<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:cpe="http://cpe.mitre.org/dictionary/2.0" xmlns:cpel="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dsig="http://w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="USGCB-RHEL-5-Desktop" xml:lang="en-US" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" style="SCAP_1.1" resolved="false">
	<!-- Benchmark Information -->
	<status date="2010-08-20">draft</status>
	<title override="0">USGCB: Guidance for Securing Redhat Enterprise Linux 5 Desktop Systems for IT
		Professionals</title>
	<description override="0">This guide has been created to assist IT professionals in effectively securing
		systems running Red Hat Enterprise Linux 5 desktops.</description>
	<notice id="terms_of_use" xml:lang="en-US"> Do not attempt to implement any of the settings in
		this guide without first testing them in a non-operational environment. NIST assumes no
		responsibility whatsoever for its use by other parties, and makes no guarantees, expressed
		or implied, about its quality, reliability, or any other characteristic. NIST would
		appreciate acknowledgement if the document and template are used.</notice>
	<front-matter xml:lang="en-US" override="0">TODO::Insert</front-matter>
	<rear-matter xml:lang="en-US" override="0"><xhtml:strong>Trademark Information</xhtml:strong><xhtml:br/><xhtml:br/> Red Hat and Red Hat Enterprise Linux are either registered trademarks or
		trademarks of Red Hat, Inc. in the United States and other countries.<xhtml:br/><xhtml:br/><xhtml:br/>All other names are registered trademarks or trademarks of their
		respective companies. </rear-matter>
	<reference href="TODO::INSERT">
	</reference>
	<platform idref="cpe:/o:redhat:enterprise_linux:5"/>
	<platform idref="cpe:/o:redhat:enterprise_linux:5::client"/>
	<!--<platform idref="cpe:/o:redhat:enterprise_linux:5::client_workstation"/>-->
	<version>0.0.2.0</version>
	<metadata>
		<dc:publisher xmlns="http://purl.org/dc/elements/1.1/">National Institute of Standards and Technology</dc:publisher>
		<dc:creator>National Institute of Standards and Technology</dc:creator>
		<dc:contributor>Jeff Blank</dc:contributor>
		<dc:contributor>Melanie Cook</dc:contributor>
		<dc:contributor>Kurt Dillard</dc:contributor>
		<dc:contributor>Vladimir Gizspenci</dc:contributor>
		<dc:contributor>Steve Grubb</dc:contributor>
		<dc:contributor>Rob Hollis</dc:contributor>
		<dc:contributor>Matthew Kerr</dc:contributor>
		<dc:contributor>Murugiah Souppaya</dc:contributor>
		<dc:contributor>Miloslav Trmac</dc:contributor>
		<dc:contributor>Stephen Quinn</dc:contributor>
		<dc:contributor>Peter Vrabec</dc:contributor>
		<dc:source>http://usgcb.nist.gov</dc:source>
	</metadata>
	<model system="urn:xccdf:scoring:default"/>
	<model system="urn:xccdf:scoring:flat"/>
	<!-- ==================================================================================================== 	-->
	<!-- =========================================  USGCB PROFILES  ========================================== 	-->
	<!-- ==================================================================================================== 	-->
	<!--                                                                                                      																										-->
	<!-- These profiles outline the specific guidance outlined by the US Government Configuration Baselines.  														-->
	<!-- Each defines the set of XCCDF rules that are applicable for that guidance as well as specific values 															-->
	<!-- to be used when determining complinace.                                                              																				-->
	<!--                                                                                      																														-->
	<Profile id="united_states_government_configuration_baseline" abstract="false" prohibitChanges="false">
		<title xml:lang="en-US" override="0">United States Government Configuration Baseline 0.0.4.0</title>
		<description xml:lang="en-US" override="0">This profile represents guidance outlined in United States
			Government Configuration Baseline for desktop systems with Redhat Enterprise Linux 5
			installed.</description>
		<select idref="usgcb-rhel5desktop-rule-2.1.1.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.1.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.1.1.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.1.1.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.1.1.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.2.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.2.2.a" selected="true"/>
<!-- TODO:: Change to true before release -->
		<select idref="security_patches_up_to_date" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.2.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.2.3.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.2.3.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.3.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.1.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.1.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.1.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.e" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.f" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.2.5.g" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.e" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.f" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.g" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.h" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.i" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.j" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.k" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.1.l" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.4.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.5.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.3.6.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.3.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.2.4.4.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.5.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.5.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.6.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.7.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.7.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.7.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.7.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.8.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.8.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.8.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.1.9.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.e" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.f" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.1.1.g" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.3.6.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.4.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.4.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.4.4.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.2.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.6.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.6.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.6.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.6.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.5.6.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.7.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.3.7.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.4.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.4.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.4.2.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.4.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.4.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.e" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.f" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.g" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.h" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.i" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.j" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.k" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.1.2.l" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.2.2.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.3.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.3.2.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.3.2.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.5.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.5.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.5.3.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.7.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.7.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.7.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.5.7.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.7.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.8.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.9.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.10.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.11.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.12.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.13.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.2.4.14.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.3.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.3.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.3.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.3.1.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.4.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.2.5.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.9.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.12.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.12.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.14.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.3.14.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.2.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.d" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.e" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.f" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.g" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.h" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.i" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.j" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.k" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.l" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.m" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.n" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.2.3.o" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.4.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.3.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.4.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.5.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.6.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.7.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.8.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.9.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.5.2.10.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.6.1.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.6.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.7.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.8.4.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.10.2.2.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.10.2.2.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.12.2.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.12.3.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.1.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.1.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.1.1.c" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.1.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.1.3.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.3.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.3.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.3.2.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.13.3.2.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.14.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.14.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.15.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.15.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.16.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.16.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.17.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.17.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.18.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.18.2.10.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.18.2.11.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.19.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.19.1.b" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.20.1.a" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-3.20.1.b" selected="true"/>
		<select idref="nodev_option_on_tmp" selected="true"/>
		<select idref="nosuid_option_on_tmp" selected="true"/>
		<select idref="nodev_option_on_dev_shm" selected="true"/>
		<select idref="nosuid_option_on_dev_shm" selected="true"/>
		<select idref="noexec_option_on_dev_shm" selected="true"/>
		<select idref="noexec_option_on_tmp" selected="true"/>
		<select idref="bind_mount_var_tmp_to_tmp" selected="true"/>
		<select idref="network_sniffer" selected="true"/>
		<select idref="isdn4k_utils_package" selected="true"/>
		<select idref="sendmail_package_installation" selected="true"/>
		<select idref="postfix_package_installation" selected="true"/>
		<select idref="postfix_network_listening" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-2.6.1.0" selected="true"/>
		<select idref="pam_ccreds_package" selected="true"/>
		<select idref="talk_server_package" selected="true"/>
		<select idref="talk_package" selected="true"/>
		<select idref="irda_tools_package" selected="true"/>
		<select idref="ipsec_tools_package" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-18244-4" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-3649-1" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-18037-2" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-4072-5" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-18156-0" selected="true"/>
		<select idref="usgcb-rhel5desktop-rule-CCE-17816-0" selected="true"/>
		<!-- Refine Values -->
		<!-- Permissions for passwd -->
		<refine-value idref="usgcb-rhel5desktop-var-2.2.4.1.a" selector="027"/>
		<!-- daemon umask -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.1.7.a" selector="12"/>
		<!-- password minimum length -->
		<!-- maximum password age -->
		<!-- password warn age -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.retry" selector="3"/>
		<!-- Number of retry attempts before erroring out -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.minlen" selector="14"/>
		<!-- Minimum number of characters in password -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.dcredit" selector="1"/>
		<!-- Mininum number of digits in password -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.ucredit" selector="1"/>
		<!-- Mininum number of upper case in password -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.ocredit" selector="1"/>
		<!-- Mininum number of other (special characters) in password< -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.lcredit" selector="1"/>
		<!-- Mininum number of lower case in password -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.1.1.difok" selector="3"/>
		<!-- Mininum number of characters not present in old password -->
		<!-- Allow access after n seconds after failed attempt -->
		<!--		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.4.a" selector="usergroup"/>-->
		<!-- userhelper file permissions -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.5.a" selector="SHA-512"/>
		<!-- Password hashing algorithm -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.3.6.a" selector="24"/>
		<!-- Passwords to remember -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.4.4" selector="077"/>
		<!-- Sensible umask -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.5.2.a" selector="root"/>
		<!-- User that owns /etc/grub.conf -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.5.2.b" selector="root"/>
		<!-- permissions on /etc/hrub.conf -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.5.5" selector="15_minutes"/>
		<!-- Inactivity timout -->
		<refine-value idref="usgcb-rhel5desktop-var-2.3.7" selector="usgcb_default"/>
		<!-- login banner verbiage -->
		<refine-value idref="usgcb-rhel5desktop-var-2.4.2.c" selector="enforcing"/>
		<!-- SELinux state -->
		<refine-value idref="usgcb-rhel5desktop-var-2.4.2.d" selector="targeted"/>
		<!-- SELinux policy -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.a" selector="disabled"/>
		<!-- net.ipv4.conf.all.accept_source_route -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.b" selector="disabled"/>
		<!-- net.ipv4.conf.all.accept_redirectse -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.c" selector="disabled"/>
		<!-- net.ipv4.conf.all.secure_redirects -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.d" selector="enabled"/>
		<!-- net.ipv4.conf.all.log_martians -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.e" selector="disabled"/>
		<!-- net.ipv4.conf.default.accept_source_route -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.f" selector="disabled"/>
		<!-- net.ipv4.conf.default.accept_redirects -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.g" selector="disabled"/>
		<!-- net.ipv4.conf.default.secure_redirects -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.h" selector="enabled"/>
		<!-- net.ipv4.icmp_echo_ignore_broadcast -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.i" selector="enabled"/>
		<!-- net.ipv4.icmp_ignore_bogus_error_messages -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.j" selector="enabled"/>
		<!-- net.ipv4.tcp_syncookie -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.k" selector="enabled"/>
		<!-- net.ipv4.conf.all.rp_filtere -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.3.2.1.b" selector="disabled"/>
		<!-- accept default router advertisements -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.3.2.1.c" selector="disabled"/>
		<!-- accept default router advertisements -->
		<refine-value idref="usgcb-rhel5desktop-var-2.5.1.2.l" selector="enabled"/>
		<!-- net.ipv4.conf.default.rp_filter -->
		<refine-value idref="usgcb-rhel5desktop-var-2.6.1.2.a" selector="root"/>
		<!-- user that owns system log files -->
		<refine-value idref="usgcb-rhel5desktop-var-2.6.1.2.b" selector="root"/>
		<!-- permissions of system log files -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.group" selector="root"/>
		<!-- group owner of /etc/crontab -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.user" selector="root"/>
		<!-- permissions on /etc/crontab file -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.group" selector="root"/>
		<!-- group owner of /etc/anacrontab -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.user" selector="root"/>
		<!-- permissions on /etc/anacrontab file -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" selector="root"/>
		<!-- group owner of cron.hourly cron.daily cron.weekly cron.monthly cron.d -->
		<refine-value idref="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" selector="root"/>
		<!-- permissions on cron.hourly cron.daily cron.weekly cron.monthly cron.d -->
		<refine-value idref="usgcb-rhel5desktop-var-3.5.2.3.a" selector="15_minutes"/>
	</Profile>
	<!-- ==================================================================================================== -->
	<!-- ========================================  SECURITY GUIDANCE  ======================================= -->
	<!-- ==================================================================================================== -->
	<!--                                                                                                      -->
	<!-- The following groups represent the collection of guidance for this document.  For                    -->
	<!-- specific recommendations regarding which rules to enable and which values to use, please refer to    -->
	<!-- the XCCDF profiles above.                                                                            -->
	<!--                                                                                                      -->
	<Group id="usgcb-rhel5desktop-group-2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
		<title xml:lang="en-US" override="0">System-wide Configuration</title>
		<description override="0">TODO::INSERT</description>
		<Group id="usgcb-rhel5desktop-group-2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Installing and Maintaining Software</title>
			<description xml:lang="en-US" override="0"> The following sections contain information on
				security-relevant choices during the initial operating system installation process
				and the setup of software updates.</description>
			<Group id="usgcb-rhel5desktop-group-2.1.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="false" weight="1.0">
				<title xml:lang="en-US" override="0">Disk Partitioning</title>
				<description xml:lang="en-US" override="0"> Some system directories should be placed on their
					own partitions (or logical volumes). This allows for better separation and
					protection of data. <xhtml:br/> The installer’s default partitioning scheme
					creates separate partitions (or logical volumes) for /, /boot, and swap.<xhtml:br/><xhtml:ul>
						<xhtml:li>If starting with any of the default layouts, check the box to
							“Review and modify partitioning.” This allows for the easy creation
							of additional logical volumes inside the volume group already
							created, though it may require making /’s logical volume smaller to
							create space. In general, using logical volumes is preferable to
							using partitions because they can be more easily adjusted
							later.</xhtml:li>
						<xhtml:li>If creating a custom layout, create the partitions mentioned
							in the previous paragraph (which the installer will require anyway),
							as well as separate ones described in the following
							sections.</xhtml:li>
					</xhtml:ul><xhtml:br/> If a system has already been installed, and the default
					partitioning scheme was used, it is possible but nontrivial to modify it to
					create separate logical volumes for the directories listed above. The
					Logical Volume Manager (LVM) makes this possible. See the LVM HOWTO at
					http://tldp.org/HOWTO/LVM-HOWTO/ for more detailed information on LVM. </description>
				<Rule id="usgcb-rhel5desktop-rule-2.1.1.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14161-4:Ensure that /tmp has its own partition or logical volume</title>
					<description xml:lang="en-US" override="0">The /tmp directory is a world-writable
						directory used for temporary ﬁle storage. Ensure that it has its own
						partition or logical volume.</description>
					<ident system="http://cce.mitre.org">CCE-14161-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20000"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.1.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14777-7:Ensure that /var has its own partition or
						logical volume</title>
					<description xml:lang="en-US" override="0">The /var directory is used by daemons and
						other system services to store frequently-changing data. It is not
						uncommon for the /var directory to contain world-writable
						directories, installed by other software packages. Ensure that /var
						has its own partition or logical volume.</description>
					<ident system="http://cce.mitre.org">CCE-14777-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20002"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.1.1.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14011-1:Ensure that /var/log has its own partition or
						logical volume</title>
					<description xml:lang="en-US" override="0"> System logs are stored in the /var/log
						directory. Ensure that it has its own partition or logical
						volume.</description>
					<ident system="http://cce.mitre.org">CCE-14011-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20004"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.1.1.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14171-3:Ensure that /var/log/audit has its own partition
						or logical volume</title>
					<description xml:lang="en-US" override="0"> Audit logs are stored in the
						/var/log/audit directory. Ensure that it has its own partition or
						logical volume. Make absolutely certain that it is large enough to
						store all audit logs that will be created by the auditing
						daemon.</description>
					<ident system="http://cce.mitre.org">CCE-14171-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20005"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.1.1.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14559-9:Ensure that /home has its own partition or
							logical volume</title>
					<description xml:lang="en-US" override="0"> If user home directories will be stored
							locally, create a separate partition for /home. If /home will be
							mounted from another system such as an NFS server, then creating a
							separate partition is not necessary at this time, and the mountpoint
							can instead be conﬁgured later.</description>
					<ident system="http://cce.mitre.org">CCE-14559-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20006"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.1.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Updating Software</title>
				<description xml:lang="en-US" override="0"> The yum command line tool is used to install and
					update software packages. Yum replaces the up2date utility used in previous
					system releases. The system also provides two graphical package managers, pirut
					and pup. The pirut tool is a graphical front-end for yum that allows users to
					install and update packages while pup is a simple update tool for packages that
					are already installed. In the <xhtml:b>Applications</xhtml:b> menu, pirut is
					labeled <xhtml:b>Add/Remove Software</xhtml:b> and pup is labeled
						<xhtml:b>Software Updater</xhtml:b>.<xhtml:br/><xhtml:br/> It is recommended that these tools be used to keep systems up to
					date with the latest security patches. </description>
				<Rule id="usgcb-rhel5desktop-rule-2.1.2.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title xml:lang="en-US" override="0">CCE-14440-2:Ensure Red Hat GPG Key is Installed</title>
					<description override="0">The GPG key should be installed.</description>
					<ident system="http://cce.mitre.org">CCE-14440-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200065"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.2.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3416-5:Disable the rhnsd Daemon</title>
					<description override="0">The rhnsd daemon polls the Red Hat Network web
						site for scheduled actions. Unless it is actually necessary to schedule
						updates remotely through the RHN website, it is recommended that the service
						be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3416-5</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20007"/>
					</check>
				</Rule>
				<Rule id="security_patches_up_to_date" selected="false" weight="10.0" >
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title>Ensure software is up to date</title>
							<description>The following command prints a list of
							packages that need to be updated:<xhtml:br/>
							<xhtml:br/>
							<xhtml:code># yum check-update</xhtml:code>
							<xhtml:br/>
							<xhtml:br/> To actually install these updates, run:<xhtml:br/>
							<xhtml:br/>
							<xhtml:code># yum update</xhtml:code></description>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
								<check-content-ref href="http://www.redhat.com/security/data/oval/com.redhat.rhsa-all.xml"/>
								<!--<check-content-ref href="usgcb-rhel5desktop-patches.xml"/>-->
							</check>
				</Rule> 
				<Rule id="usgcb-rhel5desktop-rule-2.1.2.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4218-4:yum-updatesd service should be disabled</title>
					<description override="0">TThe yum-updatesd service is not mature enough
						for an enterprise environment, and the service may introduce unnecessary
						overhead. When possible, replace this service with a cron job that calls
						yum directly.</description>
					<ident system="http://cce.mitre.org">CCE-4218-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20008"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.2.3.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14914-6:Ensure gpgcheck is Globally Activated</title>
					<description override="0"> The gpgcheck option should be used to ensure that checking
							of an RPM package’s signature always occurs prior to its installation.<xhtml:br/><xhtml:br/>To force yum to check package signatures before
							installing them, ensure that the following line appears in
							/etc/yum.conf in the [main] section: <xhtml:br/><xhtml:br/> gpgcheck=1</description>
					<ident system="http://cce.mitre.org">CCE-14914-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20010"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.2.3.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14813-0:Ensure Package Signature Checking is Not Disabled For Any
								Repos</title>
					<description override="0">To ensure that signature checking is not disabled for any
								repos, ensure that the following line DOES NOT appear in any repo
								conﬁguration ﬁles in /etc/yum.repos.d or elsewhere:<xhtml:br/><xhtml:br/>gpgcheck=0</description>
					<ident system="http://cce.mitre.org">CCE-14813-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20011"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.1.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Software Integrity Checking</title>
				<description xml:lang="en-US" override="0"> The AIDE (Advanced Intrusion Detection Environment)
					software is included with the system to provide software integrity checking. It
					is designed to be a replacement for the well-known Tripwire integrity checker.
