - - - Configure sudo to Improve Auditing of Root Access - - Sudo privileges should be granted to the wheel group - - - - - - - - Block Shell and Login Access for Non-Root System Accounts - - Login access to non-root system accounts should be disabled - - - - - - - - Verify that No Accounts Have Empty Password Fields - - Login access to accounts without passwords should be disabled - - - - - - - - Verify that All Account Password Hashes are Shadowed - - Check that passwords are shadowed - - - - - - - - Verify that No Non-Root Accounts Have UID 0 - - Anonymous root logins are disabled - - - - - - - - Set Password Expiration Parameters - - The password minimum length should be set appropriately - - - - - - - - Set Password Expiration Parameters - - The "minimum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The "maximum password age" policy should meet minimum requirements. - - - - - - - - Set Password Expiration Parameters - - The password warn age should be set appropriately - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/shadow file - - - - - - - - Remove Legacy + Entries from Password Files - NIS file inclusions should be set appropriately in the /etc/group file - - - - - - - - Remove Legacy + Entries from Password Files - - NIS file inclusions should be set appropriately in the /etc/passwd file - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_cracklib - - - - - - - - - - - - - - Set Password Quality Requirements - - The password strength should meet minimum requirements using pam_passwdqc - - - - - - - - Set Lockouts for Failed Password Attempts - - The "account lockout threshold" policy should meet minimum requirements. - - - - - - - - - - - - - - - - - - - - - - - - - Do not leak information on authorization failure - - Authorization failures should not alert attackers as to what went wrong. - - - - - - - - Do not log authorization failures and successes - - Remove pam_succeed_if module with quiet option and remove auth pam_deny line. - - - - - - - - - Restrict Execution of userhelper to Console Users - - The /usr/sbin/userhelper file should be owned by the appropriate group. - - - - - - - - - Restrict Execution of userhelper to Console Users - - File permissions for /usr/sbin/userhelper should be set correctly. - - - - - - - - Set Password hashing algorithm - - The password hashing algorithm should be set correctly. - - - - - - - - - - - - - - - - - - Limit password reuse - - The passwords to remember should be set correctly. - - - - - - - - - - - - - - Ensure that No Dangerous Directories Exist in Root's Path - - The PATH variable should be set correctly for user root - - - - - - - - - - Write permissions are disabled for group and other in all directories in Root's Path - - Check each directory in root's path and make use it does not grant write permission to group and other - - - - - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - - File permissions should be set correctly for the home directories for all user accounts. - - - - - - - - - Ensure that Users Have Sensible Umask Values set for bash - - The default umask for all users should be set correctly for the bash shell - - - - - - - - Ensure that Users Have Sensible Umask Values set for csh - - The default umask for all users should be set correctly for the csh shell - - - - - - - - Check for existance of .netrc file - - No user directory should contain file .netrc - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate user. - - - - - - - - Set Boot Loader Password - - The /etc/grub.conf file should be owned by the appropriate group. - - - - - - - - Set Boot Loader Password - - File permissions for /etc/grub.conf should be set correctly. - - - - - - - - Set Boot Loader Password - - The grub boot loader should have password protection enabled - - - - - - - - Require Authentication for Single-User Mode - - The requirement for a password to boot into single-user mode should be configured correctly. - - - - - - - - Disable Interactive Boot - - The ability for users to perform interactive startups should be disabled. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/tcsh shell should meet the minimum requirements. - - - - - - - - Implement Inactivity Time-out for Login Shells - - The idle time-out value for the default /bin/bash shell should meet the minimum requirements. - - - - - - - - Configure GUI Screen Locking - - The allowed period of inactivity gnome desktop lockout should be configured correctly. - - - - - - - - Implement idle activation of screen saver - - Idle activation of the screen saver should be enabled. - - - - - - - - Implement idle activation of screen lock - - Idle activation of the screen lock should be enabled. - - - - - - - - Implement blank screen saver - - The screen saver should be blank. - - - - - - - - Configure GUI Screen Locking - - The vlock package should be installed - - - - - - - - Modify the System Login Banner - - The system login banner text should be set correctly. - - - - - - - - Implement a GUI Warning Banner - - The direct gnome login warning banner should be set correctly. - - - - - - - - Ensure SELinux is Properly Enabled - - Check output of /usr/sbin/sestatus. - - - - - - - - Enable SELinux - - SELinux should be enabled - - - - - - - - Enable SELinux enforcing - - SELinux should be enforcing in the bootloader - - - - - - - - Enable SELinux state - - The SELinux state should be set appropriately. - - - - - - - - Enable SELinux - - The SELinux policy should be set appropriately. - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot package should be uninstalled. - - - - - - - - Disable and Remove SETroubleshoot if Possible - - The setroubleshoot service should be disabled. - - - - - - - - - Disable MCS Translation Service (mcstrans) if Possible - - The mcstrans service should be disabled. - - - - - - - - Check for Unconfined Daemons - - Check for device file that is not labeled. - - - - - - - - Restorecon Service (restorecond) - - The restorecond service should be disabled. - - - - - - - - - Network Parameters for Hosts Only - - The default setting for sending ICMP redirects should be disabled for network interfaces. - - - - - - - - - - - - - - Network Parameters for Hosts Only - - Sending ICMP redirects should be disabled for all interfaces. - - - - - - - - - - - - - Network Parameters for Hosts Only - - IP forwarding should be disabled. - - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting source routed packets should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting ICMP redirects should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Logging of "martian" packets (those with impossible addresses) should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting source routed packets should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting ICMP redirects should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring ICMP echo requests (pings) sent to broadcast / multicast addresses should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Ignoring bogus ICMP responses to broadcasts should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Sending TCP syncookies should be enabled or disabled as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - Performing source validation by reverse path should be enabled or disabled for all interfaces as appropriate. - - - - - - - - - - - - Network Parameters for Hosts and Routers - - The default setting for performing source validation by reverse path should be enabled or disabled for network interfaces as appropriate. - - - - - - - - - - - - Disable Wireless in BIOS - - All wireless devices should be disabled in the BIOS. - - - - - - - - Deactivate Wireless Interfaces - - All wireless interfaces should be disabled. - - - - - - - - Disable Wireless Drivers - - Device drivers for wireless devices should be excluded from the kernel. - - - - - - - - - Disable Automatic Loading of IPv6 Kernel Module - - Automatic loading of the IPv6 kernel module should be disabled. - - - - - - - - Disable Interface Usage of IPv6 - - The default setting for IPv6 configuration should be disabled for network interfaces. - - - - - - - - - Disable Interface Usage of IPv6 - - Global IPv6 initialization should be disabled. - - - - - - - - - Disable Interface Usage of IPv6 - - IPv6 configuration should be disabled for all interfaces. - - - - - - - - - Disable Automatic Configuration - - Accepting IPv6 router advertisements should be disabled for all network interfaces. - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting IPv6 router advertisements should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - Accepting redirects from IPv6 routers should be disabled as appropriate for all network interfaces. (and dependencies are met) - - - - - - - - - Disable Automatic Configuration - - The default setting for accepting redirects from IPv6 routers should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - Use Privacy Extensions for Address if Necessary - - IPv6 privacy extensions should be configured appropriately for all interfaces. (and dependencies are met) - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 router solicitations for network interfaces to send should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting router preference via IPv6 router advertisement should be disabled for network interfaces. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting prefix information via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for accepting a default router via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default setting for autoconfiguring network interfaces using prefix information in IPv6 router advertisements should be enabled or disabled as appropriate. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of IPv6 duplicate address detection solicitations for network interfaces to send per configured address should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Limit Network-Transmitted Configuration - - The default number of global unicast IPv6 addresses allowed per network interface should be set appropriately. (and dependencies are met) - - - - - - - - - - - - - - - - - Verify ip6tables is enabled - - The ip6tables service should be enabled. - - - - - - - - - Inspect and Activate Default Rules - - The iptables service should be enabled. - - - - - - - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain - - Change the default policy to DROP (from ACCEPT) for the INPUT built-in chain. - - - - - - - - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain - - Change the default policy to DROP (from ACCEPT) for the FORWARD built-in chain. - - - - - - - - - - Configure Syslog - - The syslog service should be enabled or disabled as appropriate. - - - - - - - - Confirm Existence and Permissions of System Log Files - - All mandatory log files should be owned by root user. - - - - - - - - - Confirm Existence and Permissions of System Log Files - - All syslog log files should be owned by the appropriate group. - - - - - - - - - Confirm Existence and Permissions of System Log Files - - File permissions for all syslog log files should be set correctly. - - - - - - - - Send Logs to a Remote Loghost - - Syslog logs should be sent to a remote loghost - - - - - - - - Disable syslogd from Accepting Remote Messages on Loghosts Only - - Syslogd should reject remote messages - - - - - - - - - Monitor Suspicious Log Messages using Logwatch - - The logwatch service should be enabled or disabled as appropriate - - - - - - - - - Enable the auditd Service - - The auditd service should be enabled. - - - - - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - - Look for argument audit=1 in the kernel line in /etc/grub.conf - - - - - - - - Records Events that Modify Date and Time Information - - Audit rules about time are enabled - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - - Audit rules about User/Group Information are enabled - - - - - - - - - - - - Record Events that Modify the System’s Network Environment - - Audit rules about the System’s Network Environment are enabled - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System’s Mandatory Access Controls - - Audit rules about the System’s Mandatory Access Controls are enabled - - - - - - - - Ensure auditd Collects Logon and Logout Events - - Audit rules about the Logon and Logout Events are enabled - - - - - - - - - Ensure auditd Collects Process and Session Initiation Information - - Audit rules about the Process and Session Initiation Information are enabled - - - - - - - - - - Ensure auditd Collects Discretionary Access Control Permission Modification Events - - Audit rules about the Discretionary Access Control Permission Modification Events are enabled - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - - Audit rules about the Unauthorized Access Attempts to Files (unsuccessful) are enabled - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - - Audit rules about the Information on the Use of Privileged Commands are enabled - - - - - - - - Ensure auditd Collects Information on Exporting to Media (successful) - - Audit rules about the Information on Exporting to Media (successful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects Files Deletion Events by User (successful and unsuccessful) - - Audit rules about the Files Deletion Events by User (successful and unsuccessful) are enabled - - - - - - - - - - - - - - - Ensure auditd Collects System Administrator Actions - - Audit rules about the System Administrator Actions are enabled - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - - Audit rules about the Information on Kernel Module Loading and Unloading. - - - - - - - - - - - Make the auditd Configuration Immutable - - Force a reboot to change audit rules is enabled - - - - - - - - Inetd and Xinetd - - The inetd service should be disabled. - - - - - - - - - Inetd and Xinetd - - The xinetd service should be disabled. - - - - - - - - - Inetd and Xinetd - - The inetd package should be uninstalled. - - - - - - - - Inetd and Xinetd - - The xinetd package should be uninstalled. - - - - - - - - Telnet - - The telnet-server package should be uninstalled. - - - - - - - - Disable Telnet service - - The telnet service should be disabled. - - - - - - - - - Telnet Client installation - - The telnet package should be uninstalled. - - - - - - - - Telnet kerberos client - - The krb5-workstation package should be uninstalled. - - - - - - - - Remove the Rsh Server Commands from the System - - The rsh-server package should be uninstalled. - - - - - - - - disable rcp - - The rcp service should be disabled. - - - - - - - - - disable rsh - - The rsh service should be disabled. - - - - - - - - - disable rlogin - - The rlogin service should be disabled. - - - - - - - - - Remove .rhosts Support from PAM Configuration Files - - Check that pam rhosts authentication is not used by any PAM services. - - - - - - - - Remove the Rsh Client Commands from the System - - The rsh package, which contains client programs for many of r-commands should be uninstalled. - - - - - - - - NIS - - The ypserv package should be uninstalled. - - - - - - - - NIS - - The ypbind service should be disabled. - - - - - - - - - Uninstall TFTP Server - - The tftp-server package should be uninstalled. - - - - - - - - Disable TFTP Server - - The tftp service should be disabled. - - - - - - - - - Installation Helper Service (firstboot) - - The firstboot service should be disabled. - - - - - - - - Console Mouse Service (gpm) - - The gpm service should be disabled. - - - - - - - - Interrupt Distribution on Multiprocessor Systems (irqbalance) - - The irqbalance service should be disabled. - - - - - - - - ISDN Support (isdn) - - The isdn service should be disabled. - - - - - - - - Kdump Kernel Crash Analyzer (kdump) - - The kdump service should be disabled. - - - - - - - - Kudzu Hardware Probing Utility (kudzu) - - The kudzu service should be disabled. - - - - - - - - Software RAID Monitor (mdmonitor) - - The mdmonitor service should be disabled. - - - - - - - - IA32 Microcode Utility(microcodectl) - - The microcode_ctl service should be disabled. - - - - - - - - Disable All Networking if Not Needed - - The network service should be disabled. - - - - - - - - Disable All External Network Interfaces if Not Needed - - All files of the form ifcfg-interface except - for ifcfg-lo in /etc/sysconfig/network-scripts should be removed - - - - - - - - Disable Zeroconf Networking - - Disable Zeroconf automatic route assignment in the 169.245.0.0 subnet. - - - - - - - - Smart Card Support (pcscd) - - The pcscd service should be disabled. - - - - - - - - SMART Disk Monitoring Support (smartd) - - The smartd service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_early service should be disabled. - - - - - - - - Boot Caching (readahead early/readahead later) - - The readahead_later service should be disabled. - - - - - - - - D-Bus IPC Service (messagebus) - - The messagebus service should be disabled. - - - - - - - - HAL Daemon (haldaemon) - - The haldaemon service should be disabled. - - - - - - - - Bluetooth Host Controller Interface Daemon (bluetooth) - - The bluetooth service should be disabled. - - - - - - - - Bluetooth Input Devices (hidd) - - The hidd service should be disabled. - - - - - - - - Disable Bluetooth Kernel Modules - - Prevent loading of the Bluetooth module. - - - - - - - - - Advanced Power Management Subsystem (apmd) - - The apmd service should be disabled. - - - - - - - - Advanced Configuration and Power Interface (acpid) - - The acpid service should be disabled. - - - - - - - - CPU Throttling (cpuspeed) - - The cpuspeed service should be disabled. - - - - - - - - Cron Daemon running state - - The crond service should be enabled. - - - - - - - - At Daemon running state - - The atd service should be disabled. - - - - - - - - - At Daemons package is installed - - The at package should be removed. - - - - - - - - Disable anacron if Possible - - The anacron service should be disabled. - - - - - - - - Disable anacron if Possible - - The anacron package should be uninstalled. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/crontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/crontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/anacrontab file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/anacrontab should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate group. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.hourly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.daily file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.weekly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.monthly file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - The /etc/cron.d file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.hourly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.daily should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.weekly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.monthly should be set correctly. - - - - - - - - Restrict Permissions on Files Used by cron - - File permissions for /etc/cron.d should be set correctly. - - - - - - - - Restrict group owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate group. - - - - - - - - Restrict user owner on /var/spool/cron file - - The /var/spool/cron file should be owned by the appropriate user. - - - - - - - - Restrict Permissions on /var/spool/cron file - - File permissions for /var/spool/cron should be set correctly. - - - - - - - - Remove /etc/cron.deny - - /etc/cron.deny file should not exist. - - - - - - - - Remove /etc/at.deny - - /etc/at.deny file should not exist. - - - - - - - - Disable OpenSSH Software - - The sshd service should be disabled. - - - - - - - - - Remove OpenSSH Software - - SSH should be uninstalled - - - - - - - - Remove SSH Server iptables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Remove SSH Server ip6tables Firewall Exception - - Inbound connections to the ssh port should be denied (and dependencies are met) - - - - - - - - - Ensure Only Protocol 2 Connections Allowed - - SSH version 1 protocol support should be disabled. (and dependencies are met) - - - - - - - - - Set Idle Timeout Interval for User Logins - - The SSH idle timout interval should be set to an appropriate value (and dependencies are met) - - - - - - - - - Set ClientAliveCountMax for User Logins - - The SSH ClientAliveCountMax should be set to an appropriate value (and dependencies are met) - - - - - - - - - Disable .rhosts Files - - Emulation of the rsh command through the ssh server should be disabled (and dependencies are met) - - - - - - - - - Disable Host-Based Authentication - - SSH host-based authentication should be disabled (and dependencies are met) - - - - - - - - - Disable root Login via SSH - - Root login via SSH should be disabled (and dependencies are met) - - - - - - - - - Disable Empty Passwords - - Remote connections from accounts with empty passwords should be disabled (and dependencies are met) - - - - - - - - - Enable a Warning Banner - - SSH warning banner should be enabled (and dependencies are met) - - - - - - - - - Do Not Allow Users to Set Environment Options - - PermitUserEnvironment should be disabled - - - - - - - - - Use Only Approved Ciphers - - Use only approved ciphers - - - - - - - - - Disable X Windows at System Boot - - X Windows should be disabled at system boot - - - - - - - - Remove X Windows from the System if Possible - - X Windows should be removed - - - - - - - - Disable X Window System Listening - - Disable the ability to provide remote graphical display - - - - - - - - Create Warning Banners for GUI Login Users - - Enable warning banner for GUI login - - - - - - - - Disable Avahi Server Software - - The avahi-daemon service should be disabled. - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv6 (and dependencies are met) - - - - - - - - - Serve Only via Required Protocol - - The Avahi daemon should be configured not to serve via Ipv4 (and dependencies are met) - - - - - - - - - Check Responses' TTL Field - - Avahi should be configured to reject packets with a TTL field not equal to 255 (and dependencies are met) - - - - - - - - - Prevent Other Programs from Using Avahi's Port - - Avahi should be configured to not allow other stacks from binding to port 5353 (and dependencies are met) - - - - - - - - - Disable Publishing if Possible - - Avahi publishing of local information should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of local information by user applications should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of hardware information should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of workstation name should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of IP addresses should be disabled (and dependencies are met) - - - - - - - - - Restrict Published Information - - Avahi publishing of domain name should be disabled (and dependencies are met) - - - - - - - - - Disable the CUPS Service if Possible - - The cups service should be disabled. - - - - - - - - Disable Firewall Access to Printing Service over IPv4 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable Firewall Access to Printing Service over IPv6 if Possible - - Firewall access to printing service should be disabled - - - - - - - - Disable Printer Browsing Entirely if Possible - - Remote print browsing should be disabled (and dependencies are met) - - - - - - - - - Disable Printer Browsing Entirely if Possible - - CUPS should be allowed or denied the ability to listen for Incoming printer information as appropriate (and dependencies are met) - - - - - - - - - Disable HPLIP Service if Possible - - The hplip service should be disabled. - - - - - - - - Disable DHCP Client if Possible - - The dhcp client service should be disabled for each interface. - - - - - - - - Disable DHCP Server if possible - - The dhcpd service should be enabled or disabled as appropriate. - - - - - - - - - Disable DHCP Server if possible - - The dhcp package should be uninstalled. - - - - - - - - Do Not Use Dynamic DNS - - The dynamic DNS feature of the DHCP server should be disabled (and dependencies are met) - - - - - - - - - Deny