Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil&gt; --- RHEL6/input/checks/banner_etc_issue.xml | 1 + .../checks/dovecot_disable_plaintext_auth.xml | 10 ++++--- RHEL6/input/checks/dovecot_enable_ssl.xml | 12 ++++---- .../input/checks/logwatch_configured_hostlimit.xml | 8 ++--- .../checks/logwatch_configured_splithosts.xml | 10 +++---- RHEL6/input/checks/network_sniffer_disabled.xml | 1 + RHEL6/input/checks/ntp_remote_server.xml | 27 +++++++++---------- .../checks/postfix_network_listening_disabled.xml | 26 +++++++++--------- RHEL6/input/checks/postfix_server_banner.xml | 17 ++++-------- RHEL6/input/checks/restrict_serial_port_logins.xml | 7 +++-- .../checks/securetty_root_login_console_only.xml | 5 ++- RHEL6/input/checks/selinux_mode.xml | 9 ++++-- RHEL6/input/checks/selinux_policytype.xml | 18 +++++-------- .../set_password_hashing_algorithm_libuserconf.xml | 3 +- .../set_password_hashing_algorithm_logindefs.xml | 5 ++- RHEL6/input/checks/singleuser_password.xml | 19 ++++++-------- RHEL6/input/checks/smb_client_signing_smb_conf.xml | 23 +++++++++-------- .../sysconfig_networking_bootproto_ifcfg.xml | 20 +++++++------- RHEL6/input/checks/sysconfig_nozeroconf_yes.xml | 22 +++++++--------- .../input/checks/system_info_architecture_x86.xml | 22 ++++++++-------- .../checks/system_info_architecture_x86_64.xml | 22 ++++++++-------- .../input/checks/templates/packages_installed.csv | 3 +- RHEL6/input/checks/tftpd_uses_secure_mode.xml | 3 +- RHEL6/input/checks/xwindows_runlevel_setting.xml | 3 +- 24 files changed, 146 insertions(+), 150 deletions(-) diff --git a/RHEL6/input/checks/banner_etc_issue.xml b/RHEL6/input/checks/banner_etc_issue.xml index e13bd3a..64c8f30 100644 --- a/RHEL6/input/checks/banner_etc_issue.xml +++ b/RHEL6/input/checks/banner_etc_issue.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The system login banner text should be set correctly.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="/etc/issue is set appropriately" test_ref="test_banner_etc_issue" /> diff --git a/RHEL6/input/checks/dovecot_disable_plaintext_auth.xml b/RHEL6/input/checks/dovecot_disable_plaintext_auth.xml index e16eb75..27b781e 100644 --- a/RHEL6/input/checks/dovecot_disable_plaintext_auth.xml +++ b/RHEL6/input/checks/dovecot_disable_plaintext_auth.xml @@ -1,14 +1,16 @@ <def-group> - <definition class="compliance" - id="dovecot_disable_plaintext_auth" version="1"> + <definition class="compliance" id="dovecot_disable_plaintext_auth" + version="1"> <metadata> <title>Disable Plaintext Authentication in Dovecot</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Plaintext authentication of mail clients should be disabled.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> - <criteria comment="Disable Plaintext Authentication in Dovecot"> + <criteria comment="Disable Plaintext Authentication in Dovecot" operator="OR"> + <extend_definition comment="dovecot service is disabled" definition_ref="service_dovecot_disabled" /> <criterion test_ref="test_dovecot_disable_plaintext_auth" /> </criteria> </definition> @@ -21,7 +23,7 @@ version="1"> <ind:path>/etc/dovecot/conf.d</ind:path> <ind:filename>10-auth.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/dovecot_enable_ssl.xml b/RHEL6/input/checks/dovecot_enable_ssl.xml index 23d2494..811d7bb 100644 --- a/RHEL6/input/checks/dovecot_enable_ssl.xml +++ b/RHEL6/input/checks/dovecot_enable_ssl.xml @@ -1,14 +1,15 @@ <def-group> - <definition class="compliance" - id="dovecot_enable_ssl" version="1"> + <definition class="compliance" id="dovecot_enable_ssl" version="1"> <metadata> <title>Enable SSL in Dovecot</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>SSL capabilities should be enabled for the mail server.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> - <criteria comment="Enable SSL in Dovecot"> + <criteria comment="Enable SSL in Dovecot" operator="OR"> + <extend_definition comment="dovecot service is disabled" definition_ref="service_dovecot_disabled" /> <criterion test_ref="test_dovecot_enable_ssl" /> </criteria> </definition> @@ -17,11 +18,10 @@ id="test_dovecot_enable_ssl" version="1"> <ind:object object_ref="obj_dovecot_enable_ssl" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_dovecot_enable_ssl" - version="1"> + <ind:textfilecontent54_object id="obj_dovecot_enable_ssl" version="1"> <ind:path>/etc/dovecot/conf.d</ind:path> <ind:filename>10-ssl.