On 7/31/13 2:24 PM, Brian Peake wrote:
On 7/31/13 1:36 PM, "Shawn Wells"<[email protected]> wrote:
>On 7/31/13 11:31 AM, Stuart Green wrote:
>>
>>Ah-ha!! Thanks, I was looking for the buglist actually and couldn't
>>find it!
>>
>>
>>Glad to be aboard:)
>
>
>Hm. Perhaps this whole thing can be simplified.
>
>Right now we have two checks:
> - package_telnet-server_removed.xml
> - service_telnetd_disabled.xml
>
>They seem redundant, and I'm failing to find reasons against just
>deleting service_telnetd_disabled. There's no way telnet can be enabled
>if the package isn't installed, right?
>
>Is there a reason to continue maintaining both checks?
Shawn,
I don't think so. I believe there are other checks that have the same
redundancy also
Everything in the 'Obsolete Services' can trivially be migrated away to
a 'uninstall' rule:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-obsolete
These would be:
- xinetd
- telnet-server
- rsh-server
- ypserv
- tftp-server
I'd wager much of the 'Base Services' fall under this too:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide.html#item-base
- abrt
- acpid
- certmonger
- cgconfig
- cgred
- cpuspeed
- haldaemon
- irqbalance
- kdump
- mdmonitor
- messagebus
- netconsole
- ntpdate
- oddjobd
- portreserve
- psacct
- quota_nld
- rdisc
- rhnsd
- rhsmcertd
- saslauthd
- smartd
- sysstat
Can anyone think of why we'd want to have checks for*both* uninstall and
disabled?
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
