[PATCH 16/16] changed wide-ranging discussion about IPtables rules to Group
Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/network/iptables.xml | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/RHEL6/input/system/network/iptables.xml
b/RHEL6/input/system/network/iptables.xml
index dc3a584..31237b7 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -161,7 +161,7 @@ accepted.</rationale>
<ref nist="AC-4, CM-6" disa="1109" />
</Rule>
-<Rule id="iptables_icmp_disabled">
+<Group id="iptables_icmp_disabled">
<title>Restrict ICMP Message Types</title>
<description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP
messages types can be restricted. To accept only ICMP echo reply, destination unreachable,
and time exceeded messages, remove the line:<br />
<pre>-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT</pre>
@@ -179,14 +179,14 @@ If you are going to statically configure the machine’s address, it
should igno
could add another IPv6 address to the interface or alter important network settings:
<pre>-A RH-Firewall-1-INPUT -p icmpv6 --icmpv6-type router-advertisement -j
DROP</pre>
</description>
+<ref nist="AC-4, CM-6" />
<rationale>Restricting other ICMPv6 message types in
<tt>/etc/sysconfig/ip6tables</tt> is not recommended because the oper-
ation of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking
ICMPv6 types.</rationale>
<!--<ident cce="14264-6" />-->
-<oval id="iptables_icmp_disabled" />
-<ref nist="AC-4, CM-6" />
-</Rule>
+<!--<oval id="iptables_icmp_disabled" />-->
+</Group>
-<Rule id="iptables_log_and_drop_suspicious">
+<Group id="iptables_log_and_drop_suspicious">
<title>Log and Drop Packets with Suspicious Source Addresses</title>
<description>Packets with non-routable source addresses should be rejected, as they
may indicate spoofing. Because the
modified policy will reject non-matching packets, you only need to add these rules if you
are interested in also
@@ -232,7 +232,7 @@ The following rule will log all traffic originating from a site-local
address, w
<!--<ident cce="14264-6" />-->
<!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
<ref nist="AC-4, AC-17, CM-6" />
-</Rule>
+</Group>
</Group><!--<Group id="ruleset_modifications">-->
</Group><!--<Group id="network-iptables">-->
--
1.7.1