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]*ssl[\s]*=[\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*ssl[\s]*=[\s]*yes[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/logwatch_configured_hostlimit.xml b/RHEL6/input/checks/logwatch_configured_hostlimit.xml index 9c701b9..953fa59 100644 --- a/RHEL6/input/checks/logwatch_configured_hostlimit.xml +++ b/RHEL6/input/checks/logwatch_configured_hostlimit.xml @@ -6,22 +6,20 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Test if HostLimit line in logwatch.conf is set appropriately.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> - <criterion comment="hostlimit" test_ref="test_logwatch_configured_hostlimit" /> + <criterion comment="Test value of HostLimit" test_ref="test_logwatch_configured_hostlimit" /> </criteria> </definition> <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_hostlimit" version="1"> <ind:object object_ref="object_logwatch_configured_hostlimit" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_logwatch_configured_hostlimit" version="1"> - <ind:subexpression operation="equals">no</ind:subexpression> - </ind:textfilecontent54_state> <ind:textfilecontent54_object id="object_logwatch_configured_hostlimit" version="1"> <ind:path>/etc/logwatch/conf</ind:path> <ind:filename>logwatch.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> diff --git a/RHEL6/input/checks/logwatch_configured_splithosts.xml b/RHEL6/input/checks/logwatch_configured_splithosts.xml index 8143317..c399617 100644 --- a/RHEL6/input/checks/logwatch_configured_splithosts.xml +++ b/RHEL6/input/checks/logwatch_configured_splithosts.xml @@ -5,22 +5,20 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Check if splithosts line in logwatch.conf is set appropriately.</description> + <description>Check if SplitHosts line in logwatch.conf is set appropriately.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="splithosts" test_ref="test_logwatch_configured_splithosts" /> + <criterion comment="Test value of SplitHosts" test_ref="test_logwatch_configured_splithosts" /> </criteria> </definition> <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_splithosts" version="1"> <ind:object object_ref="object_logwatch_configured_splithosts" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_logwatch_configured_splithosts" version="1"> - <ind:subexpression operation="equals">yes</ind:subexpression> - </ind:textfilecontent54_state> <ind:textfilecontent54_object id="object_logwatch_configured_splithosts" version="1"> <ind:path>/etc/logwatch/conf</ind:path> <ind:filename>logwatch.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/network_sniffer_disabled.xml b/RHEL6/input/checks/network_sniffer_disabled.xml index 4075e84..59360ad 100644 --- a/RHEL6/input/checks/network_sniffer_disabled.xml +++ b/RHEL6/input/checks/network_sniffer_disabled.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Disable the network sniffer</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="promisc interfaces" test_ref="test_promisc_interfaces" negate="true" /> diff --git a/RHEL6/input/checks/ntp_remote_server.xml b/RHEL6/input/checks/ntp_remote_server.xml index b5eae21..b630ae4 100644 --- a/RHEL6/input/checks/ntp_remote_server.xml +++ b/RHEL6/input/checks/ntp_remote_server.xml @@ -1,31 +1,30 @@ <def-group> - <definition class="compliance" - id="ntp_remote_server" version="1"> + <definition class="compliance" id="ntp_remote_server" version="1"> <metadata> <title>Specify a Remote NTP Server for Time Data</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>A remote NTP Server for time synchronization - should be specified (and dependencies are met)</description> + <description>A remote NTP Server for time synchronization should be + specified (and dependencies are met)</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> - <criteria comment="ntpd is enabled and conditions are met" - operator="AND"> + <criteria comment="ntpd is enabled and conditions are met" operator="AND"> <extend_definition comment="ntpd is enabled" definition_ref="service_ntpd_enabled" /> - <criterion test_ref="test_43850" /> + <criterion test_ref="test_ntp_remote_server" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="at_least_one_exists" comment="TODO::INSERT" - id="test_43850" version="1"> - <ind:object object_ref="obj_43850" /> + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" + comment="Ensure at least one NTP server is set" id="test_ntp_remote_server" + version="1"> + <ind:object object_ref="obj_ntp_remote_server" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="TODO::INSERT" - id="obj_43850" version="1"> + <ind:textfilecontent54_object comment="Ensure at least one NTP server is set" + id="obj_ntp_remote_server" version="1"> <ind:path>/etc</ind:path> <ind:filename>ntp.conf</ind:filename> - <ind:pattern operation="pattern match">^server\s+.