scap-security-guide December 2012

scap-security-guide@lists.fedorahosted.org

8 participants
36 discussions

[PATCH 0/3] a few additions and changes to check text
by David Smith 19 Dec '12

19 Dec '12

added a few check text items, commented out some things from the FTP profile, and added some items to the 'meets inherently' category David Smith (3): Added check text where needed commented two items out from profile added a few items to 'met inherently' RHEL6/input/auxiliary/srg_support.xml | 2 +- RHEL6/input/profiles/ftp.xml | 4 ++-- RHEL6/input/system/logging.xml | 3 +++ RHEL6/input/system/permissions/execution.xml | 5 +++++ RHEL6/input/system/permissions/partitions.xml | 5 +++++ 5 files changed, 16 insertions(+), 3 deletions(-)

3 6

Legacy RHEL systems and SRR/SCAP
by Robert Sanders 19 Dec '12

19 Dec '12

Hello all, Just in time for the holidays, I figured I'd ask an end-of-the-year naïve question. What are people doing if older RHEL4 based systems are in production and need to be locked-down? Use the SRR (even though retired), the RHEL5 guidelines (understanding that 'things work different'), hope and pray? -Rob

3 2

[PATCH 0/2] more SRG/CCI ref fixups
by Jeffrey Blank 17 Dec '12

17 Dec '12

Jeffrey Blank (2): removal of reference inside Group SRG/CCI reference fixups per FSO feedback from 11/20 RHEL6/input/auxiliary/srg_support.xml | 2 +- RHEL6/input/services/obsolete.xml | 8 ++++---- RHEL6/input/services/ssh.xml | 4 ++-- .../accounts/restrictions/password_expiration.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 1 - RHEL6/input/system/auditing.xml | 6 +++--- 6 files changed, 11 insertions(+), 12 deletions(-)

1 2

[PATCH 0/2] additional CCI/SRG mapping updates
by Jeffrey Blank 17 Dec '12

17 Dec '12

This should be getting closer to a submission that addresses all OS SRG items. Jeffrey Blank (2): provided details that the RHEL auditing system meets SRG requirements updates to CCI references for Rules in auditing, software integrity * audit tools are protected with vendor default permissions RHEL6/input/auxiliary/srg_support.xml | 39 +++++++++++++++++++++++----- RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/software/integrity.xml | 2 +- 3 files changed, 34 insertions(+), 9 deletions(-)

2 4

[PATCH 0/8] repairs/improvements to CCI refs
by Jeffrey Blank 17 Dec '12

17 Dec '12

A collection of repairs and updates to CCI references, in support of addressing all OS SRG requirements as viewed in output/table-stig-rhel6-server-flat-srgs.html. Jeffrey Blank (8): adjusting references to DISA CCIs in services adjusting DISA CCI references in system config items rework of CCI references in SRG support file to indicate selection on DoD baselines adding creation of new SRG-complete table with CCI refs combined (vs flattened) new alt-titles for STIG Rules, CCI references updates added Rule for encrypting partitions to stig profile removing CCI refs when attached to Groups, in favor of Rules or srg_support support for adding SRG ID items to unflattened profile table RHEL6/Makefile | 1 + RHEL6/input/auxiliary/alt-titles-stig.xml | 24 ++++-- RHEL6/input/auxiliary/srg_support.xml | 88 ++++++++++++++------- RHEL6/input/profiles/stig-rhel6-server.xml | 9 +-- RHEL6/input/services/http.xml | 4 +- RHEL6/input/services/obsolete.xml | 6 +- RHEL6/input/services/ssh.xml | 4 +- RHEL6/input/system/accounts/pam.xml | 1 - RHEL6/input/system/auditing.xml | 5 +- RHEL6/input/system/network/ipsec.xml | 2 +- RHEL6/input/system/network/iptables.xml | 5 +- RHEL6/input/system/network/ssl.xml | 4 - RHEL6/input/system/software/disk_partitioning.xml | 41 ++++++---- RHEL6/input/system/software/integrity.xml | 3 +- RHEL6/input/system/software/updating.xml | 3 +- RHEL6/transforms/table-add-srgitems.xslt | 2 +- 16 files changed, 118 insertions(+), 84 deletions(-)

1 9

[PATCH 1/6] Removed CCI references from Group tag and added to appropriate Rule tag.
by Michele Newman 17 Dec '12