					Integrity checking cannot <xhtml:em>prevent</xhtml:em> intrusions into your
					system, but can detect that they have occurred.<xhtml:br/><xhtml:br/> Any integrity checking software should be configured before the
					system is deployed and able to provides services to users. Ideally, the
					integrity checking database would be built before the system is connected to any
					network, though this may prove impractical due to registration and software
					updates. </description>
				<Rule id="usgcb-rhel5desktop-rule-2.1.3.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4209-3:Install AIDE</title>
					<description override="0">Requirements for software integrity checking
						should be defined by policy, and this is highly dependent on the environment
						in which the system will be used. As such, a general strategy for
						implementing integrity checking is provided, but precise recommendations
						(such as to check a particular file) cannot be. Documentation for AIDE,
						including the quick-start on which this advice is based, is available in
						/usr/share/doc/aide-0.12.</description>
					<ident system="http://cce.mitre.org">CCE-4209-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20014"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.1.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14931-0:Verify Package Integrity Using RPM</title>
					<description override="0">The RPM package management system includes the
						ability to verify the integrity of installed packages by comparing the
						installed ﬁles with information about the ﬁles taken from the package
						metadata stored in the RPM database. Although an attacker could corrupt the
						RPM database (analogous to attacking the AIDE database as described above),
						this check can still reveal modiﬁcation of important ﬁles.</description>
					<ident system="http://cce.mitre.org">CCE-14931-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200155"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">File Permissions and Masks</title>
			<description xml:lang="en-US" override="0"> Traditional Unix security relies heavily on file and
				directory permissions to prevent unauthorized users from reading or modifying files
				to which they should not have access. Adhere to the principle of least privilege —
				configure each file, directory, and filesystem to allow only the access needed in
				order for that file to serve its purpose.<xhtml:br/><xhtml:br/> However, Linux systems contain a large number of files, so it is often
				prohibitively time-consuming to ensure that every file on a machine has exactly the
				permissions needed. This section introduces several permission restrictions which
				are almost always appropriate for system security, and which are easy to test and
				correct. <xhtml:br/><xhtml:br/> Note: Several of the commands in this section search filesystems for
				files or directories with certain characteristics, and are intended to be run on
				every local ext2 or ext3 partition on a given machine. When the variable
					<xhtml:em>PART</xhtml:em> appears in one of the commands below, it means that
				the command is intended to be run repeatedly, with the name of each local partition
				substituted for <xhtml:em>PART</xhtml:em> in turn.<xhtml:br/><xhtml:br/> The following command prints a list of ext2 and ext3 partitions on a
				given machine:<xhtml:br/><xhtml:br/><xhtml:code>$ mount -t ext2,ext3 | awk '{print $3}'<xhtml:br/></xhtml:code><xhtml:br/> If your site uses a local filesystem type other than ext2 or ext3, you
				will need to modify this command. </description>
			<Group id="usgcb-rhel5desktop-group-2.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Restrict Partition Mount Options</title>
				<description xml:lang="en-US" override="0"> System partitions can be mounted with certain options
					which limit what files on those partitions can do. These options are set in the
					file /etc/fstab, and can be used to make certain types of malicious behavior
					more difficult.</description>
				<Rule id="usgcb-rhel5desktop-rule-2.2.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-4249-9:Add nodev Option to Non-Root Local Partitions</title>
					<description override="0"> The nodev option prevents users from mounting unauthorized
						devices on any partition which is known not to contain any authorized
						devices. The root partition typically contains the /dev partition, which is
						the primary location for authorized devices, so this option should not be
						set on /.</description>
					<ident system="http://cce.mitre.org">CCE-4249-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20016"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3522-0:Add nodev Option to Removable Media Partitions</title>
					<description override="0">Users should not be allowed to introduce
						arbitrary devices or setuid programs to a system. These options are used to
						prevent that. In addition, while users are usually allowed to add executable
						programs to a system, the noexec option prevents code from being executed
						directly from the media itself, and may therefore provide a line of defense
						against certain types of worms or malicious code.</description>
					<ident system="http://cce.mitre.org">CCE-3522-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20017"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.1.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4275-4:Add noexec Option to Removable Media Partitions</title>
					<description override="0">Users should not be allowed to introduce
						arbitrary devices or setuid programs to a system. These options are used to
						prevent that. In addition, while users are usually allowed to add executable
						programs to a system, the noexec option prevents code from being executed
						directly from the media itself, and may therefore provide a line of defense
						against certain types of worms or malicious code.</description>
					<ident system="http://cce.mitre.org">CCE-4275-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20018"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.1.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4042-8:Add nosuid Option to Removable Media Partitions</title>
					<description override="0">Users should not be allowed to introduce
						arbitrary devices or setuid programs to a system. These options are used to
						prevent that. In addition, while users are usually allowed to add executable
						programs to a system, the noexec option prevents code from being executed
						directly from the media itself, and may therefore provide a line of defense
						against certain types of worms or malicious code.</description>
					<ident system="http://cce.mitre.org">CCE-4042-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20019"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Restrict Dynamic Mounting and Unmounting of
					Filesystems</title>
				<description xml:lang="en-US" override="0"> Linux includes a number of facilities for the
					automated addition and removal of filesystems on a running system. These
					facilities may increase convenience, but they all bring some risk, whether
					direct risk from allowing unprivileged users to introduce arbitrary filesystems
					to a machine, or risk that software flaws in the automated mount facility itself
					will allow an attacker to compromise the system. <xhtml:br/><xhtml:br/> Use caution when enabling any such facility, and find out whether
					better configuration management or user education might solve the same problem
					with less risk. </description>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14089-7:Disable Mounting of cramfs</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14089-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20027"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14457-6:Disable Mounting of freevxfs</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14457-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20028"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14853-6:Disable Mounting of jffs2</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14853-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20029"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-15087-0:Disable Mounting of hfs</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-15087-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20030"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.e" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14093-9:Disable Mounting of hfsplus</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14093-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20031"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.f" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14118-4:Disable Mounting of squashfs</title>
					<description override="0">Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14118-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20032"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.2.5.g" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14871-8:Disable Mounting of udf</title>
					<description override="0"> Using the install command inside /etc/modprobe.conf instructs
							the kernel module loading system to run the command speciﬁed (here,
							/bin/true) instead of inserting the module in the kernel as normal. This
							effectively prevents usage of these uncommon ﬁlesystems.</description>
					<ident system="http://cce.mitre.org">CCE-14871-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20033"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Verify Permissions on Important Files and
					Directories</title>
				<description xml:lang="en-US" override="0"> Permissions for many files on a system should be set
					to conform to system policy. This section discusses important permission
					restrictions gshadow which should be checked on a regular basis to ensure that
					no harmful discrepancies have arisen.</description>
				<Group id="usgcb-rhel5desktop-group-2.2.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Verify Permissions on passwd, shadow, group and gshadow
						Files</title>
					<description xml:lang="en-US" override="0"> These are the default permissions for these
						files. Many utilities need read access to the passwd file in order to
						function properly, but read access to the shadow file allows malicious
						attacks against system passwords, and should never be enabled.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3918-0:Verify user who owns 'shadow' file</title>
						<description override="0">The /etc/shadow file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3918-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20034"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3988-3:Verify group who owns 'shadow' file</title>
						<description override="0">The /etc/shadow file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3988-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20035"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3276-3:Verify user who owns 'group' file</title>
						<description override="0">The /etc/group file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3276-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20036"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3883-6:Verify group who owns 'group' file</title>
						<description override="0">The /etc/group file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3883-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20037"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.e" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4210-1:Verify user who owns 'gshadow' file</title>
						<description override="0">The /etc/gshadow file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-4210-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20038"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.f" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4064-2:Verify group who owns 'gshadow' file</title>
						<description override="0">The /etc/gshadow file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-4064-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20039"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.g" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3958-6:Verify user who owns 'passwd' file</title>
						<description override="0">The /etc/passwd file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3958-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20040"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.h" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3495-9:Verify group who owns 'passwd' file</title>
						<description override="0">The /etc/passwd file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-3495-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20041"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.i" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4130-1:Verify permissions on 'shadow' file</title>
						<description override="0">File permissions for /etc/shadow should be set
							correctly.</description>
						<ident system="http://cce.mitre.org">CCE-4130-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20042"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.j" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3967-7:Verify permissions on 'group' file</title>
						<description override="0">File permissions for /etc/group should be set
							correctly.</description>
						<ident system="http://cce.mitre.org">CCE-3967-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20043"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.k" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3932-1:Verify permissions on 'gshadow' file</title>
						<description override="0">File permissions for /etc/gshadow should be set
							correctly.</description>
						<ident system="http://cce.mitre.org">CCE-3932-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20044"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.3.1.l" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3566-7:Verify permissions on 'passwd' file</title>
						<description override="0">File permissions for /etc/passwd should be set
							correctly.</description>
						<ident system="http://cce.mitre.org">CCE-3566-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20045"/>
						</check>
					</Rule>
				</Group>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3399-3:Verify that All World-Writable Directories Have Sticky Bits
						Set</title>
					<description override="0">When the so-called 'sticky bit' is set on a
					directory, only the owner of a given file may remove that file from the
					directory. Without the sticky bit, any user with write access to a directory
					may remove any file in the directory. Setting the sticky bit prevents users
					from removing each other's files. In cases where there is no reason for a
					directory to be world-writable, a better solution is to remove that
					permission rather than to set the sticky bit. However, if a directory is
					used by a particular application, consult that application's documentation
					instead of blindly changing modes.</description>
					<ident system="http://cce.mitre.org">CCE-3399-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20046"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3795-2:Find Unauthorized World-Writable Files</title>
					<description override="0">Data in world-writable files can be modified by
					any user on the system. In almost all circumstances, files can be configured
					using a combination of user and group permissions to support whatever
					legitimate access is needed without the risk caused by world-writable files. <xhtml:br/><xhtml:br/> It is generally a good idea to remove global (other) write
					access to a file when it is discovered. However, check with documentation
					for specific applications before making changes. Also, monitor for recurring
					world-writable files, as these may be symptoms of a misconfigured
					application or user account.</description>
					<ident system="http://cce.mitre.org">CCE-3795-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20047"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-14970-8:Find Unauthorized SGID System Executables</title>
					<description override="0">The sgid bit should not be set for all files.</description>
					<ident system="http://cce.mitre.org">CCE-14970-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20048"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.4.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-14340-4:Find Unauthorized SUID System Executables</title>
					<description override="0">The suid bit should not be set for all files.</description>
					<ident system="http://cce.mitre.org">CCE-14340-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20049"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4223-4:Find files unowned by a user</title>
					<description override="0">The following command will discover and print any
					files on local partitions which do not belong to a valid user and a valid
					group. Run it once for each local partition PART: <xhtml:code># find PART
						-xdev \( -nouser -o -nogroup \) -print </xhtml:code>If this command
					prints any results, investigate each reported file and either assign it to
					an appropriate user and group or remove it. Unowned files are not directly
					exploitable, but they are generally a sign that something is wrong with some
					system process. They may be caused by an intruder, by incorrect software
					installation or draft software removal, or by failure to remove all files
					belonging to a deleted account. The files should be repaired so that they
					will not cause problems when accounts are created in the future, and the
					problem which led to unowned files should be discovered and
					addressed.</description>
					<ident system="http://cce.mitre.org">CCE-4223-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20050"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.5.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3573-3:Find files unowned by a group</title>
					<description override="0">The following command will discover and print any
					files on local partitions which do not belong to a valid user and a valid
					group. Run it once for each local partition PART: <xhtml:code># find PART
						-xdev \( -nouser -o -nogroup \) -print </xhtml:code>If this command
					prints any results, investigate each reported file and either assign it to
					an appropriate user and group or remove it. Unowned files are not directly
					exploitable, but they are generally a sign that something is wrong with some
					system process. They may be caused by an intruder, by incorrect software
					installation or draft software removal, or by failure to remove all files
					belonging to a deleted account. The files should be repaired so that they
					will not cause problems when accounts are created in the future, and the
					problem which led to unowned files should be discovered and
					addressed.</description>
					<ident system="http://cce.mitre.org">CCE-3573-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20051"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.2.3.6.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14794-2:Find world writable directories not owned by a system account</title>
					<description override="0"> Locate any directories in local partitions which
					are world-writable and ensure that they are owned by root or another system
					account. The following command will discover and print these (assuming only
					system accounts have a uid lower than 500). Run it once for each local
					partition PART:<xhtml:br/><xhtml:br/><xhtml:code># find PART -xdev -type d -perm -0002 -uid +500
						-print<xhtml:br/></xhtml:code><xhtml:br/> If this command produces any output, investigate why the current
					owner is not root or another system account.<xhtml:br/><xhtml:br/> Allowing a user account to own a world-writeable directory is
					undesirable because it allows the owner of that directory to remove or
					replace any ﬁles that may be placed in the directory by other
					users.</description>
					<ident system="http://cce.mitre.org">CCE-14794-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20052"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.2.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Restrict Programs from Dangerous Execution Patterns</title>
				<description xml:lang="en-US" override="0"> The recommendations in this section provide broad
					protection against information disclosure or other misbehavior. These
					protections are applied at the system initialization or kernel level, and defend
					against certain types of badly-configured or compromised programs.</description>
				<Group id="usgcb-rhel5desktop-group-2.2.4.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Daemon umask</title>
					<description xml:lang="en-US" override="0"> The settings file /etc/sysconfig/init contains
						settings which apply to all processes started at boot time. The system umask
						must be set to at least 022, or daemon processes may create world-writable
						files. The more restrictive setting 027 protects files, including temporary
						files and log files, from unauthorized reading by unprivileged users on the
						system. <xhtml:br/><xhtml:br/> If a particular daemon needs a less restrictive umask, consider
						editing the startup script or sysconfig file of that daemon to make a
						specific exception. </description>
					<Value id="usgcb-rhel5desktop-var-2.2.4.1.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">daemon umask</title>
						<description override="0">Enter umask for daemons</description>
						<value selector="">027</value>
						<value selector="022">022</value>
						<value selector="027">027</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.2.4.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4220-0:Set Daemon umask</title>
						<description override="0">The daemon umask should be set as appropriate</description>
						<ident system="http://cce.mitre.org">CCE-4220-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.2.4.1.a" export-name="oval:gov.nist.usgcb.rhel:var:20053"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20053"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.2.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Core Dumps</title>
					<description xml:lang="en-US" override="0"> A core dump file is the memory image of an
						executable program when it was terminated by the operating system due to
						errant behavior. In most cases, only software developers would legitimately
						need to access these files. The core dump files may also contain sensitive
						information, or unnecessarily occupy large amounts of disk space. <xhtml:br/><xhtml:br/> By default, the system sets a soft limit to stop the creation of
						core dump files for all users. This is accomplished in /etc/profile with the
						line: ulimit -S -c 0 &gt; /dev/null 2$gt;&amp;1 However, compliance with
						this limit is voluntary; it is a default intended only to protect users from
						the annoyance of generating unwanted core files. Users can increase the
						allowed core file size up to the hard limit, which is unlimited by default. <xhtml:br/><xhtml:br/> Once a hard limit is set in /etc/security/limits.conf, the user
						cannot increase that limit within his own session. If access to core dumps
						is required, consider restricting them to only certain users or groups. See
						the limits.conf man page for more information. <xhtml:br/><xhtml:br/> The core dumps of setuid programs are further protected. The
						sysctl variable fs.suid_dumpable controls whether the kernel allows core
						dumps from these programs at all. The default value of 0 is recommended. </description>
					<Rule id="usgcb-rhel5desktop-rule-2.2.4.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4225-9:Disable Core Dumps for all users</title>
						<description override="0">Core dumps for all users should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4225-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20055"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.4.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4247-3:Disable Core Dumps for SUID programs</title>
						<description override="0">Core dumps for setuid programs should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4247-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20056"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.2.4.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable ExecShield</title>
					<description xml:lang="en-US" override="0"> ExecShield comprises a number of kernel features
						to provide protection against buffer overflows. These features include
						random placement of the stack and other memory regions, prevention of
						execution in memory that should only hold data, and special handling of text
						buffers. This protection is enabled by default, but the sysctl variables
						kernel.exec-shield and kernel.randomize va space should be checked to ensure
						that it has not been disabled. <xhtml:br/><xhtml:br/> ExecShield uses the segmentation feature on all x86 systems to
						prevent execution in memory higher than a certain address. It writes an
						address as a limit in the code segment descriptor, to control where code can
						be executed, on a per-process basis. When the kernel places a process's
						memory regions such as the stack and heap higher than this address, the
						hardware prevents execution there. However, this cannot always be done for
						all memory regions in which execution should not occur, so follow guidance
						in Section 2.2.4.4 to further protect the system. </description>
					<Rule id="usgcb-rhel5desktop-rule-2.2.4.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4168-1:Enable ExecShield</title>
						<description override="0">ExecShield should be enabled</description>
						<ident system="http://cce.mitre.org">CCE-4168-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20057"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.2.4.3.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4146-7:Enable ExecShield randomized placement of virtual memory
							regions</title>
						<description override="0">ExecShield randomized placement of virtual memory regions
							should be enabled</description>
						<ident system="http://cce.mitre.org">CCE-4146-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20058"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.2.4.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable Execute Disable (XD) or No Execute (NX) Support
						on x86 Systems</title>
					<description xml:lang="en-US" override="0"> Recent processors in the x86 family support the
						ability to prevent code execution on a per memory page basis. Generically
						and on AMD processors, this ability is called No Execute (NX), while on
						Intel processors it is called Execute Disable (XD). This ability can help
						prevent exploitation of buffer overflow vulnerabilities and should be
						activated whenever possible. Extra steps must be taken to ensure that this
						protection is enabled, particularly on 32-bit x86 systems. Other processors,
						such as Itanium and POWER, have included such support since inception and
						the standard kernel for those platforms supports the feature.</description>
					<Group id="usgcb-rhel5desktop-group-2.2.4.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Install New Kernel on Supported x86 Systems</title>
						<description xml:lang="en-US" override="0"> Systems that are using the 64-bit x86 kernel
							package do not need to install the kernel-PAE package because the 64-bit
							x86 kernel already includes this support. However, if the system is
							running 32-bit kernel package supports PAE and NX features as determined
							in the previous section, the kernel-PAE package should be installed to
							enable XD or NX support:<xhtml:br/><xhtml:br/><xhtml:code># yum install kernel-PAE</xhtml:code><xhtml:br/><xhtml:br/> The installation process should also have conﬁgured the
							bootloader to load the new kernel at boot. Verify this at reboot and
							modify /etc/grub.conf if necessary.</description>
						<warning xml:lang="en-US" category="hardware" override="0">The kernel-PAE package should
							not be installed on older systems that do not support the XD or NX bit,
							as this may prevent them from booting.</warning>
						<Rule id="usgcb-rhel5desktop-rule-2.2.4.4.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4172-3:Install New Kernel on Supported x86 Systems</title>
							<description override="0">Kernel support for the XD/NX processor feature should be
								enabled</description>
							<ident system="http://cce.mitre.org">CCE-4172-3</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20059"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Account and Access Control</title>
			<description xml:lang="en-US" override="0"> In traditional Unix security, if an attacker gains shell
				access to a certain login account, he can perform any action or access any file to
				which that account has access. Therefore, making it more difficult for unauthorized
				people to gain shell access to accounts, particularly to privileged accounts, is a
				necessary part of securing a system. This section introduces mechanisms for
				restricting access to accounts under RHEL5.</description>
			<Group id="usgcb-rhel5desktop-group-2.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Protect Accounts by Restricting Password-Based Login</title>
				<description xml:lang="en-US" override="0"> Conventionally, Unix shell accounts are accessed by
					providing a username and password to a login program, which tests these values
					for correctness using the /etc/passwd and /etc/shadow files. Password-based
					login is vulnerable to guessing of weak passwords, and to sniffing and
					man-in-the-middle attacks against passwords entered over a network or at an
					insecure console. Therefore, mechanisms for accessing accounts by entering
					usernames and passwords should be restricted to those which are operationally
					necessary.</description>
				<Group id="usgcb-rhel5desktop-group-2.3.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Restrict Root Logins to System Console</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/securetty. Ensure that the
						file contains only the following lines: <xhtml:br/><xhtml:ul>
							<xhtml:li>The primary system console device:
								<xhtml:br/>console</xhtml:li>
							<xhtml:li>The virtual console devices: <xhtml:br/>tty1 tty2 tty3 tty4
								tty5 tty6 ... </xhtml:li>
							<xhtml:li>If required by your organization, the deprecated virtual
								console interface may be retained for backwards
								compatibility:<xhtml:br/>vc/1 vc/2 vc/3 vc/4 vc/5 vc/6
								...</xhtml:li>
							<xhtml:li>If required by your organization, the serial consoles may be
								added:<xhtml:br/> ttyS0 ttyS1</xhtml:li>
						</xhtml:ul> Direct root logins should be allowed only for emergency use. In
						normal situations, the administrator should access the system via a unique
						unprivileged account, and use su or sudo to execute privileged commands.
						Discouraging administrators from accessing the root account directly ensures
						an audit trail in organizations with multiple administrators. Locking down
						the channels through which root can connect directly reduces opportunities
						for password-guessing against the root account. The login program uses the
						file /etc/securetty to determine which interfaces should allow root logins.
						The virtual devices /dev/console and /dev/tty* represent the system consoles
						(accessible via the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a
						default installation). The default securetty file also contains /dev/vc/*.
						These are likely to be deprecated in most environments, but may be retained
						for compatibility. Root should also be prohibited from connecting via
						network protocols. See Section 3.5 for instructions on preventing root from
						logging in via SSH.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3485-0:Restrict virtual console Root Logins</title>
						<description override="0">Logins through the virtual console devices should be
							disabled</description>
						<ident system="http://cce.mitre.org">CCE-3485-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20063"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4256-4:Restrict serial port Root Logins</title>
						<description override="0">Login prompts on serial ports should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4256-4</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20064"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">The wheel group should exist</title>
					<description xml:lang="en-US" override="0"><xhtml:ol>
							<xhtml:li>Ensure that the group wheel exists, and that the usernames of
								all administrators who should be allowed to execute commands as root
								are members of that group. <xhtml:br/><xhtml:br/><xhtml:code># grep ^wheel /etc/group</xhtml:code></xhtml:li>
							<xhtml:li>Edit the file /etc/pam.d/su. Add, uncomment, or correct the
								line: <xhtml:br/><xhtml:code>auth required pam_wheel.so use_uid</xhtml:code></xhtml:li>
						</xhtml:ol> The su command allows a user to gain the privileges of another
						user by entering the password for that user's account. It is desirable to
						restrict the root user so that only known administrators are ever allowed to
						access the root account. This restricts password-guessing against the root
						account by unauthorized users or by accounts which have been compromised. <xhtml:br/><xhtml:br/> By convention, the group wheel contains all users who are
						allowed to run privileged commands. The PAM module pam_wheel.so is used to
						restrict root access to this set of users.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14088-9:Limit su Access to the Root Account</title>
						<description override="0">Limit su Access to the Root Account</description>
						<ident system="http://cce.mitre.org">CCE-14088-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20065"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-15047-4:Limit su Access to the wheel group</title>
						<description override="0">Command access to the root account should be restricted to the
							wheel group.</description>
						<ident system="http://cce.mitre.org">CCE-15047-4</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20066"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Block Shell and Login Access for Non-Root System
						Accounts</title>
					<description xml:lang="en-US" override="0"> Using /etc/passwd, obtain a listing of all users,
						their UIDs, and their shells, for instance by running: <xhtml:br/><xhtml:br/><xhtml:code># awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd<xhtml:br/></xhtml:code><xhtml:br/> Identify the system accounts from this listing. These will
						primarily be the accounts with UID numbers less than 500, other than root.<xhtml:br/><xhtml:br/> For each identified system account SYSACCT , lock the account: <xhtml:br/><xhtml:br/><xhtml:code># usermod -L SYSACCT <xhtml:br/></xhtml:code> and disable its shell: <xhtml:br/><xhtml:br/><xhtml:code># usermod -s /sbin/nologin SYSACCT <xhtml:br/></xhtml:code><xhtml:br/> These are the accounts which are not associated with a human
						user of the system, but which exist to perform some administrative function.
						Make it more difficult for an attacker to use these accounts by locking
						their passwords and by setting their shells to some non-valid shell. The
						RHEL5 default non-valid shell is /sbin/nologin, but any command which will
						exit with a failure status and disallow execution of any further commands,
						such as /bin/false or /dev/null, will work.</description>
					<warning xml:lang="en-US" category="functionality" override="0">Do not perform the steps in
						this section on the root account. Doing so might cause the system to become
						inaccessible.</warning>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3987-5:Block Shell and Login Access for Non-Root System Accounts</title>
						<description override="0">Login access to non-root system accounts should be
							disabled</description>
						<ident system="http://cce.mitre.org">CCE-3987-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20068"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Verify Proper Storage and Existence of Password
						Hashes</title>
					<description override="0">TODO::INSERT</description>
					<Group id="usgcb-rhel5desktop-group-2.3.1.5.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Verify that No Accounts Have Empty Password
							Fields</title>
						<description xml:lang="en-US" override="0"> Run the command: <xhtml:br/><xhtml:br/><xhtml:code># awk -F: '($2 == "") {print}' /etc/shadow <xhtml:br/></xhtml:code><xhtml:br/> If this produces any output, fix the problem by locking each
							account (see Section 2.3.1.4 above) or by setting a password. <xhtml:br/><xhtml:br/> If an account has an empty password, anybody may log in and
							run commands with the privileges of that account. Accounts with empty
							passwords should never be used in operational
							environments.</description>
						<Rule id="usgcb-rhel5desktop-rule-2.3.1.5.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4238-2:Verify that No Accounts Have Empty Password Fields</title>
							<description override="0">Login access to accounts without passwords should be
								disabled</description>
							<ident system="http://cce.mitre.org">CCE-4238-2</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20069"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.3.1.5.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Verify that All Account Password Hashes are
							Shadowed</title>
						<description xml:lang="en-US" override="0"> To ensure that no password hashes are stored
							in /etc/passwd, the following command should have no output:<xhtml:br/><xhtml:br/><xhtml:code># awk -F: '($2 != "x") {print}' /etc/passwd<xhtml:br/></xhtml:code><xhtml:br/> The hashes for all user account passwords should be stored
							in the ﬁle /etc/shadow and never in /etc/passwd, which is readable by
							all users. </description>
						<Rule id="usgcb-rhel5desktop-rule-2.3.1.5.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14300-8:Verify that All Account Password Hashes are Shadowed</title>
							<description override="0">Check that passwords are shadowed</description>
							<ident system="http://cce.mitre.org">CCE-14300-8</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200695"/>
							</check>
						</Rule>
					</Group>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Verify that No Non-Root Accounts Have UID 0</title>
					<description xml:lang="en-US" override="0"> This command will print all password file entries
						for accounts with UID 0: <xhtml:br/><xhtml:br/><xhtml:code># awk -F: '($3 == "0") {print}' /etc/passwd <xhtml:br/></xhtml:code><xhtml:br/> This should print only one line, for the user root. If any other
						lines appear, ensure that these additional UID-0 accounts are authorized,
						and that there is a good reason for them to exist. <xhtml:br/><xhtml:br/> In general, the best practice solution for auditing use of the
						root account is to restrict the set of cases in which root must be accessed
						anonymously by requiring use of su or sudo in almost all cases. Some sites
						choose to have more than one account with UID 0 in order to differentiate
						between administrators, but this practice may have unexpected side effects,
						and is therefore not recommended.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.6.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4009-7:Verify that No Non-Root Accounts Have UID 0</title>
						<description override="0">Anonymous root logins should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4009-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20070"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Password Expiration Parameters</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/login.defs to specify password
						expiration settings for new accounts. Add or correct the following lines: <xhtml:br/><xhtml:br/><xhtml:code> PASS_MAX_DAYS=180<xhtml:br/> PASS_MIN_DAYS=7 <xhtml:br/>
							PASS_MIN_LEN=8 <xhtml:br/> PASS_WARN_AGE=7 <xhtml:br/></xhtml:code><xhtml:br/> For each existing human user USER , modify the current
						expiration settings to match these: <xhtml:br/><xhtml:code># chage -M 180 -m 7 -W 7 USER<xhtml:br/></xhtml:code><xhtml:br/> Users should be forced to change their passwords, in order to
						decrease the utility of compromised passwords. However, the need to change
						passwords often should be balanced against the risk that users will reuse or
						write down passwords if forced to change them too often. Forcing password
						changes every 90-360 days, depending on the environment, is recommended. Set
						the appropriate value as PASS_MAX_DAYS and apply it to existing accounts
						with the -M flag. <xhtml:br/><xhtml:br/> The PASS_MIN_DAYS (-m) setting prevents password changes for 7
						days after the first change, to discourage password cycling. If you use this
						setting, train users to contact an administrator for an emergency password
						change in case a new password becomes compromised. The PASS_WARN_AGE (-W)
						setting gives users 7 days of warnings at login time that their passwords
						are about to expire.<xhtml:br/><xhtml:br/> The PASS_MIN_LEN setting, which controls minimum password
						length, should be set to whatever is required by your site or organization
						security policy. The example value of 8 provided here may be inadequate for
						many environments. See Section 2.3.3 for information on how to enforce more
						sophisticated requirements on password length and quality </description>
					<Value id="usgcb-rhel5desktop-var-2.3.1.7.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title xml:lang="en-US" override="0">minimum password length</title>
						<description xml:lang="en-US" override="0">Minimum number of characters in
							password</description>
						<warning override="0" category="general">This will only check new passwords</warning>
						<value selector="">14</value>
						<value selector="6">6</value>
						<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
						<value selector="8">8</value>
						<value selector="10">10</value>
						<value selector="12">12</value>
						<value selector="14">14</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.7.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4154-1:Set password minimum length</title>
						<description xml:lang="en-US" override="0">The password minimum length should be set
							appropriately</description>
						<ident system="http://cce.mitre.org">CCE-4154-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.1.7.a" export-name="oval:gov.nist.usgcb.rhel:var:20071"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20071"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.7.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4180-6:Set minimum password age</title>
						<description override="0">The minimum password age should be set
							appropriately</description>
						<ident system="http://cce.mitre.org">CCE-4180-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20072"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.7.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4092-3:Set maximum password age</title>
						<description override="0">The maximum password age should be set to: <sub idref="usgcb-rhel5desktop-var-2.3.1.7.c"/></description>
						<ident system="http://cce.mitre.org">CCE-4092-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20073"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.7.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4097-2:Set password warn age</title>
						<description override="0">The password warn age should be set to: <sub idref="usgcb-rhel5desktop-var-2.3.1.7.d"/></description>
						<ident system="http://cce.mitre.org">CCE-4097-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20074"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.1.8" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Remove Legacy + Entries from Password Files</title>
					<description xml:lang="en-US" override="0"> The command: <xhtml:br/><xhtml:br/><xhtml:code># grep "^+:" /etc/passwd /etc/shadow /etc/group<xhtml:br/></xhtml:code><xhtml:br/> should produce no output. <xhtml:br/><xhtml:br/> The + symbol was used by systems to include data from NIS maps
						into existing files. However, a certain configuration error in which a NIS
						inclusion line appears in /etc/passwd, but NIS is not running, could lead to
						anyone being able to access the system with the username + and no password.
						Therefore, it is important to verify that no such line appears in any of the
						relevant system files. <xhtml:br/><xhtml:br/> The correct way to tell the local system to consult network
						databases such as LDAP or NIS for user information is to make appropriate
						modifications to /etc/nsswitch.conf.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.8.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14071-5:Remove Legacy + Entries from /etc/shadow</title>
						<description override="0">NIS file inclusions should be set appropriately in the
							/etc/shadow file</description>
						<ident system="http://cce.mitre.org">CCE-14071-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20075"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.1.8.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14675-3:Remove Legacy + Entries from /etc/group</title>
						<description override="0">NIS file inclusions should be set appropriately in the
							/etc/group file</description>
						<ident system="http://cce.mitre.org">CCE-14675-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20076"/>
						</check>
					</Rule>	
				<Rule id="usgcb-rhel5desktop-rule-2.3.1.8.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4114-5:Remove Legacy + Entries from /etc/passwd</title>
						<description override="0">NIS file inclusions should be set appropriately in the
							/etc/passwd file</description>
						<ident system="http://cce.mitre.org">CCE-4114-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20077"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.3.1.9" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Set Accounts to Disable After Password Expiration</title>
				<description xml:lang="en-US" override="0">The /etc/default/useradd file contains the INACTIVE configuration option. For example, when INACTIVE = 30 and the password is on the verge of expiration, then 30 days remain before the account will become automatically disabled.</description>
				<Rule id="usgcb-rhel5desktop-rule-2.3.1.9.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<version update="1"/>
					<title override="0">User accounts may or may not be inactivated a specified number of days after account expiration.</title>
					<description override="0">/etc/default/useradd shouls set INACTIVE=30</description>
					<ident system="http://cce.mitre.org">CCE-18412-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:99900"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.3.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Protect Accounts by Configuring PAM</title>
				<description xml:lang="en-US" override="0"> PAM, or Pluggable Authentication Modules, is a system
					which implements modular authentication for Linux programs. PAM is
					well-integrated into Linux's authentication architecture, making it difficult to
					remove, but it can be configured to minimize your system's exposure to
					unnecessary risk. This section contains guidance on how to accomplish that, and
					how to ensure that the modules used by your PAM configuration do what they are
					supposed to do. <xhtml:br/><xhtml:br/> PAM is implemented as a set of shared objects which are loaded and
					invoked whenever an application wishes to authenticate a user. Typically, the
					application must be running as root in order to take advantage of PAM.
