[PATCH] deletion of unused OVAL checks

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt; --- .../accounts_no_nis_inclusions_etc_group.xml | 23 ----- RHEL6/input/checks/accounts_wheel_exists.xml | 29 ------ RHEL6/input/checks/cups_limit_browsing.xml | 23 ----- .../input/checks/file_group_owner_etc_crontab.xml | 25 ----- .../input/checks/file_owner_ldap_server_files.xml | 31 ------ .../checks/file_permissions_ldap_server_files.xml | 38 ------- RHEL6/input/checks/iptables_cupsd_disabled.xml | 41 -------- RHEL6/input/checks/iptables_icmp_disabled.xml | 105 -------------------- .../checks/network_ipv6_disable_interfaces.xml | 59 ----------- .../checks/no_shelllogin_for_systemaccounts.xml | 25 ----- .../checks/package_cronie-anacron_removed.xml | 25 ----- .../input/checks/package_isdn4k-utils_removed.xml | 25 ----- RHEL6/input/checks/package_ntpdate_installed.xml | 25 ----- RHEL6/input/checks/service_isdn_disabled.xml | 99 ------------------ RHEL6/input/checks/service_mcstrans_disabled.xml | 96 ------------------ RHEL6/input/checks/sysconfig_ipv6_autoconf.xml | 33 ------ RHEL6/input/checks/templates/packages_removed.csv | 3 - RHEL6/input/checks/templates/services_disabled.csv | 2 - 18 files changed, 0 insertions(+), 707 deletions(-) delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml delete mode 100644 RHEL6/input/checks/accounts_wheel_exists.xml delete mode 100644 RHEL6/input/checks/cups_limit_browsing.xml delete mode 100644 RHEL6/input/checks/file_group_owner_etc_crontab.xml delete mode 100644 RHEL6/input/checks/file_owner_ldap_server_files.xml delete mode 100644 RHEL6/input/checks/file_permissions_ldap_server_files.xml delete mode 100644 RHEL6/input/checks/iptables_cupsd_disabled.xml delete mode 100644 RHEL6/input/checks/iptables_icmp_disabled.xml delete mode 100644 RHEL6/input/checks/network_ipv6_disable_interfaces.xml delete mode 100644 RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml delete mode 100644 RHEL6/input/checks/package_cronie-anacron_removed.xml delete mode 100644 RHEL6/input/checks/package_isdn4k-utils_removed.xml delete mode 100644 RHEL6/input/checks/package_ntpdate_installed.xml delete mode 100644 RHEL6/input/checks/service_isdn_disabled.xml delete mode 100644 RHEL6/input/checks/service_mcstrans_disabled.xml delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_autoconf.xml diff --git a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml b/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml deleted file mode 100644 index 90adc23..0000000 --- a/RHEL6/input/checks/accounts_no_nis_inclusions_etc_group.xml +++ /dev/null @@ -1,23 +0,0 @@ -<def-group> - <definition class="compliance" id="accounts_no_nis_inclusions_etc_group" version="1"> - <metadata> - <title>Remove Legacy + Entries From /etc/group</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>NIS file inclusions should be set appropriately in the /etc/group file.</description> - </metadata> - <criteria> - <criterion comment="tests for reg exp '^\+' in /etc/group" test_ref="test_accounts_no_nis_inclusions_etc_group" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp '^\+' in /etc/group" id="test_accounts_no_nis_inclusions_etc_group" version="1"> - <ind:object object_ref="object_accounts_no_nis_inclusions_etc_group" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_accounts_no_nis_inclusions_etc_group" version="1"> - <ind:path>/etc</ind:path> - <ind:filename>group</ind:filename> - <ind:pattern operation="pattern match">^\+</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/accounts_wheel_exists.xml b/RHEL6/input/checks/accounts_wheel_exists.xml deleted file mode 100644 index 82dc22e..0000000 --- a/RHEL6/input/checks/accounts_wheel_exists.xml +++ /dev/null @@ -1,29 +0,0 @@ -<def-group> - <definition class="compliance" - id="accounts_wheel_exists" version="1"> - <metadata> - <title>Limit su Access to the wheel group</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The wheel group should exist</description> - </metadata> - <criteria> - <criterion comment="Does wheel group exist" - test_ref="test_20065" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the &lt;:begin:&gt;wheel setting in the /etc/group file" - id="test_20065" version="1"> - <ind:object object_ref="obj_20065" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20065" - version="1"> - <ind:path>/etc</ind:path> - <ind:filename>group</ind:filename> - <ind:pattern operation="pattern match">^[\s]*wheel:.