+$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/postfix_network_listening_disabled.xml b/RHEL6/input/checks/postfix_network_listening_disabled.xml index 3a66118..7b29afd 100644 --- a/RHEL6/input/checks/postfix_network_listening_disabled.xml +++ b/RHEL6/input/checks/postfix_network_listening_disabled.xml @@ -1,29 +1,29 @@ <def-group> - <definition class="compliance" - id="postfix_network_listening_disabled" version="1"> + <definition class="compliance" id="postfix_network_listening_disabled" + version="1"> <metadata> <title>Postfix network listening should be disabled</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Postfix network listening should be - disabled</description> + <description>Postfix network listening should be disabled</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="Unknown test stub" - test_ref="test_150180" /> + <criterion comment="Check inet_interfaces in /etc/postfix/main.cf" + test_ref="test_postfix_network_listening_disabled" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="at_least_one_exists" comment="TODO::INSERT" - id="test_150180" version="1"> - <ind:object object_ref="obj_150180" /> + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" + comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" + id="test_postfix_network_listening_disabled" version="1"> + <ind:object object_ref="obj_postfix_network_listening_disabled" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object comment="TODO::INSERT" - id="obj_150180" version="1"> + <ind:textfilecontent54_object comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" + id="obj_postfix_network_listening_disabled" version="1"> <ind:path>/etc/postfix</ind:path> <ind:filename>main.cf</ind:filename> - <ind:pattern operation="pattern match">^inet_interfaces = localhost$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*localhost[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/postfix_server_banner.xml b/RHEL6/input/checks/postfix_server_banner.xml index d13d8c2..b95256b 100644 --- a/RHEL6/input/checks/postfix_server_banner.xml +++ b/RHEL6/input/checks/postfix_server_banner.xml @@ -1,31 +1,26 @@ <def-group> - <definition class="compliance" - id="postfix_server_banner" version="1"> + <definition class="compliance" id="postfix_server_banner" version="1"> <metadata> <title>Configure Postfix Against Unnecessary Release of Information</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Protect against unnecessary release of information.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> - <criterion comment="Limit release of information" test_ref="test_postfix_server_banner" /> + <criterion comment="Limit release of information" test_ref="test_postfix_server_banner" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Set banner" - id="test_postfix_server_banner" version="1"> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Set banner" id="test_postfix_server_banner" version="1"> <ind:object object_ref="obj_postfix_server_banner" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_postfix_server_banner" - version="1"> - <ind:subexpression operation="equals">$myhostname ESMTP</ind:subexpression> - </ind:textfilecontent54_state> <ind:textfilecontent54_object id="obj_postfix_server_banner" version="1"> <ind:path>/etc/postfix</ind:path> <ind:filename>main.cf</ind:filename> - <ind:pattern operation="pattern match">^[\s]*smtpd_banner[\s]*=[\s]*(.+)[\s]*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*smtpd_banner[\s]*=[\s]*\$myhostname[\s]+ESMTP[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> diff --git a/RHEL6/input/checks/restrict_serial_port_logins.xml b/RHEL6/input/checks/restrict_serial_port_logins.xml index 9cc7641..c25d3dc 100644 --- a/RHEL6/input/checks/restrict_serial_port_logins.xml +++ b/RHEL6/input/checks/restrict_serial_port_logins.xml @@ -5,9 +5,10 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Preventing direct root login to serial port interfaces - helps ensure accountability for actions taken on the system - using the root account.</description> + <description>Preventing direct root login to serial port interfaces helps + ensure accountability for actions taken on the system using the root + account.