17 Dec '12

--- RHEL6/input/services/ssh.xml | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 9069e30..576f9ac 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -8,7 +8,6 @@ implementation included with the system is called OpenSSH, and more detailed documentation is available from its website, http://www.openssh.org. Its server program is called <tt>sshd</tt> and provided by the RPM package <tt>openssh-server</tt>.</description> -<ref disa="1453,877" /> <Value id="sshd_idle_timeout_value" type="number" operator="equals" interactive="0"> @@ -59,7 +58,6 @@ certain changes should be made to the OpenSSH daemon configuration file <tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied to this file. See the <tt>sshd_config(5)</tt> man page for more detailed information.</description> -<ref disa="68,197,888,1632,779,781" /> <Rule id="sshd_allow_only_protocol2" severity="high"> <title>Allow Only SSH Protocol 2</title> @@ -82,7 +80,7 @@ should not be used. </rationale> <ident cce="4325-7" /> <oval id="sshd_protocol_2" /> -<ref disa="776,774,1135,1436" /> +<ref disa="68,776,774,1135,1436" /> <tested by="DS" on="20121024"/> </Rule> @@ -289,7 +287,7 @@ even in the event of misconfiguration elsewhere. </rationale> <ident cce="3660-8" /> <oval id="sshd_permitemptypasswords_no" /> -<ref disa="765,766"/> +<ref disa="197,765,766,877"/> <tested by="DS" on="20121024"/> </Rule> @@ -362,7 +360,7 @@ implementation. These are also required for compliance. </rationale> <ident cce="14491-5" /> <oval id="sshd_use_approved_ciphers" /> -<ref disa="803,1144,1145,1146,196" /> +<ref disa="779,781,803,888,1144,1145,1146,196,1453,1632" /> <tested by="DS" on="20121024"/> </Rule> -- 1.7.1

2 6

It's time to branch & tag
by Shawn Wells 14 Dec '12

14 Dec '12

As we're now at a point where the project is about to submit "Informal Draft" content to DISA, it may be a good time to clean up our git branching/tagging model (err.. create one). My thoughts: (1) For every project within SSG, create a unique branch. Currently this would set us up as: MASTER |--- JBossEAP5 |--- RHEL6 (2) Each project is responsible for their own release tags. MASTER |--- JBossEAP5 |--- RHEL6 | |--- InformalDraft Comments?

3 5

[PATCH] more SRG mappings
by David Smith 14 Dec '12

14 Dec '12

moved several SRG mappings out of groups into rules David Smith (1): mapped to SRG requirements RHEL6/input/auxiliary/srg_support.xml | 35 +++++++++++++++++---------------- RHEL6/input/system/auditing.xml | 9 +++---- RHEL6/input/system/selinux.xml | 3 +- 3 files changed, 23 insertions(+), 24 deletions(-)

1 1

[PATCH] Do not select the Group but the Rule.
by Šimon Lukašík 14 Dec '12

14 Dec '12

--- RHEL6/input/profiles/STIG-server.xml | 2 +- RHEL6/input/profiles/test.xml | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml index 5f67335..3fa5add 100644 --- a/RHEL6/input/profiles/STIG-server.xml +++ b/RHEL6/input/profiles/STIG-server.xml @@ -66,7 +66,7 @@ <refine-value idref="user_umask_value" selector="077"/> -<select idref="daemon_umask" selected="true" /> +<select idref="set_daemon_umask" selected="true" /> <refine-value idref="var_umask_for_daemons" selector="027"/> diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml index 9f0bd50..7742b31 100644 --- a/RHEL6/input/profiles/test.xml +++ b/RHEL6/input/profiles/test.xml @@ -9,7 +9,6 @@ <select idref="package_rsyslog_installed" selected="true"/> <select idref="service_rsyslog_enabled" selected="true"/> <select idref="disable_vsftpd" selected="true"/> -<select idref="set_daemon_umask" selected="true"/> <select idref="set_selinux_state" selected="true"/> <select idref="password_require_digits" selected="true"/> <select idref="tftpd_uses_secure_mode" selected="true"/> @@ -52,7 +51,7 @@ <refine-value idref="user_umask_value" selector="077"/> -<select idref="daemon_umask" selected="true" /> +<select idref="set_daemon_umask" selected="true"/> <refine-value idref="var_umask_for_daemons" selector="027"/> -- 1.7.7.6

