<Profile id="common">
<title>Common Profile for General-Purpose Systems</title>
<description>This profile contains items common to general-purpose desktop and server installations.</description>
<select idref="partition_for_tmp" selected="true"/>
<select idref="partition_for_var" selected="true"/>
<select idref="partition_for_var_log" selected="true"/>
<select idref="partition_for_var_log_audit" selected="true"/>
<select idref="partition_for_home" selected="true"/>
<select idref="ensure_redhat_gpgkey_installed" selected="true"/>
<select idref="service_rhnsd_disabled" selected="true"/>
<select idref="security_patches_up_to_date" selected="true"/>
<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
<select idref="ensure_gpgcheck_never_disabled" selected="true"/>
<select idref="package_aide_installed" selected="true"/>
<select idref="enable_selinux_bootloader" selected="true"/>
<select idref="no_rsh_trust_files" selected="true"/>
<select idref="selinux_state" selected="true"/>
<select idref="selinux_policytype" selected="true"/>
<select idref="selinux_all_devicefiles_labeled" selected="true"/>
<select idref="securetty_root_login_console_only" selected="true"/>
<select idref="restrict_serial_port_logins" selected="true"/>
<select idref="no_shelllogin_for_systemaccounts" selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="accounts_password_all_shadowed" selected="true"/>
<select idref="accounts_no_uid_except_zero" selected="true"/>

<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
<select idref="file_permissions_etc_shadow" selected="true"/>

<select idref="file_owner_etc_gshadow" selected="true"/>
<select idref="file_groupowner_etc_gshadow" selected="true"/>
<select idref="file_permissions_etc_gshadow" selected="true"/>

<select idref="file_owner_etc_passwd" selected="true"/>
<select idref="file_groupowner_etc_passwd" selected="true"/>
<select idref="file_permissions_etc_passwd" selected="true"/>

<select idref="file_owner_etc_group" selected="true" />
<select idref="file_groupowner_etc_group" selected="true" />
<select idref="file_permissions_etc_group" selected="true" />

<select idref="file_permissions_library_dirs" selected="true"/>
<select idref="file_ownership_library_dirs" selected="true"/>
<select idref="file_permissions_binary_dirs" selected="true"/>
<select idref="file_ownership_binary_dirs" selected="true"/>

<select idref="file_permissions_var_log_audit" selected="true"/>

<select idref="accounts_password_minlen_login_defs" selected="true"/>
<select idref="accounts_minimum_age_login_defs" selected="true"/>
<select idref="accounts_maximum_age_login_defs" selected="true"/>
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
<select idref="accounts_password_pam_retry" selected="true"/>
<select idref="accounts_password_pam_dcredit" selected="true"/>
<select idref="accounts_password_pam_ucredit" selected="true"/>
<select idref="accounts_password_pam_ocredit" selected="true"/>
<select idref="accounts_password_pam_lcredit" selected="true"/>
<select idref="accounts_password_pam_difok" selected="true"/>
<select idref="accounts_passwords_pam_faillock_deny" selected="true"/>
<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
<select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
<select idref="file_user_owner_grub_conf" selected="true"/>
<select idref="file_group_owner_grub_conf" selected="true"/>
<select idref="file_permissions_grub_conf" selected="true"/>
<select idref="bootloader_password" selected="true"/>
<select idref="require_singleuser_auth" selected="true"/>
<select idref="disable_interactive_boot" selected="true"/>
<select idref="package_screen_installed" selected="true"/>
<select idref="banner_etc_issue" selected="true"/>
<!-- CURRENTLY NOT IMPLEMENTED <select idref="set_gui_login_banner" selected="true"/> -->

<select idref="sysctl_kernel_randomize_va_space" selected="true"/>
<select idref="sysctl_kernel_exec_shield" selected="true"/>