					Traditional privileged network listeners (e.g. sshd) or SUID programs (e.g.
					sudo) already meet this requirement. An SUID root application, userhelper, is
					provided so that programs which are not SUID or privileged themselves can still
					take advantage of PAM. <xhtml:br/><xhtml:br/> PAM looks in the directory /etc/pam.d for application-specific
					configuration information. For instance, if the program login attempts to
					authenticate a user, then PAM's libraries follow the instructions in the file
					/etc/ pam.d/login to determine what actions should be taken. <xhtml:br/><xhtml:br/>One very important file in /etc/pam.d is /etc/pam.d/system-auth. This
					file, which is included by many other PAM configuration files, defines 'default'
					system authentication measures. Modifying this file is a good way to make
					far-reaching authentication changes, for instance when implementing a
					centralized authentication service. </description>
				<warning xml:lang="en-US" override="0" category="general"> Be careful when making changes to PAM's configuration
					files. The syntax for these files is complex, and modifications can have
					unexpected consequences.1 The default configurations shipped with applications
					should be sufficient for most users. </warning>
				<warning xml:lang="en-US" override="0" category="general"> Running authconfig or system-config-authentication will
					re-write the PAM configuration files, destroying any manually made changes and
					replacing them with a series of system defaults. 1One reference to the
					configuration file syntax can be found at
					http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/
					sag-configuration-file.html. </warning>
				<Group id="usgcb-rhel5desktop-group-2.3.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Password Quality Requirements</title>
					<description xml:lang="en-US" override="0"> The default pam_cracklib PAM module provides
						strength checking for passwords. It performs a number of checks, such as
						making sure passwords are not similar to dictionary words, are of at least a
						certain length, are not the previous password reversed, and are not simply a
						change of case from the previous password. It can also require passwords to
						be in certain character classes.<xhtml:br/><xhtml:br/> The pam_passwdqc PAM module provides the ability to enforce even
						more stringent password strength requirements. It is provided in an RPM of
						the same name. <xhtml:br/><xhtml:br/> The man pages pam_cracklib(8) and pam_passwdqc(8) provide
						information on the capabilities and configuration of each. </description>
					<Group id="usgcb-rhel5desktop-group-2.3.3.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Set Password Quality Requirements, if using
							pam_cracklib</title>
						<description xml:lang="en-US" override="0"> The pam_cracklib PAM module can be conﬁgured
							to meet recommendations for DoD systems as stated in [12].<xhtml:br/><xhtml:br/> To conﬁgure pam_cracklib to require at least one uppercase
							character, lowercase character, digit, and other (special) character,
							locate the following line in /etc/pam.d/system-auth:<xhtml:br/><xhtml:br/> password requisite pam_cracklib.so try_first_pass retry=3<xhtml:br/><xhtml:br/> and then alter it to read:<xhtml:br/><xhtml:br/> password required pam_cracklib.so try_first_pass retry=3
							minlen=14 dcredit=-1 / ucredit=-1 ocredit=-1 lcredit=0<xhtml:br/><xhtml:br/> If necessary, modify the arguments to ensure compliance with
							your organization’s security policy. </description>
						<warning xml:lang="en-US" override="0" category="general">Note that the password quality requirements are
							not enforced for the root account for some reason. </warning>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.retry" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">retry</title>
							<description xml:lang="en-US" override="0">Number of retry attempts before erroring
								out</description>
							<value selector="">3</value>
							<value selector="1">1</value>
							<value selector="2">2</value>
							<value selector="3">3</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.minlen" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">minlen</title>
							<description xml:lang="en-US" override="0">Minimum number of characters in
								password</description>
							<value selector="">12</value>
							<value selector="6">6</value>
							<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
							<value selector="8">8</value>
							<value selector="10">10</value>
							<value selector="12">12</value>
							<value selector="14">14</value>
							<value selector="15">15</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.dcredit" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">dcredit</title>
							<description xml:lang="en-US" override="0">Mininum number of digits in
								password</description>
							<value selector="">-2</value>
							<value selector="2">-2</value>
							<value selector="1">-1</value>
							<value selector="0">0</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.ocredit" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">ocredit</title>
							<description xml:lang="en-US" override="0">Mininum number of other (special
								characters) in password</description>
							<value selector="">-2</value>
							<value selector="2">-2</value>
							<value selector="1">-1</value>
							<value selector="0">0</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.lcredit" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">lcredit</title>
							<description xml:lang="en-US" override="0">Mininum number of lower case in
								password</description>
							<value selector="">-2</value>
							<value selector="2">-2</value>
							<value selector="1">-1</value>
							<value selector="0">0</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.ucredit" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">ucredit</title>
							<description xml:lang="en-US" override="0">Mininum number of upper case in
								password</description>
							<value selector="">-2</value>
							<value selector="2">-2</value>
							<value selector="1">-1</value>
							<value selector="0">0</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.3.3.1.1.difok" type="number" prohibitChanges="false" abstract="false" operator="equals" hidden="false" interactive="0">
							<title xml:lang="en-US" override="0">difok</title>
							<description xml:lang="en-US" override="0">Mininum number of characters not present
								in old password</description>
							<warning xml:lang="en-US" override="0" category="general">Keep this high for short passwords</warning>
							<value selector="">5</value>
							<value selector="2">2</value>
							<value selector="3">3</value>
							<value selector="4">4</value>
							<value selector="5">5</value>
						</Value>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-15054-0:Set Password retry Requirements</title>
							<description override="0">The password retry should meet minimum
								requirements</description>
							<ident system="http://cce.mitre.org">CCE-15054-0</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.retry" export-name="oval:gov.nist.usgcb.rhel:var:200781"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200781"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14113-5:The password strength parameters should require a minimum number of digits</title>
							<description override="0">The password dcredit should meet minimum
								requirements</description>
							<ident system="http://cce.mitre.org">CCE-14113-5</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.dcredit" export-name="oval:gov.nist.usgcb.rhel:var:141130"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:141130"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14672-0:The password strength parameters should require a minimum number of uppercase characters</title>
							<description override="0">The password ucredit should meet minimum
								requirements</description>
							<ident system="http://cce.mitre.org">CCE-14672-0</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.ucredit" export-name="oval:gov.nist.usgcb.rhel:var:200784"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200784"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.e" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14122-6:The password strenght parameters should require a minimum number of special characters</title>
							<description override="0">The password strenght parameters should require a minimum number of special characters</description>
							<ident system="http://cce.mitre.org">CCE-14122-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.ocredit" export-name="oval:gov.nist.usgcb.rhel:var:200785"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200785"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.f" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14712-4:Set Password lcredit Requirements</title>
							<description override="0">The password strenght parameters should require a minimum number of lowercase characters</description>
							<ident system="http://cce.mitre.org">CCE-14712-4</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.lcredit" export-name="oval:gov.nist.usgcb.rhel:var:200786"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200786"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.3.1.1.g" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14701-7:The password strength parameters should require new passwords to difer from old ones by a minimum number of characters</title>
							<description override="0">The password difok should meet minimum
								requirements</description>
							<ident system="http://cce.mitre.org">CCE-14701-7</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.3.1.1.difok" export-name="oval:gov.nist.usgcb.rhel:var:200787"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200787"/>
							</check>
						</Rule>
					</Group>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Lockouts for Failed Password Attempts</title>
					<description xml:lang="en-US" override="0"> The pam_tally2 PAM module provides the capability
						to lock out user accounts after a number of failed login attempts. Its
						documentation is available in
						/usr/share/doc/pam-version/txts/README.pam_tally2. <xhtml:br/><xhtml:br/> If locking out accounts after a number of incorrect login
						attempts is required by your security policy, implement use of pam_tally2.so
						for the relevant PAM-aware programs such as login, sshd, and vsftpd. <xhtml:br/><xhtml:br/> Find the following line in /etc/pam.d/system-auth: <xhtml:br/><xhtml:br/> auth sufficient pam_unix.so nullok try_first_pass <xhtml:br/><xhtml:br/> and then change it so that it reads as follows: <xhtml:br/><xhtml:br/> auth required pam_unix.so nullok try_first_pass <xhtml:br/><xhtml:br/> In the same file, comment out or delete the lines: <xhtml:br/><xhtml:br/> auth requisite pam_succeed_if.so uid &gt;= 500 quiet <xhtml:br/>
						auth required pam_deny.so <xhtml:br/><xhtml:br/> To enforce password lockout, add the following to the individual
						programs' configuration files in /etc/pam.d. First, add to end of the auth
						lines: <xhtml:br/><xhtml:br/> auth required pam_tally2.so deny=5 onerr=fail <xhtml:br/><xhtml:br/> Second, add to the end of the account lines: <xhtml:br/><xhtml:br/> account required pam_tally2.so<xhtml:br/><xhtml:br/> Adjust the deny argument to conform to your system security
						policy. The pam_tally2 utility can be used to unlock user accounts as
						follows: <xhtml:br/><xhtml:br/><xhtml:code># /sbin/pam_tally2 --user username --reset <xhtml:br/></xhtml:code></description>
					<warning xml:lang="en-US" override="0" category="general"> Locking out user accounts presents the risk of a
						denial-of-service attack. The security policy regarding system lockout must
						weigh whether the risk of such a denial-of-service attack outweighs the
						benefits of thwarting password guessing attacks. The pam_tally2 utility can
						be run from a cron job on a hourly or daily basis to try and offset this
						risk. </warning>
					<Rule id="usgcb-rhel5desktop-rule-2.3.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-3410-8:Set deny for Failed Password Attempts</title>
						<description override="0">The deny policy should meet minimum requirements.</description>
						<ident system="http://cce.mitre.org">CCE-3410-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200801"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.3.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Upgrade Password Hashing Algorithm to SHA-512</title>
					<description xml:lang="en-US" override="0"> The default algorithm for storing password hashes
						in /etc/shadow is MD5. In release 5.2 (and for those systems fully updated
						since its release), the algorithms SHA-256 and SHA-512 are available.<xhtml:br/><xhtml:br/> In order to conﬁgure the system to use the SHA-512 algorithm,
						issue the command: <xhtml:br/><xhtml:br/><xhtml:code># /usr/sbin/authconfig --passalgo=sha512 --update<xhtml:br/></xhtml:code><xhtml:br/> When users changes their passwords, hashes for the new passwords
						will be generated using the SHA-512 algorithm.<xhtml:br/><xhtml:br/> The release notes available at
						http://www.redhat.com/docs/en-US/Red_Hat_
						Enterprise_Linux/5.2/html/Release_Notes/singles/relnotesU2-x86.html document
						this change. As noted there, only kickstart-installed systems can be
						conﬁgured to begin operation with this algorithm. Other systems will need to
						have this command issued and then all accounts will need to perform a
						password change in order to upgrade the stored hashes to the stronger
						algorithm. </description>
					<Value id="usgcb-rhel5desktop-var-2.3.3.5.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">Password hashing algorithm</title>
						<description xml:lang="en-US" override="0">Enter /etc/shadow password hashing
							algorithm</description>
						<value selector="">sha512</value>
						<value selector="MD5">md5</value>
						<value selector="SHA-256">sha256</value>
						<value selector="SHA-512">sha512</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.3.3.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14063-2:Set Password hashing algorithm</title>
						<description override="0">The password hashing algorithm should be set to
							SHA-512</description>
						<ident system="http://cce.mitre.org">CCE-14063-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.3.5.a" export-name="oval:gov.nist.usgcb.rhel:var:20083"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20083"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.3.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Limit Password Reuse</title>
					<description xml:lang="en-US" override="0"> Do not allow users to reuse recent passwords.
						This can be accomplished by using the remember option for the pam_unix PAM
						module. In order to prevent a user from re-using any of his or her last 5
						passwords, append remember=5 to the password line which uses the pam_unix
						module in the ﬁle /etc/pam.d/system-auth, as shown:<xhtml:br/><xhtml:br/> password sufficient pam_unix.so existing_options remember=5<xhtml:br/><xhtml:br/> Old (and thus no longer valid) passwords are stored in the ﬁle
						/etc/security/opasswd. </description>
					<Value id="usgcb-rhel5desktop-var-2.3.3.6.a" type="number" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">remember</title>
						<description xml:lang="en-US" override="0"> The last n passwords for each user are saved
							in /etc/security/opasswd in order to force password change history and
							keep the user from alternating between the same password too frequently. </description>
						<value selector="">5</value>
						<value selector="0">0</value>
						<value selector="5">5</value>
						<value selector="10">10</value>
						<value selector="24">24</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.3.3.6.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14939-3:Limit password reuse</title>
						<description override="0">The passwords to remember should be set to: <sub idref="usgcb-rhel5desktop-var-2.3.3.6.a"/></description>
						<ident system="http://cce.mitre.org">CCE-14939-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.3.6.a" export-name="oval:gov.nist.usgcb.rhel:var:20084"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20084"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.3.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Secure Session Configuration Files for Login
					Accounts</title>
				<description xml:lang="en-US" override="0"> When a user logs into a Unix account, the system
					configures the user's session by reading a number of files. Many of these files
					are located in the user's home directory, and may have weak permissions as a
					result of user error or misconfiguration. If an attacker can modify or even read
					certain types of account configuration information, he can often gain full
					access to the affected user's account. Therefore, it is important to test and
					correct configuration file permissions for interactive accounts, particularly
					those of privileged users such as root or system administrators.</description>
				<Group id="usgcb-rhel5desktop-group-2.3.4.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Ensure that No Dangerous Directories Exist in Roots Path
						'</title>
					<description xml:lang="en-US" override="0"> The active path of the root account can be
						obtained by starting a new root shell and running: <xhtml:br/><xhtml:br/><xhtml:code># echo $PATH <xhtml:br/></xhtml:code> This will produce a colon-separated list of directories in the
						path. For each directory DIR in the path, ensure that DIR is not equal to a
						single . character. Also ensure that there are no 'empty' elements in the
						path, such as in these examples: <xhtml:br/><xhtml:br/><xhtml:code>PATH=:/bin <xhtml:br/> PATH=/bin: <xhtml:br/> PATH=/bin::/sbin
							<xhtml:br/></xhtml:code><xhtml:br/> These empty elements have the same effect as a single .
						character. <xhtml:br/><xhtml:br/> For each element in the path, run: <xhtml:br/><xhtml:br/><xhtml:code># ls -ld DIR <xhtml:br/></xhtml:code><xhtml:br/> and ensure that write permissions are disabled for group and
						other. <xhtml:br/><xhtml:br/> It is important to prevent root from executing unknown or
						untrusted programs, since such programs could contain malicious code.
						Therefore, root should not run programs installed by unprivileged users.
						Since root may often be working inside untrusted directories, the .
						character, which represents the current directory, should never be in the
						root path, nor should any directory which can be written to by an
						unprivileged or semi-privileged (system) user. <xhtml:br/><xhtml:br/> It is a good practice for administrators to always execute
						privileged commands by typing the full path to the command.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3301-9:The PATH variable should be set correctly for user root</title>
						<description override="0">The PATH variable should be set correctly for user
							root</description>
						<ident system="http://cce.mitre.org">CCE-3301-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20085"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14957-5:The path variable for ROOT does not include any world-writable or group-writable directories</title>
						<description override="0">Check each directory in root's path and make use it does not
							grant write permission to group and other</description>
						<ident system="http://cce.mitre.org">CCE-14957-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:200855"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Ensure that User Home Directories are not Group-Writable
						or World-Readable</title>
					<description xml:lang="en-US" override="0"> For each human user USER of the system, view the
						permissions of the user's home directory: <xhtml:br/><xhtml:br/><xhtml:code># ls -ld /home/USER <xhtml:br/></xhtml:code><xhtml:br/> Ensure that the directory is not group-writable and that it is
						not world-readable. If necessary, repair the permissions:<xhtml:br/><xhtml:br/><xhtml:code># chmod g-w /home/USER <xhtml:br/> # chmod o-rwx /home/USER
							<xhtml:br/></xhtml:code><xhtml:br/> User home directories contain many configuration files which
						affect the behavior of a user's account. No user should ever have write
						permission to another user's home directory. Group shared directories can be
						configured in subdirectories or elsewhere in the filesystem if they are
						needed. Typically, user home directories should not be world-readable. If a
						subset of users need read access to one another's home directories, this can
						be provided using groups.</description>
					<warning xml:lang="en-US" override="0" category="general">Sections 2.3.4.2–2.3.4.5 recommend modifying user home
						directories. Notify your user community, and solicit input if appropriate,
						before making this type of change. </warning>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4090-7:Ensure that User Home Directories are not Group-Writable or
							World-Readable</title>
						<description override="0">File permissions should be set correctly for the home
							directories for all user accounts.</description>
						<ident system="http://cce.mitre.org">CCE-4090-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20086"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.4.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Ensure that Users Have Sensible Umask Values</title>
					<description xml:lang="en-US" override="0"><xhtml:ol>
							<xhtml:li>Edit the global configuration files /etc/profile, /etc/bashrc,
								and /etc/csh.cshrc. Add or correct the line: <xhtml:br/><xhtml:br/> umask 077</xhtml:li>
							<xhtml:li>Edit the user definitions file /etc/login.defs. Add or correct
								the line:<xhtml:br/><xhtml:br/> UMASK 077 </xhtml:li>
							<xhtml:li>View the additional configuration files /etc/csh.login and
								/etc/profile.d/*, and ensure that none of these files redefine the
								umask to a more permissive value unless there is a good reason for
								it.</xhtml:li>
							<xhtml:li>Edit the root shell configuration files /root/.bashrc,
								/root/.bash profile, /root/.cshrc, and /root/.tcshrc. Add or correct
								the line: <xhtml:br/><xhtml:br/> umask 077 </xhtml:li>
						</xhtml:ol> With a default umask setting of 077, files and directories
						created by users will not be readable by any other user on the system. Users
						who wish to make specific files group- or world-readable can accomplish this
						using the chmod command. Additionally, users can make all their files
						readable to their group by default by setting a umask of 027 in their shell
						configuration files. If default per-user groups exist (that is, if every
						user has a default group whose name is the same as that user's username and
						whose only member is the user), then it may even be safe for users to select
						a umask of 007, making it very easy to intentionally share files with group
						s of which the user is a member. <xhtml:br/><xhtml:br/> In addition, it may be necessary to change root's umask
						temporarily in order to install software or files which must be readable by
						other users, or to change the default umasks of certain service accounts
						such as the FTP user. However, setting a restrictive default protects the
						files of users who have not taken steps to make their files more available,
						and preventing files from being inadvertently shared.</description>
					<Value id="usgcb-rhel5desktop-var-2.3.4.4" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">Sensible umask</title>
						<description xml:lang="en-US" override="0">Enter default user umask</description>
						<value selector="">027</value>
						<value selector="007">007</value>
						<value selector="022">022</value>
						<value selector="027">027</value>
						<value selector="077">077</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3844-8:The default umask for all users is set correctly in /etc/bashrc</title>
						<description override="0">The default umask for all users for the bash shell should be
							set to: <sub idref="usgcb-rhel5desktop-var-2.3.4.4"/></description>
						<ident system="http://cce.mitre.org">CCE-3844-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.4.4" export-name="oval:gov.nist.usgcb.rhel:var:20087"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20087"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.4.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4227-5:The default umask for all users is set correctly in /etc/csh.cshrc</title>
						<description override="0">The default umask for all users for the csh shell should be set
							to: <sub idref="usgcb-rhel5desktop-var-2.3.4.4"/></description>
						<ident system="http://cce.mitre.org">CCE-4227-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.4.4" export-name="oval:gov.nist.usgcb.rhel:var:20087"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20088"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.4.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14107-7:The default umask for all users is set correctly in /etc/login.defs</title>
						<description override="0">The default umask for all users should be set to: <sub idref="usgcb-rhel5desktop-var-2.3.4.4"/></description>
						<ident system="http://cce.mitre.org">CCE-14107-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.4.4" export-name="oval:gov.nist.usgcb.rhel:var:20087"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20089"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.4.4.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14847-8:The default umask for all users is set correctly in /etc/profile</title>
						<description override="0">The default umask for all users should be set to: <sub idref="usgcb-rhel5desktop-var-2.3.4.4"/></description>
						<ident system="http://cce.mitre.org">CCE-14847-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.4.4" export-name="oval:gov.nist.usgcb.rhel:var:20087"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20090"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.3.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Protect Physical Console Access</title>
				<description xml:lang="en-US" override="0"> It is impossible to fully protect a system from an
					attacker with physical access, so securing the space in which the system is
					located should be considered a necessary step. However, there are some steps
					which, if taken, make it more difficult for an attacker to quickly or
					undetectably modify a system from its console.</description>
				<Group id="usgcb-rhel5desktop-group-2.3.5.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Boot Loader Password</title>
					<description xml:lang="en-US" override="0"> During the boot process, the boot loader is
						responsible for starting the execution of the kernel and passing options to
						it. The boot loader allows for the selection of different kernels – possibly
						on different partitions or media. Options it can pass to the kernel include
						'single-user mode,' which provides root access without any authentication,
						and the ability to disable SELinux. To prevent local users from modifying
						the boot parameters and endangering security, the boot loader configuration
						should be protected with a password. <xhtml:br/><xhtml:br/> The default RHEL boot loader for x86 systems is called GRUB. To
						protect its configuration: <xhtml:br/><xhtml:ol>
							<xhtml:li>Select a password and then generate a hash from it by running: <xhtml:br/><xhtml:br/><xhtml:code># grub-md5-crypt </xhtml:code></xhtml:li>
							<xhtml:li>Insert the following line into /etc/grub.conf immediately
								after the header comments. (Use the output from grub-md5-crypt as
								the value of password-hash ): <xhtml:br/><xhtml:br/><xhtml:code>password --md5 password-hash </xhtml:code></xhtml:li>
							<xhtml:li>Verify the permissions on /etc/grub.conf (which is a symlink
								to ../boot/grub/grub.conf): <xhtml:br/><xhtml:br/><xhtml:code># chown root:root /etc/grub.conf <xhtml:br/> # chmod 600
									/etc/grub.conf</xhtml:code></xhtml:li>
						</xhtml:ol> Boot loaders for other platforms should offer a similar password
						protection feature.</description>
					<Value id="usgcb-rhel5desktop-var-2.3.5.2.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">User that owns /etc/grub.conf</title>
						<description xml:lang="en-US" override="0">Choose user that should own
							/etc/grub.conf</description>
						<value selector="root">root</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.3.5.2.b" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">Group that owns /etc/grub.conf</title>
						<description xml:lang="en-US" override="0">Choose group that should own
							/etc/grub.conf</description>
						<value selector="root">root</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4144-2:Set Boot Loader user owner</title>
						<description override="0">The /etc/grub.conf file should be owned by root.</description>
						<ident system="http://cce.mitre.org">CCE-4144-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.5.2.a" export-name="oval:gov.nist.usgcb.rhel:var:20092"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20092"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4197-0:Set Boot Loader group owner</title>
						<description override="0">The /etc/grub.conf file should be owned by group
							root.</description>
						<ident system="http://cce.mitre.org">CCE-4197-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.5.2.b" export-name="oval:gov.nist.usgcb.rhel:var:20093"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20093"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3923-0:Set permission on /etc/grub.conf</title>
						<description override="0">File permissions for /etc/grub.conf should be set
							correctly.</description>
						<ident system="http://cce.mitre.org">CCE-3923-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20094"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.2.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3818-2:Set Boot Loader Password</title>
						<description override="0">The grub boot loader should have password protection
							enabled</description>
						<ident system="http://cce.mitre.org">CCE-3818-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20095"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.5.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Require Authentication for Single-User Mode</title>
					<description xml:lang="en-US" override="0"> Single-user mode is intended as a system recovery
						method, providing a single user root access to the system by providing a
						boot option at startup. By default, no authentication is performed if
						single-user mode is selected. This provides a trivial mechanism of bypassing
						security on the machine and gaining root access. <xhtml:br/><xhtml:br/> To require entry of the root password even if the system is
						started in single-user mode, add the following line to the /etc/inittab file:<xhtml:br/><xhtml:br/> ~~:S:wait:/sbin/sulogin</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4241-6:Require Authentication for Single-User Mode</title>
						<description override="0">The requirement for a password to boot into single-user mode
							should be enabled.</description>
						<ident system="http://cce.mitre.org">CCE-4241-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20096"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.5.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Interactive Boot</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/sysconfig/init. Add or correct
						the setting:<xhtml:br/><xhtml:br/> PROMPT=no <xhtml:br/> The PROMPT option allows the console user
						to perform an interactive system startup, in which it is possible to select
						the set of services which are started on boot. Using interactive boot, the
						console user could disable auditing, firewalls, or other services, weakening
						system security.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.5.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4245-7:Disable Interactive Boot</title>
						<description override="0">The ability for users to perform interactive startups should be
							disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4245-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20097"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.5.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Configure Screen Locking</title>
					<description xml:lang="en-US" override="0"> When a user must temporarily leave an account
						logged-in, screen locking should be employed to prevent passersby from
						abusing the account. User education and training is particularly important
						for screen locking to be effective. <xhtml:br/><xhtml:br/> A policy should be implemented that trains all users to lock the
						screen when they plan to temporarily step away from a logged-in account.
