scap-security-guide May 2012

scap-security-guide@lists.fedorahosted.org

11 participants
43 discussions

net.ipv6.conf.default.accept_redirects
by Joe Nall 22 May '12

22 May '12

When ipv6 is disabled, net.ipv6.conf.default.accept_redirects is an unknown key. sysctl net.ipv6.conf.default.accept_redirects error: "net.ipv6.conf.default.accept_redirects" is an unknown key because of this, the oval sysctl test associated with sysctl_net_ipv6_conf_default_accept_redirects fails, even when net.ipv6.conf.default.accept_redirects = 0 is in /etc/sysctl.conf. Is the right fix to pull this out of create_sysctl_checks.py and write a more complex test using extend_definition like network_ipv6_limit_requests.xml? joe

1 0

set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages
by Joe Nall 22 May '12

22 May '12

Should set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages be set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses since the kernel parameter is net.ipv4.icmp_ignore_bogus_error_responses? Some of the associated prose is incorrect as well. I'll generate a patch if desired. joe

2 1

ldap_client_tls_checkpeer question
by Joe Nall 21 May '12

21 May '12

There are a number of checks like ldap_client_tls_checkpeer that look for a string or value in a file that are not sensitive to whether the relevant application is installed. What is the preferred way to deal with this problem? I would prefer not to create unused config files just to make a bogus test happy. Is there a good example in the code of how to test for installation then configuration? I know I can profile my way around this, but down that path is failures to identify issues when a package is added to a system under management. joe

3 5

[PATCH 13/13] Created JBossEAP5 Working Directory
by Shawn Wells 21 May '12

21 May '12

2 1

[PATCH 0/2] update for obsolete services prose
by Jeffrey Blank 21 May '12

21 May '12

I plan to update and test the base service section next, with a consistent style. Jeffrey Blank (2): updated obsolete services section with complete prose * also removed irrelevant (for RHEL 6) Rules and checks removed checks for inetd that are inapplicable to RHEL 6 * also removed unnecessary "hidden" attribute from auxiliary Groups rhel6/src/input/auxiliary/srg_support.xml | 6 +- rhel6/src/input/checks/package_inetd_removed.xml | 26 -- rhel6/src/input/checks/service_inetd_disabled.xml | 95 -------- rhel6/src/input/profiles/common.xml | 3 - rhel6/src/input/services/obsolete.xml | 262 ++++++++++++--------- 5 files changed, 155 insertions(+), 237 deletions(-) delete mode 100644 rhel6/src/input/checks/package_inetd_removed.xml delete mode 100644 rhel6/src/input/checks/service_inetd_disabled.xml

2 3

[PATCH] make Makefile use transform to remove auxiliary Groups
by Jeffrey Blank 18 May '12

18 May '12

This was supposed to have been done originally with the commit of the auxiliary Group support, but was somehow not included. As a bugfix, this does not require an ACK. Jeffrey Blank (1): made Makefile use transform to remove auxiliary Groups rhel6/src/Makefile | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-)

1 1

[PATCH 11/11] Mapped CCI-001693 to enforce_DAC_access_rights
by Shawn Wells 18 May '12

18 May '12

2 1

[PATCH 10/11] Renamed enforce_DAC to enforce_DAC_per_user
by Shawn Wells 18 May '12

18 May '12

2 1

[PATCH 09/11] Removed description fields in auxilary.xml
by Shawn Wells 18 May '12

18 May '12

2 1

[PATCH 08/11] Mapped CCI-001694 to met_inherently
by Shawn Wells 18 May '12

18 May '12

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2012