*$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/cups_limit_browsing.xml b/RHEL6/input/checks/cups_limit_browsing.xml deleted file mode 100644 index 3531034..0000000 --- a/RHEL6/input/checks/cups_limit_browsing.xml +++ /dev/null @@ -1,23 +0,0 @@ -<def-group> - <definition class="compliance" - id="cups_limit_browsing" version="1"> - <metadata> - <title>Limit Printer Browsing to a Particular Subnet if Necessary</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>By default, when printer sharing is enabled, CUPS will broadcast to every network that its host machine is connected to through all available network interfaces on port 631. It will also listen to incoming broadcasts from other machines on the network. Either list one BrowseAddress line for each client machine and one BrowseAllow line for each print server or use one of the supported shorthand notations that the CUPS service recognizes. Please see the cupsd.conf(5) man page or the documentation provided at http://www.cups.org for more information on other ways to format these directives.</description> - </metadata> - <criteria operator="OR"> - <extend_definition comment="Disable browsing or..." - definition_ref="cups_disable_browsing" /> - <criteria operator="AND"> - <extend_definition comment="restrict via the BrowseAddress directive and..." - definition_ref="cups_limit_browsing_browseaddress" /> - <extend_definition comment="restrict via BrowseDeny then BrowseAllow directives" - definition_ref="cups_limit_browsing_browsedenyallow" /> - </criteria> - </criteria> - </definition> - -</def-group> diff --git a/RHEL6/input/checks/file_group_owner_etc_crontab.xml b/RHEL6/input/checks/file_group_owner_etc_crontab.xml deleted file mode 100644 index 9f3dad8..0000000 --- a/RHEL6/input/checks/file_group_owner_etc_crontab.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <definition class="compliance" id="file_group_owner_etc_crontab" version="1"> - <metadata> - <title>Check Group Ownership /etc/crontab</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The file /etc/crontab should be owned by the root group.</description> - </metadata> - <criteria> - <criterion test_ref="test_file_group_owner_etc_crontab" /> - </criteria> - </definition> - <unix:file_test check="all" check_existence="all_exist" comment="root gid for /etc/crontab" id="test_file_group_owner_etc_crontab" version="1"> - <unix:object object_ref="object_gid_file_etc_crontab" /> - <unix:state state_ref="state_root_gid_etc_crontab" /> - </unix:file_test> - <unix:file_object comment="/etc/crontab" id="object_gid_file_etc_crontab" version="1"> - <unix:path>/etc</unix:path> - <unix:filename>crontab</unix:filename> - </unix:file_object> - <unix:file_state id="state_root_gid_etc_crontab" version="1"> - <unix:group_id datatype="int">0</unix:group_id> - </unix:file_state> -</def-group> diff --git a/RHEL6/input/checks/file_owner_ldap_server_files.xml b/RHEL6/input/checks/file_owner_ldap_server_files.xml deleted file mode 100644 index b4428da..0000000 --- a/RHEL6/input/checks/file_owner_ldap_server_files.xml +++ /dev/null @@ -1,31 +0,0 @@ -<def-group> - <definition class="compliance" - id="file_owner_ldap_server_files" version="1"> - <metadata> - <title>Verify User Who Owns The LDAP Server Files</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The /var/lib/ldap/* files should be owned by user ldap.</description> - </metadata> - <criteria> - <criterion comment="Check file ownership of /var/lib/ldap/*" - test_ref="test_20143" /> - </criteria> - </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership of /var/lib/ldap/*" - id="test_20143" version="1"> - <unix:object object_ref="obj_20143" /> - <unix:state state_ref="state_20143" /> - </unix:file_test> - <unix:file_state id="state_20143" - version="1"> - <unix:user_id datatype="int">55</unix:user_id> - </unix:file_state> - <unix:file_object comment="/var/lib/ldap/*" - id="obj_20143" version="1"> - <unix:path>/var/lib/ldap</unix:path> - <unix:filename operation="pattern match">.*</unix:filename> - </unix:file_object> -</def-group> diff --git a/RHEL6/input/checks/file_permissions_ldap_server_files.xml b/RHEL6/input/checks/file_permissions_ldap_server_files.xml deleted file mode 100644 index 73423e1..0000000 --- a/RHEL6/input/checks/file_permissions_ldap_server_files.xml +++ /dev/null @@ -1,38 +0,0 @@ -<def-group> - <definition class="compliance" - id="file_permissions_ldap_server_files" version="1"> - <metadata> - <title>Verify Permissions On LDAP Server Files</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The /var/lib/ldap/* files should have the appropriate permissions.