						Automatic screen locking is only meant as a safeguard for those cases where
						a user forgot to lock the screen.</description>
					<Group id="usgcb-rhel5desktop-group-2.3.5.6.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Configure GUI Screen Locking</title>
						<description xml:lang="en-US" override="0"> In the default GNOME desktop, the screen can
							be locked by choosing Lock Screen from the System menu. <xhtml:br/><xhtml:br/> The gconftool-2 program can be used to enforce mandatory
							screen locking settings for the default GNOME environment. Run the
							following commands to enforce idle activation of the screen saver,
							screen locking, a blank-screen screensaver, and 15-minute idle
							activation time: <xhtml:br/><xhtml:br/><xhtml:pre>
								<xhtml:code> # gconftool-2 --direct \ --config-source
									xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \
									--set /apps/gnome-screensaver/idle_activation_enabled true #
									gconftool-2 --direct \ --config-source
									xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \
									--set /apps/gnome-screensaver/lock_enabled true # gconftool-2
									--direct \ --config-source
									xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type string \
									--set /apps/gnome-screensaver/mode blank-only # gconftool-2
									--direct \ --config-source
									xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type int \
									--set /apps/gnome-screensaver/idle_delay 15 </xhtml:code>
							</xhtml:pre><xhtml:br/> The default setting of 15 minutes for idle activation is
							reasonable for many office environments, but the setting should conform
							to whatever policy is defined. The screensaver mode blank-only is
							selected to conceal the contents of the display from passersby. <xhtml:br/><xhtml:br/> Because users should be trained to lock the screen when they
							step away from the computer, the automatic locking feature is only meant
							as a backup. The Lock Screen icon from the System menu can also be
							dragged to the taskbar in order to facilitate even more convenient
							screen-locking. <xhtml:br/><xhtml:br/> The root account cannot be screen-locked, but this should
							have no practical effect as the root account should never be used to log
							into an X Windows environment, and should only be used to for direct
							login via console in emergency circumstances. <xhtml:br/><xhtml:br/> For more information about configuring GNOME screensaver,
							see http://live.gnome.org/GnomeScreensaver. For more information about
							enforcing preferences in the GNOME environment using the GConf
							configuration system, see http://www.gnome.org/projects/gconf and the
							man page gconftool-2(1).</description>
						<Value id="usgcb-rhel5desktop-var-2.3.5.5" type="string" operator="equals">
						<title>Inactivity timout</title>
						<description xml:lang="en-US">Choose allowed duration of inactive SSH
							connections, shells, and X sessions</description>
						<value>15</value>
						<value selector="0_minutes">0</value>
						<value selector="10_minutes">10</value>
						<value selector="15_minutes">15</value>
					</Value>
						<Rule id="usgcb-rhel5desktop-rule-2.3.5.6.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-3315-9:Implement Inactivity Time-out for Login Shells</title>
							<description override="0">The idle time-out value for period of inactivity gnome
								desktop lockout should be 15 minutes</description>
							<ident system="http://cce.mitre.org">CCE-3315-9</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.3.5.5" export-name="oval:gov.nist.usgcb.rhel:var:20098"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20100"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.5.6.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-14604-3:The gnome desktop screensaver should be enabled or disabled as appropriate as a mandatory setting for all users.</title>
							<description override="0">Idle activation of the screen saver should be
								enabled</description>
							<ident system="http://cce.mitre.org">CCE-14604-3</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201005"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.5.6.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-14023-6:Implement idle activation of screen lock</title>
							<description override="0">Idle activation of the screen lock should be
								enabled</description>
							<ident system="http://cce.mitre.org">CCE-14023-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201006"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.3.5.6.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-14735-5:Implement blank screen saver</title>
							<description override="0">The screen saver should be blank</description>
							<ident system="http://cce.mitre.org">CCE-14735-5</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201007"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.3.5.6.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Configure Console Screen Locking</title>
						<description xml:lang="en-US" override="0"> A console screen locking mechanism is
							provided in the vlock package, which is not installed by default. If the
							ability to lock console screens is necessary, install the vlock package: <xhtml:br/><xhtml:br/><xhtml:code># yum install vlock <xhtml:br/></xhtml:code><xhtml:br/> Instruct users to invoke the program when necessary, in
							order to prevent passersby from abusing their login: <xhtml:br/><xhtml:code>$ vlock <xhtml:br/></xhtml:code><xhtml:br/> The -a option can be used to prevent switching to other
							virtual consoles.</description>
						<Rule id="usgcb-rhel5desktop-rule-2.3.5.6.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-3910-7:Configure console screen locking</title>
							<description override="0">The vlock package should be installed</description>
							<ident system="http://cce.mitre.org">CCE-3910-7</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20101"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.3.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Warning Banners for System Accesses</title>
				<description xml:lang="en-US" override="0"> Each system should expose as little information about
					itself as possible. <xhtml:br/><xhtml:br/> System banners, which are typically displayed just before a login
					prompt, give out information about the service or the host's operating system.
					This might include the distribution name and the system kernel version, and the
					particular version of a network service. This information can assist intruders
					in gaining access to the system as it can reveal whether the system is running
					vulnerable software. Most network services can be configured to limit what
					information is displayed. <xhtml:br/><xhtml:br/> Many organizations implement security policies that require a system
					banner provide notice of the system's ownership, provide warning to unauthorized
					users, and remind authorized users of their consent to monitoring.</description>
				<Value id="usgcb-rhel5desktop-var-2.3.7" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">login banner verbiage</title>
					<description xml:lang="en-US" override="0">Enter an appropriate login banner for your
					organization</description>
					<value selector="any_text">.+</value>
					<value selector="usgcb_default">
-- WARNING --
This system is for the use of authorized users only. Individuals
using this computer system without authority or in excess of their
authority are subject to having all their activities on this system
monitored and recorded by system personnel. Anyone using this
system expressly consents to such monitoring and is advised that
if such monitoring reveals possible evidence of criminal activity
system personal may provide the evidence of such monitoring to law
enforcement officials.

</value>
				</Value>
				<Group id="usgcb-rhel5desktop-group-2.3.7.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Modify the System Login Banner</title>
					<description xml:lang="en-US" override="0"> The contents of the file /etc/issue are displayed
						on the screen just above the login prompt for users logging directly into a
						terminal. Remote login programs such as SSH or FTP can be configured to
						display /etc/issue as well. Instructions for configuring each server daemon
						to show this file can be found in the relevant sections of Chapter 3. <xhtml:br/><xhtml:br/> By default, the system will display the version of the OS, the
						kernel version, and the host name. <xhtml:br/><xhtml:br/> Edit /etc/issue. Replace the default text with a message
						compliant with the local site policy or a legal disclaimer.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.7.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4060-0:Modify the System Login Banner</title>
						<description override="0">The system login banner text should be: <sub idref="usgcb-rhel5desktop-var-2.3.7"/></description>
						<ident system="http://cce.mitre.org">CCE-4060-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.7" export-name="oval:gov.nist.usgcb.rhel:var:20102"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20102"/>
							<!-- TBD -->
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.3.7.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Implement a GUI Warning Banner</title>
					<description xml:lang="en-US" override="0"> In the default graphical environment, users
						logging directly into the system are greeted with a login screen provided by
						the GNOME display manager. The warning banner should be displayed in this
						graphical environment for these users.<xhtml:br/><xhtml:br/> The files for the default RHEL theme can be found in
						/usr/share/gdm/themes/RHEL. Add the following sample block of XML to
						/usr/share/gdm/themes/RHEL/RHEL.xml after the first two "pixmap" entries:<xhtml:br/><xhtml:pre> &lt;item type="rect"&gt; &lt;pos anchor="n" x="50%" y="10"
							width="box" height="box"/&gt; &lt;box&gt; &lt;item type="label"&gt;
							&lt;normal font="Sans 14" color="#ffffff"/&gt; &lt;text&gt;Insert the
							text of your warning banner here.&lt;/text&gt; &lt;/item&gt;
							&lt;/box&gt; &lt;/item&gt; </xhtml:pre><xhtml:br/> The full syntax that GDM theme files expect is documented
						elsewhere, but the above XML will create a text box centered at the top of
						the screen. The font, text color, and exact positioning can all be easily
						modified by editing the appropriate values. The latest current GDM theme
						manual can be found at http://www.gnome.org/
						projects/gdm/docs/thememanual.html. </description>
					<Rule id="usgcb-rhel5desktop-rule-2.3.7.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4188-9:Implement a GUI Warning Banner</title>
						<description override="0">The direct gnome login warning banner text should be set
							appropriately</description>
						<ident system="http://cce.mitre.org">CCE-4188-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.3.7" export-name="oval:gov.nist.usgcb.rhel:var:20102"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20103"/>
							<!-- TBD -->
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-2.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">SELinux</title>
			<description xml:lang="en-US" override="0"> SELinux is a feature of the Linux kernel which can be
				used to guard against misconfigured or compromised programs. SELinux enforces the
				idea that programs should be limited in what files they can access and what actions
				they can take. <xhtml:br/><xhtml:br/> The default SELinux policy, as configured on RHEL5, has been
				sufficiently developed and debugged that it should be usable on almost any Red Hat
				machine with minimal configuration and a small amount of system administrator
				training. This policy prevents system services — including most of the common
				network-visible services such as mail servers, ftp servers, and DNS servers — from
				accessing files which those services have no valid reason to access. This action
				alone prevents a huge amount of possible damage from network attacks against
				services, from trojaned software, and so forth. <xhtml:br/><xhtml:br/> This guide recommends that SELinux be enabled using the default
				(targeted) policy on every Red Hat system, unless that system has requirements which
				make a stronger policy appropriate.</description>
			<Group id="usgcb-rhel5desktop-group-2.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Enable SELinux</title>
				<description xml:lang="en-US" override="0"> Edit the file /etc/selinux/config. Add or correct the
					following lines: <xhtml:br/><xhtml:br/><xhtml:code>SELINUX=enforcing <xhtml:br/> SELINUXTYPE=targeted <xhtml:br/></xhtml:code><xhtml:br/> Edit the file /etc/grub.conf. Ensure that the following arguments DO
					NOT appear on any kernel command line in the file: <xhtml:br/><xhtml:br/><xhtml:code>selinux=0 <xhtml:br/> enforcing=0 <xhtml:br/></xhtml:code><xhtml:br/> The directive SELINUX=enforcing enables SELinux at boot time. If
					SELinux is causing a lot of problems or preventing the system from booting, it
					is possible to boot into the warning-only mode SELINUX=permissive for debugging
					purposes. Make certain to change the mode back to enforcing after debugging, set
					the filesystems to be relabelled for consistency using the command touch
					/.autorelabel, and reboot. <xhtml:br/><xhtml:br/> However, the RHEL5 default SELinux configuration should be
					sufficiently reasonable that most systems will boot without serious problems.
					Some applications that require deep or unusual system privileges, such as
					virtual machine software, may not be compatible with SELinux in its default
					configuration. However, this should be uncommon, and SELinux's application
					support continues to improve. In other cases, SELinux may reveal unusual or
					insecure program behavior by design. <xhtml:br/><xhtml:br/> The directive SELINUXTYPE=targeted configures SELinux to use the
					default targeted policy. See Section 2.4.6 if a stricter policy is appropriate
					for your site. <xhtml:br/><xhtml:br/> The SELinux boot mode specified in /etc/selinux/config can be
					overridden by command-line arguments passed to the kernel. It is necessary to
					check grub.conf to ensure that this has not been done and to protect the
					bootloader as described in Section 2.3.5.2.</description>
				<Value id="usgcb-rhel5desktop-var-2.4.2.c" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">SELinux state</title>
					<description xml:lang="en-US" override="0"> enforcing - SELinux security policy is enforced.
						<xhtml:br/> permissive - SELinux prints warnings instead of
						enforcing.<xhtml:br/> disabled - SELinux is fully disabled. </description>
					<value selector="">enforcing</value>
					<value selector="enforcing">enforcing</value>
					<value selector="permissive">permissive</value>
					<value selector="disabled">disabled</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-2.4.2.d" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">SELinux policy</title>
					<description xml:lang="en-US" override="0"> Type of policy in use. Possible values
						are:<xhtml:br/> targeted - Only targeted network daemons are
						protected.<xhtml:br/> strict - Full SELinux protection.<xhtml:br/> mls -
						Multiple levels of security</description>
					<value selector="">targeted</value>
					<value selector="targeted">targeted</value>
					<value selector="strict">strict</value>
					<value selector="mls">mls</value>
				</Value>
				<Rule id="usgcb-rhel5desktop-rule-2.4.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3977-6:Enable SELinux in /etc/grub.conf</title>
					<description override="0">SELinux should NOT be disabled in /etc/grub.conf. Check that
						selinux=0 is not found</description>
					<ident system="http://cce.mitre.org">CCE-3977-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20104"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.4.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-3999-0:Set the SELinux state</title>
					<description override="0">The SELinux state should be set appropriately</description>
					<ident system="http://cce.mitre.org">CCE-3999-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-2.4.2.c" export-name="oval:gov.nist.usgcb.rhel:var:20106"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20106"/>
						<!-- TBD -->
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.4.2.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3624-4:Set the SELinux policy</title>
					<description override="0">The SELinux policy should be set appropriately.</description>
					<ident system="http://cce.mitre.org">CCE-3624-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-2.4.2.d" export-name="oval:gov.nist.usgcb.rhel:var:20107"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20107"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.4.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Unnecessary SELinux Daemons</title>
				<description xml:lang="en-US" override="0"> Several daemons are installed by default as part of
					the RHEL5 SELinux support mechanism. These daemons may improve the system's
					ability to enforce SELinux policy in a useful fashion, but may also represent
					unnecessary code running on the machine, increasing system risk. If these
					daemons are not needed on your system, they should be disabled.</description>
				<Group id="usgcb-rhel5desktop-group-2.4.3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable MCS Translation Service (mcstrans) if
						Possible</title>
					<description xml:lang="en-US" override="0"> Unless there is some overriding need for the
						convenience of category label translation, disable the MCS translation
						service: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig mcstrans off <xhtml:br/></xhtml:code><xhtml:br/> The mcstransd daemon provides the category label translation
						information defined in /etc/selinux/targeted/ setrans.conf to client
						processes which request this information.<xhtml:br/><xhtml:br/> Category labelling is unlikely to be used except in sites with
						special requirements. Therefore, it should be disabled in order to reduce
						the amount of potentially vulnerable code running on the system. See Section
						2.4.6 for more information about systems which use category
						labelling.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.4.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3668-1:Disable MCS Translation Service (mcstrans) if Possible</title>
						<description override="0">The mcstrans service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-3668-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20110"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.4.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Check for Unconfined Daemons</title>
				<description xml:lang="en-US" override="0"> Device ﬁles are used for communication with important
					system resources. SELinux contexts should exist for these. If a device ﬁle is
					not labeled, then misconﬁguration is likely.<xhtml:br/><xhtml:br/> To check for unlabeled device ﬁles, run the following command:<xhtml:br/><xhtml:code># ls -Z | grep unlabeled_t<xhtml:br/></xhtml:code><xhtml:br/> It should produce no output in a well-conﬁgured
					system.</description>
				<Rule id="usgcb-rhel5desktop-rule-2.4.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14991-4:Check for Unconfined Daemons</title>
					<description override="0">Check for device ﬁle that is not labeled.</description>
					<ident system="http://cce.mitre.org">CCE-14991-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201115"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-2.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Network Configuration and Firewalls</title>
			<description xml:lang="en-US" override="0"> Most machines must be connected to a network of some
				sort, and this brings with it the substantial risk of network attack. This section
				discusses the security impact of decisions about networking which must be made when
				configuring a system. <xhtml:br/><xhtml:br/> This section also discusses firewalls, network access controls, and
				other network security frameworks, which allow system-level rules to be written that
				can limit attackers' ability to connect to your system. These rules can specify that
				network traffic should be allowed or denied from certain IP addresses, hosts, and
				networks. The rules can also specify which of the system's network services are
				available to particular hosts or networks.</description>
			<Group id="usgcb-rhel5desktop-group-2.5.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Kernel Parameters which Affect Networking</title>
				<description xml:lang="en-US" override="0"> The sysctl utility is used to set a number of
					parameters which affect the operation of the Linux kernel. Several of these
					parameters are specific to networking, and the configuration options in this
					section are recommended.</description>
				<Group id="usgcb-rhel5desktop-group-2.5.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Network Parameters for Hosts Only</title>
					<description xml:lang="en-US" override="0"> Is this system going to be used as a firewall or
						gateway to pass IP traffic between different networks? <xhtml:br/> If not,
						edit the file /etc/sysctl.conf and add or correct the following lines: <xhtml:br/><xhtml:br/><xhtml:code>net.ipv4.ip forward = 0 <xhtml:br/>
							net.ipv4.conf.all.send_redirects = 0 <xhtml:br/>
							net.ipv4.conf.default.send_redirects = 0 <xhtml:br/></xhtml:code><xhtml:br/> These settings disable hosts from performing network
						functionality which is only appropriate for routers.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4151-7:Disable net.ipv4.conf.default.send_redirects for Hosts Only</title>
						<description override="0">The default setting for sending ICMP redirects should be
							disabled for network interfaces.</description>
						<ident system="http://cce.mitre.org">CCE-4151-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20112"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4155-8:Disable net.ipv4.conf.all.send_redirects for Hosts Only</title>
						<description override="0">Sending ICMP redirects should be disabled for all
							interfaces.</description>
						<ident system="http://cce.mitre.org">CCE-4155-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20113"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3561-8:Disable net.ipv4.ip forward for Hosts Only</title>
						<description override="0">IP forwarding should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-3561-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20114"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.1.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Network Parameters for Hosts and Routers</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/sysctl.conf and add or correct
						the following lines: <xhtml:br/><xhtml:br/> net.ipv4.conf.all.accept_source_route = 0 <xhtml:br/>
						net.ipv4.conf.all.accept_redirects = 0<xhtml:br/>
						net.ipv4.conf.all.secure_redirects = 0 <xhtml:br/>
						net.ipv4.conf.all.log_martians = 1<xhtml:br/>
						net.ipv4.conf.default.accept_source_route = 0 <xhtml:br/>
						net.ipv4.conf.default.accept_redirects = 0<xhtml:br/>
						net.ipv4.conf.default.secure_redirects = 0 <xhtml:br/>
						net.ipv4.icmp_echo_ignore_broadcasts = 1<xhtml:br/>
						net.ipv4.icmp_ignore_bogus_error_messages = 1 <xhtml:br/>
						net.ipv4.tcp_syncookies = 1<xhtml:br/> net.ipv4.conf.all.rp_filter = 1
						<xhtml:br/> net.ipv4.conf.default.rp_filter = 1 <xhtml:br/><xhtml:br/> These options improve Linux's ability to defend against certain
						types of IPv4 protocol attacks. <xhtml:br/><xhtml:br/> The accept source route, accept redirects, and secure redirects
						options are turned off to disable IPv4 protocol features which are
						considered to have few legitimate uses and to be easy to abuse. <xhtml:br/><xhtml:br/> The net.ipv4.conf.all.log martians option logs several types of
						suspicious packets, such as spoofed packets, source-routed packets, and
						redirects. <xhtml:br/><xhtml:br/> The icmp echo ignore broadcasts icmp ignore bogus error messages
						options protect against ICMP attacks. <xhtml:br/><xhtml:br/> The tcp syncookies option uses a cryptographic feature called
						SYN cookies to allow machines to continue to accept legitimate connections
						when faced with a SYN flood attack. See [12] for further information on this
						option. <xhtml:br/><xhtml:br/> The rp filter option enables RFC-recommended source validation.