3 4

Which of these be added to STIG profile?
by Shawn Wells 14 Dec '12

14 Dec '12

$ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml These ones seem to make sense, and many are mapped to actual CCI/SRG: XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_prelink XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: aide_build_database XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_nonroot_partitions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_removable_partitions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nosuid_on_removable_partitions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_tmp_nodev XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_tmp_noexec XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_tmp_nosuid XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_dev_shm_nodev XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_dev_shm_noexec XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_dev_shm_nosuid XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mount_option_var_tmp_bind_var XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: console_device_restrict_access_desktop XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: console_device_restrict_access_server XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: bootloader_nousb_argument XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: bios_disable_usb_boot XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: gconf_gnome_disable_automount XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_cramfs XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_freevxfs XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_jffs2 XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_hfs XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_hfsplus XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_squashfs XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_module_udf XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_gnome_thumbnailers XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: no_unpackaged_sgid_files XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: no_unpackaged_suid_files XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_setuid_coredumps XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: bios_enable_execution_restrictions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_restorecond_enabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: selinux_confinement_of_daemons XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: root_path_no_dot XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: root_path_no_groupother_writable XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: homedir_perms_no_groupwrite_worldread XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_user_list XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_disable_unused_interfaces XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_disable_zeroconf XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_sniffer_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: wireless_disable_in_bios XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: deactivate_wireless_interfaces XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_disable_interfaces XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_disable_rpc XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: set_sysctl_net_ipv6_conf_default_accept_ra XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_static_address XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_privacy_extensions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_default_gateway XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: network_ipv6_limit_requests XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: rsyslog_logfiles_exist XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: rsyslog_accept_remote_messages_none XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: rsyslog_accept_remote_messages_tcp XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: rsyslog_accept_remote_messages_udp XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: configure_logwatch_hostlimit XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: configure_logwatch_splithosts XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_logwatch_for_logserver XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: audit_logs_rootowner XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: audit_manual_logon_edits XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: audit_manual_session_edits XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: audit_config_immutable I'm not terribly in favor of specifying what services people can/can't run without an incredibly good reason, and I do not see a valid policy requirement to get this included into the STIG. Perhaps we should remove the CCI reference (it's the generic catch all)? XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_acpid_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_certmonger_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_cgconfig_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_cgred_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_cpuspeed_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_haldaemon_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_irqbalance_enabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_kdump_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_mdmonitor_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_messagebus_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_portreserve_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_psacct_enabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_quota_nld_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_rhsmcertd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_saslauthd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_smartd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_sysstat_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_anacron XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ssh_server_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ssh_server_iptables_exception XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: sshd_limit_user_access XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: avahi_ip_only XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: avahi_check_ttl XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: avahi_prevent_port_sharing XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: avahi_disable_publishing XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_cups_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: iptables_cupsd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: cups_disable_browsing XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: cups_disable_printserver XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_dhcp_server XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_dhcp_server XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dhcp_server_disable_ddns XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dhcp_server_deny_decline XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dhcp_server_deny_bootp XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dhcp_server_configure_logging XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ntpd_specify_multiple_servers XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: iptables_smtp_enabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_logging XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_install_ssl_cert XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_denial_of_service XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_banner XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_mail_relay_set_trusted_networks XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_mail_relay_for_trusted_networks XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_mail_relay_smtp_auth_for_untrusted_networks XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: postfix_server_mail_relay_require_tls_for_smtp_auth XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_olcsuffix XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_bdb_file_security XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_olcrootpw XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_certificate_files XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_olcaccess XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_directory_file_security XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: iptables_ldap_enabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ldap_server_config_logging XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_nfslock_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_rpcgssd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_rpcidmapd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_netfs_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_rpcbind_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: nfs_fixed_lockd_tcp_port XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: nfs_fixed_lockd_udp_port XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: nfs_fixed_statd_port XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: nfs_fixed_mountd_port XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_nfs_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: service_rpcsvcgssd_disabled XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: use_root_squashing_all_exports XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: restrict_nfs_clients_to_privileged_ports XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_dns_server XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_bind XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dns_server_chroot XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dns_server_disable_dynamic_updates XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_vsftpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_vsftpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: install_vsftpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ftp_restrict_to_anon XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ftp_disable_uploads XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: ftp_home_partition XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_httpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_httpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_servertokens_prod XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_serversignature_off XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_digest_authentication XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_mod_rewrite XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_ldap_support XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_server_side_includes XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_mime_magic XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_webdav XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_server_activity_status XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_server_configuration_display XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_url_correction XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_proxy_support XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_cache_support XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_cgi_support XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_restrict_root_directory XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_restrict_web_directory XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_restrict_critical_directories XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_limit_available_methods XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_install_mod_ssl XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_install_mod_security XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_logs_permissions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_conf_dir_permissions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: httpd_conf_files_permissions XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_dovecot XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_dovecot XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dovecot_support_necessary_protocols XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dovecot_enable_ssl XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dovecot_configure_ssl_cert XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dovecot_configure_ssl_key XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: dovecot_disable_plaintext_auth XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_smb_server XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: smb_server_disable_root XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: smb_set_auth_levels XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_squid XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_squid XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_snmpd XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: uninstall_net-snmp XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: snmpd_configuration_guidance

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide December 2012