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="serial ports /etc/securetty" test_ref="test_serial_ports_etc_securetty" negate="true" /> diff --git a/RHEL6/input/checks/securetty_root_login_console_only.xml b/RHEL6/input/checks/securetty_root_login_console_only.xml index 18cdca5..7a686ec 100644 --- a/RHEL6/input/checks/securetty_root_login_console_only.xml +++ b/RHEL6/input/checks/securetty_root_login_console_only.xml @@ -6,8 +6,9 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Preventing direct root login to virtual console devices - helps ensure accountability for actions taken on the system - using the root account.</description> + helps ensure accountability for actions taken on the system using the + root account.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="virtual consoles /etc/securetty" test_ref="test_virtual_consoles_etc_securetty" /> diff --git a/RHEL6/input/checks/selinux_mode.xml b/RHEL6/input/checks/selinux_mode.xml index 2a1c4ca..affd4ca 100644 --- a/RHEL6/input/checks/selinux_mode.xml +++ b/RHEL6/input/checks/selinux_mode.xml @@ -6,13 +6,15 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The SELinux state should be enforcing the local policy.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> <criterion comment="enforce is disabled" test_ref="test_etc_selinux_config" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1"> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1"> <ind:object object_ref="object_etc_selinux_config" /> <ind:state state_ref="state_etc_selinux_config" /> </ind:textfilecontent54_test> @@ -20,7 +22,7 @@ <ind:textfilecontent54_object id="object_etc_selinux_config" version="1"> <ind:path>/etc/selinux</ind:path> <ind:filename>config</ind:filename> - <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> @@ -28,5 +30,6 @@ <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_selinux_state_name" /> </ind:textfilecontent54_state> - <external_variable comment="external variable for selinux state" datatype="string" id="var_selinux_state_name" version="1" /> + <external_variable comment="external variable for selinux state" + datatype="string" id="var_selinux_state_name" version="1" /> </def-group> diff --git a/RHEL6/input/checks/selinux_policytype.xml b/RHEL6/input/checks/selinux_policytype.xml index 43f7e3f..a694b9e 100644 --- a/RHEL6/input/checks/selinux_policytype.xml +++ b/RHEL6/input/checks/selinux_policytype.xml @@ -1,21 +1,19 @@ <def-group> - <definition class="compliance" - id="selinux_policytype" version="1"> + <definition class="compliance" id="selinux_policytype" version="1"> <metadata> <title>Enable SELinux</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The SELinux policy should be set - appropriately.</description> + <description>The SELinux policy should be set appropriately.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion test_ref="test_selinux_policy" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="test_selinux_policy" version="1"> <ind:object object_ref="obj_selinux_policy" /> @@ -28,14 +26,12 @@ </ind:textfilecontent54_state> <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" - datatype="string" id="var_selinux_policy_name" - version="1" /> + datatype="string" id="var_selinux_policy_name" version="1" /> - <ind:textfilecontent54_object id="obj_selinux_policy" - version="1"> + <ind:textfilecontent54_object id="obj_selinux_policy" version="1"> <ind:path>/etc/selinux</ind:path> <ind:filename>config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*SELINUXTYPE[\s]*=[\s]*([^#\s]*)</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*SELINUXTYPE[\s]*=[\s]*([^\s]*)</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/set_password_hashing_algorithm_libuserconf.xml b/RHEL6/input/checks/set_password_hashing_algorithm_libuserconf.xml index f8a55b9..ff0dfd2 100644 --- a/RHEL6/input/checks/set_password_hashing_algorithm_libuserconf.xml +++ b/RHEL6/input/checks/set_password_hashing_algorithm_libuserconf.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> <criterion test_ref="test_etc_libuser_conf_cryptstyle" /> @@ -21,7 +22,7 @@ <ind:textfilecontent54_object comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="object_etc_libuser_conf_cryptstyle" version="1"> <ind:filepath>/etc/libuser.conf</ind:filepath> - <ind:pattern operation="pattern match">^\s*crypt_style\s=\ssha512\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/set_password_hashing_algorithm_logindefs.xml b/RHEL6/input/checks/set_password_hashing_algorithm_logindefs.xml index bec9337..6ff2ce7 100644 --- a/RHEL6/input/checks/set_password_hashing_algorithm_logindefs.xml +++ b/RHEL6/input/checks/set_password_hashing_algorithm_logindefs.xml @@ -1,11 +1,12 @@ <def-group> <definition class="compliance" id="set_password_hashing_algorithm_logindefs" version="1"> <metadata> - <title>Set SHA512 Password Hashing Algorithm In /etc/login.defs</title> + <title>Set SHA512 Password Hashing Algorithm in /etc/login.defs</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria operator="AND"> <criterion test_ref="test_etc_logins_defs_encrypt_method" /> @@ -18,7 +19,7 @@ <ind:textfilecontent54_object comment="check ENCRYPT_METHOD in /etc/login.defs" id="object_etc_logins_defs_encrypt_method" version="1"> <ind:filepath>/etc/login.defs</ind:filepath> - <ind:pattern operation="pattern match">^\s*ENCRYPT_METHOD\s+SHA512\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*ENCRYPT_METHOD[\s]+SHA512[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/singleuser_password.xml b/RHEL6/input/checks/singleuser_password.xml index c405bec..31441ee 100644 --- a/RHEL6/input/checks/singleuser_password.xml +++ b/RHEL6/input/checks/singleuser_password.xml @@ -1,31 +1,28 @@ <def-group> - <definition class="compliance" - id="singleuser_password" version="1"> + <definition class="compliance" id="singleuser_password" version="1"> <metadata> <title>Require Authentication for Single-User Mode</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The requirement for a password to boot into - single-user mode should be configured - correctly.</description> + <description>The requirement for a password to boot into single-user mode + should be configured correctly.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Conditions are satisfied" test_ref="test_singleuser_password" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the SINGLE variable in the /etc/sysconfig/init file, to ensure that a password must be entered to access single user mode it should be set as 'SINGLE=/sbin/sulogin'. The init file provides further documentation on the configuration of this setting." + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="Tests that the SINGLE variable in the /etc/sysconfig/init file is set to /sbin/sulogin, to ensure that a password must be entered to access single user mode" id="test_singleuser_password" version="1"> <ind:object object_ref="obj_singleuser_password" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_singleuser_password" - version="1"> + <ind:textfilecontent54_object id="obj_singleuser_password" version="1"> <ind:path>/etc/sysconfig</ind:path> <ind:filename>init</ind:filename> - <ind:pattern operation="pattern match">^SINGLE=/sbin/sulogin[\s#]*</ind:pattern> + <ind:pattern operation="pattern match">^SINGLE=/sbin/sulogin[\s]*</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/smb_client_signing_smb_conf.xml b/RHEL6/input/checks/smb_client_signing_smb_conf.xml index 910e493..09604ad 100644 --- a/RHEL6/input/checks/smb_client_signing_smb_conf.xml +++ b/RHEL6/input/checks/smb_client_signing_smb_conf.xml @@ -1,33 +1,34 @@ <def-group> - <definition class="compliance" - id="smb_client_signing_smb_conf" version="1"> + <definition class="compliance" id="smb_client_signing_smb_conf" version="1"> <metadata> <title>Require Client SMB Packet Signing in smb.conf</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Require samba clients which use smb.conf, such as smbclient, to - use packet signing. A Samba client should only communicate with servers who can support SMB packet signing.</description> + <description>Require samba clients which use smb.conf, such as smbclient, + to use packet signing. A Samba client should only communicate with + servers who can support SMB packet signing.</description> + <reference source="MED" ref_id="20130814" ref_url="test_attestation" /> </metadata> <criteria operator="OR"> <extend_definition comment="package samba-common is not installed" definition_ref="package_samba-common_removed" /> <criterion comment="check for client signing = mandatory in /etc/samba/smb.conf" - test_ref="test_2034010" /> + test_ref="test_smb_client_signing_smb_conf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="at_least_one_exists" + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for client signing = mandatory in /etc/samba/smb.conf" - id="test_2034010" version="1"> - <ind:object object_ref="obj_2034010" /> + id="test_smb_client_signing_smb_conf" version="1"> + <ind:object object_ref="obj_smb_client_signing_smb_conf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_2034010" + + <ind:textfilecontent54_object id="obj_smb_client_signing_smb_conf" version="1"> <ind:path>/etc/samba</ind:path> <ind:filename>smb.