</description> - </metadata> - <criteria> - <criterion test_ref="test_file_permissions_ldap_server_files" /> - </criteria> - </definition> - <unix:file_test check="all" check_existence="all_exist" comment="/var/lib/ldap/* permissions" - id="test_file_permissions_ldap_server_files" version="1"> - <unix:object object_ref="object_file_permissions_ldap_server_files" /> - <unix:state state_ref="state_file_permissions_ldap_server_files" /> - </unix:file_test> - <unix:file_state id="state_file_permissions_ldap_server_files" - version="1"> - <unix:uread datatype="boolean">true</unix:uread> - <unix:uwrite datatype="boolean">true</unix:uwrite> - <unix:uexec datatype="boolean">false</unix:uexec> - <unix:gread datatype="boolean">true</unix:gread> - <unix:gwrite datatype="boolean">false</unix:gwrite> - <unix:gexec datatype="boolean">false</unix:gexec> - <unix:oread datatype="boolean">false</unix:oread> - <unix:owrite datatype="boolean">false</unix:owrite> - <unix:oexec datatype="boolean">false</unix:oexec> - </unix:file_state> - <unix:file_object comment="/var/lib/ldap/* permissions" - id="object_file_permissions_ldap_server_files" version="1"> - <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> - <unix:path operation="equals">/var/lib/ldap</unix:path> - <unix:filename operation="pattern match">^.*$</unix:filename> - </unix:file_object> -</def-group> diff --git a/RHEL6/input/checks/iptables_cupsd_disabled.xml b/RHEL6/input/checks/iptables_cupsd_disabled.xml deleted file mode 100644 index 24197f2..0000000 --- a/RHEL6/input/checks/iptables_cupsd_disabled.xml +++ /dev/null @@ -1,41 +0,0 @@ -<def-group> - <definition class="compliance" - id="iptables_cupsd_disabled" version="1"> - <metadata> - <title>Firewall Access to Printing Service</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Firewall access to printing service should be - disabled unless required</description> - </metadata> - <criteria operator="AND"> - <criterion comment="iptables" test_ref="test_iptables_cupsd_disabled_iptables" /> - <criterion comment="ip6tables" test_ref="test_iptables_cupsd_disabled_ip6tables" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" comment="Check iptables" - id="test_iptables_cupsd_disabled_iptables" version="1"> - <ind:object object_ref="obj_iptables_cupsd_disabled_iptables" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_cupsd_disabled_iptables" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>iptables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" comment="Check ipv6 tables" - id="test_iptables_cupsd_disabled_ip6tables" version="1"> - <ind:object object_ref="obj_iptables_cupsd_disabled_ip6tables" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check ipv6 tables" - id="obj_iptables_cupsd_disabled_ip6tables" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>ip6tables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT -p (?:(?:udp)|(?:tcp)) -m (?:(?:udp)|(?:tcp)) --dport 631 -j ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/iptables_icmp_disabled.xml b/RHEL6/input/checks/iptables_icmp_disabled.xml deleted file mode 100644 index ec1b31e..0000000 --- a/RHEL6/input/checks/iptables_icmp_disabled.xml +++ /dev/null @@ -1,105 +0,0 @@ -<def-group> - <definition class="compliance" - id="iptables_icmp_disabled" version="1"> - <metadata> - <title>Restrict ICMP</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Firewall should restrict icmp at iptables and iptables6</description> - </metadata> - <criteria operator="AND"> - <criterion comment="disallow all icmp" - test_ref="test_iptables_icmp_disabled_restrict_icmp_ipv4" /> - <criterion comment="iptables-echo-reply" - test_ref="test_iptables_icmp_disabled_echo_reply_ipv4" /> - <criterion comment="iptables-destination-unreachable" - test_ref="test_iptables_icmp_disabled_destication_unreachable_ipv4" /> - <criterion comment="iptables-time-exceeded" - test_ref="test_iptables_icmp_disabled_time_exceeded_ipv4" /> - <criterion comment="ip6tables" - test_ref="test_iptables_icmp_disabled_drop_echo_request_ipv6" /> - <criterion comment="ip6tables" - test_ref="test_iptables_icmp_disabled_drop_router_advertisement_ipv6" /> - </criteria> - </definition> - - <ind:textfilecontent54_test