						It should not be used on machines which are routers for very complicated
						networks, but is helpful for end hosts and routers serving small networks. <xhtml:br/><xhtml:br/> For more information on any of these, see the kernel source
						documentation file /Documentation/networking/ip-sysctl.txt.2</description>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.all.accept_source_route</title>
						<description xml:lang="en-US" override="0">Trackers could be using source-routed packets
							to generate traffic that seems to be intra-net, but actually was created
							outside and has been redirected.</description>
						<value selector="">0</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.b" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.all.accept_redirects</title>
						<description xml:lang="en-US" override="0">Disable ICMP Redirect
							Acceptance?</description>
						<value selector="">0</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.c" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.all.secure_redirects</title>
						<description xml:lang="en-US" override="0">Enable to prevent hijacking of routing path by
							only allowing redirects from gateways known in routing table. </description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.d" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.all.log_martians</title>
						<description xml:lang="en-US" override="0">Disable so you don't Log Spoofed Packets,
							Source Routed Packets, Redirect Packets </description>
						<value selector="">0</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.e" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.default.accept_source_route</title>
						<description xml:lang="en-US" override="0">Disable IP source routing?</description>
						<value selector="">0</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.f" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.default.accept_redirects</title>
						<description xml:lang="en-US" override="0">Disable ICMP Redirect
							Acceptance?</description>
						<value selector="">0</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.g" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.default.secure_redirects</title>
						<description xml:lang="en-US" override="0">Log packets with impossible addresses to
							kernel log?</description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.h" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.icmp_echo_ignore_broadcast</title>
						<description xml:lang="en-US" override="0">Ignore all ICMP ECHO and TIMESTAMP requests
							sent to it via broadcast/multicast</description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.i" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.icmp_ignore_bogus_error_messages</title>
						<description xml:lang="en-US" override="0">Enable to prevent certain types of
							attacks</description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.j" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.tcp_syncookie</title>
						<description xml:lang="en-US" override="0">Enable to turn on TCP SYN Cookie
							Protection</description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.k" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.all.rp_filter</title>
						<description xml:lang="en-US" override="0">Enable to enforce sanity checking, also called
							ingress filtering or egress filtering. The point is to drop a packet if
							the source and destination IP addresses in the IP header do not make
							sense when considered in light of the physical interface on which it
							arrived. </description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.5.1.2.l" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">net.ipv4.conf.default.rp_filter</title>
						<description xml:lang="en-US" override="0">Enables source route
							verification</description>
						<value selector="">1</value>
						<value selector="enabled">1</value>
						<value selector="disabled">0</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4236-6:Set net.ipv4.conf.all.accept_source_route for Hosts and
							Routers</title>
						<description override="0">Accepting source routed packets should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.a"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4236-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.a" export-name="oval:gov.nist.usgcb.rhel:var:20115"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20115"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4217-6:Set net.ipv4.conf.all.accept_redirects for Hosts and Routers</title>
						<description override="0">Accepting ICMP redirects should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.b"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4217-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.b" export-name="oval:gov.nist.usgcb.rhel:var:20116"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20116"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3472-8:Set net.ipv4.conf.all.secure_redirects for Hosts and Routers</title>
						<description override="0">Accepting "secure" ICMP redirects (those from gateways listed
							in the default gateways list) should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.c"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-3472-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.c" export-name="oval:gov.nist.usgcb.rhel:var:20117"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20117"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4320-8:Set net.ipv4.conf.all.log_martians for Hosts and Routers</title>
						<description override="0">Logging of "martian" packets (those with impossible addresses)
							should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.d"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4320-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.d" export-name="oval:gov.nist.usgcb.rhel:var:20118"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20118"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.e" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4091-5:Set net.ipv4.conf.default.accept_source_route for Hosts and
							Routers</title>
						<description override="0">The default setting for accepting source routed packets should
							be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.e"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4091-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.e" export-name="oval:gov.nist.usgcb.rhel:var:20119"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20119"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.f" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4186-3:Set net.ipv4.conf.default.accept_redirects for Hosts and
							Routers</title>
						<description override="0">The default setting for accepting ICMP redirects should be:
								<sub idref="usgcb-rhel5desktop-var-2.5.1.2.f"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4186-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.f" export-name="oval:gov.nist.usgcb.rhel:var:20120"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20120"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.g" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3339-9:Set net.ipv4.conf.default.secure_redirects for Hosts and
							Routers</title>
						<description override="0">The default setting for accepting "secure" ICMP redirects
							(those from gateways listed in the default gateways list) should be:
								<sub idref="usgcb-rhel5desktop-var-2.5.1.2.g"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-3339-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.g" export-name="oval:gov.nist.usgcb.rhel:var:20121"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20121"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.h" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3644-2:Set net.ipv4.icmp_echo_ignore_broadcasts for Hosts and
							Routers</title>
						<description override="0">Ignoring ICMP echo requests (pings) sent to broadcast /
							multicast addresses should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.h"/>
							for all interfaces as appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-3644-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.h" export-name="oval:gov.nist.usgcb.rhel:var:20122"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20122"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.i" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4133-5:Set net.ipv4.icmp_ignore_bogus_error_messages for Hosts and
							Routers</title>
						<description override="0">Ignoring bogus ICMP responses to broadcasts should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.i"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4133-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.i" export-name="oval:gov.nist.usgcb.rhel:var:20123"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20123"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.j" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4265-5:Set net.ipv4.tcp_syncookies for Hosts and Routers</title>
						<description override="0">Sending TCP syncookies should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.j"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4265-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.j" export-name="oval:gov.nist.usgcb.rhel:var:20124"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20124"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.k" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4080-8:Set net.ipv4.conf.all.rp_filter for Hosts and Routers</title>
						<description override="0">Performing source validation by reverse path should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.k"/> for all interfaces as
							appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-4080-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.k" export-name="oval:gov.nist.usgcb.rhel:var:20125"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20125"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.1.2.l" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3840-6:Set net.ipv4.conf.default.rp_filter for Hosts and Routers</title>
						<description override="0">The default setting for performing source validation by reverse
							path should be: <sub idref="usgcb-rhel5desktop-var-2.5.1.2.l"/> for all
							interfaces as appropriate.</description>
						<ident system="http://cce.mitre.org">CCE-3840-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.5.1.2.l" export-name="oval:gov.nist.usgcb.rhel:var:20126"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20126"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.5.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Wireless Networking</title>
				<description xml:lang="en-US" override="0"> Wireless networking (sometimes referred to as 802.11
					or Wi-Fi) presents a serious security risk to sensitive or classified systems
					and networks. Wireless networking hardware is much more likely to be included in
					laptop or portable systems than desktops or servers. See Section 3.3.14 for
					information on Bluetooth wireless support. Bluetooth serves a different purpose
					and possesses a much shorter range, but it still presents serious security
					risks. <xhtml:br/><xhtml:br/> Removal of hardware is the only way to absolutely ensure that the
					wireless capability remains disabled. If it is completely impractical to remove
					the wireless hardware, and site policy still allows the device to enter
					sensitive spaces, every effort to disable the capability via software should be
					made. In general, acquisition policy should include provisions to prevent the
					purchase of equipment that will be used in sensitive spaces and includes
					wireless capabilities.</description>
				<Group id="usgcb-rhel5desktop-group-2.5.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Wireless Through Software Configuration</title>
					<description xml:lang="en-US" override="0"> If it is impossible to remove the wireless
						hardware from the device in question, disable as much of it as possible
						through software. The following methods can disable software support for
						wireless networking, but note that these methods do not prevent malicious
						software or careless users from re-activating the devices.</description>
					<Group id="usgcb-rhel5desktop-group-2.5.2.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Deactivate Wireless Interfaces</title>
						<description xml:lang="en-US" override="0"> Deactivating the wireless interfaces should
							prevent normal usage of the wireless capability. <xhtml:br/><xhtml:br/> First, identify the interfaces available with the command: <xhtml:br/><xhtml:br/><xhtml:code># ifconfig -a <xhtml:br/></xhtml:code><xhtml:br/> Additionally,the following command may also be used to
							determine whether wireless support ('extensions') is included for a
							particular interface, though this may not always be a clear indicator: <xhtml:br/><xhtml:br/><xhtml:code># iwconfig <xhtml:br/></xhtml:code><xhtml:br/> After identifying any wireless interfaces (which may have
							names like wlan0, ath0, wifi0, or eth0), deactivate the interface with
							the command: <xhtml:br/><xhtml:br/><xhtml:code># ifdown interface <xhtml:br/></xhtml:code><xhtml:br/> These changes will only last until the next reboot. To
							disable the interface for future boots, remove the appropriate interface
							file from /etc/sysconfig/network-scripts: <xhtml:br/><xhtml:br/><xhtml:code># rm
								/etc/sysconfig/network-scripts/ifcfg-interface</xhtml:code></description>
						<Rule id="usgcb-rhel5desktop-rule-2.5.2.2.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4276-2:Deactivate Wireless Interfaces</title>
							<description override="0">All wireless interfaces should be disabled.</description>
							<ident system="http://cce.mitre.org">CCE-4276-2</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20128"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.5.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">IPv6</title>
				<description xml:lang="en-US" override="0"> The system includes support for Internet Protocol
					version 6. A major and often-mentioned improvement over IPv4 is its enormous
					increase in the number of available addresses. Another important feature is its
					support for automatic configuration of many network settings.</description>
				<Group id="usgcb-rhel5desktop-group-2.5.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Support for IPv6 unless Needed</title>
					<description xml:lang="en-US" override="0">As with any networking protocol, IPv6 should be disabled unless needed.</description>
					<Group id="usgcb-rhel5desktop-group-2.5.3.1.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Disable Functionality of IPv6 Kernel Module Through Option</title>
						<description xml:lang="en-US" override="0">To prevent activation of IPv6 addresses, add the following line to /etc/modprobe.conf: <xhtml:br/><xhtml:br/> options ipv6 disable=1</description>
						<Rule id="usgcb-rhel5desktop-rule-2.5.3.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<version update="1"/>
							<title override="0">The IPv6 protocol should be enabled or disabled as appropriate.</title>
							<description override="0">The IPv6 protocol should be enabled or disabled as appropriate.</description>
							<ident system="http://cce.mitre.org">CCE-18455-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20130"/>
							</check>
						</Rule>
					</Group>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Configure IPv6 Settings if Necessary</title>
					<description xml:lang="en-US" override="0"> A major feature of IPv6 is the extent to which
						systems implementing it can automatically configure their networking devices
						using information from the network. From a security perspective, manually
						configuring important configuration information is always preferable to
						accepting it from the network in an unauthenticated fashion.</description>
					<Group id="usgcb-rhel5desktop-group-2.5.3.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Disable Automatic Configuration</title>
						<description xml:lang="en-US" override="0"> Disable the system's acceptance of router
							advertisements and redirects by adding or correcting the following line
							in /etc/sysconfig/network (note that this does not disable sending
							router solicitations): <xhtml:br/><xhtml:br/> IPV6_AUTOCONF=no</description>
						<Value id="usgcb-rhel5desktop-var-2.5.3.2.1.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
							<title override="0">IPV6_AUTOCONF</title>
							<description xml:lang="en-US" override="0">Toggle global IPv6 autoconfiguration
								(only, if global forwarding is disabled)</description>
							<value selector="">disabled</value>
							<value selector="enabled">enabled</value>
							<value selector="disabled">disabled</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.5.3.2.1.b" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
							<title override="0">net.ipv6.conf.default.accept_ra</title>
							<description xml:lang="en-US" override="0">accept default router
								advertisements</description>
							<value selector="">no</value>
							<value selector="enabled">yes</value>
							<value selector="disabled">no</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.5.3.2.1.c" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
							<title override="0">net.ipv6.conf.default.accept_redirects</title>
							<description xml:lang="en-US" override="0">Toggle ICMP Redirect
								Acceptance</description>
							<value selector="">disabled</value>
							<value selector="enabled">enabled</value>
							<value selector="disabled">disabled</value>
						</Value>
						<Value id="usgcb-rhel5desktop-var-2.5.3.2.1.d" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
							<title override="0">net.ipv6.conf.all.accept_redirects</title>
							<description xml:lang="en-US" override="0">Toggle ICMP Redirect
								Acceptance</description>
							<value selector="">disabled</value>
							<value selector="enabled">enabled</value>
							<value selector="disabled">disabled</value>
						</Value>
						<Rule id="usgcb-rhel5desktop-rule-2.5.3.2.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4269-7:Disable accepting IPv6 router advertisements
								(net.ipv6.conf.default.accept_ra)</title>
							<description override="0">The default setting for accepting IPv6 router
								advertisements should be: <sub idref="usgcb-rhel5desktop-var-2.5.3.2.b"/> for
								all interfaces.</description>
							<ident system="http://cce.mitre.org">CCE-4269-7</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.5.3.2.1.b" export-name="oval:gov.nist.usgcb.rhel:var:20135"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20135"/>
							</check>
						</Rule>
						<Rule id="usgcb-rhel5desktop-rule-2.5.3.2.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4313-3:Disable accepting redirects from IPv6 routers
								(net.ipv6.conf.default.accept_redirects)</title>
							<description override="0">Accepting redirects from IPv6 routers should be: <sub idref="usgcb-rhel5desktop-var-2.5.3.2.c"/> for all
								interfaces.</description>
							<ident system="http://cce.mitre.org">CCE-4313-3</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-export value-id="usgcb-rhel5desktop-var-2.5.3.2.1.c" export-name="oval:gov.nist.usgcb.rhel:var:20136"/>
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20136"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.5.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Iptables and Ip6tables</title>
				<description xml:lang="en-US" override="0"> A host-based firewall called Netfilter is included as
					part of the Linux kernel distributed with the system. It is activated by
					default. This firewall is controlled by the program iptables, and the entire
					capability is frequently referred to by this name. An analogous program called
					ip6tables handles filtering for IPv6. <xhtml:br/><xhtml:br/> Unlike TCP Wrappers, which depends on the network server program to
					support and respect the rules written, Netfilter filtering occurs at the kernel
					level, before a program can even process the data from the network packet. As
					such, any program on the system is affected by the rules written. <xhtml:br/><xhtml:br/> This section provides basic information about strengthening the
					iptables and ip6tables configurations included with the system. For more
					complete information that may allow the construction of a sophisticated ruleset
					tailored to your environment, please consult the references at the end of this
					section.</description>
				<Group id="usgcb-rhel5desktop-group-2.5.5.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Inspect and Activate Default Rules</title>
					<description xml:lang="en-US" override="0"> View the currently-enforced iptables rules by
						running the command: <xhtml:br/><xhtml:br/><xhtml:code># iptables -nL --line-numbers <xhtml:br/></xhtml:code><xhtml:br/> The command is analogous for the ip6tables program. <xhtml:br/><xhtml:br/> If the firewall does not appear to be active (i.e., no rules
						appear), activate it and ensure that it starts at boot by issuing the
						following commands (and analogously for ip6tables): <xhtml:br/><xhtml:br/><xhtml:code># service iptables restart <xhtml:br/> # chkconfig iptables on
							<xhtml:br/></xhtml:code><xhtml:br/> The default iptables rules are: <xhtml:br/><xhtml:br/> Chain INPUT (policy ACCEPT) <xhtml:br/> num target prot opt
						source destination <xhtml:br/> 1 RH-Firewall-1-INPUT all -- 0.0.0.0/0
						0.0.0.0/0 <xhtml:br/><xhtml:br/> Chain FORWARD (policy ACCEPT) <xhtml:br/> num target prot opt
						source destination <xhtml:br/> 1 RH-Firewall-1-INPUT all -- 0.0.0.0/0
						0.0.0.0/0 <xhtml:br/><xhtml:br/> Chain OUTPUT (policy ACCEPT) <xhtml:br/> num target prot opt
						source destination <xhtml:br/><xhtml:br/> Chain RH-Firewall-1-INPUT (2 references) <xhtml:br/> num target
						prot opt source destination <xhtml:br/> 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
						<xhtml:br/> 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255 <xhtml:br/> 3
						ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0 <xhtml:br/> 4 ACCEPT ah -- 0.0.0.0/0
						0.0.0.0/0 <xhtml:br/> 5 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
						<xhtml:br/> 6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:631 <xhtml:br/> 7
						ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:631 <xhtml:br/> 8 ACCEPT all --
						0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED <xhtml:br/> 9 ACCEPT tcp --
						0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 <xhtml:br/> 10 REJECT all --
						0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited <xhtml:br/><xhtml:br/> The ip6tables default rules are similar, with its rules 2 and 10
						reflecting protocol naming and addressing differences. Instead of rule 8,
						however, ip6tables includes two rules that accept all incoming udp and tcp
						packets with a particular destination port range. This is because the
						current Netfilter implementation for IPv6 lacks reliable connection-tracking
						functionality.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.5.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4167-3:Verify ip6tables is enabled</title>
						<description override="0">The ip6tables service should be enabled.</description>
						<ident system="http://cce.mitre.org">CCE-4167-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20146"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.5.5.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4189-7:Verify iptables is enabled</title>
						<description override="0">The iptables service should be enabled.</description>
						<ident system="http://cce.mitre.org">CCE-4189-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20147"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.5.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Strengthen the Default Ruleset</title>
					<description xml:lang="en-US" override="0"> The default rules can be strengthened. The system
						scripts that activate the firewall rules expect them to be defined in the
						configuration files iptables and ip6tables in the directory /etc/sysconfig.
						Many of the lines in these files are similar to the command line arguments
						that would be provided to the programs /sbin/iptables or /sbin/ip6tables –
						but some are quite different. <xhtml:br/><xhtml:br/> The following recommendations describe how to strengthen the
						default ruleset configuration file. An alternative to editing this
						configuration file is to create a shell script that makes calls to the
						iptables program to load in rules, and then invokes service iptables save to
						write those loaded rules to /etc/sysconfig/iptables. <xhtml:br/><xhtml:br/> The following alterations can be made directly to
						/etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Instructions apply to
						both unless otherwise noted. Language and address conventions for regular
						iptables are used throughout this section; configuration for ip6tables will
						be either analogous or explicitly covered.</description>
					<warning xml:lang="en-US" override="0" category="general">The program system-config-securitylevel allows
						additional services to penetrate the default firewall rules and
						automatically adjusts /etc/ sysconfig/ iptables . This program is only
						useful if the default ruleset meets your security requirements. Otherwise,
						this program should not be used to make changes to the firewall
						configuration because it re-writes the saved configuration file. </warning>
					<Group id="usgcb-rhel5desktop-group-2.5.5.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Change the Default Policies</title>
						<description xml:lang="en-US" override="0"> Change the default policy to DROP (from
							ACCEPT) for the INPUT and FORWARD built-in chains: <xhtml:br/><xhtml:br/> *filter <xhtml:br/> :INPUT DROP [0:0] <xhtml:br/> :FORWARD
							DROP [0:0] <xhtml:br/><xhtml:br/> Changing the default policy in this way implements proper
							design for a firewall, i.e. any packets which are not explicitly
							permitted should not be accepted.</description>
						<Rule id="usgcb-rhel5desktop-rule-2.5.5.3.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-14264-6:The default policy for iptables INPUT table should be set appropriately</title>
							<description override="0">Change the default policy to DROP (from ACCEPT) for the
								INPUT built-in chain.</description>
							<ident system="http://cce.mitre.org">CCE-14264-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201474"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.5.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Uncommon Network Protocols</title>
				<description xml:lang="en-US" override="0"> The system includes support for several network
					protocols which are not commonly used. Although security vul- nerabilities in
					kernel networking code are not frequently discovered, the consequences can be
					dramatic. Ensuring uncommon network protocols are disabled reduces the system’s
					risk to attacks targeted at its implementation of those protocols.</description>
				<Group id="usgcb-rhel5desktop-group-2.5.7.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Support for DCCP</title>
					<description xml:lang="en-US" override="0"> To prevent the DCCP kernel module from being
						loaded, add the following line to /etc/modprobe.conf:<xhtml:br/><xhtml:br/><xhtml:code>install dccp /bin/true<xhtml:br/></xhtml:code><xhtml:br/> The Datagram Congestion Control Protocol (DCCP) is a relatively
						new transport layer protocol, designed to support streaming media and
						telephony.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.7.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14268-7:Disable Support for DCCP</title>
						<description override="0">Support for DCCP should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-14268-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201476"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.7.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Support for SCTP</title>
					<description xml:lang="en-US" override="0"> To prevent the SCTP kernel module from being
						loaded, add the following line to /etc/modprobe.conf:<xhtml:br/><xhtml:br/><xhtml:code>install sctp /bin/true<xhtml:br/></xhtml:code><xhtml:br/> The Stream Control Transmission Protocol (SCTP) is a transport
						layer protocol, designed to support the idea of message-oriented
						communication, with several streams of messages within one
						connection.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.7.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14132-5:Disable Support for SCTP</title>
						<description override="0">Support for SCTP should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-14132-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201477"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.7.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Support for RDS</title>
					<description xml:lang="en-US" override="0"> To prevent the RDS kernel module from being
						loaded, add the following line to /etc/modprobe.conf:<xhtml:br/><xhtml:br/><xhtml:code>install rds /bin/true<xhtml:br/></xhtml:code><xhtml:br/> The Reliable Datagram Sockets (RDS) protocol is a transport
						layer protocol designed to provide reliable high- bandwidth, low-latency
						communications between nodes in a cluster.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.7.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14027-7:Disable Support for RDS</title>
						<description override="0">Support for RDS should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-14027-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201478"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.5.7.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Support for TIPC</title>
					<description xml:lang="en-US" override="0"> To prevent the TIPC kernel module from being
						loaded, add the following line to /etc/modprobe.conf:<xhtml:br/><xhtml:br/><xhtml:code>install rds /bin/true<xhtml:br/></xhtml:code><xhtml:br/> The Transparent Inter-Process Communication (TIPC) protocol is
						designed to provide communications between nodes in a
						cluster..</description>
					<Rule id="usgcb-rhel5desktop-rule-2.5.7.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14911-2:Disable Support for TIPC</title>
						<description override="0">Support for TIPC should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-14911-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201479"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-2.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Logging and Auditing</title>
			<description xml:lang="en-US" override="0"> Successful local or network attacks on systems do not
				necessarily leave clear evidence of what happened. It is necessary to build a
				configuration in advance that collects this evidence, both in order to determine
				that something anomalous has occurred, and in order to respond appropriately. In
				addition, a well-configured logging and audit infrastructure will show evidence of
				any misconfiguration which might leave the system vulnerable to attack. <xhtml:br/><xhtml:br/> Logging and auditing take different approaches to collecting data. A
				logging infrastructure provides a framework for individual programs running on the
				system to report whatever events are considered interesting: the sshd program may
				report each successful or failed login attempt, while the sendmail program may
				report each time it sends an e-mail on behalf of a local or remote user. An auditing
				infrastructure, on the other hand, reports each instance of certain low-level
				events, such as entry to the setuid system call, regardless of which program caused
				the event to occur. <xhtml:br/><xhtml:br/> Auditing has the advantage of being more comprehensive, but the
				disadvantage of reporting a large amount of information, most of which is
				uninteresting. Logging (particularly using a standard framework like syslog) has the
				advantage of being compatible with a wide variety of client applications, and of
				reporting only information considered important by each application, but the
				disadvantage that the information reported is not consistent between applications. <xhtml:br/><xhtml:br/> A robust infrastructure will perform both logging and auditing, and will
				use configurable automated methods of summarizing the reported data, so that system
				administrators can remove or compress reports of events known to be uninteresting in
				favor of alert monitoring for events known to be interesting. <xhtml:br/><xhtml:br/> This section discusses how to configure logging, log monitoring, and
				auditing, using tools included with RHEL5. It is recommended that syslog be used for
				logging, with logwatch providing summarization, and that auditd be used for
				auditing, with aureport providing summarization.</description>
			<Group id="usgcb-rhel5desktop-group-2.6.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure Syslog</title>
				<description xml:lang="en-US" override="0"> Syslog has been the default Unix logging mechanism
					for many years. It has a number of downsides, including inconsistent log format,
					lack of authentication for received messages, and lack of authentication,
					encryption, or reliable transport for messages sent over a network. However, due
					to its long history, syslog is an accepted standard which is supported by almost
					all Unix applications. This section discusses how to configure syslog for best
					effect, and how to use tools provided with the system to maintain and monitor
					your logs.</description>
				<Rule id="usgcb-rhel5desktop-rule-2.6.1.0" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2011-02-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-17742-8:The rsyslog package should be installed or uninstalled as appropriate.</title>
					<description override="0">The rsyslog package should be installed or uninstalled as appropriate.</description>
					<ident system="http://cce.mitre.org">CCE-17742-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201480"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-2.6.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-17698-2:Configure Syslog</title>
					<description override="0">The rsyslog service should be enabled or disabled as appropriate.</description>
					<ident system="http://cce.mitre.org">CCE-17698-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20148"/>
					</check>
				</Rule>
				<Group id="usgcb-rhel5desktop-group-2.6.1.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Confirm Existence and Permissions of System Log
						Files</title>
					<description xml:lang="en-US" override="0"> For each log file LOGFILE referenced in
						/etc/rsyslog.conf, run the commands: <xhtml:br/><xhtml:br/><xhtml:code># touch LOGFILE<xhtml:br/> # chown root:root LOGFILE <xhtml:br/>
							# chmod 0600 LOGFILE <xhtml:br/></xhtml:code><xhtml:br/> Rsyslog will refuse to log to a file which does not exist. All
						messages intended for that file will be silently discarded, so it is
						important to verify that all log files exist. Some logs may contain
						sensitive information, so it is better to restrict permissions so that only
						administrative users can read or write logfiles.</description>
					<Value id="usgcb-rhel5desktop-var-2.6.1.2.a" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">User who owns log files</title>
						<description xml:lang="en-US" override="0">Specify user owner of all logfiles specified
							in /etc/rsyslog.conf.</description>
						<value selector="root">root</value>
					</Value>
					<Value id="usgcb-rhel5desktop-var-2.6.1.2.b" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">group who owns log files</title>
						<description xml:lang="en-US" override="0">Specify group owner of all logfiles specified
							in /etc/rsyslog.conf.</description>
						<value selector="root">root</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-17857-4:All rsyslog log files should be owned by the appropriate user.</title>
						<description override="0">All rsyslog log files should be owned by the appropriate user.</description>
						<ident system="http://cce.mitre.org">CCE-17857-4</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.6.1.2.a" export-name="oval:gov.nist.usgcb.rhel:var:20149"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20149"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-18240-2:All rsyslog log files should be owned by the appropriate group.</title>
						<description override="0">All rsyslog log files should be owned by the appropriate group.</description>
						<ident system="http://cce.mitre.org">CCE-18240-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-2.6.1.2.b" export-name="oval:gov.nist.usgcb.rhel:var:20150"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20150"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-18095-0:File permissions for all rsyslog log files should be set correctly.</title>
						<description override="0">File permissions for all rsyslog log files should be set correctly.</description>
						<ident system="http://cce.mitre.org">CCE-18095-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20151"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.6.1.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Rsyslog logs should be sent to a remote loghost</title>
					<description xml:lang="en-US" override="0"> Edit /etc/rsyslog.conf. Add or correct the line: <xhtml:br/><xhtml:br/> *.* @loghost.example.com <xhtml:br/><xhtml:br/> where loghost.example.com is the name of your central log server.<xhtml:br/><xhtml:br/> If system logs are to be useful in detecting malicious
						activities, it is necessary to send logs to a remote server. An intruder who
						has compromised the root account on a machine may delete the log entries
						which indicate that the system was attacked before they are seen by an
						administrator. <xhtml:br/><xhtml:br/> However, it is recommended that logs be stored on the local host
						in addition to being sent to the loghost, because syslog uses the UDP
						protocol to send messages over a network. UDP does not guarantee reliable
						delivery, and moderately busy sites will lose log messages occasionally,
						especially in periods of high traffic which may be the result of an attack.
						In addition, remote syslog messages are not authenticated in any way, so it
						is easy for an attacker to introduce spurious messages to the central log
						server. Also, some problems cause loss of network connectivity, which will
						prevent the sending of messages to the central server. For all of these
						reasons, it is better to store log messages both centrally and on each host,
						so that they can be correlated if necessary.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-17248-6:Rsyslog logs should be sent to a remote loghost or not as appropriate</title>
						<description override="0">Rsyslog logs should be sent to a remote loghost or not as appropriate</description>
						<ident system="http://cce.mitre.org">CCE-17248-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20152"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.6.1.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable rsyslogd to Accept Remote Messages on Loghosts
						Only</title>
					<description xml:lang="en-US" override="0"> Is this machine the central log server for your
						organization? If so, edit the file /etc/sysconfig/rsyslog. Add or correct the
						following line:<xhtml:br/><xhtml:br/> SYSLOGD_OPTIONS="-m 0 -r -s example.com " <xhtml:br/><xhtml:br/> where example.com is the name of your domain.<xhtml:br/><xhtml:br/> If the machine is not a log server, edit /etc/sysconfig/syslog,
						and instead add or correct the line: <xhtml:br/><xhtml:br/> SYSLOGD_OPTIONS="-m 0" <xhtml:br/><xhtml:br/> By default, RHEL5's syslog does not listen over the network for
						log messages. The -r flag enables syslogd to listen over a network, and
						should be used only if necessary. The -s example.com flag strips the domain
						name example.com from each sending machine's hostname before logging
						messages from that host, to reduce the amount of redundant information
						placed in log files. See the syslogd(8) man page for further
						information.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-17639-6:Rsyslog should accept remote messages or not as appropriate</title>
						<description override="0">Rsyslog should accept remote messages or not as appropriate</description>
						<ident system="http://cce.mitre.org">CCE-17639-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20153"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.6.1.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Ensure All Logs are Rotated by logrotate</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/logrotate.d/syslog. Find the
						first line, which should look like this (wrapped for clarity): <xhtml:br/><xhtml:br/> /var/log/messages /var/log/secure /var/log/maillog
						/var/log/spooler \ /var/log/boot.log /var/log/cron { <xhtml:br/><xhtml:br/> Edit this line so that it contains a one-space-separated listing
						of each log file referenced in /etc/syslog.conf. <xhtml:br/> All logs in use
						on a system must be rotated regularly, or the log files will consume disk
						space over time, eventually interfering with system operation. The file
						/etc/logrotate.d/syslog is the configuration file used by the logrotate
						program to maintain all log files written by syslog. By default, it rotates
						logs weekly and stores four archival copies of each log. These settings can
						be modified by editing /etc/logrotate.conf, but the defaults are sufficient
						for purposes of this guide. <xhtml:br/><xhtml:br/> Note that logrotate is run nightly by the cron job
						/etc/cron.daily/logrotate. If particularly active logs need to be rotated
						more often than once a day, some other mechanism must be used.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.6.1.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4182-2:Ensure All Logs are Rotated by logrotate</title>
						<description override="0">The logrotate (syslog rotater) service should be
							enabled.</description>
						<ident system="http://cce.mitre.org">CCE-4182-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20154"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-2.6.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">System Accounting with auditd</title>
				<description xml:lang="en-US" override="0"> The audit service is the current Linux recommendation
					for kernel-level auditing. By default, the service audits about SELinux AVC
					denials and certain types of security-relevant events such as system logins,
					account modifications, and authentication events performed by programs such as
					sudo. <xhtml:br/><xhtml:br/> Under its default configuration, auditd has modest disk space
					requirements, and should not noticeably impact system performance. The audit
					service, in its default configuration, is strongly recommended for all sites,
					regardless of whether they are running SELinux. <xhtml:br/><xhtml:br/> DoD or federal networks often have substantial auditing requirements
					and auditd can be conﬁgured to meet these requirements.<xhtml:br/><xhtml:br/> Typical DoD requirements include:<xhtml:br/><xhtml:br/><xhtml:ul>
						<xhtml:li>Ensure Auditing is Conﬁgured to Collect Certain System Events <xhtml:ul>
								<xhtml:li>Information on the Use of Print Command (unsuccessful and
									successful)</xhtml:li>
								<xhtml:li>Startup and Shutdown Events (unsuccessful and
									successful)</xhtml:li>
							</xhtml:ul></xhtml:li>
						<xhtml:li>Ensure the auditing software can record the following for each
							audit event: <xhtml:ul>
								<xhtml:li>Date and time of the event</xhtml:li>
								<xhtml:li>Userid that initiated the event</xhtml:li>
								<xhtml:li>Type of event</xhtml:li>
								<xhtml:li>Success or failure of the event</xhtml:li>
								<xhtml:li>For I&amp;A events, the origin of the request (e.g.,
									terminal ID)</xhtml:li>
								<xhtml:li>For events that introduce an object into a user’s address
									space, and for object deletion events, the name of the object,
									and in MLS systems, the objects security level.</xhtml:li>
							</xhtml:ul></xhtml:li>
						<xhtml:li>Ensure ﬁles are backed up no less than weekly onto a diﬀerent
							system than the system being audited or backup media.</xhtml:li>
						<xhtml:li>Ensure old logs are closed out and new audit logs are started
							daily</xhtml:li>
						<xhtml:li>Ensure the conﬁguration is immutable. With the -e 2 setting a
							reboot will be required to change any audit rules.</xhtml:li>
						<xhtml:li>Ensure that the audit data ﬁles have permissions of 640, or more
							restrictive.</xhtml:li>
					</xhtml:ul></description>
				<Group id="usgcb-rhel5desktop-group-2.6.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable the auditd Service</title>
					<description xml:lang="en-US" override="0"> Ensure that the auditd service is enabled (this
						is the default): <xhtml:br/><xhtml:br/><xhtml:code># chkconfig auditd on <xhtml:br/></xhtml:code><xhtml:br/> By default, auditd logs only SELinux denials, which are helpful
						for debugging SELinux and discovering intrusion attempts, and certain types
						of security events, such as modifications to user accounts (useradd, passwd,
						etc), login events, and calls to sudo. <xhtml:br/><xhtml:br/> Data is stored in /var/log/audit/audit.log. By default, auditd
						rotates 4 logs by size (5MB), retaining a maximum of 20MB of data in total,
						and refuses to write entries when the disk is too full. This minimizes the
						risk of audit data filling its partition and impacting other services.
