It doesn't looks like anyone has tried a rhel6 based distro (and reported success/failure). I'm downloaing the scientific linux rhel6 iso now, but in the mean time try this:
diff -r d01886ea2e14 src/rootcheck/db/cis_rhel5_linux_rcl.txt --- a/src/rootcheck/db/cis_rhel5_linux_rcl.txt Fri Mar 25 15:32:18 2011 -0300 +++ b/src/rootcheck/db/cis_rhel5_linux_rcl.txt Tue Mar 29 09:10:21 2011 -0400 @@ -41,6 +41,8 @@ [CIS - Testing against the CIS Red Hat Enterprise Linux 5 Benchmark v1.1] [any required] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 5; f:/etc/redhat-release -> r:^CentOS && r:release 5.2; +f:/etc/redhat-release -> r:^Scientific Linux CERN SLC release 5; +f:/etc/redhat-release -> r:^Scientific Linux CERN SLC release 6; On Mon, Mar 28, 2011 at 10:04:25PM +0200, carlopmart wrote: > On 03/28/2011 09:01 PM, dan (ddp) wrote: > >What is the contents of /etc/redhat-release on an SL system? > >Depending on that, it could be an easy addition: > >https://bitbucket.org/dcid/ossec-hids/src/d01886ea2e14/src/rootcheck/db/cis_rhel_linux_rcl.txt > > > > For example Scientific Linux CERN (http://linux.cern.ch) is: > > [root@lorien]# cat /etc/redhat-release > Scientific Linux CERN SLC release 6.0 (Carbon) > > > -- > CL Martinez > carlopmart {at} gmail {d0t} com