check="all" - check_existence="none_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_restrict_icmp_ipv4" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_restrict_icmp_ipv4" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_restrict_icmp_ipv4" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>iptables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+any\s+-j\s+ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_echo_reply_ipv4" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_echo_reply_ipv4" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_echo_reply_ipv4" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>iptables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+echo-reply\s+-j\s+ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_destication_unreachable_ipv4" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_destication_unreachable_ipv4" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_destication_unreachable_ipv4" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>iptables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+destination-unreachable\s+-j\s+ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_time_exceeded_ipv4" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_time_exceeded_ipv4" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_time_exceeded_ipv4" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>iptables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmp\s+--icmp-type\s+time-exceeded\s+-j\s+ACCEPT$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_drop_echo_request_ipv6" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_drop_echo_request_ipv6" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_drop_echo_request_ipv6" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>ip6tables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+echo-request\s+-j\s+DROP$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Check iptables" - id="test_iptables_icmp_disabled_drop_router_advertisement_ipv6" version="1"> - <ind:object object_ref="obj_iptables_icmp_disabled_drop_router_advertisement_ipv6" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="Check iptables" - id="obj_iptables_icmp_disabled_drop_router_advertisement_ipv6" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>ip6tables</ind:filename> - <ind:pattern operation="pattern match">^-A INPUT\s+-p\s+icmpv6\s+--icmpv6-type\s+router-advertisement\s+-j\s+DROP$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - -</def-group> diff --git a/RHEL6/input/checks/network_ipv6_disable_interfaces.xml b/RHEL6/input/checks/network_ipv6_disable_interfaces.xml deleted file mode 100644 index 4c42744..0000000 --- a/RHEL6/input/checks/network_ipv6_disable_interfaces.xml +++ /dev/null @@ -1,59 +0,0 @@ -<def-group> - <definition class="compliance" - id="network_ipv6_disable_interfaces" version="1"> - <metadata> - <title>Disable Interface Usage of IPv6 Unless Needed</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Disable ipv6 on interfaces</description> - </metadata> - <criteria operator="AND"> - <criterion comment="Disable NETWORKING_IPV6" test_ref="test_network_ipv6_disable_interfaces_networking" /> - <criterion comment="Disable IPV6INIT" test_ref="test_network_ipv6_disable_interfaces_ipv6init" /> - <criterion comment="Disable IPV6INIT per interface" test_ref="test_network_ipv6_disable_interfaces_ipv6init_per_interface" /> - </criteria> - </definition> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Disable NETWORKING_IPV6" - id="test_network_ipv6_disable_interfaces_networking" version="1"> - <ind:object object_ref="obj_network_ipv6_disable_interfaces_networking" /> - </ind:textfilecontent54_test> - - <ind:textfilecontent54_object comment="Disable NETWORKING_IPV6" - id="obj_network_ipv6_disable_interfaces_networking" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>network</ind:filename> - <ind:pattern operation="pattern match">^NETWORKING_IPV6=no$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Disable IPV6INIT" - id="test_network_ipv6_disable_interfaces_ipv6init" version="1"> - <ind:object object_ref="obj_network_ipv6_disable_interfaces_ipv6init" /> - </ind:textfilecontent54_test> - - <ind:textfilecontent54_object comment="Disable IPV6INIT" - id="obj_network_ipv6_disable_interfaces_ipv6init" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>network</ind:filename> - <ind:pattern operation="pattern match">^IPV6INIT=no$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" - check_existence="all_exist" comment="Disable IPV6INIT per interface" - id="test_network_ipv6_disable_interfaces_ipv6init_per_interface" version="1"> - <ind:object object_ref="obj_network_ipv6_disable_interfaces_ipv6init_per_interface" /> - </ind:textfilecontent54_test> - - <ind:textfilecontent54_object comment="Disable IPV6INIT per interface" - id="obj_network_ipv6_disable_interfaces_ipv6init_per_interface" version="1"> - <ind:path>/etc/sysconfig/network-scripts</ind:path> - <ind:filename operation="pattern match">ifcfg-.*</ind:filename> - <ind:pattern operation="pattern match">^IPV6INIT=no$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml deleted file mode 100644 index fdca860..0000000 --- a/RHEL6/input/checks/no_shelllogin_for_systemaccounts.