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]*client[\s]+signing[\s]*=[\s]mandatory</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*client[\s]+signing[\s]*=[\s]*mandatory</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml b/RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml index 3a9d26d..6d2237e 100644 --- a/RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml +++ b/RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml @@ -1,6 +1,6 @@ <def-group> - <definition class="compliance" - id="sysconfig_networking_bootproto_ifcfg" version="1"> + <definition class="compliance" id="sysconfig_networking_bootproto_ifcfg" + version="1"> <metadata> <title>Disable DHCP Client</title> <affected family="unix"> @@ -8,23 +8,23 @@ </affected> <description>DHCP configuration should be static for all interfaces.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="Test for BOOTPROTO=static across all interfaces"> - <criterion test_ref="test_20135" /> + <criterion test_ref="test_sysconfig_networking_bootproto_ifcfg" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file" - id="test_20135" version="1"> - <ind:object object_ref="obj_20135" /> - <ind:state state_ref="state_20135" /> + id="test_sysconfig_networking_bootproto_ifcfg" version="1"> + <ind:object object_ref="obj_sysconfig_networking_bootproto_ifcfg" /> + <ind:state state_ref="state_sysconfig_networking_bootproto_ifcfg" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20135" + <ind:textfilecontent54_state id="state_sysconfig_networking_bootproto_ifcfg" version="1"> <ind:subexpression operation="equals">static</ind:subexpression> </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20135" + <ind:textfilecontent54_object id="obj_sysconfig_networking_bootproto_ifcfg" version="1"> <ind:path>/etc/sysconfig/network-scripts</ind:path> <ind:filename operation="pattern match">ifcfg-.*</ind:filename> diff --git a/RHEL6/input/checks/sysconfig_nozeroconf_yes.xml b/RHEL6/input/checks/sysconfig_nozeroconf_yes.xml index 0d862e7..977f125 100644 --- a/RHEL6/input/checks/sysconfig_nozeroconf_yes.xml +++ b/RHEL6/input/checks/sysconfig_nozeroconf_yes.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="sysconfig_nozeroconf_yes" version="1"> + <definition class="compliance" id="sysconfig_nozeroconf_yes" version="1"> <metadata> <title>Disable Zeroconf Networking</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Disable Zeroconf automatic route assignment in - the 169.245.0.0 subnet.</description> + <description>Disable Zeroconf automatic route assignment in the + 169.245.0.0 subnet.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Look for NOZEROCONF=yes in /etc/sysconfig/network" - test_ref="test_20193" /> + test_ref="test_sysconfig_nozeroconf_yes" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="at_least_one_exists" + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check NOZEROCONF=yes in /etc/sysconfig/network" - id="test_20193" version="1"> - <ind:object object_ref="obj_20193" /> + id="test_sysconfig_nozeroconf_yes" version="1"> + <ind:object object_ref="obj_sysconfig_nozeroconf_yes" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20193" - version="1"> + <ind:textfilecontent54_object id="obj_sysconfig_nozeroconf_yes" version="1"> <ind:path>/etc/sysconfig</ind:path> <ind:filename>network</ind:filename> - <ind:pattern operation="pattern match">^\s*NOZEROCONF=yes</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/system_info_architecture_x86.xml b/RHEL6/input/checks/system_info_architecture_x86.xml index 2486a2c..f05260a 100644 --- a/RHEL6/input/checks/system_info_architecture_x86.xml +++ b/RHEL6/input/checks/system_info_architecture_x86.xml @@ -1,30 +1,30 @@ <def-group> - <definition class="miscellaneous" - id="system_info_architecture_x86" version="1"> -<!-- Note that this does not meet requirements for class=inventory as that -only tests for patches per 5.10.1 Revision 1 --> + <definition class="miscellaneous" id="system_info_architecture_x86" + version="1"> + <!-- Note that this does not meet requirements for class=inventory as + that only tests for patches per 5.10.1 Revision 1 --> <metadata> <title>Test for x86 Architecture</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Generic test for x86 architecture to be used by other tests</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Generic test for x86 architecture" test_ref="test_system_info_architecture_x86" /> </criteria> </definition> - <unix:uname_test check="all" - comment="32 bit architecture" - id="test_system_info_architecture_x86" - version="1"> + <unix:uname_test check="all" comment="32 bit architecture" + id="test_system_info_architecture_x86" version="1"> <unix:object object_ref="object_system_info_architecture_x86" /> <unix:state state_ref="state_system_info_architecture_x86" /> </unix:uname_test> - <unix:uname_object