<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
<select idref="sysctl_ipv4_ip_forward" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
<select idref="sysctl_net_ipv4_tcp_syncookies" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
<select idref="kernel_module_ipv6_option_disabled" selected="true"/>
<select idref="sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
<select idref="service_ip6tables_enabled" selected="true"/>
<select idref="service_iptables_enabled" selected="true"/>
<select idref="set_iptables_default_rule" selected="true"/>
<select idref="set_ip6tables_default_rule" selected="true" />
<select idref="kernel_module_dccp_disabled" selected="true"/>
<select idref="kernel_module_sctp_disabled" selected="true"/>
<select idref="kernel_module_rds_disabled" selected="true"/>
<select idref="kernel_module_tipc_disabled" selected="true"/>
<select idref="package_rsyslog_installed" selected="true"/>
<select idref="service_rsyslog_enabled" selected="true"/>

<select idref="userowner_rsyslog_files" selected="true"/>
<select idref="groupowner_rsyslog_files" selected="true"/>
<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver" selected="true"/>
<select idref="ensure_logrotate_activated" selected="true"/>
<select idref="service_auditd_enabled" selected="true"/>
<select idref="bootloader_audit_argument" selected="true"/>

<select idref="auditd_data_retention_num_logs" selected="true"/>
<select idref="auditd_data_retention_max_log_file" selected="true"/>
<select idref="auditd_data_retention_max_log_file_action" selected="true"/>
<select idref="auditd_data_retention_admin_space_left_action" selected="true"/>

<!-- <select idref="audit_time_rules" selected="true"/> -->
<select idref="audit_rules_time_adjtimex" selected="true"/>
<select idref="audit_rules_time_settimeofday" selected="true"/>
<select idref="audit_rules_time_stime" selected="true"/>
<select idref="audit_rules_time_clock_settime" selected="true"/>
<select idref="audit_rules_time_watch_localtime" selected="true"/>

<select idref="audit_rules_usergroup_modification" selected="true"/>
<select idref="audit_rules_networkconfig_modification" selected="true"/>
<select idref="audit_rules_mac_modification" selected="true"/>

<!-- Audit DAC modifications -->
<!-- <select idref="audit_dac_actions" selected="true"/> -->
<select idref="audit_rules_dac_modification_chmod" selected="true"/>
<select idref="audit_rules_dac_modification_chown" selected="true"/>
<select idref="audit_rules_dac_modification_fchmod" selected="true"/>
<select idref="audit_rules_dac_modification_fchmodat" selected="true"/>
<select idref="audit_rules_dac_modification_fchown" selected="true"/>
<select idref="audit_rules_dac_modification_fchownat" selected="true"/>
<select idref="audit_rules_dac_modification_fremovexattr" selected="true"/>
<select idref="audit_rules_dac_modification_fsetxattr" selected="true"/>
<select idref="audit_rules_dac_modification_lchown" selected="true"/>
<select idref="audit_rules_dac_modification_lremovexattr" selected="true"/>
<select idref="audit_rules_dac_modification_lsetxattr" selected="true"/>
<select idref="audit_rules_dac_modification_removexattr" selected="true"/>
<select idref="audit_rules_dac_modification_setxattr" selected="true"/>

<select idref="audit_rules_unsuccessful_file_modification" selected="true"/>
<select idref="audit_rules_privileged_commands" selected="true"/>
<select idref="audit_rules_media_export" selected="true"/>
<select idref="audit_rules_file_deletion_events" selected="true"/>
<select idref="audit_rules_sysadmin_actions" selected="true"/>
<select idref="audit_rules_kernel_module_loading" selected="true"/>