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <definition class="compliance" id="accounts_nologin_for_system" version="1"> - <metadata> - <title>Block Shell and Login Access for Non-Root System Accounts</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Login access to non-root system accounts should be disabled.</description> - </metadata> - <criteria> - <criterion comment="check /etc/passwd for /sbin/nologin on non root system accounts" test_ref="test_accounts_nologin_for_system" /> - </criteria> - </definition> - <unix:password_test check="none satisfy" id="test_accounts_nologin_for_system" comment="no system user unauthorized shell" version="1"> - <unix:object object_ref="object_accounts_nologin_for_system" /> - <unix:state state_ref="state_sys_user_unauth_shell" /> - </unix:password_test> - <unix:password_object id="object_accounts_nologin_for_system" version="1"> - <unix:username operation="not equal">root</unix:username> - </unix:password_object> - <unix:password_state id="state_sys_user_unauth_shell" version="1" operator="AND"> - <unix:user_id datatype="int" operation="less than">500</unix:user_id> - <unix:login_shell datatype="string" operation="not equal">/sbin/nologin</unix:login_shell> - </unix:password_state> -</def-group> diff --git a/RHEL6/input/checks/package_cronie-anacron_removed.xml b/RHEL6/input/checks/package_cronie-anacron_removed.xml deleted file mode 100644 index 2e5b859..0000000 --- a/RHEL6/input/checks/package_cronie-anacron_removed.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. --> - <definition class="compliance" id="package_cronie-anacron_removed" - version="1"> - <metadata> - <title>Package cronie-anacron Removed</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The RPM package cronie-anacron should be removed.</description> - </metadata> - <criteria> - <criterion comment="package cronie-anacron is removed" - test_ref="test_package_cronie-anacron_removed" /> - </criteria> - </definition> - <linux:rpminfo_test check="all" check_existence="none_exist" - id="test_package_cronie-anacron_removed" version="1" - comment="package cronie-anacron is removed"> - <linux:object object_ref="obj_package_cronie-anacron_removed" /> - </linux:rpminfo_test> - <linux:rpminfo_object id="obj_package_cronie-anacron_removed" version="1"> - <linux:name>cronie-anacron</linux:name> - </linux:rpminfo_object> -</def-group> diff --git a/RHEL6/input/checks/package_isdn4k-utils_removed.xml b/RHEL6/input/checks/package_isdn4k-utils_removed.xml deleted file mode 100644 index 1170306..0000000 --- a/RHEL6/input/checks/package_isdn4k-utils_removed.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. --> - <definition class="compliance" id="package_isdn4k-utils_removed" - version="1"> - <metadata> - <title>Package isdn4k-utils Removed</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The RPM package isdn4k-utils should be removed.</description> - </metadata> - <criteria> - <criterion comment="package isdn4k-utils is removed" - test_ref="test_package_isdn4k-utils_removed" /> - </criteria> - </definition> - <linux:rpminfo_test check="all" check_existence="none_exist" - id="test_package_isdn4k-utils_removed" version="1" - comment="package isdn4k-utils is removed"> - <linux:object object_ref="obj_package_isdn4k-utils_removed" /> - </linux:rpminfo_test> - <linux:rpminfo_object id="obj_package_isdn4k-utils_removed" version="1"> - <linux:name>isdn4k-utils</linux:name> - </linux:rpminfo_object> -</def-group> diff --git a/RHEL6/input/checks/package_ntpdate_installed.xml b/RHEL6/input/checks/package_ntpdate_installed.xml deleted file mode 100644 index 6c7d0fc..0000000 --- a/RHEL6/input/checks/package_ntpdate_installed.xml +++ /dev/null @@ -1,25 +0,0 @@ -<def-group> - <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> - <definition class="compliance" id="package_ntpdate_installed" - version="1"> - <metadata> - <title>Package ntpdate Installed</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The RPM package ntpdate should be installed.</description> - </metadata> - <criteria> - <criterion comment="package ntpdate is installed" - test_ref="test_package_ntpdate_installed" /> - </criteria> - </definition> - <linux:rpminfo_test check="all" check_existence="all_exist" - id="test_package_ntpdate_installed" version="1" - comment="package ntpdate is installed"> - <linux:object object_ref="obj_package_ntpdate_installed" /> - </linux:rpminfo_test> - <linux:rpminfo_object id="obj_package_ntpdate_installed" version="1"> - <linux:name>ntpdate</linux:name> - </linux:rpminfo_object> -</def-group> diff --git a/RHEL6/input/checks/service_isdn_disabled.xml b/RHEL6/input/checks/service_isdn_disabled.xml deleted file mode 100644 index ff01e72..0000000 --- a/RHEL6/input/checks/service_isdn_disabled.xml +++ /dev/null @@ -1,99 +0,0 @@ -<def-group> - <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. --> - <definition class="compliance" id="service_isdn_disabled" - version="1"> - <metadata> - <title>Service isdn Disabled</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The isdn service should be disabled if possible.