						However, it is possible to lose audit data if the system is
						busy.</description>
					<Rule id="usgcb-rhel5desktop-rule-2.6.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4292-9:Enable the auditd Service</title>
						<description override="0">The auditd service should be enabled.</description>
						<ident system="http://cce.mitre.org">CCE-4292-9</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20156"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.6.2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable Auditing for Processes Which Start Prior to the
						Audit Daemon</title>
					<description xml:lang="en-US" override="0"> To ensure that all processes can be audited, even
						those which start prior to the audit daemon, add the argument audit=1 to the
						kernel line in /etc/grub.conf, in the manner below:<xhtml:br/><xhtml:br/> kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00
						rhgb quiet audit=1<xhtml:br/><xhtml:br/> Each process on the system carries an ”auditable” ﬂag which
						indicates whether its activities can be audited. Although auditd takes care
						of enabling this for all processes which launch after it does, adding the
						kernel argument ensures that it is set for every process during boot. </description>
					<Rule id="usgcb-rhel5desktop-rule-2.6.2.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-15026-8:Enable Auditing for Processes Which Start Prior to the Audit
							Daemon</title>
						<description override="0"> To ensure that all processes can be audited, even those which
							start prior to the audit daemon, add the argument audit=1 to the kernel
							line in /etc/grub.conf, in the manner below:<xhtml:br/><xhtml:br/>kernel /vmlinuz-version ro vga=ext
							root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1</description>
						<ident system="http://cce.mitre.org">CCE-15026-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20157"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-2.6.2.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Conﬁgure auditd Rules for Comprehensive Auditing</title>
					<description xml:lang="en-US" override="0"> The auditd program can perform comprehensive
						monitoring of system activity. This section describes rec- ommended
						conﬁguration settings for comprehensive auditing, but a full description of
						the auditing system’s capabilities is beyond the scope of this guide. The
						mailing list linux-audit@redhat.com may be a good source of further information.<xhtml:br/><xhtml:br/> The audit subsystem supports extensive collection of events, including:<xhtml:br/><xhtml:ul>
							<xhtml:li>Tracing of arbitrary system calls (identiﬁed by name or
								number) on entry or exit.</xhtml:li>
							<xhtml:li>Filtering by PID, UID, call success, system call argument
								(with some limitations), etc.</xhtml:li>
							<xhtml:li>Monitoring of speciﬁc ﬁles for modiﬁcations to the ﬁle’s
								contents or metadata.</xhtml:li>
						</xhtml:ul><xhtml:br/> Auditing rules are controlled in the ﬁle /etc/audit/audit.rules.
						Add rules to it to meet the auditing re- quirements for your organization.
						Each line in /etc/audit/audit.rules represents a series of arguments that
						can be passed to auditctl and can be individually tested as such. See
						documentation in /usr/share/doc/ audit-version and in the related man pages
						for more details.<xhtml:br/><xhtml:br/> Recommended audit rules are provided in
						/usr/share/doc/audit-version /stig.rules. In order to activate those rules:<xhtml:br/><xhtml:br/><xhtml:code># cp /usr/share/doc/audit-version /stig.rules
							/etc/audit/audit.rules<xhtml:br/></xhtml:code><xhtml:br/> and then edit /etc/audit/audit.rules and comment out the lines
						containing arch= which are not appropriate for your system’s architecture.
						Then review and understand the following rules, ensuring rules are activated
						as needed for the appropriate architecture.<xhtml:br/><xhtml:br/> After reviewing all the rules, reading the following sections,
						and editing as needed, activate the new rules:<xhtml:br/><xhtml:br/><xhtml:code># service auditd restart</xhtml:code></description>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Records Events that Modify Date and Time
							Information</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules,
							setting ARCH to either b32 or b64 as appropriate for your system:<xhtml:br/><xhtml:br/> -a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S
							stime -k time-change<xhtml:br/> -a always,exit -F arch=ARCH -S
							clock_settime -F a0=0 -k time-change<xhtml:br/> -w /etc/localtime -p wa -k
							time-change </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14051-7:Records Events that Modify Date and Time Information</title>
							<description override="0">Audit rules about time</description>
							<ident system="http://cce.mitre.org">CCE-14051-7</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201575"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Record Events that Modify User/Group
							Information</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules,
							in order to capture events that modify account changes:<xhtml:br/><xhtml:br/> -w /etc/group -p wa -k identity<xhtml:br/> -w /etc/passwd -p
							wa -k identity<xhtml:br/> -w /etc/gshadow -p wa -k identity<xhtml:br/>
							-w /etc/shadow -p wa -k identity<xhtml:br/> -w /etc/security/opasswd -p
							wa -k identity </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14829-6:Record Events that Modify User/Group Information</title>
							<description override="0">Audit rules about User/Group Information</description>
							<ident system="http://cce.mitre.org">CCE-14829-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20158"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Record Events that Modify the System’s Network
							Environment</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules,
							setting ARCH to either b32 or b64 as appropriate for your system:<xhtml:br/><xhtml:br/> -a exit,always -F arch=ARCH -S sethostname -S setdomainname
							-k system-locale<xhtml:br/> -w /etc/issue -p wa -k
							system-locale<xhtml:br/> -w /etc/issue.net -p wa -k
							system-locale<xhtml:br/> -w /etc/hosts -p wa -k system-locale<xhtml:br/>
							-w /etc/sysconfig/network -p wa -k system-locale<xhtml:br/></description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14816-3:Record Events that Modify the System’s Network
								Environment</title>
							<description override="0">Audit rules about the System’s Network
								Environment</description>
							<ident system="http://cce.mitre.org">CCE-14816-3</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20159"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Record Events that Modify the System’s Mandatory
							Access Controls</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules:<xhtml:br/><xhtml:br/> -w /etc/selinux/ -p wa -k MAC-policy </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14821-3:Record Events that Modify the System’s Mandatory Access
								Controls</title>
							<description override="0">Audit rules about the System’s Mandatory Access
								Controls</description>
							<ident system="http://cce.mitre.org">CCE-14821-3</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20160"/>
							</check>
						</Rule>
					</Group>

					<Group id="usgcb-rhel5desktop-group-2.6.2.4.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Discretionary Access Control
							Permission Modiﬁcation Events</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							ﬁle permission changes for all users and root. Add the following to
							/etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate
							for your system:<xhtml:br/><xhtml:br/> -a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat
							-F auid&gt;=500 \<xhtml:br/> -F auid!=4294967295 -k perm_mod<xhtml:br/> -a
							always,exit -F arch=ARCH -S chown -S fchown -S fchownat -S lchown -F
							auid&gt;=500 \<xhtml:br/> -F auid!=4294967295 -k perm_mod<xhtml:br/> -a
							always,exit -F arch=ARCH -S setxattr -S lsetxattr -S fsetxattr -S
							removexattr -S \<xhtml:br/> lremovexattr -S fremovexattr -F auid&gt;=500 -F
							auid!=4294967295 -k perm_mod </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.7.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14058-2:Ensure auditd Collects Discretionary Access Control Permission
								Modiﬁcation Events</title>
							<description override="0">Audit rules about the Discretionary Access Control
								Permission Modiﬁcation Events</description>
							<ident system="http://cce.mitre.org">CCE-14058-2</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20163"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.8" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Unauthorized Access Attempts
							to Files (unsuccessful)</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							unauthorized ﬁle accesses for all users and root. Add the following to
							/etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate
							for your system:<xhtml:br/><xhtml:br/> -a always,exit -F arch=ARCH -S creat -S open -S openat -S
							truncate -S ftruncate \<xhtml:br/> -F exit=-EACCES -F auid&gt;=500 -F
							auid!=4294967295 -k access<xhtml:br/> -a always,exit -F arch=ARCH -S
							creat -S open -S openat -S truncate -S ftruncate \<xhtml:br/> -F
							exit=-EPERM -F auid&gt;=500 -F auid!=4294967295 -k access </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.8.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14917-9:Ensure auditd Collects Unauthorized Access Attempts to Files
								(unsuccessful)</title>
							<description override="0">Audit rules about the Unauthorized Access Attempts to Files
								(unsuccessful)</description>
							<ident system="http://cce.mitre.org">CCE-14917-9</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20164"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.9" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Information on the Use of
							Privileged Commands</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							the execution of privileged commands for all users and root. Add the
							following to /etc/audit/audit.rules:<xhtml:br/><xhtml:br/> -a always,exit -F path=/bin/ping -F perm=x -F auid&gt;=500 -F
							auid!=4294967295 \<xhtml:br/> -k privileged </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.9.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14296-8:Ensure auditd Collects Information on the Use of Privileged
								Commands</title>
							<description override="0">Audit rules about the Information on the Use of Privileged
								Commands</description>
							<ident system="http://cce.mitre.org">CCE-14296-8</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20165"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.10" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Information on Exporting to
							Media (successful)</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							media exportation events for all users and root. Add the following to
							/etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate
							for your system:<xhtml:br/><xhtml:br/> -a always,exit -F arch=ARCH -S mount -F auid&gt;=500 -F
							auid!=4294967295 -k export </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.10.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14569-8:Ensure auditd Collects Information on Exporting to Media
								(successful)</title>
							<description override="0">Audit rules about the Information on Exporting to Media
								(successful)</description>
							<ident system="http://cce.mitre.org">CCE-14569-8</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20166"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.11" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Files Deletion Events by User
							(successful and unsuccessful)</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							ﬁle deletion events for all users and root. Add the following to
							/etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate
							for your system:<xhtml:br/><xhtml:br/> -a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename
							-S renameat -F auid&gt;=500 \<xhtml:br/> -F auid!=4294967295 -k delete </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.11.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14820-5:Ensure auditd Collects Files Deletion Events by User (successful
								and unsuccessful)</title>
							<description override="0">Audit rules about the Files Deletion Events by User
								(successful and unsuccessful)</description>
							<ident system="http://cce.mitre.org">CCE-14820-5</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20167"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.12" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects System Administrator
							Actions</title>
						<description xml:lang="en-US" override="0"> At a minimum the audit system should collect
							administrator actions for all users and root. Add the following to /etc/audit/audit.rules:<xhtml:br/><xhtml:br/> -w /etc/sudoers -p wa -k actions</description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.12.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14824-7:Ensure auditd Collects System Administrator Actions</title>
							<description override="0">Audit rules about the System Administrator
								Actions</description>
							<ident system="http://cce.mitre.org">CCE-14824-7</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20168"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.13" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Ensure auditd Collects Information on Kernel Module
							Loading and Unloading</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules
							in order to capture kernel module loading and unloading events:<xhtml:br/><xhtml:br/> -w /sbin/insmod -p x -k modules<xhtml:br/> -w /sbin/rmmod -p
							x -k modules<xhtml:br/> -w /sbin/modprobe -p x -k modules<xhtml:br/> -a
							always,exit -S init_module -S delete_module -k modules<xhtml:br/></description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.13.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14688-6:Ensure auditd Collects Information on Kernel Module Loading and
								Unloading</title>
							<description override="0">Audit rules about the Information on Kernel Module Loading
								and Unloading</description>
							<ident system="http://cce.mitre.org">CCE-14688-6</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201685"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-2.6.2.4.14" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Make the auditd Conﬁguration Immutable</title>
						<description xml:lang="en-US" override="0"> Add the following to /etc/audit/audit.rules
							in order to make the conﬁguration immutable:<xhtml:br/><xhtml:br/> -e 2<xhtml:br/><xhtml:br/> With this setting, a reboot will be required to change any
							audit rules. </description>
						<Rule id="usgcb-rhel5desktop-rule-2.6.2.4.14.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">draft</status>
							<version update="1"/>
							<title override="0">CCE-14692-8:Make the auditd Conﬁguration Immutable</title>
							<description override="0">Force a reboot to change audit rules</description>
							<ident system="http://cce.mitre.org">CCE-14692-8</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20169"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
		</Group>
	</Group>
	<Group id="usgcb-rhel5desktop-group-3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
		<title xml:lang="en-US" override="0">Services</title>
		<description override="0">TODO::INSERT</description>
		<Group id="usgcb-rhel5desktop-group-3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Obsolete Services</title>
			<description xml:lang="en-US" override="0"> This section discusses a number of network-visible
				services which have historically caused problems for system security, and for which
				disabling or severely limiting the service has been the best available guidance for
				some time. As a result of this consensus, these services are not installed as part
				of RHEL5 by default. <xhtml:br/><xhtml:br/> Organizations which are running these services should prioritize
				switching to more secure services which provide the needed functionality. If it is
				absolutely necessary to run one of these services for legacy reasons, care should be
				taken to restrict the service as much as possible, for instance by configuring host
				firewall software (see Section 2.5.5) to restrict access to the vulnerable service
				to only those remote hosts which have a known need to use it.</description>
			<Group id="usgcb-rhel5desktop-group-3.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Inetd and Xinetd</title>
				<description xml:lang="en-US" override="0"> Is there an operational need to run the deprecated
					inetd or xinetd software packages? If not, ensure that they are removed from the
					system: <xhtml:br/><xhtml:br/><xhtml:code># yum erase inetd xinetd <xhtml:br/></xhtml:code><xhtml:br/> Beginning with Red Hat Enterprise Linux 5, the xinetd service is no
					longer installed by default. This change represents increased awareness that the
					dedicated network listener model does not improve security or reliability of
					services, and that restriction of network listeners is better handled using a
					granular model such as SELinux than using xinetd's limited security
					options.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4234-1:Disable Inetd</title>
					<description override="0">The inetd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4234-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20170"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4252-3:Disable Xinetd</title>
					<description override="0">The xinetd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4252-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20171"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4023-8:Uninstall Inetd</title>
					<description override="0">The inetd package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4023-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20172"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4164-0:Uninstall Xinetd</title>
					<description override="0">The xinetd package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4164-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20173"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Telnet</title>
				<description xml:lang="en-US" override="0"> Is there a mission-critical reason for users to
					access the system via the insecure telnet protocol, rather than the more secure
					SSH protocol? If not, ensure that the telnet server is removed from the system: <xhtml:br/><xhtml:br/><xhtml:code># yum erase telnet-server <xhtml:br/></xhtml:code><xhtml:br/> The telnet protocol uses unencrypted network communication, which
					means that data from the login session, including passwords and all other
					information transmitted during the session, can be stolen by eavesdroppers on
					the network, and also that outsiders can easily hijack the session to gain
					authenticated access to the telnet server. Organizations which use telnet should
					be actively working to migrate to a more secure protocol. <xhtml:br/><xhtml:br/> See Section 3.5 for information about the SSH service.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.2.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4330-7:Uninstall Telnet server</title>
					<description override="0">The telnet-server package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4330-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20174"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3390-2:Disable telnet service</title>
					<description override="0">telnet service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3390-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201745"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Rlogin, Rsh, and Rcp</title>
				<description xml:lang="en-US" override="0">The Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.2.3.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4308-3:Remove the Rsh Server Commands from the System</title>
					<description override="0">The rsh-server package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4308-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20177"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.3.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3974-3:disable rcp</title>
					<description override="0">The rcp service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3974-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201774"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.3.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4141-8:disable rsh</title>
					<description override="0">The rsh service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4141-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201775"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.3.1.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3537-8:disable rlogin</title>
					<description override="0">The rlogin service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3537-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201776"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.2.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">NIS</title>
				<description xml:lang="en-US" override="0"> The NIS client service ypbind is not activated by
					default. In the event that it was activated at some point, disable it by
					executing the command: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig ypbind off <xhtml:br/></xhtml:code><xhtml:br/> The NIS server package is not installed by default. In the event
					that it was installed at some point, remove it from the system by executing the
					command: <xhtml:br/><xhtml:br/><xhtml:code># yum erase ypserv <xhtml:br/></xhtml:code><xhtml:br/> The Network Information Service (NIS), also known as 'Yellow Pages'
					(YP), and its successor NIS+ have been made obsolete by Kerberos, LDAP, and
					other modern centralized authentication services. NIS should not be used because
					it suffers from security problems inherent in its design, such as inadequate
					protection of important authentication information.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.2.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4348-9:Uninstall NIS</title>
					<description override="0">The ypserv package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4348-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20180"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.4.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3705-1:Disable NIS</title>
					<description override="0">The ypbind service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3705-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20181"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.2.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">TFTP Server</title>
				<description xml:lang="en-US" override="0"> Is there an operational need to run the deprecated
					TFTP server software? If not, ensure that it is removed from the system: <xhtml:br/><xhtml:br/><xhtml:code># yum erase tftp-server <xhtml:br/></xhtml:code><xhtml:br/> TFTP is a lightweight version of the FTP protocol which has
					traditionally been used to configure networking equipment. However, TFTP
					provides little security, and modern versions of networking operating systems
					frequently support configuration via SSH or other more secure protocols. A TFTP
					server should be run only if no more secure method of supporting existing
					equipment can be found.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.2.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3916-4:Uninstall TFTP Server</title>
					<description override="0">The tftp-server package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-3916-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20182"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.2.5.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4273-9:Disable TFTP Server</title>
					<description override="0">The tftp service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4273-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:201825"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">BaseServices</title>
			<description xml:lang="en-US" override="0"> This section addresses the base services that are
				configured to start up on boot in a RHEL5 default installation. Some of these
				services listen on the network and should be treated with particular discretion. The
				other services are local system utilities that may or may not be extraneous. Each of
				these services should be disabled if not required.</description>
			<Group id="usgcb-rhel5desktop-group-3.3.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">ISDN Support (isdn)</title>
				<description xml:lang="en-US" override="0"> The ISDN service facilitates Internet connectivity in
					the presence of an ISDN modem. If an ISDN modem is not being used, disable this
					service: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig isdn off</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.3.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4286-1:ISDN Support (isdn)</title>
					<description override="0">The isdn service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4286-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20186"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.3.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Kdump Kernel Crash Analyzer (kdump)</title>
				<description xml:lang="en-US" override="0"> Kdump is a new kernel crash dump analyzer. It uses
					kexec to boot a secondary kernel ('capture' kernel) following a system crash.