<select idref="disable_xinetd" selected="true"/>
<select idref="uninstall_xinetd" selected="true"/>
<select idref="uninstall_telnet_server" selected="true"/>
<select idref="service_telnetd_disabled" selected="true"/>
<select idref="package_rsh-server_removed" selected="true"/>
<select idref="service_rsh_disabled" selected="true"/>
<select idref="service_rexec_disabled" selected="true"/>
<select idref="service_rlogin_disabled" selected="true"/>
<select idref="uninstall_ypserv" selected="true"/>
<select idref="disable_ypbind" selected="true"/>
<select idref="uninstall_tftp-server" selected="true"/>
<select idref="service_tftp_disabled" selected="true"/>
<select idref="service_crond_enabled" selected="true"/>
<select idref="sshd_allow_only_protocol2" selected="true"/>
<select idref="sshd_set_idle_timeout" selected="true"/>
<select idref="sshd_set_keepalive" selected="true"/>
<select idref="sshd_disable_rhosts" selected="true"/>
<select idref="disable_host_auth" selected="true"/>
<select idref="sshd_disable_root_login" selected="true"/>
<select idref="sshd_disable_empty_passwords" selected="true"/>
<select idref="sshd_enable_warning_banner" selected="true"/>
<select idref="sshd_do_not_permit_user_env" selected="true"/>
<select idref="sshd_use_approved_ciphers" selected="true"/>
<!-- <select idref="xwindows_remote_listening" selected="true"/> Rule to be rewritten to refer to /etc/gdm/custom.conf -->
<select idref="disable_avahi" selected="true"/>
<!-- <select idref="disable_dhcp_server" selected="true"/> -->
<!-- <select idref="uninstall_dhcp_server" selected="true"/> -->
<select idref="service_ntpd_enabled" selected="true"/>
<select idref="ntpd_specify_remote_server" selected="true"/>
<select idref="postfix_network_listening_disabled" selected="true"/>
<select idref="ldap_client_start_tls" selected="true"/>
<select idref="ldap_client_tls_cacertpath" selected="true"/>
<select idref="package_openldap-servers_removed" selected="true"/>
<!-- acting as an NFS client is normal for many roles.
these should likely be moved out of common.
<select idref="service_nfslock_disabled" selected="true"/>
<select idref="service_rpcgssd_disabled" selected="true"/>
<select idref="service_rpcidmapd_disabled" selected="true"/>
<select idref="service_netfs_disabled" selected="true"/>
<select idref="service_nfs_disabled" selected="true"/> 
<select idref="service_rpcsvcgssd_disabled" selected="true"/> -->

<select idref="gconf_gnome_screensaver_idle_delay" selected="true"/>
<refine-value idref="inactivity_timeout_value" selector="15_minutes"/>

<select idref="gconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
<select idref="gconf_gnome_screensaver_lock_enabled" selected="true"/>
<select idref="gconf_gnome_screensaver_mode_blank" selected="true"/>

<select idref="service_abrtd_disabled" selected="true"/>
<select idref="service_atd_disabled" selected="true"/>
<select idref="service_autofs_disabled" selected="true"/>
<select idref="service_ntpdate_disabled" selected="true"/>
<select idref="service_oddjobd_disabled" selected="true"/>
<select idref="service_qpidd_disabled" selected="true"/>
<select idref="service_rdisc_disabled" selected="true"/>

<select idref="use_nodev_option_on_nfs_mounts" selected="true"/>
<select idref="use_nosuid_option_on_nfs_mounts" selected="true"/>
<select idref="mount_option_noexec_removable_partitions" selected="true"/>