</description> - </metadata> - <criteria comment="package isdn4k-utils removed or service isdn is not configured to start" operator="OR"> - <extend_definition comment="isdn4k-utils removed" definition_ref="package_isdn4k-utils_removed" /> - <criteria operator="AND" comment="service isdn is not configured to start"> - <criterion comment="isdn runlevel 0" test_ref="test_runlevel0_isdn" /> - <criterion comment="isdn runlevel 1" test_ref="test_runlevel1_isdn" /> - <criterion comment="isdn runlevel 2" test_ref="test_runlevel2_isdn" /> - <criterion comment="isdn runlevel 3" test_ref="test_runlevel3_isdn" /> - <criterion comment="isdn runlevel 4" test_ref="test_runlevel4_isdn" /> - <criterion comment="isdn runlevel 5" test_ref="test_runlevel5_isdn" /> - <criterion comment="isdn runlevel 6" test_ref="test_runlevel6_isdn" /> - </criteria> - </criteria> - </definition> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel0_isdn" - version="2"> - <unix:object object_ref="obj_runlevel0_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel1_isdn" - version="2"> - <unix:object object_ref="obj_runlevel1_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel2_isdn" - version="2"> - <unix:object object_ref="obj_runlevel2_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel3_isdn" - version="2"> - <unix:object object_ref="obj_runlevel3_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel4_isdn" - version="2"> - <unix:object object_ref="obj_runlevel4_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel5_isdn" - version="2"> - <unix:object object_ref="obj_runlevel5_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel6_isdn" - version="2"> - <unix:object object_ref="obj_runlevel6_isdn" /> - <unix:state state_ref="state_service_isdn_off" /> - </unix:runlevel_test> - <unix:runlevel_object id="obj_runlevel0_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">0</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel1_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">1</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel2_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">2</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel3_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">3</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel4_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">4</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel5_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">5</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel6_isdn" version="1"> - <unix:service_name>isdn</unix:service_name> - <unix:runlevel operation="equals">6</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_state comment="not configured to start" id="state_service_isdn_off" version="1"> - <unix:start datatype="boolean">false</unix:start> - <unix:kill datatype="boolean">true</unix:kill> - </unix:runlevel_state> -</def-group> diff --git a/RHEL6/input/checks/service_mcstrans_disabled.xml b/RHEL6/input/checks/service_mcstrans_disabled.xml deleted file mode 100644 index 65a90d2..0000000 --- a/RHEL6/input/checks/service_mcstrans_disabled.xml +++ /dev/null @@ -1,96 +0,0 @@ -<def-group> - <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. --> - <definition class="compliance" id="service_mcstrans_disabled" - version="1"> - <metadata> - <title>Service mcstrans Disabled</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>The mcstrans service should be disabled if possible.