Decline Messages - - DHCPDECLINE messages should be denied by the DHCP server (and dependencies are met) - - - - - - - - - Deny BOOTP Queries - - BOOTP queries should be accepted or denied by the DHCP server as appropriate (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name server information should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Default routers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Domain name should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS domain should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NIS servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - Time offset should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Minimize Served Information - - NTP servers should be sent or not sent by the DHCP server as appropriate. (and dependencies are met) - - - - - - - - - Configure DHCP Logging - - dhcpd logging should be enabled. (and dependencies are met) - - - - - - - - - Enable the NTP Daemon - - The ntpd service should be enabled. - - - - - - - - Deny All Access to ntpd by Default - - Network access to ntpd should be denied (and dependencies are met) - - - - - - - - - Specify a Remote NTP Server for Time Data - - A remote NTP Server for time synchronization should be specified (and dependencies are met) - - - - - - - - - Obtain NTP Software - - OpenNTPD should be installed - - - - - - - - Enable the NTP Daemon - - The ntp daemon should be enabled (and dependencies are met) - - - - - - - - - - Configure the Client NTP Daemon to Use the Local Server - - The ntp daemon synchronization server should be set appropriately (and dependencies are met) - - - - - - - - - Mail Transfer Agent - - The sendmail service should be disabled. - - - - - - - - Disable the Listening Sendmail Daemon - - The listening sendmail daemon should be disabled. (and dependencies are met) - - - - - - - - - Configure LDAP to Use TLS for All Transactions - - Clients require LDAP servers to provide valid certificates for SSL communications. - - - - - - - - Install OpenLDAP Server RPM - - The ldap service should be disabled. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate group. - - - - - - - - Correct Permissions on LDAP Server Files - - The /var/lib/ldap/* files should be owned by the appropriate user. - - - - - - - - Disable Services Used Only by NFS - - The nfslock service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcgssd service should be disabled. - - - - - - - - Disable Services Used Only by NFS - - The rpcidmapd service should be disabled. - - - - - - - - Disable netfs if Possible - - The netfs service should be disabled. - - - - - - - - Disable RPC Portmapper if Possible - - The portmap service should be disabled. - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for TCP - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use an outgoing static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The statd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The lockd service should be configured to use a static port for UDP - - - - - - - - Configure NFS Services to Use Fixed Ports - - The mountd service should be configured to use a static port - - - - - - - - Configure NFS Services to Use Fixed Ports - - The rquotad service should be configured to use a static port - - - - - - - - Disable NFS Server Daemons - - The nfs service should be disabled - - - - - - - - Disable NFS Server Daemons - - The rpcsvcgssd service should be disabled - - - - - - - - - Mount Remote Filesystems with nosuid - - The nosuid option should be enabled for all NFS mounts - - - - - - - - Mount Remote Filesystems with noexec - - The noexec option should be enabled for all NFS mounts - - - - - - - - Use Root-Squashing on All Exports - - Root squashing should be enabled for all NFS shares - - - - - - - - - Restrict NFS Clients to Privileged Ports - - Restriction of NFS clients to privileged ports should be enabled - - - - - - - - - Export Filesystems Read-Only if Possible - - Write access to NFS shares should be disabled - - - - - - - - Disable DNS Server if Possible - - The named service should be disabled. - - - - - - - - - Disable DNS Server if Possible - - The bind package should be uninstalled. - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate group. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - The /var/named/chroot/etc/named.conf file should be owned by the appropriate user. (and dependencies are met) - - - - - - - - - Run DNS Software in a chroot Jail - - File permissions for /var/named/chroot/etc/named.conf should be set correctly. (and dependencies are met) - - - - - - - - - Disable Dynamic Updates if Possible - - LDAP's dynamic updates feature should be disabled as appropriate (and dependencies are met) - - - - - - - - - Disable vsftpd if Possible - - The vsftpd service should be disabled. - - - - - - - - - Uninstall vsftpd if Possible - - The vsftpd service should be uninstalled. - - - - - - - - Enable Logging of All FTP Transactions - - Logging of vsftpd transactions should be enabled (and dependencies are met) - - - - - - - - - Create Warning Banners for All FTP Users - - A warning banner for all FTP users should be enabled (and dependencies are met) - - - - - - - - - Restrict Access to Anonymous Users if Possible - - Local user login to the vsftpd service should be disabled (and dependencies are met) - - - - - - - - - Disable FTP Uploads if Possible - - File uploads via vsftpd should be disabled (and dependencies are met) - - - - - - - - - Disable Apache if Possible - - The httpd service should be disabled. - - - - - - - - - Uninstall Apache if Possible - - The httpd package should be uninstalled. - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerTokens value should be set appropriately (and dependencies are met) - - - - - - - - - Restrict Information Leakage - - The apache2 server's ServerSignature value should be set appropriately (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /etc/httpd/conf/* should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - File permissions for /usr/sbin/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Restrict File and Directory Access - - The /etc/httpd/conf/* files should be owned by the appropriate group. - - - - - - - - - Restrict File and Directory Access - - File permissions for /var/log/httpd should be set correctly. (and dependencies are met) - - - - - - - - - Disable Dovecot if Possible - - The dovecot service should be disabled. - - - - - - - - - Disable Dovecot if Possible - - The dovecot package should be uninstalled. - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imaps protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3s protocol (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the pop3 (and dependencies are met) - - - - - - - - - Support Only the Necessary Protocols - - Dovecot should be configured to not support the imap protocol (and dependencies are met) - - - - - - - - - Disable Plaintext Authentication - - Dovecot plaintext authentication of clients should be disabled as necessary (and dependencies are met) - - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to drop privileges to user before executing mail process should be enabled (and dependencies are met) - - - - - - - - - Enable Dovecot Options to Protect Against Code Flaws - - The Dovecot option to spawn a new login process per connection should be enabled (and dependencies are met) - - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - Disable Guest Access and Local Login Support - - Do not allow guest users to access local file or printer shares. - - - - - - - - Require Client SMB Packet Signing, if using smbclient - - Require samba clients running smbclient to use packet signing. A Samba client should only communicate with servers who can support SMB packet signing. - - - - - - - - Disable Samba if Possible - - The smb service should be disabled. - - - - - - - - - Disable Squid if Possible - - The squid service should be disabled. - - - - - - - - - Disable Squid if Possible - - The squid package should be uninstalled. - - - - - - - - Verify Default Secure Settings - - The Squid option to force FTP passive connections should be enabled (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to perform FTP sanity checks should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to check for RFC compliant hostnames should be enabled or not as appropriate (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max request HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid max reply HTTP header length should be set to an appropriate value (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid EUID should be set to an appropriate user (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid GUID should be set to an appropriate group (and dependencies are met) - - - - - - - - - Verify Default Secure Settings - - The Squid option to ignore unknown nameservers should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to allow underscores in hostnames should be disabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to suppress the httpd version string should be enabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to show proxy client IP addresses in HTTP headers should be disabled (and dependencies are met) - - - - - - - - - Change Default Insecure Settings - - The Squid option to log HTTP MIME headers should be enabled (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gss-http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow https traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow wais traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow multiling http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow ftp traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow gopher traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow filemaker traffic (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid proxy access to localhost should be denied (and dependencies are met) - - - - - - - - - Access Control Lists (ACL) - - Squid should be configured to not allow http-mgmt traffic (and dependencies are met) - - - - - - - - - Disable SNMP Server if Possible - - The snmpd service should be disabled. - - - - - - - - - Disable SNMP Server if Possible - - The net-snmp package should be uninstalled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This will enumerate all world writable directories on local partitions - - - - - - - This will enumerate all world writable files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all files on local partitions - - - - - - This will enumerate all directories on local partitions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /etc - fstab - ^[[:space:]]*[^[:space:]]+[[:space:]]+([^[:space:]]+)[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+ - - 1 - - - ^/etc/cron\.(hourly|daily|weekly|monthly)$ - 0yum.cron - - - /etc - yum.conf - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc/yum.repos.d - .* - ^[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - yum.conf - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc/yum.repos.d - .* - ^[[:space:]]*repo_gpgcheck[[:space:]]*=[[:space:]]*([0-1]) - 1 - - - /etc - fstab - ^[^#]*\/.+*ext[234]([^#]*) - 1 - - - /etc - mtab - ^[^#]*\/[^[:space:]]*ext[234]([^#])? - 1 - - - redhat-release - - - gpg-pubkey - - - - yum-updatesd - .* - - - aide - - - /etc/security/console.perms.d - 50-default.perms - ^[\s]*(<console>|<xconsole>) - 1 - - - /lib/modules/.*/kernel/drivers/usb/storage - usb-storage.ko - - - /etc - grub.conf - ^[[:space:]]*kernel[^#]nousb - 1 - - - autofs - .* - - - /etc/gconf - gconf.xml.mandatory - /desktop/gnome/volume_manager/automount_(media)|(drives) - - - /etc/modprobe.d - denylist.conf - ^[^#]*denylist[[:space:]]+([^#]*)$ - 1 - - - /etc - shadow - - - /etc - group - - - /etc - gshadow - - - /etc - passwd - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:200462 - - - - - / - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200471 - oval:org.open-scap.f14:ste:200472 - - - - - / - .* - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:200481 - oval:org.open-scap.f14:ste:200482 - oval:org.open-scap.f14:ste:200483 - oval:org.open-scap.f14:ste:200484 - oval:org.open-scap.f14:ste:200485 - oval:org.open-scap.f14:ste:200486 - oval:org.open-scap.f14:ste:200487 - oval:org.open-scap.f14:ste:200488 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:2004901 - oval:org.open-scap.f14:ste:2004902 - oval:org.open-scap.f14:ste:2004903 - oval:org.open-scap.f14:ste:2004904 - oval:org.open-scap.f14:ste:2004905 - oval:org.open-scap.f14:ste:2004906 - oval:org.open-scap.f14:ste:2004907 - oval:org.open-scap.f14:ste:2004908 - oval:org.open-scap.f14:ste:2004909 - oval:org.open-scap.f14:ste:2004910 - oval:org.open-scap.f14:ste:2004911 - oval:org.open-scap.f14:ste:2004912 - oval:org.open-scap.f14:ste:2004913 - oval:org.open-scap.f14:ste:2004914 - oval:org.open-scap.f14:ste:2004915 - oval:org.open-scap.f14:ste:2004916 - - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20050 - - - - /etc - passwd - ^[^:]+:[^:]+:([[:digit:]]+):[[:digit:]]+:[^:]*:[^:]+:[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20047 - oval:org.open-scap.f14:ste:20051 - - - - /etc - group - ^[^:]+:[^:]*:([[:digit:]]+):[^:]* - 1 - - - - oval:org.open-scap.f14:obj:20046 - oval:org.open-scap.f14:ste:20052 - - - - /etc/rc.d/init.d - functions - ^[[:space:]]*umask[[:space:]]+([[:digit:]]+).* - 1 - - - /etc/security - limits.conf - ^[[:space:]]*\*[[:space:]]+hard[[:space:]]+core[[:space:]]+([[:digit:]]+) - 1 - - - /proc/sys/fs - suid_dumpable - ^(.*)$ - 1 - - - /proc/sys/kernel - randomize_va_space - ^(.*)$ - 1 - - - /proc/sys/kernel - exec-shield - ^(.*)$ - 1 - - - /etc - securetty - ^[[:space:]]*tty[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*vc\/[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*console[[:space:]]*(#.*)?$ - 1 - - - /etc - securetty - ^[[:space:]]*ttyS[0-9]+[[:space:]]*(#.*)?$ - 1 - - - /etc - group - ^[[:space:]]*wheel.*$ - 1 - - - /etc/pam.d - su - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_wheel\.so[[:space:]]+use_uid([[[:space:]]#].*)?$ - 1 - - - /etc - sudoers - ^[[:space:]]*%wheel[[:space:]]+ALL=\(ALL\)[[:space:]]+ALL - 1 - - - root - - - /etc - shadow - ^[^:]*:: - 1 - - - .* - - - /etc - passwd - ^([^:]+):[^:]*:0:.* - 1 - - - /etc - login.defs - ^PASS_MIN_LEN[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MIN_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_MAX_DAYS[[:space:]]*(.*) - 1 - - - /etc - login.defs - ^PASS_WARN_AGE[[:space:]]*(.*) - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc - group - ^\+: - 1 - - - /etc - passwd - ^\+: - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*retry=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*minlen=([1-9][[:digit:]]*) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*dcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ucredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*ocredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*lcredit=([-]?[[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*password[[:space:]]+required[[:space:]]+pam_cracklib\.so[[:space:]]+try_first_pass[[:space:]]+.*difok=([[:digit:]]+) - 1 - - - oval:org.open-scap.f14:var:200803 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*deny=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*[^u][^n]lock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*auth[[:space:]]+required[[:space:]]+pam_tally2\.so[[:space:]]+onerr\=fail[[:space:]]+.*unlock_time=([[:digit:]]+) - 1 - - - /etc/pam.d - system-auth - ^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_tally2\.so$ - 1 - - - /usr/sbin - userhelper - - - oval:org.open-scap.f14:var:20083 - - - /etc - login.defs - ^MD5_CRYPT_ENAB[[:space:]]+(yes|no) - 1 - - - /etc - login.defs - ^ENCRYPT_METHOD[[:space:]]+(MD5|SHA256|SHA512) - 1 - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)*|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+(sha256|sha512)* - 1 - - - /etc - libuser.conf - ^crypt_style[[:space:]]+\=[[:space:]]+(sha256|sha512) - 1 - - - oval:org.open-scap.f14:var:20084 - - - /etc/pam.d - system-auth - ^password[[:space:]]+sufficient[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+)|^password[[:space:]]+required[[:space:]]+pam_unix\.so[[:space:]]+.*remember=([[:digit:]]+) - 1 - - - PATH - - - - oval:org.open-scap.f14:obj:200855 - oval:org.open-scap.f14:ste:2008551 - - - - - - - - - /home - - - - /etc - bashrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - /etc - csh.cshrc - ^[[:space:]]*umask[[:space:]]+([[:alnum:]]*) - 1 - - - /boot/grub - grub.conf - - - /boot/grub - grub.conf - - - /boot/grub - grub.conf - password[[:space:]]+--md5[[:space:]]+.* - 1 - - - /etc - grub.conf - - - /etc - inittab - ~~:S:wait:/sbin/sulogin - 1 - - - /etc/sysconfig - init - PROMPT[\s]*=[\s]*([^#]*) - 1 - - - /etc/profile.d - autologout.csh - ^[\s]*set[\s]+-r[\s]+autologout[\s]+([^#]*) - 1 - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value - - - /etc/gconf/gconf.xml.defaults - %gconf-tree.xml - /gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text() - - - vlock - - - /etc - issue - (.*) - 1 - - - /usr/share/gdm/themes/RHEL - RHEL.xml - /greeter/item[@id='banner']/box[1]/item[@id='DOD_Banner']/text[1] - - - /etc - grub.conf - [[:space:]]selinux=([^[:space:]]*) - 1 - - - /etc - grub.conf - [[:space:]]enforcing=([^[:space:]]*) - 1 - - - /etc/selinux - config - ^[[:space:]]*SELINUX[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - /etc/selinux - config - ^[[:space:]]*SELINUXTYPE[[:space:]]*=[[:space:]]*([[:alnum:]]*) - 1 - - - setroubleshoot - .* - - - setroubleshoot - - - mcstrans - .* - - - restorecond - .* - - - - /proc/sys/net/ipv4/conf/default - send_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - send_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.send_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - /proc/sys/net/ipv4 - ip_forward - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.ip_forward[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - log_martians - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.log_martians[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_source_route - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_source_route[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - accept_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.accept_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - secure_redirects - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.secure_redirects[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_echo_ignore_broadcasts - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_echo_ignore_broadcasts[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - icmp_ignore_bogus_error_responses - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.icmp_ignore_bogus_error_responses[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4 - tcp_syncookies - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.tcp_syncookies[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/all - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.all\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv4/conf/default - rp_filter - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv4\.conf\.default\.rp_filter[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - /proc/net - wireless - ^[[:space:]]*([^[:space:]]*):.* - 1 - - - /lib/modules/.*/kernel/drivers/net/wireless$ - - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*alias[[:space:]]+net-pf-10[[:space:]]+off[[:space:]]*(#.*)?$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig/network-scripts - ifcfg-.* - ^[[:space:]]*NETWORKING_IPV6[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - /etc/sysconfig - network - ^[[:space:]]*IPV6INIT[[:space:]]*=[[:space:]]*([^#]*).*$ - 1 - - - - /proc/sys/net/ipv6/conf/default - accept_ra_rtr_pref - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_rtr_pref[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - max_addresses - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.max_addresses[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - router_solicitations - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.router_solicitations[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - dad_transmits - ^([0-9]+)$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.dad_transmits[[:space:]]*=[[:space:]]*([0-9]+)[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - autoconf - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.autoconf[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_pinfo - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_pinfo[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - /proc/sys/net/ipv6/conf/default - accept_ra_defrtr - ^([01])$ - 1 - - - /etc - sysctl.conf - ^[[:space:]]*net\.ipv6\.conf\.default\.accept_ra_defrtr[[:space:]]*=[[:space:]]*([01])[[:space:]]*$ - 1 - - - - ip6tables - .* - - - iptables - .* - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]DROP[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:INPUT[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]DROP[:space:]\[0:0\] - 1 - - - /etc/sysconfig - iptables - ^[[:space:]]*:FORWARD[:space:]ACCEPT[:space:]\[0:0\] - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+DCCP[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+SCTP[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+RDS[[:space:]]+/bin/true - 1 - - - /etc/modprobe.d - dist.conf - ^[[:space:]]*install[[:space:]]+TIPC[[:space:]]+/bin/true - 1 - - - rsyslog - .* - - - /etc - rsyslog.conf - ^[^\#][[:space:]]*[^[:space:]]+\.[^[:space:]]+[[:space:]]+[\-]?([^[:space:]]+) - 1 - - - - /var/log - - - - /etc - rsyslog.conf - ^[^#]*\*\.\*[[:space:]]+@ - 1 - - - /etc/sysconfig - rsyslog - SYSLOGD_OPTIONS[[:space:]]*=[[:space:]]*.*-r.* - 1 - - - - - auditd - .* - - - /etc - grub.conf - ^[[:space:]]*kernel.+[[:space:]]audit=1 - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]adjtimex[[:space:]]\-S[[:space:]]settimeofday[[:space:]]\-S[[:space:]]stime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]clock_settime[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/localtime[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]time\-change$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/group[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/passwd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/gshadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/shadow[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/security/opasswd[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]identity$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]exit,always[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]sethostname[[:space:]]\-S[[:space:]]setdomainname[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/issue\.net[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/hosts[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sysconfig/network[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]system\-locale$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/selinux/[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]MAC\-policy$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/faillog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/lastlog[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]logins$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/run/utmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/btmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/var/log/wtmp[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]session$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chmod[[:space:]]\-S[[:space:]]fchmod[[:space:]]\-S[[:space:]]fchmodat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]chown[[:space:]]\-S[[:space:]]fchown[[:space:]]\-S[[:space:]]fchownat[[:space:]]\-S[[:space:]]lchown[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]setxattr[[:space:]]\-S[[:space:]]lsetxattr[[:space:]]\-S[[:space:]]fsetxattr[[:space:]]\-S[[:space:]]removexattr[[:space:]]\-S[[:space:]]lremovexattr[[:space:]]\-S[[:space:]]fremovexattr[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]perm_mod$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EACCES[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]creat[[:space:]]\-S[[:space:]]open[[:space:]]\-S[[:space:]]openat[[:space:]]\-S[[:space:]]truncate[[:space:]]\-S[[:space:]]ftruncate[[:space:]]\-F[[:space:]]exit=\-EPERM[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]access$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]-F[[:space:]]path=/bin/ping[[:space:]]-F perm=x[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]privileged - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]mount[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]export$ - 1 - - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b32[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-F[[:space:]]arch=b64[[:space:]]\-S[[:space:]]unlink[[:space:]]\-S[[:space:]]unlinkat[[:space:]]\-S[[:space:]]rename[[:space:]]\-S[[:space:]]renameat[[:space:]]\-F[[:space:]]auid>=500[[:space:]]\-F[[:space:]]auid!