<!-- <select idref="disable_dns_server" selected="true"/> -->
<!-- <select idref="uninstall_bind" selected="true"/> -->
<!-- <select idref="disable_vsftpd" selected="true"/> -->
<!-- <select idref="uninstall_vsftpd" selected="true"/> -->
<!-- <select idref="disable_httpd" selected="true"/> -->
<!-- <select idref="package_httpd_removed" selected="true"/> -->
<!-- <select idref="disable_dovecot" selected="true"/> -->
<!-- <select idref="package_dovecot_removed" selected="true"/> -->
<!-- <select idref="disable_smb_server" selected="true"/> -->
<select idref="require_smb_client_signing" selected="true"/>
<select idref="require_smb_client_signing_mount.cifs" selected="true"/>
<!-- <select idref="disable_squid" selected="true"/> -->
<!-- <select idref="uninstall_squid" selected="true"/> -->
<!-- <select idref="disable_snmpd" selected="true"/> -->
<!-- <select idref="package_net-snmp_removed" selected="true"/> -->
<select idref="accounts_password_pam_unix_remember" selected="true"/>
<!-- Refine Values -->
<refine-value idref="var_umask_for_daemons" selector="027"/>
<!-- daemon umask -->
<refine-value idref="var_accounts_password_minlen_login_defs" selector="14"/>
<!-- password minimum length -->
<refine-value idref="var_accounts_maximum_age_login_defs" selector="90"/>
<!-- maximum password age -->
<refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
<!-- minimum password age -->
<refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
<!-- password warn age -->
<refine-value idref="var_password_pam_retry" selector="3"/>
<!-- Number of retry attempts before erroring out -->
<refine-value idref="var_password_pam_minlen" selector="14"/>
<!-- Minimum number of characters in password -->
<refine-value idref="var_password_pam_dcredit" selector="1"/>
<!-- Minimum number of digits in password -->
<refine-value idref="var_password_pam_ucredit" selector="2"/>
<!-- Minimum number of upper case in password -->
<refine-value idref="var_password_pam_ocredit" selector="2"/>
<!-- Minimum number of other (special characters) in password< -->
<refine-value idref="var_password_pam_lcredit" selector="2"/>
<!-- Minimum number of lower case in password -->
<refine-value idref="var_password_pam_difok" selector="3"/>
<!-- Minimum number of characters not present in old password -->
<refine-value idref="var_password_pam_unix_remember" selector="5"/>
<!-- Passwords to remember -->

<refine-value idref="var_accounts_user_umask" selector="077"/>

<!-- Sensible umask -->
<refine-value idref="login_banner_text" selector="usgcb_default"/>
<!-- login banner verbiage -->
<refine-value idref="var_selinux_state" selector="enforcing"/>
<!-- SELinux state -->
<refine-value idref="var_selinux_policy_name" selector="targeted"/>
<!-- SELinux policy -->

<refine-value idref="var_auditd_num_logs" selector="5"/>
<refine-value idref="var_auditd_max_log_file" selector="6"/>
<refine-value idref="var_auditd_max_log_file_action" selector="rotate"/>
<refine-value idref="var_auditd_admin_space_left_action" selector="single"/>

<refine-value idref="sysctl_net_ipv4_conf_all_accept_source_route_value" selector="disabled"/>
<!-- net.ipv4.conf.all.accept_source_route -->
<refine-value idref="sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled"/>
<!-- net.ipv4.conf.all.accept_redirectse -->
<refine-value idref="sysctl_net_ipv4_conf_all_secure_redirects_value" selector="disabled"/>
<!-- net.ipv4.conf.all.secure_redirects -->
<refine-value idref="sysctl_net_ipv4_conf_all_log_martians_value" selector="enabled"/>
<!-- net.ipv4.conf.all.log_martians -->
<refine-value idref="sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled"/>
<!-- net.ipv4.conf.default.accept_source_route -->
<refine-value idref="sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled"/>
<!-- net.ipv4.conf.default.accept_redirects -->
<refine-value idref="sysctl_net_ipv4_conf_default_secure_redirects_value" selector="disabled"/>
<!-- net.ipv4.conf.default.secure_redirects -->
<refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
<!-- net.ipv4.icmp_echo_ignore_broadcast -->
<refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/>
<!-- net.ipv4.icmp_ignore_bogus_error_messages -->
<refine-value idref="sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
<!-- net.ipv4.tcp_syncookie -->
<refine-value idref="sysctl_net_ipv4_conf_all_rp_filter_value" selector="enabled"/>
<!-- net.ipv4.conf.all.rp_filtere -->
<refine-value idref="sysctl_net_ipv4_conf_default_rp_filter_value" selector="enabled"/>
<!-- net.ipv4.conf.default.rp_filter -->
<refine-value idref="file_owner_logfiles_value" selector="root"/>
<!-- user that owns system log files -->
<refine-value idref="file_groupowner_logfiles_value" selector="root"/>
<!-- permissions of system log files -->
<refine-value idref="sshd_idle_timeout_value" selector="5_minutes"/>
</Profile>