					The kernel dump from the system crash is loaded into the capture kernel for
					analysis. <xhtml:br/><xhtml:br/> Unless the system is used for kernel development or testing, disable
					the service: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig kdump off</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.3.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3425-6:Kdump Kernel Crash Analyzer (kdump)</title>
					<description override="0">The kdump service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3425-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20187"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.3.9" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Network Service (network)</title>
				<description xml:lang="en-US" override="0"> The network service allows associated network
					interfaces to access the network. This section contains general guidance for
					controlling the operation of the service. For kernel parameters which affect
					networking, see Section</description>
				<Group id="usgcb-rhel5desktop-group-3.3.9.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Zeroconf Networking</title>
					<description xml:lang="en-US" override="0"> Zeroconf networking allows the system to assign
						itself an IP address and engage in IP communication without a
						statically-assigned address or even a DHCP server. Automatic address
						assignment via Zeroconf (or DHCP) is not recommended. <xhtml:br/><xhtml:br/> To disable Zeroconf automatic route assignment in the
						169.245.0.0 subnet, add or correct the following line in
						/etc/sysconfig/network: <xhtml:br/><xhtml:br/> NOZEROCONF=yes <xhtml:br/><xhtml:br/> Zeroconf addresses are in the network 169.254.0.0. The
						networking scripts add entries to the system's routing table for these
						addresses. Zeroconf address assignment commonly occurs when the system is
						configured to use DHCP but fails to receive an address assignment from the
						DHCP server.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.3.9.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14054-1:Disable Zeroconf Networking</title>
						<description override="0">Disable Zeroconf automatic route assignment in the 169.245.0.0
							subnet.</description>
						<ident system="http://cce.mitre.org">CCE-14054-1</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20193"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.3.12" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Boot Caching (readahead early/readahead later)</title>
				<description xml:lang="en-US" override="0"> The following services provide one-time caching of
					files belonging to some boot services, with the goal of allowing the system to
					boot faster. <xhtml:br/><xhtml:br/> It is recommended that this service be disabled on most machines: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig readahead_early off <xhtml:br/> # chkconfig
						readahead_later off <xhtml:br/></xhtml:code><xhtml:br/> The readahead services do not substantially increase a system's risk
					exposure, but they also do not provide great benefit. Unless the system is
					running a specialized application for which the file caching substantially
					improves system boot time, this guide recommends disabling the
					services.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.3.12.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4421-4:Boot Caching (readahead early/readahead later)</title>
					<description override="0">The readahead_early service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4421-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20196"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.3.12.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4302-6:Boot Caching (readahead early/readahead later)</title>
					<description override="0">The readahead_later service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4302-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20197"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.3.14" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Bluetooth Support</title>
				<description xml:lang="en-US" override="0"> Bluetooth provides a way to transfer information
					between devices such as mobile phones, laptops, PCs, printers, digital cameras,
					and video game consoles over a short-range wireless link. Any wireless
					communication presents a serious security risk to sensitive or classified
					systems. Section 2.5.2 contains information on the related topic of wireless
					networking. <xhtml:br/><xhtml:br/> Removal of hardware is the only way to ensure that the Bluetooth
					wireless capability remains disabled. If it is completely impractical to remove
					the Bluetooth hardware module, and site policy still allows the device to enter
					sensitive spaces, every effort to disable the capability via software should be
					made. In general, acquisition policy should include provisions to prevent the
					purchase of equipment that will be used in sensitive spaces and includes
					Bluetooth capabilities.</description>
				<Group id="usgcb-rhel5desktop-group-3.3.14.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Bluetooth Host Controller Interface Daemon (bluetooth)</title>
					<description xml:lang="en-US" override="0"> The bluetooth service enables the system to use
						Bluetooth devices. If the system requires no Bluetooth devices, disable this service:<xhtml:br/><xhtml:code># chkconfig bluetooth off</xhtml:code></description>
					<Rule id="usgcb-rhel5desktop-rule-3.3.14.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4355-4:Bluetooth Host Controller Interface Daemon (bluetooth)</title>
						<description override="0">The bluetooth service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4355-4</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20200"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.3.14.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Bluetooth Input Devices (hidd)</title>
					<description xml:lang="en-US" override="0"> The hidd service provides support for Bluetooth
						input devices. If the system has no Bluetooth input devices (e.g. keyboard
						or mouse), disable this service: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig hidd off</xhtml:code></description>
					<Rule id="usgcb-rhel5desktop-rule-3.3.14.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4377-8:Bluetooth Input Devices (hidd)</title>
						<description override="0">The hidd service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4377-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20201"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Cron and At Daemons</title>
			<description xml:lang="en-US" override="0"> The cron and at services are used to allow commands to be
				executed at a later time. The cron service is required by almost all systems to
				perform necessary maintenance tasks, while at may or may not be required on a given
				system. Both daemons should be configured defensively.</description>
			<Rule id="usgcb-rhel5desktop-rule-3.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
				<status date="2010-07-01">accepted</status>
				<version update="1"/>
				<title override="0">CCE-4324-0:Enable cron Daemon</title>
				<description override="0">The crond service should be enabled.</description>
				<ident system="http://cce.mitre.org">CCE-4324-0</ident>
				<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
					<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20205"/>
				</check>
			</Rule>
			<Group id="usgcb-rhel5desktop-group-3.4.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Restrict Permissions on Files Used by cron</title>
				<description xml:lang="en-US" override="0"><xhtml:ol>
						<xhtml:li>Restrict the permissions on the primary system crontab file: <xhtml:br/><xhtml:br/><xhtml:code># chown root:root /etc/crontab <xhtml:br/> # chmod 600
								/etc/crontab</xhtml:code></xhtml:li>
						<xhtml:li>If anacron has not been removed, restrict the permissions on its
							primary configuration file: <xhtml:br/><xhtml:br/><xhtml:code># chown root:root /etc/anacrontab <xhtml:br/> # chmod 600
								/etc/anacrontab </xhtml:code></xhtml:li>
						<xhtml:li>Restrict the permission on all system crontab directories: <xhtml:br/><xhtml:br/><xhtml:code># cd /etc <xhtml:br/> # chown -R root:root cron.hourly
								cron.daily cron.weekly cron.monthly cron.d <xhtml:br/> # chmod -R
								go-rwx cron.hourly cron.daily cron.weekly cron.monthly cron.d
							</xhtml:code></xhtml:li>
						<xhtml:li>Restrict the permissions on the spool directory for user crontab
							files: <xhtml:br/><xhtml:br/><xhtml:code># chown root:root /var/spool/cron <xhtml:br/> # chmod -R
								go-rwx /var/spool/cron </xhtml:code></xhtml:li>
					</xhtml:ol><xhtml:br/><xhtml:br/> Cron and anacron make use of a number of configuration files and
					directories. The system crontabs need only be edited by root, and user crontabs
					are edited using the setuid root crontab command. If unprivileged users can
					modify system cron configuration files, they may be able to gain elevated
					privileges, so all unnecessary access to these files should be
					disabled.</description>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.group" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">group owner of /etc/crontab</title>
					<description xml:lang="en-US" override="0">Specify group owner of /etc/crontab.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.user" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">user owner of /etc/crontab</title>
					<description xml:lang="en-US" override="0">Specify user owner of /etc/crontab.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.group" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">group owner of /etc/anacrontab</title>
					<description xml:lang="en-US" override="0">Specify group owner of
						/etc/ancrontab.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.user" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">user owner of /etc/anacrontab</title>
					<description xml:lang="en-US" override="0">Specify user owner of
						/etc/anacrontab.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">group owner of cron.hourly cron.daily cron.weekly cron.monthly
						cron.d</title>
					<description xml:lang="en-US" override="0">Specify group owner of /etc/cron.* files and
						directories.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">user owner of cron.hourly cron.daily cron.weekly cron.monthly
						cron.d</title>
					<description xml:lang="en-US" override="0">Specify user owner of /etc/cron.* files and
						directories.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.spool.directory.group" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">group owner of /var/spool/cron</title>
					<description xml:lang="en-US" override="0">Specify group owner of
						/var/spool/cron.</description>
					<value selector="root">root</value>
				</Value>
				<Value id="usgcb-rhel5desktop-var-3.4.2.spool.directory.user" type="string" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
					<title override="0">user owner of /var/spool/cron</title>
					<description xml:lang="en-US" override="0">Specify user owner of
						/var/spool/cron.</description>
					<value selector="root">root</value>
				</Value>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3626-9:Set group owner on /etc/crontab</title>
					<description override="0">The /etc/crontab file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-3626-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.group" export-name="oval:gov.nist.usgcb.rhel:var:20208"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20208"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3851-3:Set user owner on /etc/crontab</title>
					<description override="0">The /etc/crontab file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-3851-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.primary.user" export-name="oval:gov.nist.usgcb.rhel:var:20209"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20209"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4388-5:Set Permissions on /etc/crontab</title>
					<title override="0">Restrict Permissions on Files Used by cron</title>
					<description override="0">File permissions for /etc/crontab should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4388-5</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20210"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3604-6:Set group owner on /etc/anacrontab</title>
					<description override="0">The /etc/anacrontab file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-3604-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.group" export-name="oval:gov.nist.usgcb.rhel:var:20211"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20211"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4379-4:Set user owner on /etc/anacrontab</title>
					<description override="0">The /etc/anacrontab file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-4379-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.anacrontab.user" export-name="oval:gov.nist.usgcb.rhel:var:20212"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20212"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.2.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4304-2:Set Permissions on /etc/anacrontab</title>
					<description override="0">File permissions for /etc/anacrontab should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4304-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20213"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4054-3:Set group owner on /etc/cron.hourly</title>
					<description override="0">The /etc/cron.hourly file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-4054-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" export-name="oval:gov.nist.usgcb.rhel:var:20214"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20214"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3481-9:Set group owner on /etc/cron.daily</title>
					<description override="0">The /etc/cron.daily file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-3481-9</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" export-name="oval:gov.nist.usgcb.rhel:var:20214"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20215"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4331-5:Set group owner on /etc/cron.weekly</title>
					<description override="0">The /etc/cron.weekly file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-4331-5</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" export-name="oval:gov.nist.usgcb.rhel:var:20214"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20216"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.d" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4322-4:Set group owner on /etc/cron.monthly</title>
					<description override="0">The /etc/cron.monthly file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-4322-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" export-name="oval:gov.nist.usgcb.rhel:var:20214"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20217"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.e" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4212-7:Set group owner on /etc/cron.d</title>
					<description override="0">The /etc/cron.d file should be owned by the appropriate
						group.</description>
					<ident system="http://cce.mitre.org">CCE-4212-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.group" export-name="oval:gov.nist.usgcb.rhel:var:20214"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20218"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.f" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3983-4:Set user owner on /etc/cron.hourly</title>
					<description override="0">The /etc/cron.hourly file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-3983-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" export-name="oval:gov.nist.usgcb.rhel:var:20219"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20219"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.g" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4022-0:Set user owner on /etc/cron.daily</title>
					<description override="0">The /etc/cron.daily file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-4022-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" export-name="oval:gov.nist.usgcb.rhel:var:20219"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20220"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.h" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3833-1:Set user owner on /etc/cron.weekly</title>
					<description override="0">The /etc/cron.weekly file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-3833-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" export-name="oval:gov.nist.usgcb.rhel:var:20219"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20221"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.i" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4441-2:Set user owner on /etc/cron.monthly</title>
					<description override="0">The /etc/cron.monthly file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-4441-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" export-name="oval:gov.nist.usgcb.rhel:var:20219"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20222"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.j" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4380-2:Set user owner on /etc/cron.d</title>
					<description override="0">The /etc/cron.d file should be owned by the appropriate
						user.</description>
					<ident system="http://cce.mitre.org">CCE-4380-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-export value-id="usgcb-rhel5desktop-var-3.4.2.system.crontab.directories.user" export-name="oval:gov.nist.usgcb.rhel:var:20219"/>
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20223"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.k" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4106-1:Set permissions on /etc/cron.hourly</title>
					<description override="0">File permissions for /etc/cron.hourly should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4106-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20224"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.l" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4450-3:Set permissions on /etc/cron.daily</title>
					<description override="0">File permissions for /etc/cron.daily should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4450-3</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20225"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.m" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4203-6:Set permissions on /etc/cron.weekly</title>
					<description override="0">File permissions for /etc/cron.weekly should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4203-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20226"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.n" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4251-5:Set permissions on /etc/cron.monthly</title>
					<description override="0">File permissions for /etc/cron.monthly should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4251-5</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20227"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.4.2.3.o" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4250-7:Set permissions on /etc/cron.d</title>
					<description override="0">File permissions for /etc/cron.d should be set
						correctly.</description>
					<ident system="http://cce.mitre.org">CCE-4250-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20228"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.4.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable at if Possible</title>
				<description xml:lang="en-US" override="0">Unless the at daemon is required, disable it with the
					following command:<xhtml:br/><xhtml:br/><xhtml:code># chkconfig atd off<xhtml:br/></xhtml:code><xhtml:br/> Many of the periodic or delayed execution features of the at daemon
					can be provided through the cron daemon instead. </description>
				<Rule id="usgcb-rhel5desktop-rule-3.4.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">draft</status>
					<version update="1"/>
					<title override="0">CCE-14466-7:The 'at' daemon should be disabled</title>
					<description override="0">The atd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-14466-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:202052"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">SSH Server</title>
			<description xml:lang="en-US" override="0"> The SSH protocol is recommended for remote login and
				remote file transfer. SSH provides confidentiality and integrity for data exchanged
				between two systems, as well as server authentication, through the use of public key
				cryptography. The implementation included with the system is called OpenSSH, and
				more detailed documentation is available from its website, http://www.openssh.org.
				Its server program is called sshd and provided by the RPM package
				openssh-server.</description>
			<Group id="usgcb-rhel5desktop-group-3.5.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure OpenSSH Server if Necessary</title>
				<description xml:lang="en-US" override="0"> If the system needs to act as an SSH server, then
					certain changes should be made to the OpenSSH daemon configuration file
					/etc/ssh/sshd config. The following recommendations can be applied to this file.
					See the sshd config(5) man page for more detailed information.</description>
				<Group id="usgcb-rhel5desktop-group-3.5.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Ensure Only Protocol 2 Connections Allowed</title>
					<description xml:lang="en-US" override="0"> Only SSH protocol version 2 connections should be
						permitted. Version 1 of the protocol contains security vulnerabilities. The
						default setting shipped in the configuration file is correct, but it is
						important enough to check. <xhtml:br/><xhtml:br/> Verify that the following line appears: <xhtml:br/><xhtml:br/> Protocol 2</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4325-7:Ensure Only Protocol 2 Connections Allowed</title>
						<description override="0">SSH version 1 protocol support should be
							disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4325-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20238"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Set Idle Timeout Interval for User Logins</title>
					<description xml:lang="en-US" override="0"> SSH allows administrators to set an idle timeout
						interval. After this interval has passed, the idle user will be
						automatically logged out. <xhtml:br/><xhtml:br/> Find and edit the following lines in /etc/ssh/sshd config as
						follows: <xhtml:br/><xhtml:br/> ClientAliveInterval interval <xhtml:br/> ClientAliveCountMax 0 <xhtml:br/><xhtml:br/> The timeout interval is given in seconds. To have a timeout of 5
						minutes, set interval to 300. <xhtml:br/><xhtml:br/> If a shorter timeout has already been set for the login shell,
						as in Section 2.3.5.5, that value will preempt any SSH setting made here.
						Keep in mind that some processes may stop SSH from correctly detecting that
						the user is idle.</description>
					<Value id="usgcb-rhel5desktop-var-3.5.2.3.a" type="number" operator="equals" prohibitChanges="false" abstract="false" hidden="false" interactive="0">
						<title override="0">SSH session Idle time</title>
						<description xml:lang="en-US" override="0">Specify duration of allowed idle
							time.</description>
						<value selector="">300</value>
						<value selector="5_minutes">300</value>
						<value selector="10_minutes">600</value>
						<value selector="15_minutes">900</value>
					</Value>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3845-5:The SSH idle timout interval should be set to an appropriate
							value</title>
						<description override="0">The SSH idle timout interval should be set to an appropriate
							value</description>
						<ident system="http://cce.mitre.org">CCE-3845-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-export value-id="usgcb-rhel5desktop-var-3.5.2.3.a" export-name="oval:gov.nist.usgcb.rhel:var:20239"/>
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20239"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.3.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14061-6:The SSh 'keep alive' message count should be set to an appropriate value</title>
						<description override="0">The ClientAliveCountMax should be set to an appropriate
							value</description>
						<ident system="http://cce.mitre.org">CCE-14061-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20240"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable .rhosts Files</title>
					<description xml:lang="en-US" override="0"> SSH can emulate the behavior of the obsolete rsh
						command in allowing users to enable insecure access to their accounts via
						.rhosts files. <xhtml:br/><xhtml:br/> To ensure that this behavior is disabled, add or correct the
						following line: <xhtml:br/><xhtml:br/> IgnoreRhosts yes</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.4.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4475-0:Disable .rhosts Files</title>
						<description override="0">Emulation of the rsh command through the ssh server should be
							disabled</description>
						<ident system="http://cce.mitre.org">CCE-4475-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20241"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.5" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Host-Based Authentication</title>
					<description xml:lang="en-US" override="0"> SSH's cryptographic host-based authentication is
						slightly more secure than .rhosts authentication, since hosts are
						cryptographically authenticated. However, it is not recommended that hosts
						unilaterally trust one another, even within an organization. <xhtml:br/><xhtml:br/> To disable host-based authentication, add or correct the
						following line:<xhtml:br/><xhtml:br/> HostbasedAuthentication no</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.5.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4370-3:Disable Host-Based Authentication</title>
						<description override="0">SSH host-based authentication should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4370-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20242"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable root Login via SSH</title>
					<description xml:lang="en-US" override="0"> The root user should never be allowed to login
						directly over a network, as this both reduces auditable information about
						who ran privileged commands on the system and allows direct attack attempts
						on root's password. <xhtml:br/><xhtml:br/> To disable root login via SSH, add or correct the following
						line: <xhtml:br/><xhtml:br/> PermitRootLogin no</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.6.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4387-7:Disable root Login via SSH</title>
						<description override="0">Root login via SSH should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4387-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20243"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Empty Passwords</title>
					<description xml:lang="en-US" override="0"> To explicitly disallow remote login from accounts
						with empty passwords, add or correct the following line: <xhtml:br/><xhtml:br/> PermitEmptyPasswords no <xhtml:br/><xhtml:br/> Measures should also be taken to disable accounts with empty
						passwords system-wide, as described in Section 2.3.1.5.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.7.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3660-8:Disable Empty Passwords</title>
						<description override="0">Remote connections from accounts with empty passwords should be
							disabled</description>
						<ident system="http://cce.mitre.org">CCE-3660-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20244"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.8" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Enable a Warning Banner</title>
					<description xml:lang="en-US" override="0"> Section 2.3.7 contains information on how to
						create an appropriate warning banner. <xhtml:br/><xhtml:br/> To enable a warning banner, add or correct the following line: <xhtml:br/><xhtml:br/> Banner /etc/issue</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.8.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4431-3:Enable a Warning Banner</title>
						<description override="0">SSH warning banner should be enabled</description>
						<ident system="http://cce.mitre.org">CCE-4431-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20245"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.9" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Do Not Allow Users to Set Environment Options</title>
					<description xml:lang="en-US" override="0"> To prevent users from being able to present
						environment options to the SSH daemon and potentially bypass some access
						restrictions, add or correct the following line:<xhtml:br/><xhtml:br/> PermitUserEnvironment no </description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.9.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title xml:lang="en-US" override="0">CCE-4422-2:Do Not Allow Users to Set Environment
							Options</title>
						<description override="0">PermitUserEnvironment should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4422-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:202455"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.5.2.10" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Use Only Approved Ciphers</title>
					<description xml:lang="en-US" override="0"> Limit the ciphers to those which are
						FIPS-approved and only use ciphers in counter (CTR) mode. The following line
						demonstrates use of FIPS-approved ciphers in CTR mode:<xhtml:br/><xhtml:br/> Ciphers aes128-ctr,aes192-ctr,aes256-ctr<xhtml:br/><xhtml:br/> The man page sshd_config(5) contains a list of the ciphers
						supported for the current release of the SSH daemon.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.5.2.10.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title xml:lang="en-US" override="0">CCE-14491-5:Use Only Approved Ciphers</title>
						<description override="0">Use only FIPS approved ciphers not in CBC mode</description>
						<ident system="http://cce.mitre.org">CCE-14491-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:202456"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.6" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">X Window System</title>
			<description xml:lang="en-US" override="0">The X Window System implementation included with the
				system is called X.org.</description>
			<Group id="usgcb-rhel5desktop-group-3.6.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable X Windows if Possible</title>
				<description xml:lang="en-US" override="0"> Unless there is a mission-critical reason for the
					machine to run a GUI login screen, prevent X from starting automatically at
					boot. There is usually no reason to run X Windows on a dedicated server machine,
					since administrators can login via SSH or on the text console.</description>
				<Group id="usgcb-rhel5desktop-group-3.6.1.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Lock Down X Windows startx Configuration if
						Necessary</title>
					<description xml:lang="en-US" override="0"> If X is not to be started at boot time but the
						software must remain installed, users will be able to run X manually using
						the startx command. In some cases, this runs X with a configuration which is
						less safe than the default. Follow these instructions to mitigate risk from
						this configuration.</description>
					<Group id="usgcb-rhel5desktop-group-3.6.1.3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Disable X Window System Listening</title>
						<description xml:lang="en-US" override="0"> To prevent X.org from listening for remote
							connections, create the file /etc/X11/xinit/xserverrc and fill it with
							the following line: <xhtml:br/><xhtml:br/> exec X :0 -nolisten tcp $@ <xhtml:br/><xhtml:br/> One of X.org's features is the ability to provide remote
							graphical display. This feature should be disabled unless it is
							required. If the system uses runlevel 5, which is the default, the GDM
							display manager starts X safely, with remote listening disabled.
							However, if X is started from the command line with the startx command,
							then the server will listen for new connections on X's default port, 6000.<xhtml:br/><xhtml:br/> See the xinit(1), startx(1), and Xserver(1) man pages for
							more information.</description>
						<Rule id="usgcb-rhel5desktop-rule-3.6.1.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4074-1:Disable X Window System Listening</title>
							<description override="0">Disable the ability to provide remote graphical
								display</description>
							<ident system="http://cce.mitre.org">CCE-4074-1</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20248"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.6.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure X Windows if Necessary</title>
				<description xml:lang="en-US" override="0"> If there is a mission-critical reason for this
					machine to run a GUI, improve the security of the default X configuration by
					following the guidance in this section.</description>
				<Group id="usgcb-rhel5desktop-group-3.6.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Create Warning Banners for GUI Login Users</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/gdm/custom.conf. Locate the
						[greeter] section, and correct that section to contain the lines: <xhtml:br/><xhtml:br/> [greeter] <xhtml:br/> InfoMsgFile=/etc/issue<xhtml:br/><xhtml:br/> See Section 2.3.7 for an explanation of banner file use. This
						setting will cause the system greeting banner to be displayed in a box prior
						to GUI login. If the default banner font is inappropriate, it can be changed
						by specifying the InfoMsgFont directive as well, for instance: <xhtml:br/><xhtml:br/> InfoMsgFont=Sans 12</description>
					<Rule id="usgcb-rhel5desktop-rule-3.6.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3717-6:Create Warning Banners for GUI Login Users</title>
						<description override="0">Enable warning banner for GUI login</description>
						<ident system="http://cce.mitre.org">CCE-3717-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20249"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.7" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Avahi Server</title>
			<description xml:lang="en-US" override="0"> The Avahi daemon implements the DNS Service Discovery and
				Multicast DNS protocols, which provide service and host discovery on a network. It
				allows a system to automatically identify resources on the network, such as printers
				or web servers. This capability is also known as mDNSresponder and is a major part
				of Zeroconf networking. By default, it is enabled.</description>
			<Group id="usgcb-rhel5desktop-group-3.7.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Avahi Server if Possible</title>
				<description xml:lang="en-US" override="0"> Because the Avahi daemon service keeps an open
					network port, it is subject to network attacks. Disabling it is particularly
					important to reduce the system's vulnerability to such attacks.</description>
				<Group id="usgcb-rhel5desktop-group-3.7.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Avahi Server Software</title>
					<description xml:lang="en-US" override="0"> Issue the command: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig avahi-daemon off</xhtml:code></description>
					<Rule id="usgcb-rhel5desktop-rule-3.7.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4365-3:Disable Avahi Server Software</title>
						<description override="0">The avahi-daemon service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4365-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20250"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.8" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Print Support</title>
			<description xml:lang="en-US" override="0"> The Common Unix Printing System (CUPS) service provides
				both local and network printing support. A system running the CUPS service can
				accept print jobs from other systems, process them, and send them to the appropriate
				printer. It also provides an interface for remote administration through a web
				browser. The CUPS service is installed and activated by default. The project
				homepage and more detailed documentation are available at http://www.cups.org. <xhtml:br/><xhtml:br/> The HP Linux Imaging and Printing service (HPLIP) is a separate package
				that provides support for some of the additional features that HP printers provide
				that CUPS may not necessarily support. It relies upon the CUPS
				service.</description>
			<reference href="http://www.cups.org">CUPS is the standards-based, open source printing
				system</reference>
			<Group id="usgcb-rhel5desktop-group-3.8.4" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">The HP Linux Imaging and Printing (HPLIP) Toolkit</title>
				<description xml:lang="en-US" override="0"> The HPLIP package is an HP printing support utility
					that is installed and enabled in a default installation. The HPLIP package is
					comprised of two separate components. The first is the main HPLIP service and
					the second is a smaller subcomponent called HPIJS. HPLIP is a feature-oriented
					network service that provides higher level printing support (such as
					bi-directional I/O, scanning, photo card, and toolbox functionality). HPIJS is a
					lower level basic printing driver that provides basic support for non-PostScript
					HP printers.</description>
				<Group id="usgcb-rhel5desktop-group-3.8.4.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable HPLIP Service if Possible</title>
					<description xml:lang="en-US" override="0"> Since the HPIJS driver will still function
						without the added HPLIP service, HPLIP should be disabled unless the
						specific higher level functions that HPLIP provides are needed by a
						non-PostScript HP printer on the system. <xhtml:br/><xhtml:br/><xhtml:code># chkconfig hplip off <xhtml:br/></xhtml:code><xhtml:br/> Note: If installing the HPLIP package from scratch, it should be
						noted that HPIJS can be installed directly without HPLIP. Please see the FAQ
						at the HPLIP web site at http://hplip.sourceforge.net/faqs.html for more
						information on how to do this.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.8.4.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4425-5:Disable HPLIP Service if Possible</title>
						<description override="0">The hplip service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4425-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20266"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.9" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">DHCP</title>
			<description xml:lang="en-US" override="0"> The Dynamic Host Configuration Protocol (DHCP) allows
				systems to request and obtain an IP address and many other parameters from a server. <xhtml:br/><xhtml:br/> In general, sites use DHCP either to allow a large pool of mobile or
				unknown machines to share a limited number of IP addresses, or to standardize
				installations by avoiding static, individual IP address configuration on hosts. It
				is recommended that sites avoid DHCP as much as possible. Since DHCP authentication
				is not well-supported, DHCP clients are open to attacks from rogue DHCP servers.
				Such servers can give clients incorrect information (e.g. malicious DNS server
				addresses) which could lead to their compromise. <xhtml:br/><xhtml:br/> If a machine must act as a DHCP client or server, configure it
				defensively using the guidance in this section. This guide recommends configuring
				networking on clients by manually editing the appropriate files under
				/etc/sysconfig. It is also possible to use the graphical front-end programs
				system-config-network and system-config-network-tui, but these programs rewrite
				configuration files from scratch based on their defaults – destroying any manual
				changes – and should therefore be used with caution.</description>
			<Group id="usgcb-rhel5desktop-group-3.9.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable DHCP Server if possible</title>
				<description xml:lang="en-US" override="0"> If the dhcp package has been installed on a machine
					which does not need to operate as a DHCP server, disable the daemon: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig dhcpd off <xhtml:br/></xhtml:code><xhtml:br/> If possible, remove the software as well: <xhtml:br/><xhtml:br/><xhtml:code># yum erase dhcp <xhtml:br/></xhtml:code><xhtml:br/> The DHCP server dhcpd is not installed or activated by default. If
					the software was installed and activated, but the system does not need to act as
					a DHCP server, it should be disabled and removed. Unmanaged DHCP servers will
					provide faulty information to clients, interfering with the operation of a
					legitimate site DHCP server if there is one, or causing misconfigured machines
					to exhibit unpredictable behavior if there is not.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.9.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4336-4:Disable DHCP Server if possible</title>
					<description override="0">The dhcpd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4336-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20268"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.9.3.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4464-4:Uninstall DHCP Server if possible</title>
					<description override="0">The dhcp package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4464-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20269"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.10" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Network Time Protocol</title>
			<description xml:lang="en-US" override="0"> The Network Time Protocol is used to manage the system
				clock over a network. Computer clocks are not very accurate, so time will drift
				unpredictably on unmanaged systems. Central time protocols can be used both to
				ensure that time is consistent among a network of machines, and that their time is
				consistent with the outside world. <xhtml:br/><xhtml:br/> Local time synchronization is recommended for all networks. If every
				machine on your network reliably reports the same time as every other machine, then
				it is much easier to correlate log messages in case of an attack. In addition, a
				number of cryptographic protocols (such as Kerberos) use timestamps to prevent
				certain types of attacks. If your network does not have synchronized time, these
				protocols may be unreliable or even unusable. <xhtml:br/><xhtml:br/> Depending on the specifics of the network, global time accuracy may be
				just as important as local synchronization, or not very important at all. If your
				network is connected to the Internet, it is recommended that you make use of a
				public timeserver, since globally accurate timestamps may be necessary if you need
				to investigate or respond to an attack which originated outside of your network. <xhtml:br/><xhtml:br/> Whether or not you use an outside timeserver, configure the network to
				have a small number of machines operating as NTP servers, and the remainder
				obtaining time information from those internal servers.</description>
			<Group id="usgcb-rhel5desktop-group-3.10.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure Reference NTP if Appropriate</title>
				<description xml:lang="en-US" override="0">The ntp RPM implements the reference NTP
					server.</description>
				<Group id="usgcb-rhel5desktop-group-3.10.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Configure an NTP Server</title>
					<description xml:lang="en-US" override="0"> The site’s NTP server contacts a central NTP
						server, probably either one provided by your ISP or a public time server, to
						obtain accurate time data. The server then allows other machines on your
						network to request the time data.<xhtml:br/><xhtml:br/> The NTP server conﬁguration ﬁle is located at
						/etc/ntp.conf.</description>
					<Group id="usgcb-rhel5desktop-group-3.10.2.2.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Enable the NTP Daemon</title>
						<description xml:lang="en-US" override="0"> If this machine is an NTP server, ensure that
							ntpd is enabled at boot time: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig ntpd on</xhtml:code></description>
						<Rule id="usgcb-rhel5desktop-rule-3.10.2.2.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4376-0:Enable the NTP Daemon</title>
							<description override="0">The ntpd service should be enabled.</description>
							<ident system="http://cce.mitre.org">CCE-4376-0</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20281"/>
							</check>
						</Rule>
					</Group>
					<Group id="usgcb-rhel5desktop-group-3.10.2.2.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
						<title xml:lang="en-US" override="0">Specify a Remote NTP Server for Time Data</title>
						<description xml:lang="en-US" override="0"> Find the IP address, server-ip , of an
							appropriate remote NTP server. Edit the file /etc/ntp.conf, and add or
							correct the following lines: <xhtml:br/><xhtml:br/> restrict server-ip mask 255.255.255.255 nomodify notrap
							noquery <xhtml:br/> server server-ip <xhtml:br/><xhtml:br/> If your site does not require time data to be accurate, but
							merely to be synchronized among local machines, this step can be
							omitted, and the NTP server will default to providing time data from the
							local clock. However, it is a good idea to periodically synchronize the
							clock to some source of accurate time, even if it is not appropriate to
							do so automatically. <xhtml:br/><xhtml:br/> The previous step disabled all remote access to this NTP
							server's state data. This NTP server must contact a remote server to
							obtain accurate data, so NTP's configuration must allow that remote data
							to be used to modify the system clock. The restrict line changes the
							default access permissions for that remote server. The server line
							specifies the remote server as the preferred NTP server for time data.