</description> - </metadata> - <criteria operator="AND" comment="service mcstrans is not configured to start"> - <criterion comment="mcstrans runlevel 0" test_ref="test_runlevel0_mcstrans" /> - <criterion comment="mcstrans runlevel 1" test_ref="test_runlevel1_mcstrans" /> - <criterion comment="mcstrans runlevel 2" test_ref="test_runlevel2_mcstrans" /> - <criterion comment="mcstrans runlevel 3" test_ref="test_runlevel3_mcstrans" /> - <criterion comment="mcstrans runlevel 4" test_ref="test_runlevel4_mcstrans" /> - <criterion comment="mcstrans runlevel 5" test_ref="test_runlevel5_mcstrans" /> - <criterion comment="mcstrans runlevel 6" test_ref="test_runlevel6_mcstrans" /> - </criteria> - </definition> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel0_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel0_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel1_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel1_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel2_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel2_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel3_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel3_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel4_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel4_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel5_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel5_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_test check="all" check_existence="any_exist" - comment="Runlevel test" id="test_runlevel6_mcstrans" - version="2"> - <unix:object object_ref="obj_runlevel6_mcstrans" /> - <unix:state state_ref="state_service_mcstrans_off" /> - </unix:runlevel_test> - <unix:runlevel_object id="obj_runlevel0_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">0</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel1_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">1</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel2_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">2</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel3_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">3</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel4_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">4</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel5_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">5</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_object id="obj_runlevel6_mcstrans" version="1"> - <unix:service_name>mcstrans</unix:service_name> - <unix:runlevel operation="equals">6</unix:runlevel> - </unix:runlevel_object> - <unix:runlevel_state comment="not configured to start" id="state_service_mcstrans_off" version="1"> - <unix:start datatype="boolean">false</unix:start> - <unix:kill datatype="boolean">true</unix:kill> - </unix:runlevel_state> -</def-group> diff --git a/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml b/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml deleted file mode 100644 index d75bd00..0000000 --- a/RHEL6/input/checks/sysconfig_ipv6_autoconf.xml +++ /dev/null @@ -1,33 +0,0 @@ -<def-group> - <definition class="compliance" - id="sysconfig_ipv6_autoconf" version="1"> - <metadata> - <title>Disable Automatic Configuration</title> - <affected family="unix"> - <platform>Red Hat Enterprise Linux 6</platform> - </affected> - <description>Accepting redirects from IPv6 routers should be - disabled as appropriate for all network interfaces. (and - dependencies are met)</description> - </metadata> - <criteria comment="Either IPv6 kernel module is not loaded or this feature should be disabled" - operator="OR"> - <extend_definition comment="Automatic loading of the IPv6 kernel module should be disabled" - definition_ref="kernel_module_ipv6_option_disabled" /> - <criterion comment="Unknown test stub" - test_ref="test_43130" /> - </criteria> - </definition> - <ind:textfilecontent54_test check="all" - check_existence="at_least_one_exists" comment="TODO::INSERT" - id="test_43130" version="1"> - <ind:object object_ref="obj_43130" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="TODO::INSERT" - id="obj_43130" version="1"> - <ind:path>/etc/sysconfig</ind:path> - <ind:filename>network</ind:filename> - <ind:pattern operation="pattern match">^IPV6_AUTOCONF=no$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> -</def-group> diff --git a/RHEL6/input/checks/templates/packages_removed.csv b/RHEL6/input/checks/templates/packages_removed.csv index 9f95f6b..7a0f878 100644 --- a/RHEL6/input/checks/templates/packages_removed.csv +++ b/RHEL6/input/checks/templates/packages_removed.csv @@ -4,7 +4,6 @@ autofs bind certmonger cpuspeed -cronie-anacron cups cyrus-sasl dbus @@ -14,7 +13,6 @@ dovecot hal httpd iputils -isdn4k-utils kexec-tools libcgroup mdadm @@ -35,7 +33,6 @@ samba sendmail smartmontools squid -sssd subscription-manager sysstat talk diff --git a/RHEL6/input/checks/templates/services_disabled.csv b/RHEL6/input/checks/templates/services_disabled.csv index 57f6c71..642dd8c 100644 --- a/RHEL6/input/checks/templates/services_disabled.csv +++ b/RHEL6/input/checks/templates/services_disabled.csv @@ -13,9 +13,7 @@ dhcpd,dhcp dovecot,dovecot haldaemon,hal httpd,httpd -isdn,isdn4k-utils kdump,kexec-tools -mcstrans, mdmonitor,mdadm messagebus,dbus named,bind -- 1.7.1