=4294967295[[:space:]]\-k[[:space:]]delete$ - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/etc/sudoers[[:space:]]\-p[[:space:]]wa[[:space:]]\-k[[:space:]]actions - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/insmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/rmmod[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-w[[:space:]]/sbin/modprobe[[:space:]]\-p[[:space:]]x[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/audit - audit.rules - ^\-a[[:space:]]always,exit[[:space:]]\-S[[:space:]]init_module[[:space:]]\-S[[:space:]]delete_module[[:space:]]\-k[[:space:]]modules - 1 - - - /etc/xinetd.d - telnet - - 1 - - - /etc/xinetd.d - rcp - - 1 - - - /etc/xinetd.d - rsh - - 1 - - - /etc/xinetd.d - rlogin - - 1 - - - /etc/xinetd.d - tftp - - 1 - - - /etc/pam.d - .* - ^[[:space:]]*.*pam_rhosts - 1 - - - /etc/audit - audit.rules - ^\-e[[:space:]]2 - 1 - - - inetd - .* - - - xinetd - .* - - - rsh - - - inetd - - - xinetd - - - telnet-server - - - telnet - - - krb5-workstation - - - rsh-server - - - ypbind - .* - - - ypserv - - - tftp-server - - - firstboot - .* - - - gpm - .* - - - irqbalance - .* - - - isdn - .* - - - kdump - .* - - - kudzu - .* - - - mdmonitor - .* - - - microcode_ctl - .* - - - network - .* - - - /etc/sysconfig/network-scripts - ifcfg-[^l][^o].* - - - /etc/sysconfig - network - ^[:space:]*NOZEROCONF=yes - 1 - - - pcscd - .* - - - smartd - .* - - - readahead_early - .* - - - readahead_later - .* - - - messagebus - .* - - - haldaemon - .* - - - bluetooth - .* - - - hidd - .* - - - /etc/modprobe.d - .*\.conf - alias[:space:]net\-pf\-31[:space:]off - 1 - - - /etc/modprobe.d - .*\.conf - alias[:space:]bluetooth[:space:]off - 1 - - - apmd - .* - - - acpid - .* - - - cpuspeed - .* - - - crond - .* - - - atd - .* - - - at - - - anacron - .* - - - cronie-anacron - - - /etc/cron.monthly - - - - /etc/cron.daily - - - - /etc/cron.weekly - - - - /etc - crontab - - - - - - /etc - anacrontab - - - - - - /etc - crontab - - - /etc/cron.hourly - - - - /etc/cron.monthly - - - - - /etc/cron.d - - - - - /etc/cron.d - - - - /etc/cron.weekly - - - - /etc - anacrontab - - - /etc/cron.hourly - - - - /etc/cron.hourly - - - - - - - - - - /etc - crontab - - - /etc/cron.daily - - - - /etc - anacrontab - - - /etc/cron.weekly - - - - /etc/cron.monthly - - - - /etc/cron.daily - - - - - /etc/cron.d - - - - /var/spool/cron - - - - /etc - cron.deny - - - /etc - at.deny - - - sshd - .* - - - openssh-server - - - /etc/sysconfig - iptables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - /etc/sysconfig - ip6tables - ^[[:space:]]*-A[[:space:]]+.*INPUT[[:space:]]+-m[[:space:]]+state[[:space:]]+--state[[:space:]]+NEW[[:space:]]+-m[[:space:]]+tcp[[:space:]]+-p[[:space:]]+tcp[[:space:]]+--dport[[:space:]]+22[[:space:]]+-j[[:space:]]+ACCEPT[[:space:]]*$ - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Protocol[[:space:]](2) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveInterval[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*ClientAliveCountMax[[:space:]]*([[:digit:]]+) - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*IgnoreRhosts[[:space:]]*yes - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*HostbasedAuthentication[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitRootLogin[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitEmptyPasswords[[:space:]]*no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Banner[[:space:]]+/etc/issue$ - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*PermitUserEnvironment[[:space:]]+no - 1 - - - /etc/ssh - sshd_config - ^[[:space:]]*Ciphers[[:space:]]+([^ \t\r\n\v\f]+) - 1 - - - /etc - inittab - ^[\s]*id:([^:]*):initdefault: - 1 - - - /etc/X11/xinit - xserverrc - ^[\s]*exec\sX\s:0\s\-nolisten\stcp\s\$@ - 1 - - - /etc/gdm - custom.conf - ^[\s]*InfoMsgFile[\s]*=[\s]*/etc/issue - 1 - - - avahi-daemon - .* - - - /etc/avahi - avahi-daemon.conf - check-response-ttl[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disallow-other-stacks[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - disable-user-service-publishing[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-hinfo[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-workstation[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-addresses[\s]*=[\s]*([^#]*) - 1 - - - /etc/avahi - avahi-daemon.conf - publish-domain[\s]*=[\s]*([^#]*) - 1 - - - cups - .* - - - /etc/cups - cupsd.conf - Browsing[\s]+([^#]*) - 1 - - - /etc/cups - cupsd.conf - BrowseAllow[\s]+none - 1 - - - hplip - .* - - - /etc/sysconfig/network-scripts - ifcfg-eth.* - ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) - 1 - - - oval:org.open-scap.f14:var:20267 - - - dhcpd - .* - - - dhcp - - - /etc - dhcpd.conf - ddns-update-style[\s]+none; - 1 - - - /etc - dhcpd.conf - deny[\s]+declines; - 1 - - - /etc - dhcpd.conf - deny[\s]+bootp; - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name-servers - 1 - - - /etc - dhcpd.conf - option[\s]+routers - 1 - - - /etc - dhcpd.conf - option[\s]+domain-name - 1 - - - /etc - dhcpd.conf - option[\s]+nis-domain - 1 - - - /etc - dhcpd.conf - option[\s]+nis-servers - 1 - - - /etc - dhcpd.conf - option[\s]+time-offset - 1 - - - /etc - dhcpd.conf - option[\s]+ntp-servers - 1 - - - /etc - syslog.conf - daemon\.\*[\s]+/var/log/daemon\.log - 1 - - - ntpd - .* - - - /etc - ntp.conf - restrict[\s]+default[\s]+ignore - 1 - - - /etc - rc.local - /usr/local/sbin/ntpd -s - 1 - - - sendmail - .* - - - /etc/sysconfig - sendmail - DAEMON[\s]*=[\s]*yes - 1 - - - /etc - ldap.conf - ^[\s]*tls_checkpeer[\s]+yes - 1 - - - ldap - .* - - - /var/lib/ldap - .* - - - /var/lib/ldap - .* - - - nfslock - .* - - - rpcgssd - .* - - - rpcidmapd - .* - - - netfs - .* - - - portmap - .* - - - /etc/sysconfig - nfs - LOCKD_TCPPORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_OUTGOING_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - STATD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - LOCKD_UDPPORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - MOUNTD_PORT[\s]*=[\s]*[0-9] - 1 - - - /etc/sysconfig - nfs - RQUOTAD_PORT[\s]*=[\s]*[0-9] - 1 - - - nfs - .* - - - rpcsvcgssd - .* - - - /etc - exports - no_root_squash - 1 - - - /etc - exports - insecure - 1 - - - /etc - exports - rw - 1 - - - named - .* - - - bind - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - /var/named/chroot/etc - named.conf - - - vsftpd - .* - - - vsftpd - - - /etc - vsftpd.conf - banner_file[\s]*=[\s]*/etc/issue - 1 - - - /etc - vsftpd.conf - local_enable[\s]*=[\s]*([^#]*) - 1 - - - /etc - vsftpd.conf - write_enable[\s]*=[\s]*([^#]*) - 1 - - - httpd - .* - - - httpd - - - /etc/httpd/conf - httpd.conf - ServerTokens[\s]+([^#]*) - 1 - - - /etc/httpd/conf - httpd.conf - ServerSignature[\s]+([^#]*) - 1 - - - /etc/httpd/conf - - - - /etc/httpd/conf - .* - - - /usr/sbin - httpd - - - /etc/httpd/conf - .* - - - /var/log/httpd - - - - dovecot - .* - - - dovecot - - - /etc - dovecot.conf - protocols[\s]*=.*imaps - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3s - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*pop3 - 1 - - - /etc - dovecot.conf - protocols[\s]*=.*imap - 1 - - - /etc - dovecot.conf - disable_plaintext_auth[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - mail_drop_priv_before_exec[\s]*=[\s]*([^#]*) - 1 - - - /etc - dovecot.conf - login_process_per_connection[\s]*=[\s]*([^#]*) - 1 - - - smb - .* - - - /etc/samba - smb.conf - ^[\s]*guest[\s]+ok[\s]*=[\s]yes - 1 - - - /etc/samba - smb.conf - ^[\s]*client[\s]+signing[\s]*=[\s]mandatory - 1 - - - /etc - fstab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - /etc - mtab - ^[\s]*[\S]+[\s]+[\S]+[\s]+([\S]+)[\s]+([\S]+) - 1 - - - squid - .* - - - squid - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_passive[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*request_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*check_hostnames[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ignore_unknown_nameservers[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*reply_header_max_size[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_user[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*ftp_sanitycheck[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*cache_effective_group[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*forwarded_for[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*log_mime_hdrs[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*allow_underscore[[:space:]]+([^#]*) - 1 - - - /etc/squid - squid.conf - ^[[:space:]]*httpd_suppress_version_string[[:space:]]+([^#]*) - 1 - - - snmpd - .* - - - net-snmp - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - /etc - group - - 1 - - - - - /tmp - - - /var - - - /var/log - - - /var/log/audit - - - /home - - - 1 - 1 - - - 0 - - - 1 - - - 0 - - - .*,nodev.* - - - ^5[^\d] - - - 4c49d6fe - 97a1071f - - - ^5\.[2-9] - - - unix - - - false - - - usb_storage - - - cramfs - - - freevxfs - - - jffs2 - - - hfs - - - hfsplus - - - squashfs - - - udf - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - 0 - - - - - - - - - - - - - - 1 - - - 0 - - - 0 - - - regular - - - regular - 0 - - - /sbin - netreport - - - /var/cache/jwhois - jwhois.db - - - /usr/sbin - - - - /usr/bin - - - - /usr/libexec/utempter - utempter - - - /usr/lib/vte - gnome-pty-helper - - - /usr/lib64/vte - gnome-pty-helper - - - regular - 0 - - - /bin - - - - /lib/dbus-1 - dbus-daemon-launch-helper - - - /lib64/dbus-1 - dbus-daemon-launch-helper - - - /sbin - - - - /usr/bin - - - - /usr/lib/nspluginwrapper - plugin-config - - - /usr/lib64/nspluginwrapper - plugin-config - - - /usr/libexec/kde4 - kpac_dhcp_helper - - - /usr/libexec/news - - - - /usr/libexec/openssh - ssh-keysign - - - /usr/libexec/polkit-1 - polkit-agent-helper-1 - - - /usr/libexec - pt_chown - - - /usr/libexec/pulse - proximity-helper - - - /usr/sbin - - - - /usr/share/BackupPC/sbin - BackupPC_Admin - - - - - - - - - 500 - 0 - - - - - - 0 - - - 0 - - - 1 - - - 1 - - - 500 - /sbin/nologin - - - x - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - md5 - - - yes - - - - - - 0 - - - - - - ^:|^\. - - - :$|\.