From jlieskov at redhat.com Thu Aug 20 11:37:12 2015
Content-Type: multipart/mixed; boundary="===============1455789276115140468=="
MIME-Version: 1.0
From: Jan Lieskovsky <jlieskov at redhat.com>
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: [PATCH] modified remediation text for disabling anacron
Date: Tue, 03 Jun 2014 11:27:56 -0400
Message-ID: <1232356709.25364751.1401809276877.JavaMail.zimbra@redhat.com>
In-Reply-To: 1401748875-63055-1-git-send-email-dsmith@secure-innovations.net

--===============1455789276115140468==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

----- Original Message -----
> From: "David Smith" <dsmith(a)secure-innovations.net>
> To: scap-security-guide(a)lists.fedorahosted.org
> Sent: Tuesday, June 3, 2014 12:41:15 AM
> Subject: [PATCH] modified remediation text for disabling anacron
> =

> =

> Signed-off-by: David Smith <dsmith(a)secure-innovations.net>
> ---
>  RHEL/6/input/services/cron.xml |   14 ++++++++------
>  1 files changed, 8 insertions(+), 6 deletions(-)
> =

> diff --git a/RHEL/6/input/services/cron.xml b/RHEL/6/input/services/cron.=
xml
> index 983d9ed..b859dc0 100644
> --- a/RHEL/6/input/services/cron.xml
> +++ b/RHEL/6/input/services/cron.xml
> @@ -25,16 +25,18 @@ enabling the cron daemon is essential.
>  =

>  <Rule id=3D"disable_anacron">
>  <title>Disable anacron Service</title>
> -<description>The <tt>cronie-anacron</tt> package which provides anacron
> -functionality is installed by default. To disable <tt>anacron</tt> suppo=
rt,
> -run the following commands:
> -<pre># yum install cronie-noanacron
> -# yum erase cronie-anacron</pre>
> +<description>The <tt>cronie-anacron</tt> package, which provides
> <tt>anacron</tt>
> +functionality, is installed by default.
> +<package-remove-macro package=3D"cronie-anacron" />
> +</description>
> +<ocil><package-check-macro package=3D"cronie-anacron" /></ocil>
> +<rationale>
>  The <tt>anacron</tt> service provides <tt>cron</tt> functionality for
>  systems
>  such as laptops and workstations that may be shut down during the normal
>  times
>  that <tt>cron</tt> jobs are scheduled to run. On systems which do not
>  require this
>  additional functionality, <tt>anacron</tt> could needlessly increase the
>  possible
> -attack surface for an intruder.</description>
> +attack surface for an intruder.
> +</rationale>
>  <ref nist=3D"CM-7" />
>  <ident cce=3D"27158-5" />
>  </Rule>
> --
> 1.7.1

ACK. Makes sense.


Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> =

> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>=20

--===============1455789276115140468==--