comment="32 bit architecture" id="object_system_info_architecture_x86" version="1"> - </unix:uname_object> - <unix:uname_state comment="32 bit architecture" id="state_system_info_architecture_x86" version="1"> + <unix:uname_object comment="32 bit architecture" + id="object_system_info_architecture_x86" version="1" /> + <unix:uname_state comment="32 bit architecture" + id="state_system_info_architecture_x86" version="1"> <unix:processor_type operation="equals">i686</unix:processor_type> </unix:uname_state> </def-group> diff --git a/RHEL6/input/checks/system_info_architecture_x86_64.xml b/RHEL6/input/checks/system_info_architecture_x86_64.xml index 0019a49..d4e681f 100644 --- a/RHEL6/input/checks/system_info_architecture_x86_64.xml +++ b/RHEL6/input/checks/system_info_architecture_x86_64.xml @@ -1,30 +1,30 @@ <def-group> - <definition class="miscellaneous" - id="system_info_architecture_x86_64" version="1"> -<!-- Note that this does not meet requirements for class=inventory as that - only tests for patches per 5.10.1 Revision 1 --> + <definition class="miscellaneous" id="system_info_architecture_x86_64" + version="1"> + <!-- Note that this does not meet requirements for class=inventory as + that only tests for patches per 5.10.1 Revision 1 --> <metadata> <title>Test for x86_64 Architecture</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Generic test for x86_64 architecture to be used by other tests</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="Generic test for x86_64 architecture" test_ref="test_system_info_architecture_x86_64" /> </criteria> </definition> - <unix:uname_test check="all" - comment="64 bit architecture" - id="test_system_info_architecture_x86_64" - version="1"> + <unix:uname_test check="all" comment="64 bit architecture" + id="test_system_info_architecture_x86_64" version="1"> <unix:object object_ref="object_system_info_architecture_x86_64" /> <unix:state state_ref="state_system_info_architecture_x86_64" /> </unix:uname_test> - <unix:uname_object comment="64 bit architecture" id="object_system_info_architecture_x86_64" version="1"> - </unix:uname_object> - <unix:uname_state comment="64 bit architecture" id="state_system_info_architecture_x86_64" version="1"> + <unix:uname_object comment="64 bit architecture" + id="object_system_info_architecture_x86_64" version="1" /> + <unix:uname_state comment="64 bit architecture" + id="state_system_info_architecture_x86_64" version="1"> <unix:processor_type operation="equals">x86_64</unix:processor_type> </unix:uname_state> </def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 318ec91..990f332 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -9,5 +9,6 @@ openswan policycoreutils postfix psacct -vsftpd +rsyslog screen +vsftpd diff --git a/RHEL6/input/checks/tftpd_uses_secure_mode.xml b/RHEL6/input/checks/tftpd_uses_secure_mode.xml index cdb0a6d..0dc15c6 100644 --- a/RHEL6/input/checks/tftpd_uses_secure_mode.xml +++ b/RHEL6/input/checks/tftpd_uses_secure_mode.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The TFTP daemon should use secure mode.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria comment="package tftp-server removed or /etc/xinetd.d/tftp configured correctly" operator="OR"> <extend_definition comment="rpm package tftp-server removed" definition_ref="package_tftp-server_removed" /> @@ -17,7 +18,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_tftpd_uses_secure_mode" version="1"> <ind:filepath>/etc/xinetd.d/tftp</ind:filepath> - <ind:pattern operation="pattern match">^\s*server_args\s+=\s+\-s\s+.+$$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=[\s]+\-s[\s]+.+$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/xwindows_runlevel_setting.xml b/RHEL6/input/checks/xwindows_runlevel_setting.xml index 5aa134b..650c4f2 100644 --- a/RHEL6/input/checks/xwindows_runlevel_setting.xml +++ b/RHEL6/input/checks/xwindows_runlevel_setting.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Checks /etc/inittab to ensure that default runlevel is set to 3.</description> + <reference source="MED" ref_id="20130819" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="default runlevel is 3" test_ref="test_etc_inittab_default_runlevel" /> @@ -18,7 +19,7 @@ <ind:textfilecontent54_object id="object_etc_inittab_default_runlevel" version="1"> <ind:filepath>/etc/inittab</ind:filepath> - <ind:pattern operation="pattern match">^\s*id:3:initdefault:\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*id:3:initdefault:[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> -- 1.7.1