$ - - - :\.:|:: - - - 0 - 0 - - - /home - 1 - - - /home - 1 - - - - - - 0 - - - - - - - - - - - - - - 0 - - - no - - - - - - - - - true - - - true - - - blank-only - - - - - - - - - 1 - - - 1 - - - - - - - - - false - true - - - false - true - - - ^[2345]$ - true - - - - 0 - - - 1 - - - - 0 - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - no - - - no - - - no - - - - - - - - - - - - - - - - - - - - - - - - - - - yes - - - ^[35]$ - true - - - ^[2345]$ - true - - - - - - - - - - - - - - - - - - - - true - false - - - ^i386$|^i686$ - - - ^x86_64$|^ia64$| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - aes128-ctr,aes192-ctr,aes256-ctr - - - yes - - - yes - - - yes - - - yes - - - no - - - no - - - no - - - no - - - off - - - 0 - - - 0 - - - 0 - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - - - - - - - - - - - yes - - - yes - - - yes - - - 1 - cifs - - - 2 - sec=(krb5i|ntlmv2i) - - - on - - - - - - on - - - on - - - - - - - - - on - - - - - - - - - - - - - - - - - - root - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - cron - messages - secure - maillog - - - - lockdev - sendmail.sendmail - - - write - locate - ssh-agent - wall - screen - lockfile - gnomine - jwhois - iagno - crontab - - - cgexec - fusermount - mount - ping - ping6 - su - umount - - - mount.nfs - pam_timestamp_check - unix_chkpwd - - - Xorg - at - chage - chfn - chsh - crontab - gpasswd - ksu - newgrp - passwd - pkexec - rcp - rlogin - rsh - staprun - sudo - sudoedit - - - innbind - rnews - - - ccreds_chkpwd - mtr - seunshare - suexec - userhelper - usernetctl - userisdnctl - - - ^[[:space:]]+disable[[:space:]]*=[[:space:]]*(yes|no) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - - - ^ - - :[^:]*:([[:digit:]]+) - - - - - - - - - diff --git a/tests/DS/rds_split_simple/report.xml b/tests/DS/rds_split_simple/report.xml deleted file mode 100644 index 07774bfb5ef..00000000000 --- a/tests/DS/rds_split_simple/report.xml +++ /dev/null @@ -1,1592 +0,0 @@ - - - OSCAP Scan Result - some.target.somewhere.org - 127.0.0.1 - aaa::aaa:11ba:a:1 - - 00:00:00:00:00:00 - - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-4218-4 - # chkconfig yum-updatesd off - - - notselected - echo -e "/usr/bin/yum -R 120 -e 0 -d 0 -y update yum\n/usr/bin/yum -R 10 -e 0 -d 0 -y update" > /etc/cron.weekly/yum.cron - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-4209-3 - yum install aide - - - notselected - echo -e "/usr/sbin/aide --check" > /etc/cron.daily/aide.cron - - - notselected - - - notselected - CCE-4249-9 - - - notselected - CCE-3522-0 - - - notselected - CCE-4275-4 - - - notselected - CCE-4042-8 - - - notselected - CCE-4187-1 - echo -e "\ndenylist usb_storage" >> /etc/modprobe.d/denylist.conf - - - notselected - CCE-4006-3 - rm /lib/modules/2.6.*/kernel/drivers/usb/storage/usb-storage.ko - - - notselected - CCE-4173-1 - - - notselected - CCE-3944-6 - - - notselected - CCE-4072-5 - chkconfig autofs off - - - notselected - CCE-4231-7 - - - notselected - echo "denylist cramfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist freevxfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist jffs2" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist hfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist hfsplus" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist squashfs" >> /etc/modprobe.d/denylist.conf - - - notselected - echo "denylist udf" >> /etc/modprobe.d/denylist.conf - - - notselected - CCE-3918-0 - - - notselected - CCE-3988-3 - - - notselected - CCE-3276-3 - - - notselected - CCE-3883-6 - - - notselected - CCE-4210-1 - - - notselected - CCE-4064-2 - - - notselected - CCE-3958-6 - - - notselected - CCE-3495-9 - - - notselected - CCE-4130-1 - - - notselected - CCE-3967-7 - - - notselected - CCE-3932-1 - - - notselected - CCE-3566-7 - - - notselected - CCE-3399-3 - - - notselected - CCE-3795-2 - - - notselected - CCE-4178-0 - - - notselected - CCE-3324-1 - - - notselected - CCE-4223-4 - - - notselected - CCE-3573-3 - - - notselected - - - notselected - CCE-4220-0 - - - notselected - CCE-4225-9 - - - notselected - CCE-4247-3 - - - notselected - CCE-4168-1 - - - notselected - CCE-4146-7 - - - notselected - CCE-4177-2 - - - notselected - CCE-3820-8 - - - notselected - CCE-3485-0 - - - notselected - CCE-4111-1 - - - notselected - CCE-4256-4 - - - notselected - - - notselected - - - notselected - CCE-4044-4 - echo "%wheel ALL=(ALL) ALL" >> /etc/sudoers - - - notselected - CCE-3987-5 - - - notselected - CCE-4238-2 - - - notselected - - - notselected - CCE-4009-7 - - - notselected - CCE-4154-1 - - - notselected - CCE-4180-6 - - - notselected - CCE-4092-3 - - - notselected - CCE-4097-2 - - - notselected - - - notselected - - - notselected - CCE-4114-5 - - - notselected - CCE-3762-2 - - - notselected - CCE-3762-2 - - - notselected - CCE-3410-8 - - - notselected - - - notselected - - - notselected - CCE-4185-5 - # chgrp usergroup /usr/sbin/userhelper - - - notselected - CCE-3952-9 - # chmod 4710 /usr/sbin/userhelper - - - notselected - /usr/sbin/authconfig --passalgo=sha512 --update - - - notselected - - - notselected - CCE-3301-9 - - - notselected - - - notselected - CCE-4090-7 - - - notselected - CCE-3844-8 - - - notselected - CCE-4227-5 - - - notselected - rm .netrc - - - notselected - CCE-4144-2 - chown root /boot/grub/grub.conf - - - notselected - CCE-4197-0 - chown :root /boot/grub/grub.conf - - - notselected - CCE-3923-0 - chmod 600 /boot/grub/grub.conf - - - notselected - CCE-3818-2 - - - notselected - CCE-4241-6 - - - notselected - CCE-4245-7 - - - notselected - CCE-3689-7 - - - notselected - CCE-3707-7 - - - notselected - CCE-3315-9 - - - notselected - - - notselected - - - notselected - - - notselected - CCE-3910-7 - yum install vlock - - - notselected - CCE-4060-0 - - - notselected - CCE-4188-9 - - - notselected - - - notselected - CCE-3977-6 - - - notselected - - - notselected - - - notselected - CCE-3624-4 - - - notselected - CCE-4148-3 - - - notselected - CCE-4254-9 - - - notselected - CCE-3668-1 - - - notselected - CCE-4129-3 - - - notselected - - - notselected - CCE-4151-7 - - - notselected - CCE-4155-8 - - - notselected - CCE-3561-8 - - - notselected - CCE-4236-6 - - - notselected - CCE-4217-6 - - - notselected - CCE-3472-8 - - - notselected - CCE-4320-8 - - - notselected - CCE-4091-5 - - - notselected - CCE-4186-3 - - - notselected - CCE-3339-9 - - - notselected - CCE-3644-2 - - - notselected - CCE-4133-5 - - - notselected - CCE-4265-5 - - - notselected - CCE-4080-8 - - - notselected - CCE-3840-6 - - - notselected - CCE-3628-5 - - - notselected - CCE-4276-2 - - - notselected - CCE-4170-7 - - - notselected - CCE-3562-6 - - - notselected - CCE-3381-1 - - - notselected - CCE-3377-9 - - - notselected - CCE-4296-0 - - - notselected - CCE-4269-7 - - - notselected - CCE-4291-1 - - - notselected - CCE-4313-3 - - - notselected - CCE-4198-8 - - - notselected - CCE-3842-2 - - - notselected - CCE-4159-0 - - - notselected - CCE-4221-8 - - - notselected - CCE-4058-4 - - - notselected - CCE-4128-5 - - - notselected - CCE-4287-9 - - - notselected - CCE-3895-0 - - - notselected - CCE-4137-6 - - - notselected - CCE-4167-3 - chkconfig ip6tables on - - - notselected - CCE-4189-7 - chkconfig iptables on - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - CCE-3679-8 - chkconfig rsyslog on - - - notselected - CCE-4366-1 - - - notselected - CCE-3701-0 - - - notselected - CCE-4233-3 - - - notselected - CCE-4260-6 - - - notselected - CCE-3382-9 - - - notselected - CCE-4182-2 - - - notselected - CCE-4323-2 - - - notselected - CCE-4292-9 - - - notselected - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - - - notselected - cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules - - - notselected - CCE-4234-1 - - - notselected - CCE-4252-3 - - - notselected - CCE-4023-8 - # yum erase inetd - - - notselected - CCE-4164-0 - # yum erase xinetd - - - notselected - # yum erase telnet - - - notselected - # yum erase rsh-server - - - notselected - CCE-4330-7 - # yum erase telnet-server - - - notselected - CCE-3390-2 - - - notselected - CCE-4308-3 - # yum erase rsh-server - - - notselected - CCE-3974-3 - # chkconfig rcp off - - - notselected - CCE-4141-8 - # chkconfig rsh off - - - notselected - CCE-3537-8 - # chkconfig rlogin off - - - notselected - - - notselected - # yum erase rsh - - - notselected - CCE-4348-9 - # yum erase ypserv - - - notselected - CCE-3705-1 - # chkconfig ypbind off - - - notselected - CCE-3916-4 - # yum erase tftp-server - - - notselected - CCE-4273-9 - # chkconfig tftp off - - - notselected - CCE-3412-4 - # chkconfig firstboot off - - - notselected - CCE-4229-1 - # chkconfig gpm off - - - notselected - CCE-4123-6 - # chkconfig irqbalance off - - - notselected - CCE-4286-1 - # chkconfig isdn off - - - notselected - CCE-3425-6 - # chkconfig kdump off - - - notselected - CCE-4211-9 - # chkconfig kudzu off - - - notselected - CCE-3854-7 - # chkconfig mdmonitor off - - - notselected - CCE-4356-2 - # chkconfig microcode ctl off - - - notselected - CCE-4369-5 - # chkconfig network off - - - notselected - # rm /etc/sysconfig/network-scripts/ifcfg-interface - - - notselected - CCE-4369-5 - - - notselected - CCE-4100-4 - # chkconfig pcscd off - - - notselected - CCE-3455-3 - # chkconfig smartd off - - - notselected - CCE-4421-4 - # chkconfig readahead early off - - - notselected - CCE-4302-6 - # chkconfig readahead later off - - - notselected - CCE-3822-4 - # chkconfig messagebus off - - - notselected - CCE-4364-6 - # chkconfig haldaemon off - - - notselected - CCE-4355-4 - # chkconfig bluetooth off - - - notselected - CCE-4377-8 - # chkconfig hidd off - - - notselected - - - notselected - CCE-4289-5 - # chkconfig apmd off - - - notselected - CCE-4298-6 - - - notselected - CCE-4051-9 - - - notselected - CCE-4324-0 - - - notselected - CCE-4406-5 - - - notselected - CCE-4428-9 - # yum erase anacron - - - notselected - CCE-3626-9 - - - notselected - CCE-3851-3 - - - notselected - CCE-4388-5 - - - notselected - CCE-3604-6 - - - notselected - CCE-4379-4 - - - notselected - CCE-4304-2 - - - notselected - CCE-4054-3 - - - notselected - CCE-3481-9 - - - notselected - CCE-4331-5 - - - notselected - CCE-4322-4 - - - notselected - CCE-4212-7 - - - notselected - CCE-3983-4 - - - notselected - CCE-4022-0 - - - notselected - CCE-3833-1 - - - notselected - CCE-4441-2 - - - notselected - CCE-4380-2 - - - notselected - CCE-4106-1 - - - notselected - CCE-4450-3 - - - notselected - CCE-4203-6 - - - notselected - CCE-4251-5 - - - notselected - CCE-4250-7 - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - - - notselected - rm /etc/cron.deny - - - notselected - rm /etc/at.deny - - - notselected - CCE-4268-9 - # chkconfig sshd off - - - notselected - CCE-4272-1 - # yum erase openssh-server - - - notselected - CCE-4295-2 - - - notselected - - - notselected - CCE-4325-7 - - - notselected - CCE-3845-5 - - - notselected - - - notselected - CCE-4475-0 - - - notselected - CCE-4370-3 - - - notselected - CCE-4387-7 - - - notselected - CCE-3660-8 - - - notselected - CCE-4431-3 - - - notselected - - - notselected - - - notselected - CCE-4462-8 - - - notselected - CCE-4422-2 - # yum groupremove "X Window System" - - - notselected - CCE-4074-1 - echo "exec X :0 -nolisten tcp $@" > /etc/X11/xinit/xserverrc - - - notselected - CCE-3717-6 - - - notselected - CCE-4365-3 - # chkconfig avahi-daemon off - - - notselected - CCE-4136-8 - - - notselected - CCE-4409-9 - - - notselected - CCE-4426-3 - - - notselected - CCE-4193-9 - - - notselected - CCE-4444-6 - - - notselected - CCE-4352-1 - - - notselected - CCE-4433-9 - - - notselected - CCE-4451-1 - - - notselected - CCE-4341-4 - - - notselected - CCE-4358-8 - - - notselected - CCE-4112-9 - # chkconfig cups off - - - notselected - CCE-3649-1 - - - notselected - - - notselected - CCE-4420-6 - - - notselected - CCE-4407-3 - - - notselected - CCE-4425-5 - - - notselected - CCE-4191-3 - - - notselected - CCE-4336-4 - # chkconfig dhcpd off - - - notselected - CCE-4464-4 - # yum erase dhcp - - - notselected - CCE-4257-2 - - - notselected - CCE-4403-2 - - - notselected - CCE-4345-5 - - - notselected - CCE-3724-2 - - - notselected - CCE-4243-2 - - - notselected - CCE-4389-3 - - - notselected - CCE-3913-1 - - - notselected - CCE-4169-9 - - - notselected - CCE-4318-2 - - - notselected - CCE-4319-0 - - - notselected - CCE-3733-3 - - - notselected - CCE-4376-0 - # chkconfig ntpd on - - - notselected - CCE-4134-3 - - - notselected - CCE-4385-1 - - - notselected - CCE-4032-9 - - - notselected - CCE-4424-8 - - - notselected - CCE-3487-6 - - - notselected - CCE-4416-4 - - - notselected - CCE-4293-7 - - - notselected - - - notselected - CCE-3501-4 - - - notselected - CCE-4484-2 - - - notselected - CCE-4502-1 - - - notselected - CCE-4396-8 - - - notselected - CCE-3535-2 - - - notselected - CCE-3568-3 - - - notselected - CCE-4533-6 - - - notselected - CCE-4550-0 - - - notselected - CCE-4559-1 - - - notselected - CCE-4015-4 - - - notselected - CCE-3667-3 - - - notselected - CCE-4310-9 - - - notselected - CCE-4438-8 - - - notselected - CCE-3579-0 - - - notselected - CCE-4473-5 - - - notselected - CCE-4491-7 - - - notselected - CCE-4368-7 - - - notselected - CCE-4024-6 - - - notselected - CCE-4526-0 - - - notselected - CCE-4544-3 - - - notselected - CCE-4465-1 - - - notselected - CCE-4350-5 - - - notselected - CCE-3578-2 - - - notselected - CCE-4219-2 - - - notselected - CCE-3985-9 - - - notselected - CCE-4258-0 - - - notselected - CCE-4487-5 - - - notselected - CCE-4399-2 - - - notselected - CCE-3919-8 - - - notselected - CCE-3919-8 - - - notselected - CCE-4549-2 - - - notselected - CCE-4554-2 - - - notselected - CCE-4443-8 - - - notselected - CCE-4461-0 - - - notselected - CCE-4338-0 - - - notselected - CCE-4514-6 - - - notselected - CCE-4474-3 - - - notselected - CCE-3756-4 - - - notselected - CCE-4509-6 - - - notselected - CCE-4386-9 - - - notselected - CCE-4029-5 - - - notselected - CCE-3581-6 - - - notselected - CCE-4574-0 - - - notselected - CCE-3847-1 - - - notselected - CCE-4239-0 - - - notselected - CCE-4384-4 - - - notselected - CCE-3887-7 - - - notselected - CCE-4530-2 - - - notselected - CCE-4547-6 - - - notselected - CCE-4552-6 - - - notselected - CCE-4371-1 - - - notselected - CCE-4410-7 - - - notselected - CCE-4551-8 - - - notselected - - - notselected - CCE-4556-7 - - - notselected - CCE-4556-7 - - - notselected - CCE-4556-7 - - - notselected - CCE-4076-6 - - - notselected - CCE-4454-5 - - - notselected - CCE-4459-4 - - - notselected - CCE-4503-9 - - - notselected - CCE-4353-9 - - - notselected - CCE-4419-8 - - - notselected - CCE-3692-1 - - - notselected - CCE-4476-8 - - - notselected - CCE-3585-7 - - - notselected - CCE-4344-8 - - - notselected - CCE-4494-1 - - - notselected - CCE-4181-4 - - - notselected - CCE-4577-3 - - - notselected - CCE-4511-2 - - - notselected - CCE-4529-4 - - - notselected - CCE-3610-3 - - - notselected - CCE-4466-9 - - - notselected - CCE-4607-8 - - - notselected - CCE-4255-6 - - - notselected - CCE-4127-7 - - - notselected - CCE-4519-5 - - - notselected - CCE-4413-1 - - - notselected - CCE-4373-7 - - - notselected - CCE-3765-5 - - - notselected - CCE-4404-0 - - 0.000000 - 0.000000 - diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh index ca7e34415a8..ee1e0983b40 100755 --- a/tests/DS/test_ds_misc.sh +++ b/tests/DS/test_ds_misc.sh @@ -10,71 +10,6 @@ set -e -o pipefail # Test Cases. -sds_add_multiple_twice(){ - local DIR="${srcdir}/sds_multiple_oval" - local XCCDF_FILE="multiple-oval-xccdf.xml" - local DS_TARGET_DIR="$(mktemp -d)" - local DS_FILE="$DS_TARGET_DIR/sds.xml" - local stderr=$(mktemp -t sds_add.out.XXXXXX) - - # Create DS from scratch - pushd "$DIR" - $OSCAP ds sds-compose "$XCCDF_FILE" "$DS_FILE" 2>&1 > $stderr - diff $stderr /dev/null - popd - - # Add the very same XCCDF file again with two OVAL files - local ADD_DIR="$(mktemp -d)" - cp ${DIR}/*.xml ${ADD_DIR} - chmod u+w ${ADD_DIR}/* # distcheck shall be able to unlink these files (without --force) - local XCCDF2="$ADD_DIR/$XCCDF_FILE" - pushd ${ADD_DIR} - $OSCAP ds sds-add "$XCCDF2" "$DS_FILE" 2>&1 > $stderr - local ifiles=$(ls *.xml) - popd - diff $stderr /dev/null - rm $XCCDF2 ${ADD_DIR}/*-oval.xml - rm -f ${ADD_DIR}/oscap_debug.log.* - rmdir ${ADD_DIR} - - $OSCAP ds sds-validate "$DS_FILE" 2>&1 > $stderr - diff $stderr /dev/null - assert_correct_xlinks "$DS_FILE" - $OSCAP info "$DS_FILE" 2> $stderr - diff $stderr /dev/null - - local result=$DS_FILE - assert_exists 1 '/ds:data-stream-collection/ds:data-stream' - assert_exists 2 '/ds:data-stream-collection/ds:data-stream/*' - assert_exists 1 '/ds:data-stream-collection/ds:data-stream/ds:checklists' - assert_exists 2 '/ds:data-stream-collection/ds:data-stream/ds:checklists/*' - assert_exists 2 '/ds:data-stream-collection/ds:data-stream/ds:checklists/ds:component-ref' - assert_exists 1 '/ds:data-stream-collection/ds:data-stream/ds:checks' - assert_exists 4 '/ds:data-stream-collection/ds:data-stream/ds:checks/*' - assert_exists 4 '/ds:data-stream-collection/ds:data-stream/ds:checks/ds:component-ref' - assert_exists 6 '/ds:data-stream-collection/ds:component' - assert_exists 4 '/ds:data-stream-collection/ds:component/oval_definitions' - assert_exists 2 '/ds:data-stream-collection/ds:component/xccdf:Benchmark' - - # split the SDS and verify the content - pushd "$DS_TARGET_DIR" - $OSCAP ds sds-split "`basename $DS_FILE`" "$DS_TARGET_DIR" - [ ! -f multiple-oval-xccdf.xml ] - mv scap_org.open-scap_cref_multiple-oval-xccdf.xml multiple-oval-xccdf.xml - popd - local f - for f in second-oval.xml first-oval.xml multiple-oval-xccdf.xml; do - $OSCAP info ${DS_TARGET_DIR}/$f 2> $stderr - diff $stderr /dev/null - diff ${DS_TARGET_DIR}/$f ${DIR}/$f - rm ${DS_TARGET_DIR}/$f - done - rm $DS_FILE - rm -f $DS_TARGET_DIR/oscap_debug.log.* - rmdir $DS_TARGET_DIR - rm $stderr -} - function test_eval { probecheck "rpminfo" || return 255 [ -e "/var/lib/rpm" ] || return 255 @@ -267,21 +202,6 @@ function test_ds_error_remote_resources() { rm -f "$result" "$stderr" } -function test_source_date_epoch() { - local xccdf="$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml" - local result="$(mktemp)" - local timestamp="2020-03-05T12:09:37" - export SOURCE_DATE_EPOCH="1583410177" - export TZ=UTC - # ensure the file mtime is always newer than the $timestamp - touch -c "$srcdir/sds_multiple_oval/first-oval.xml" - touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml" - touch -c "$srcdir/sds_multiple_oval/second-oval.xml" - $OSCAP ds sds-compose "$xccdf" "$result" - assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]' - rm -f "$result" -} - # Testing. test_init @@ -305,12 +225,10 @@ test_run "eval_oval_id2" test_oval_eval_id eval_oval_id/sds.xml scap_org.open-sc test_run "eval_cpe" test_eval_cpe eval_cpe/sds.xml test_run "test_eval_complex" test_eval_complex -test_run "sds_add_multiple_oval_twice_in_row" sds_add_multiple_twice test_run "test_ds_1_2_continue_without_remote_resources" test_ds_continue_without_remote_resources ds_continue_without_remote_resources/remote_content_1.2.ds.xml xccdf_com.example.www_profile_test_remote_res test_run "test_ds_1_2_error_remote_resources" test_ds_error_remote_resources ds_continue_without_remote_resources/remote_content_1.2.ds.xml xccdf_com.example.www_profile_test_remote_res test_run "test_ds_1_3_continue_without_remote_resources" test_ds_continue_without_remote_resources ds_continue_without_remote_resources/remote_content_1.3.ds.xml xccdf_com.example.www_profile_test_remote_res test_run "test_ds_1_3_error_remote_resources" test_ds_error_remote_resources ds_continue_without_remote_resources/remote_content_1.3.ds.xml xccdf_com.example.www_profile_test_remote_res -test_run "test_source_date_epoch" test_source_date_epoch test_exit diff --git a/tests/DS/test_rds.sh b/tests/DS/test_rds.sh index 67e3a12c961..0a681325b83 100755 --- a/tests/DS/test_rds.sh +++ b/tests/DS/test_rds.sh @@ -9,35 +9,6 @@ set -e -o pipefail . $srcdir/test_ds_common.sh # Test Cases. - -function test_rds -{ - local ret_val=0; - - local SDS_FILE="${srcdir}/$1" - local XCCDF_RESULT_FILE="${srcdir}/$2" - local OVAL_RESULT_FILE="${srcdir}/$3" - local DS_TARGET_DIR="`mktemp -d`" - local DS_FILE="$DS_TARGET_DIR/rds.xml" - - $OSCAP ds rds-create "$SDS_FILE" "$DS_FILE" "$XCCDF_RESULT_FILE" "$OVAL_RESULT_FILE" - - if [ $? -ne 0 ]; then - ret_val=1 - fi - - assert_correct_xlinks $DS_FILE - - #pushd "$DS_TARGET_DIR" - #$OSCAP ds sds_split "`basename $DS_FILE`" "$DS_TARGET_DIR" - #rm sds.xml - #popd - - rm -r "$DS_TARGET_DIR" - - return "$ret_val" -} - function test_rds_index { local ret_val=0; @@ -73,48 +44,11 @@ function test_rds_index return "$ret_val" } -function test_rds_split { - - local DIR="${srcdir}/$1" - local SDS_FILE="$2" - local REPORT_FILE="$3" - local SKIP_DIFF="$4" - local DS_TARGET_DIR="`mktemp -d`" - local DS_FILE="$DS_TARGET_DIR/arf.xml" - - pushd "$DIR" - - $OSCAP ds rds-create "$SDS_FILE" "$DS_FILE" "$REPORT_FILE" - - assert_correct_xlinks $DS_FILE - popd - - pushd "$DS_TARGET_DIR" - - $OSCAP ds rds-split "`basename $DS_FILE`" "$DS_TARGET_DIR" - - rm "$DS_FILE" - popd - - if [ "$SKIP_DIFF" != "1" ]; then - if ! diff --exclude "oscap_debug.log.*" "$DIR" "$DS_TARGET_DIR"; then - echo "The files are different after going through result data stream!" - echo - return 1 - fi - fi - - rm -r "$DS_TARGET_DIR" - return 0 -} # Testing. test_init -test_run "rds_simple" test_rds rds_simple/sds.xml rds_simple/results-xccdf.xml rds_simple/results-oval.xml -test_run "rds_testresult" test_rds rds_testresult/sds.xml rds_testresult/results-xccdf.xml rds_testresult/results-oval.xml test_run "rds_index_simple" test_rds_index rds_index_simple/arf.xml "asset0 asset1" "report0" "collection0" -test_run "rds_split_simple" test_rds_split rds_split_simple report-request.xml report.xml 0 test_exit diff --git a/tests/DS/test_sds_compose_split.sh b/tests/DS/test_sds_compose_split.sh deleted file mode 100755 index 09aae3ea2a7..00000000000 --- a/tests/DS/test_sds_compose_split.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/usr/bin/env bash - -# Author: -# Martin Preisler - -set -e -o pipefail - -. $builddir/tests/test_common.sh -. $srcdir/test_ds_common.sh - -# Test Cases. - -function test_sds { - - local DIR="${srcdir}/$1" - local XCCDF_FILE="$2" - local SKIP_DIFF="$3" - local DS_TARGET_DIR="`mktemp -d`" - local DS_FILE="$DS_TARGET_DIR/sds.xml" - - pushd "$DIR" - - $OSCAP ds sds-compose "$XCCDF_FILE" "$DS_FILE" - - assert_correct_xlinks $DS_FILE - popd - - pushd "$DS_TARGET_DIR" - - $OSCAP ds sds-split "`basename $DS_FILE`" "$DS_TARGET_DIR" - - rm "$DS_FILE" - - # get rid of filler prefix to make the diff work - for file in scap_org.open-scap_cref_*; - do - mv "$file" "${file#scap_org.open-scap_cref_}" - done - - popd - - if [ "$SKIP_DIFF" != "1" ]; then - if ! diff --exclude "oscap_debug.log.*" "$DIR" "$DS_TARGET_DIR"; then - echo "The files are different after going through source data stream!" - echo - return 1 - fi - fi - - rm -r "$DS_TARGET_DIR" - return 0 -} - -# Testing. -test_init - -test_run "sds_simple" test_sds sds_simple scap-fedora14-xccdf.xml 0 -test_run "sds_simple OVAL 5.11.1" test_sds sds_simple_5_11_1 simple_xccdf.xml 0 -test_run "sds_multiple_oval" test_sds sds_multiple_oval multiple-oval-xccdf.xml 0 -test_run "sds_missing_oval-prepare" [ ! -f sds_missing_oval/second-oval.xml ] -test_run "sds_missing_oval" test_sds sds_missing_oval multiple-oval-xccdf.xml 0 -test_run "sds_subdir" test_sds sds_subdir subdir/scap-fedora14-xccdf.xml 1 -test_run "sds_extended_component" test_sds sds_extended_component fake-check-xccdf.xml 0 -test_run "sds_extended_component_plain_text" test_sds sds_extended_component_plain_text fake-check-xccdf.xml 0 -test_run "sds_extended_component_plain_text_entities" test_sds sds_extended_component_plain_text_entities fake-check-xccdf.xml 0 -test_run "sds_extended_component_plain_text_whitespace" test_sds sds_extended_component_plain_text_whitespace fake-check-xccdf.xml 0 - -test_exit diff --git a/tests/bz2/sds.xml b/tests/bz2/sds.xml new file mode 100644 index 00000000000..84ab15d45ac --- /dev/null +++ b/tests/bz2/sds.xml @@ -0,0 +1,111 @@ + + + + vim, emacs + 5.5 + 2010-08-30T12:00:00-04:00 + + + + + Ensure that /tmp has its own partition or logical volume + + The /tmp directory is a world-writable directory used for temporary file storage. Verify that it has its own partition or logical volume. + + + + + + + + + + + + + + + /etc + fstab + ^[[:space:]]*[^[:space:]]+[[:space:]]+([^[:space:]]+)[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+ + + 1 + + + + + /tmp + + + + + vim, emacs + 5.5 + 2010-08-30T12:00:00-04:00 + + + + + Ensure that /tmp has its own partition or logical volume + + The /tmp directory is a world-writable directory used for temporary file storage. Verify that it has its own partition or logical volume. + + + + + + + + + + + + + + + /etc + fstab + ^[[:space:]]*[^[:space:]]+[[:space:]]+([^[:space:]]+)[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+ + + 1 + + + + + /tmp + + + + draft + Example of SCAP Security Guidance + This example security guidance has been created to demonstrate SCAP functionality + on Linux. + 0.1 + + + + diff --git a/tests/bz2/test_bz2_datastream.sh b/tests/bz2/test_bz2_datastream.sh index 7b7381be45b..4dbd2508f95 100755 --- a/tests/bz2/test_bz2_datastream.sh +++ b/tests/bz2/test_bz2_datastream.sh @@ -14,6 +14,7 @@ echo "Stderr file = $stderr" sds=$dir/sds.xml xccdf=$dir/xccdf.xml cp $srcdir/../DS/sds_multiple_oval/*.xml $dir/ +cp $srcdir/../bz2/sds.xml $sds mv $dir/multiple-oval-xccdf.xml $xccdf # @@ -31,9 +32,6 @@ bash $builddir/run ./test_bz2_memory_source "${xccdf}.bz2" | grep 'XCCDF Checkli # # Compose DataStream # -$OSCAP ds sds-compose "${xccdf}.bz2" "$sds" 2>&1 > $stderr -[ ! -s $stderr ] - bzip2 $sds [ -f "${sds}.bz2" ] $OSCAP info "${sds}.bz2" 2> $stderr diff --git a/tests/sce/CMakeLists.txt b/tests/sce/CMakeLists.txt index 30f3d62ea72..5f2d1cd3f0a 100644 --- a/tests/sce/CMakeLists.txt +++ b/tests/sce/CMakeLists.txt @@ -4,7 +4,6 @@ if(ENABLE_SCE) endif() add_oscap_test("test_passing_vars.sh") add_oscap_test("test_check_engine_results.sh") - add_oscap_test("test_sce_parse_errors.sh") add_oscap_test("test_sce_in_ds.sh") add_oscap_test("test_sce_in_report.sh") add_oscap_test("test_sce_stdout_stderr.sh") diff --git a/tests/sce/test_sce_parse_errors.sh b/tests/sce/test_sce_parse_errors.sh deleted file mode 100755 index 499d61cd1cd..00000000000 --- a/tests/sce/test_sce_parse_errors.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash - -# Author: -# Zbynek Moravec - -# We were getting parse error when oscap_source struct tried to read .sh -# file as xml. Main purpose of the test is check stderr of output -# More info: https://github.com/OpenSCAP/openscap/issues/230 - -set -e -o pipefail - -. $builddir/tests/test_common.sh - -# In this test oscap should try to load corrupted/invalid (XML) file and get -# error -function test_load_with_error { - xccdf_file=${srcdir}/$1 - stderr=$(mktemp) - result=$(mktemp) - - $OSCAP ds sds-compose "$xccdf_file" "$result" 2> $stderr - - [ -f $stderr ]; [ -s $stderr ]; rm $stderr # we WANT stderr - [ -f $result ]; [ -s $result ]; rm $result -} - - -# In this test oscap should try to load (SCE) file which is not XML. -# We don't want to see some error on stderr -function test_load_without_error { - xccdf_file=${srcdir}/$1 - stderr=$(mktemp) - result=$(mktemp) - - $OSCAP ds sds-compose "$xccdf_file" "$result" 2> $stderr - - [ -f $stderr ]; [ ! -s $stderr ]; rm $stderr # we do NOT want stderr - [ -f $result ]; [ -s $result ]; rm $result -} - -# Testing. -test_init - -test_run "Load script WITHOUT error on stderr" test_load_without_error ./test_sce_parse_errors_load_script.xccdf.xml -test_run "Load script WITH error on stderr" test_load_with_error ./test_sce_parse_errors_load_corrupted_xml.xccdf.xml - -test_exit - diff --git a/tests/sce/test_sce_parse_errors_load_corrupted_xml.xccdf.xml b/tests/sce/test_sce_parse_errors_load_corrupted_xml.xccdf.xml deleted file mode 100644 index 8723c3f1515..00000000000 --- a/tests/sce/test_sce_parse_errors_load_corrupted_xml.xccdf.xml +++ /dev/null @@ -1,16 +0,0 @@ - - draft - Dummy content - check no error occurs whe we tries to load .sh script as xml - 1.0 - - - - - - - Without this file we don't have valid output DS - - - - - diff --git a/tests/sce/test_sce_parse_errors_load_script.xccdf.xml b/tests/sce/test_sce_parse_errors_load_script.xccdf.xml deleted file mode 100644 index 3367eb9245e..00000000000 --- a/tests/sce/test_sce_parse_errors_load_script.xccdf.xml +++ /dev/null @@ -1,16 +0,0 @@ - - draft - Dummy content - check no error occurs whe we tries to load .sh script as xml - 1.0 - - - - - - - Without this file we don't have valid output DS - - - - - diff --git a/utils/oscap-ds.c b/utils/oscap-ds.c index dd0913d62ef..122216ad945 100644 --- a/utils/oscap-ds.c +++ b/utils/oscap-ds.c @@ -68,48 +68,6 @@ struct oscap_module OSCAP_DS_MODULE = { .submodules = DS_SUBMODULES }; -static struct oscap_module DS_SDS_SPLIT_MODULE = { - .name = "sds-split", - .parent = &OSCAP_DS_MODULE, - .summary = "Split given source data stream into separate files", - .usage = "[options] SDS TARGET_DIRECTORY", - .help = - "SDS - Source data stream that will be split into multiple files.\n" - "TARGET_DIRECTORY - Directory of the resulting files.\n" - "\n" - "Options:\n" - " --datastream-id - ID of the data stream in the collection to use.\n" - " --xccdf-id - ID of XCCDF in the data stream that should be evaluated.\n" - " --skip-validation - Skips validating of given XCCDF.\n" - " --fetch-remote-resources - Download remote content referenced by data stream.\n" - " --local-files - Use locally downloaded copies of remote resources stored in the given directory.\n", - .opt_parser = getopt_ds, - .func = app_ds_sds_split -}; - -static struct oscap_module DS_SDS_COMPOSE_MODULE = { - .name = "sds-compose", - .parent = &OSCAP_DS_MODULE, - .summary = "Compose source data stream from given XCCDF", - .usage = "[options] xccdf-file.xml target_datastream.xml", - .help = "Options:\n" - " --skip-validation - Skips validating of given XCCDF.\n", - .opt_parser = getopt_ds, - .func = app_ds_sds_compose -}; - -static struct oscap_module DS_SDS_ADD_MODULE = { - .name = "sds-add", - .parent = &OSCAP_DS_MODULE, - .summary = "Add a component to the existing source data stream", - .usage = "[options] new-component.xml existing_datastream.xml", - .help = "Options:\n" - " --datastream-id - ID of the data stream in the collection for adding to.\n" - " --skip-validation - Skips validating of given XCCDF.\n", - .opt_parser = getopt_ds, - .func = app_ds_sds_add -}; - static struct oscap_module DS_SDS_VALIDATE_MODULE = { .name = "sds-validate", .parent = &OSCAP_DS_MODULE, @@ -120,29 +78,6 @@ static struct oscap_module DS_SDS_VALIDATE_MODULE = { .func = app_ds_sds_validate }; -static struct oscap_module DS_RDS_SPLIT_MODULE = { - .name = "rds-split", - .parent = &OSCAP_DS_MODULE, - .summary = "Splits a result data stream. Creating source data stream (from report-request) and report in target directory.", - .usage = "[OPTIONS] rds.xml TARGET_DIRECTORY", - .help = "Options:\n" - " --report-id - ID of report inside ARF that should be split.\n" - " --skip-validation - Skips validating of given XCCDF.\n", - .opt_parser = getopt_ds, - .func = app_ds_rds_split -}; - -static struct oscap_module DS_RDS_CREATE_MODULE = { - .name = "rds-create", - .parent = &OSCAP_DS_MODULE, - .summary = "Create a result data stream from given source data stream, XCCDF results and one or more OVAL results", - .usage = "[options] sds.xml target-arf.xml results-xccdf.xml [results-oval1.xml [results-oval2.xml]]", - .help = "Options:\n" - " --skip-validation - Skips validating of given XCCDF.\n", - .opt_parser = getopt_ds, - .func = app_ds_rds_create -}; - static struct oscap_module DS_RDS_VALIDATE_MODULE = { .name = "rds-validate", .parent = &OSCAP_DS_MODULE, @@ -154,12 +89,7 @@ static struct oscap_module DS_RDS_VALIDATE_MODULE = { }; static struct oscap_module* DS_SUBMODULES[DS_SUBMODULES_NUM] = { - &DS_SDS_SPLIT_MODULE, - &DS_SDS_COMPOSE_MODULE, - &DS_SDS_ADD_MODULE, &DS_SDS_VALIDATE_MODULE, - &DS_RDS_SPLIT_MODULE, - &DS_RDS_CREATE_MODULE, &DS_RDS_VALIDATE_MODULE, NULL }; @@ -202,34 +132,7 @@ bool getopt_ds(int argc, char **argv, struct oscap_action *action) { } } - if (action->module == &DS_SDS_SPLIT_MODULE) { - if (optind + 2 != argc) { - oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); - return false; - } - action->ds_action = malloc(sizeof(struct ds_action)); - action->ds_action->file = argv[optind]; - action->ds_action->target = argv[optind + 1]; - } - else if (action->module == &DS_SDS_COMPOSE_MODULE) { - if(optind + 2 != argc) { - oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); - return false; - } - action->ds_action = malloc(sizeof(struct ds_action)); - action->ds_action->file = argv[optind]; - action->ds_action->target = argv[optind + 1]; - } - else if (action->module == &DS_SDS_ADD_MODULE) { - if (optind + 2 != argc) { - oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); - return false; - } - action->ds_action = malloc(sizeof(struct ds_action)); - action->ds_action->file = argv[optind]; - action->ds_action->target = argv[optind + 1]; - } - else if (action->module == &DS_SDS_VALIDATE_MODULE) { + if (action->module == &DS_SDS_VALIDATE_MODULE) { if( argc != 4 ) { oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); return false; @@ -237,27 +140,6 @@ bool getopt_ds(int argc, char **argv, struct oscap_action *action) { action->ds_action = malloc(sizeof(struct ds_action)); action->ds_action->file = argv[3]; } - else if (action->module == &DS_RDS_SPLIT_MODULE) { - if (optind + 2 != argc) { - oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); - return false; - } - action->ds_action = malloc(sizeof(struct ds_action)); - action->ds_action->file = argv[optind]; - action->ds_action->target = argv[optind + 1]; - } - else if (action->module == &DS_RDS_CREATE_MODULE) { - if(argc - optind < 3 ) { - oscap_module_usage(action->module, stderr, "Wrong number of parameters.\n"); - return false; - } - action->ds_action = malloc(sizeof(struct ds_action)); - action->ds_action->file = argv[optind]; - action->ds_action->target = argv[optind + 1]; - action->ds_action->xccdf_result = argv[optind + 2]; - action->ds_action->oval_results = &argv[optind + 3]; - action->ds_action->oval_result_count = argc - optind - 3; - } else if (action->module == &DS_RDS_VALIDATE_MODULE) { if(optind >= argc) { oscap_module_usage(action->module, stderr, "Result data stream file need to be specified!\n"); diff --git a/utils/oscap.8 b/utils/oscap.8 index 78d83bcaec3..f135c2f8594 100644 --- a/utils/oscap.8 +++ b/utils/oscap.8 @@ -589,66 +589,11 @@ Validate given CPE dictionary file against a XML schema. Every found error is pr .SH DS OPERATIONS .TP -.B \fBsds-compose\fR [\fIoptions\fR] SOURCE_XCCDF TARGET_SDS -.RS -Creates an SCAP source data stream from the XCCDF file given in SOURCE_XCCDF and stores the result in TARGET_SDS. Dependencies like OVAL files are automatically detected and bundled in the created source data stream. -.TP -\fB\-\-skip-validation -Do not validate input/output files. -.RE -.TP -.B \fBsds-add\fR [\fIoptions\fR] NEW_COMPONENT EXISTING_SDS -.RS -Adds given NEW_COMPONENT file to the existing source data stream (EXISTING_SDS). Component file might be OVAL, XCCDF or CPE Dictionary file. Dependencies like OVAL files are automatically detected and bundled in target source data stream. -.TP -\fB\-\-datastream-id DATASTREAM_ID\fR -Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. -.TP -\fB\-\-skip-validation -Do not validate input/output files. -.RE -.TP -.B \fBsds-split\fR [\fIoptions\fR] SOURCE_DS TARGET_DIR -.RS -Splits given source data stream into multiple files and stores all the files in TARGET_DIR. -.TP -\fB\-\-datastream-id DATASTREAM_ID\fR -Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. -.TP -\fB\-\-xccdf-id XCCDF_ID\fR -Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. -.TP -\fB\-\-skip-validation -Do not validate input/output files. -.TP -\fB\-\-fetch-remote-resources\fR -Allow download of remote components referenced from data stream. -.TP -\fB\-\-local-files DIRECTORY\fR -Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. -.RE -.TP .B \fBsds-validate\fR SOURCE_DS .RS Validate given source data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the source data stream is not valid. .RE .TP -.B \fBrds-create\fR [\fIoptions\fR] SDS TARGET_ARF XCCDF_RESULTS [OVAL_RESULTS [OVAL_RESULTS ..]] -.RS -Takes given source data stream, XCCDF and OVAL results and creates a result data stream (in Asset Reporting Format) and saves it to file given in TARGET_ARF. -.TP -\fB\-\-skip-validation -Do not validate input/output files. -.RE -.TP -.B \fBrds-split\fR [\fIoptions\fR] [--report-id REPORT_ID] RDS TARGET_DIR -.RS -Takes given result data stream (also called ARF = asset reporting format) and splits given report and its respective report-request to given target directory. If no report-id is given, we assume user wants the first applicable report in top-down order in the file. -.TP -\fB\-\-skip-validation -Do not validate input/output files. -.RE -.TP .B \fBrds-validate\fR SOURCE_RDS .RS Validate given result data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the result data stream is not valid.