							If you intend to synchronize to more than one server, specify restrict
							and server lines for each server. <xhtml:br/><xhtml:br/> Note: It would be possible to specify a hostname, rather
							than an IP address, for the server field. However, the restrict setting
							applies only to network blocks of IP addresses, so it is considered more
							maintainable to use the IP address in both fields.</description>
						<Rule id="usgcb-rhel5desktop-rule-3.10.2.2.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
							<status date="2010-07-01">accepted</status>
							<version update="1"/>
							<title override="0">CCE-4385-1:Specify a Remote NTP Server for Time Data</title>
							<description override="0">A remote NTP Server for time synchronization should be
								specified</description>
							<ident system="http://cce.mitre.org">CCE-4385-1</ident>
							<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
								<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20283"/>
							</check>
						</Rule>
					</Group>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.12" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">LDAP</title>
			<description xml:lang="en-US" override="0"> LDAP is a popular directory service, that is, a
				standardized way of looking up information from a central database. It is relatively
				simple to configure a RHEL5 machine to obtain authentication information from an
				LDAP server. If your network uses LDAP for authentication, be sure to configure both
				clients and servers securely.</description>
			<Group id="usgcb-rhel5desktop-group-3.12.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure OpenLDAP Clients</title>
				<description xml:lang="en-US" override="0"> This guide recommends configuring OpenLDAP clients by
					manually editing the appropriate configuration files. RHEL5 provides an
					automated configuration tool called authconfig and a graphical wrapper for
					authconfig called system-config-authentication. However, these tools do not give
					sufficient flexibility over configuration. The authconfig tools do not allow you
					to specify locations of SSL certificate files, which is useful when trying to
					use SSL cleanly across several protocols. They are also overly aggressive in
					placing services such as netgroups and automounter maps under LDAP control,
					where it is safer to use LDAP only for services to which it is relevant in your
					environment.</description>
				<warning xml:lang="en-US" override="0" category="general">Before configuring any machine to be an LDAP client,
					ensure that a working LDAP server is present on the network. See Section 3.12.3
					for instructions on configuring an LDAP server. </warning>
				<Group id="usgcb-rhel5desktop-group-3.12.2.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Configure LDAP to Use TLS for All Transactions</title>
					<description xml:lang="en-US" override="0"><xhtml:ol>
							<xhtml:li>Ensure a copy of the site's CA certificate has been placed in
								the file /etc/pki/tls/CA/cacert.pem. </xhtml:li>
							<xhtml:li>Configure LDAP to enforce TLS use and to trust certificates
								signed by the site's CA. First, edit the file /etc/ldap.conf, and
								add or correct the following lines: <xhtml:br/><xhtml:br/> ssl start_tls <xhtml:br/> tls_checkpeer yes <xhtml:br/>
								tls_cacertdir /etc/pki/tls/CA <xhtml:br/> tls_cacertfile
								/etc/pki/tls/CA/cacert.pem <xhtml:br/><xhtml:br/> Then edit /etc/openldap/ldap.conf, and add or correct
								the following lines: <xhtml:br/><xhtml:br/> TLS_CACERTDIR /etc/pki/tls/CA <xhtml:br/> TLS_CACERT
								/etc/pki/tls/CA/cacert.pem </xhtml:li>
						</xhtml:ol><xhtml:br/><xhtml:br/> Section 2.5.6 describes the system-wide configuration of SSL for
						your enterprise. It is possible to place your certificate information under
						some directory other than /etc/pki/tls, but using a consistent directory
						structure across all SSL services at your site is recommended. The LDAP
						server must be configured with a certificate signed by the CA certificate
						named here.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.12.2.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-14894-0:Configure LDAP to Use TLS for All Transactions</title>
						<description override="0">Clients require LDAP servers to provide valid certificates for
							SSL communications.</description>
						<ident system="http://cce.mitre.org">CCE-14894-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:202885"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.12.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure OpenLDAP Server</title>
				<description xml:lang="en-US" override="0"> This section contains guidance on how to configure an
					OpenLDAP server to securely provide information for use in a centralized
					authentication service. This is not a comprehensive guide to maintaining an
					OpenLDAP server, but may be helpful in transitioning to an OpenLDAP
					infrastructure nonetheless.</description>
				<Group id="usgcb-rhel5desktop-group-3.12.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Install OpenLDAP Server RPM</title>
					<description xml:lang="en-US" override="0"> Is this machine the OpenLDAP server? If so: <xhtml:br/><xhtml:br/><xhtml:code># yum install openldap-servers <xhtml:br/> # chkconfig ldap on
							<xhtml:br/></xhtml:code><xhtml:br/> The openldap-servers RPM is not installed by default on RHEL5
						machines. It is needed only by the OpenLDAP server, not by the clients which
						use LDAP for authentication.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.12.3.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3501-4:Disable OpenLDAP service</title>
						<description override="0">The ldap service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-3501-4</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20289"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.13" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">NFS and RPC</title>
			<description xml:lang="en-US" override="0"> The Network File System is the most popular distributed
				filesystem for the Unix environment, and is very widely deployed. Unfortunately, NFS
				was not designed with security in mind, and has a number of weaknesses, both in
				terms of the protocol itself and because any NFS installation must expose several
				daemons, running on both servers and clients, to network attack. <xhtml:br/><xhtml:br/> This section discusses the circumstances under which it is possible to
				disable NFS and its dependencies, and then details steps which should be taken to
				secure, as much as possible, NFS's configuration. This section is relevant to
				machines operating as NFS clients, as well as to those operating as NFS
				servers.</description>
			<Group id="usgcb-rhel5desktop-group-3.13.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable All NFS Services if Possible</title>
				<description xml:lang="en-US" override="0"> Is there a mission-critical reason for this machine
					to operate as either an NFS client or an NFS server? <xhtml:br/><xhtml:br/> If not, follow all instructions in the remainder of Section 3.13.1
					to disable subsystems required by NFS. <xhtml:br/><xhtml:br/> NFS is a commonly used mechanism for sharing data between machines
					in an organization. However, its use opens many potential security holes. If NFS
					is not universally needed in your organization, improve the security posture of
					any machine which does not require NFS by disabling it entirely.</description>
				<warning xml:lang="en-US" override="0" category="general">The steps in Section 3.13.1 will prevent a machine from
					operating as either an NFS client or an NFS server. Only perform these steps on
					machines which do not need NFS at all. </warning>
				<Group id="usgcb-rhel5desktop-group-3.13.1.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable Services Used Only by NFS</title>
					<description xml:lang="en-US" override="0"> If NFS is not needed, perform the following steps
						to disable NFS client daemons: <xhtml:br/><xhtml:code># chkconfig nfslock off <xhtml:br/> # chkconfig rpcgssd off
							<xhtml:br/> # chkconfig rpcidmapd off <xhtml:br/></xhtml:code><xhtml:br/> The nfslock, rpcgssd, and rpcidmapd daemons all perform NFS
						client functions. <xhtml:br/><xhtml:br/> All of these daemons run with elevated privileges, and many
						listen for network connections. If they are not needed, they should be
						disabled to improve system security posture.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.13.1.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4396-8:Disable nfslock</title>
						<description override="0">The nfslock service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4396-8</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20292"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-3.13.1.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3535-2:Disable rpcgssd</title>
						<description override="0">The rpcgssd service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-3535-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20293"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-3.13.1.1.c" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-3568-3:Disable rpcidmapd</title>
						<description override="0">The rpcidmapd service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-3568-3</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20294"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.13.1.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable netfs if Possible</title>
					<description xml:lang="en-US" override="0"> Determine whether any network filesystems handled
						by netfs are mounted on this system: <xhtml:br/><xhtml:br/><xhtml:code># mount -t nfs,nfs4,smbfs,cifs,ncpfs <xhtml:br/></xhtml:code><xhtml:br/> If this command returns no output, disable netfs to improve
						system security: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig netfs off <xhtml:br/></xhtml:code><xhtml:br/> The netfs script manages the boot-time mounting of several types
						of networked filesystems, of which NFS and Samba (see Section 3.18) are the
						most common. If these filesystem types are not in use, the script can be
						disabled, protecting the system somewhat against accidental or malicious
						changes to /etc/fstab and against flaws in the netfs script
						itself.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.13.1.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4533-6:Disable netfs if Possible</title>
						<description override="0">The netfs service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4533-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20295"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.13.1.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable RPC Portmapper if Possible</title>
					<description xml:lang="en-US" override="0"> If: <xhtml:br/><xhtml:br/><xhtml:ul>
							<xhtml:li>NFS is not needed </xhtml:li>
							<xhtml:li>The site does not rely on NIS for authentication information,
								and </xhtml:li>
							<xhtml:li>The machine does not run any other RPC-based
								service</xhtml:li>
						</xhtml:ul><xhtml:br/><xhtml:br/> then disable the RPC portmapper service: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig portmap off <xhtml:br/></xhtml:code><xhtml:br/> By design, the RPC model does not require particular services to
						listen on fixed ports, but instead uses a daemon, portmap, to tell
						prospective clients which ports to use to contact the services they are
						trying to reach. This model weakens system security by introducing another
						privileged daemon which may be directly attacked, and is unnecessary because
						RPC was never adopted by enough services to risk using up all the ports on a system.<xhtml:br/><xhtml:br/> Unfortunately, the portmapper is central to RPC design, so it
						cannot be disabled if your site is using any RPCbased services, including
						NFS, NIS (see Section 3.2.4 for information about NIS, which is not
						recommended), or any third-party or custom RPC-based program. If none of
						these programs are in use, however, portmap should be disabled to improve
						system security. <xhtml:br/><xhtml:br/> In order to get more information about whether portmap may be
						disabled on a given host, query the local portmapper using the command: <xhtml:br/><xhtml:br/><xhtml:code># rpcinfo -p <xhtml:br/></xhtml:code><xhtml:br/> If the only services listed are portmapper and status, it is
						safe to disable the portmapper. If other services are listed and your site
						is not running NFS or NIS, investigate these services and disable them if
						possible.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.13.1.3.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4550-0:Disable RPC Portmapper if Possible</title>
						<description override="0">The portmap service should be disabled.</description>
						<ident system="http://cce.mitre.org">CCE-4550-0</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20296"/>
						</check>
					</Rule>
				</Group>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.13.3" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure NFS Clients</title>
				<description xml:lang="en-US" override="0">The steps in this section are appropriate for machines
					which operate as NFS clients.</description>
				<Group id="usgcb-rhel5desktop-group-3.13.3.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Disable NFS Server Daemons</title>
					<description xml:lang="en-US" override="0"><xhtml:code># chkconfig nfs off <xhtml:br/> # chkconfig rpcsvcgssd off
							<xhtml:br/></xhtml:code><xhtml:br/> There is no need to run the NFS server daemons except on a small
						number of properly secured machines designated as NFS servers. Ensure that
						these daemons are turned off on clients.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.13.3.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4473-5:Disable nfs service</title>
						<description override="0">The nfs service should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4473-5</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20303"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-3.13.3.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4491-7:Disable rpcsvcgssd service</title>
						<description override="0">The rpcsvcgssd service should be disabled</description>
						<ident system="http://cce.mitre.org">CCE-4491-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20304"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.13.3.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Mount Remote Filesystems with Restrictive
						Options</title>
					<description xml:lang="en-US" override="0"> Edit the file /etc/fstab. For each filesystem
						whose type (column 3) is nfs or nfs4, add the text ,nodev,nosuid to the list
						of mount options in column 4. If appropriate, also add ,noexec. <xhtml:br/><xhtml:br/> See Section 2.2.1.2 for a description of the effects of these
						options. In general, execution of files mounted via NFS should be considered
						risky because of the possibility that an adversary could intercept the
						request and substitute a malicious file. Allowing setuid files to be
						executed from remote servers is particularly risky, both for this reason and
						because it requires the clients to extend root-level trust to the NFS
						server.</description>
					<Rule id="usgcb-rhel5desktop-rule-3.13.3.2.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4368-7:Mount Remote Filesystems with nodev</title>
						<description override="0">The nodev option should be enabled for all NFS
							mounts</description>
						<ident system="http://cce.mitre.org">CCE-4368-7</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:43680"/>
						</check>
					</Rule>
					<Rule id="usgcb-rhel5desktop-rule-3.13.3.2.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">accepted</status>
						<version update="1"/>
						<title override="0">CCE-4024-6:Mount Remote Filesystems with nosuid</title>
						<description override="0">The nosuid option should be enabled for all NFS
							mounts</description>
						<ident system="http://cce.mitre.org">CCE-4024-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20306"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.14" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">DNS Server</title>
			<description xml:lang="en-US" override="0">Most organizations have an operational need to run at
				least one nameserver. However, there are many common attacks involving DNS, be
				configured defensively.</description>
			<Group id="usgcb-rhel5desktop-group-3.14.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable DNS Server if Possible</title>
				<description xml:lang="en-US" override="0"> Is there an operational need for this machine to act
					as a DNS server for this site? <xhtml:br/><xhtml:br/> If not, disable the software and remove it from the system: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig named off <xhtml:br/> # yum erase bind <xhtml:br/></xhtml:code><xhtml:br/> DNS software should be disabled on any machine which does not need
					to be a nameserver. Note that the BIND DNS server software is not installed on
					RHEL5 by default. The remainder of this section discusses secure configuration
					of machines which must be nameservers.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.14.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3578-2:Disable DNS Server if Possible</title>
					<description override="0">The named service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3578-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20311"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.14.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4219-2:Uninstall bind if Possible</title>
					<description override="0">The bind package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4219-2</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20312"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.15" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">FTPServer</title>
			<description xml:lang="en-US" override="0"> FTP is a common method for allowing remote access to
				files. Like telnet, the FTP protocol is unencrypted, which means that passwords and
				other data transmitted during the session can be captured and that the session is
				vulnerable to hijacking. Therefore, running the FTP server software is not
				recommended. <xhtml:br/><xhtml:br/> However, there are some FTP server configurations which may be
				appropriate for some environments, particularly those which allow only read-only
				anonymous access as a means of downloading data available to the
				public.</description>
			<Group id="usgcb-rhel5desktop-group-3.15.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable vsftpd if Possible</title>
				<description xml:lang="en-US" override="0"> Is there a mission-critical reason for the machine to
					act as an FTP server? If not, disable vsftpd if it has been installed: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig vsftpd off</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.15.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3919-8:Disable vsftpd if Possible</title>
					<description override="0">The vsftpd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3919-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20317"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.15.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-14881-7:Uninstall vsftpd if Possible</title>
					<description override="0">The vsftpd service should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-14881-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:203175"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.16" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Web Server</title>
			<description xml:lang="en-US" override="0"> The web server is responsible for providing access to
				content via the HTTP protocol. Web servers represent a significant security risk
				because: <xhtml:br/><xhtml:br/><xhtml:ul>
					<xhtml:li>The HTTP port is commonly probed by malicious sources </xhtml:li>
					<xhtml:li>Web server software is very complex, and includes a long history of
						vulnerabilities </xhtml:li>
					<xhtml:li>The HTTP protocol is unencrypted and vulnerable to passive monitoring
					</xhtml:li>
				</xhtml:ul><xhtml:br/><xhtml:br/> The system's default web server software is Apache 2 and is provided in
				the RPM package httpd.</description>
			<Group id="usgcb-rhel5desktop-group-3.16.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Apache if Possible</title>
				<description xml:lang="en-US" override="0"> If Apache was installed and activated, but the system
					does not need to act as a web server, then it should be disabled and removed
					from the system: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig httpd off <xhtml:br/> # yum erase httpd</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.16.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4338-0:Disable Apache if Possible</title>
					<description override="0">The httpd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4338-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20322"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.16.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4514-6:Uninstall Apache if Possible</title>
					<description override="0">The httpd package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4514-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20323"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.17" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">IMAP and POP3 Server</title>
			<description xml:lang="en-US" override="0"> Dovecot provides IMAP and POP3 services. It is not
				installed by default. The project page at http://www.dovecot.org contains more
				detailed information about Dovecot configuration.</description>
			<Group id="usgcb-rhel5desktop-group-3.17.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Dovecot if Possible</title>
				<description xml:lang="en-US" override="0"> If the system does not need to operate as an IMAP or
					POP3 server, disable and remove Dovecot if it was installed: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig dovecot off <xhtml:br/> # yum erase dovecot</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.17.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3847-1:Disable Dovecot if Possible</title>
					<description override="0">The dovecot service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3847-1</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20331"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.17.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4239-0:Uninstall Dovecot if Possible</title>
					<description override="0">The dovecot package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4239-0</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20332"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.18" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Samba(SMB) Microsoft Windows File Sharing Server</title>
			<description xml:lang="en-US" override="0"> When properly configured, the Samba service allows Linux
				machines to provide file and print sharing to Microsoft Windows machines. There are
				two software packages that provide Samba support. The first, samba-client, provides
				a series of command line tools that enable a client machine to access Samba shares.
				The second, simply labeled samba, provides the Samba service. It is this second
				package that allows a Linux machine to act as an Active Directory server, a domain
				controller, or as a domain member. Only the samba-client package is installed by
				default.</description>
			<Group id="usgcb-rhel5desktop-group-3.18.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Samba if Possible</title>
				<description xml:lang="en-US" override="0"> If the Samba service has been enabled and will not be
					used, disable it: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig smb off <xhtml:br/></xhtml:code><xhtml:br/> Even after the Samba server package has been installed, it will
					remain disabled. Do not enable this service unless it is absolutely necessary to
					provide Microsoft Windows file and print sharing functionality.</description>
				<Rule id="usgcb-rhel5desktop-rule-3.18.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4551-8:Disable Samba if Possible</title>
					<description override="0">The smb service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4551-8</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20340"/>
					</check>
				</Rule>
			</Group>
			<Group id="usgcb-rhel5desktop-group-3.18.2" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Configure Samba if Necessary</title>
				<description xml:lang="en-US" override="0"> All settings for the Samba daemon can be found in
					/etc/samba/smb.conf. Settings are divided between a [global] configuration
					section and a series of user created share definition sections meant to describe
					file or print shares on the system. By default, Samba will operate in user mode
					and allow client machines to access local home directories and printers. It is
					recommended that these settings be changed or that additional limitations be set
					in place.</description>
				<Group id="usgcb-rhel5desktop-group-3.18.2.10" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Require Client SMB Packet Signing, if using
						smbclient</title>
					<description xml:lang="en-US" override="0"> To require samba clients running smbclient to use
						packet signing, add the following to the [global] section of the Samba
						conﬁguration ﬁle:<xhtml:br/><xhtml:br/> client signing = mandatory<xhtml:br/><xhtml:br/> A Samba client should only communicate with servers who can
						support SMB packet signing. Packet signing can prevent man-in-the-middle
						attacks which modify SMB packets in transit. </description>
					<Rule id="usgcb-rhel5desktop-rule-3.18.2.10.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-14075-6:Require Client SMB Packet Signing, if using smbclient</title>
						<description override="0"> Require samba clients running smbclient to use packet signing.
							A Samba client should only communicate with servers who can support SMB
							packet signing. Packet signing can prevent man-in-the-middle attacks
							which modify SMB packets in transit.</description>
						<ident system="http://cce.mitre.org">CCE-14075-6</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:2034010"/>
						</check>
					</Rule>
				</Group>
				<Group id="usgcb-rhel5desktop-group-3.18.2.11" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
					<title xml:lang="en-US" override="0">Require Client SMB Packet Signing, if using
						mount.cifs</title>
					<description xml:lang="en-US" override="0"> Require packet signing of clients who mount Samba
						shares using the mount.cifs program (e.g., those who specify shares in
						/etc/fstab). To do so, ensure that signing options (either sec=krb5i or
						sec=ntlmv2i) are used.<xhtml:br/><xhtml:br/> See the mount.cifs(8) man page for more information. A Samba
						client should only communicate with servers who can support SMB packet
						signing. Packet signing can prevent man-in-the-middle attacks which modify
						SMB packets in transit. </description>
					<Rule id="usgcb-rhel5desktop-rule-3.18.2.11.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
						<status date="2010-07-01">draft</status>
						<version update="1"/>
						<title override="0">CCE-15029-2:Require Client SMB Packet Signing, if using mount.cifs</title>
						<description override="0"> Require packet signing of clients who mount Samba shares using
							the mount.cifs program (e.g., those who specify shares in /etc/fstab).
							To do so, ensure that signing options (either sec=krb5i or sec=ntlmv2i)
							are used.<xhtml:br/><xhtml:br/> See the mount.cifs(8) man page for more information. A Samba
							client should only communicate with servers who can support SMB packet
							signing. Packet signing can prevent man-in-the-middle attacks which
							modify SMB packets in transit.</description>
						<ident system="http://cce.mitre.org">CCE-15029-2</ident>
						<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
							<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:2034011"/>
						</check>
					</Rule>
				</Group>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.19" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">Proxy Server</title>
			<description xml:lang="en-US" override="0"> A proxy server is a very desirable target for a potential
				adversary because much (or all) sensitive data for a given infrastructure may flow
				through it. Therefore, if one is required, the machine acting as a proxy server
				should be dedicated to that purpose alone and be stored in a physically secure
				location. The system's default proxy server software is Squid, and provided in an
				RPM package of the same name.</description>
			<Group id="usgcb-rhel5desktop-group-3.19.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable Squid if Possible</title>
				<description xml:lang="en-US" override="0"> If Squid was installed and activated, but the system
					does not need to act as a proxy server, then it should be disabled and removed: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig squid off <xhtml:br/> # yum erase squid</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.19.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4556-7:Disable Squid if Possible</title>
					<description override="0">The squid service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-4556-7</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20341"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.19.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-4076-6:Uninstall Squid if Possible</title>
					<description override="0">The squid package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-4076-6</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20342"/>
					</check>
				</Rule>
			</Group>
		</Group>
		<Group id="usgcb-rhel5desktop-group-3.20" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
			<title xml:lang="en-US" override="0">SNMP Server</title>
			<description xml:lang="en-US" override="0"> The Simple Network Management Protocol allows
				administrators to monitor the state of network devices, including computers. Older
				versions of SNMP were well-known for weak security, such as plaintext transmission
				of the community string (used for authentication) and also usage of easily-guessable
				choices for community string.</description>
			<Group id="usgcb-rhel5desktop-group-3.20.1" hidden="false" prohibitChanges="false" abstract="false" selected="true" weight="1.0">
				<title xml:lang="en-US" override="0">Disable SNMP Server if Possible</title>
				<description xml:lang="en-US" override="0"> The system includes an SNMP daemon that allows for
					its remote monitoring, though it not installed by default. If it was installed
					and activated, it is important that the software be disabled and removed. <xhtml:br/><xhtml:br/> If there is not a mission-critical need for hosts at this site to be
					remotely monitored by a SNMP tool, then disable and remove SNMP as follows: <xhtml:br/><xhtml:br/><xhtml:code># chkconfig snmpd off <xhtml:br/> # yum erase net-snmpd</xhtml:code></description>
				<Rule id="usgcb-rhel5desktop-rule-3.20.1.a" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-3765-5:Disable snmpd if Possible</title>
					<description override="0">The snmpd service should be disabled.</description>
					<ident system="http://cce.mitre.org">CCE-3765-5</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20365"/>
					</check>
				</Rule>
				<Rule id="usgcb-rhel5desktop-rule-3.20.1.b" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
					<status date="2010-07-01">accepted</status>
					<version update="1"/>
					<title override="0">CCE-14081-4:Uninstall net-snmp if Possible</title>
					<description override="0">The net-snmp package should be uninstalled.</description>
					<ident system="http://cce.mitre.org">CCE-14081-4</ident>
					<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
						<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:20366"/>
					</check>
				</Rule>
			</Group>
		</Group>
	</Group>
	<Group id="usgcb_new" prohibitChanges="false" abstract="false" hidden="false" selected="true" weight="1.0">
		<title xml:lang="en-US" override="0">Group to hold new rules added by USGCB, TODO::Move to appropriate locations</title>
		<description xml:lang="en-US" override="0"/>
		<Rule id="nodev_option_on_tmp" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14412-1:Add nodev Option to /tmp Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14412-1</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:144120"/>
			</check>
		</Rule>
		<Rule id="nosuid_option_on_tmp" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14940-1:Add nosuid Option to /tmp Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14940-1</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500112"/>
			</check>
		</Rule>
		<Rule id="nodev_option_on_dev_shm" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-15007-8:Add nodev Option to /dev/shm Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-15007-8</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500113"/>
			</check>
		</Rule>
		<Rule id="nosuid_option_on_dev_shm" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14306-5:Add nosuid Option to /dev/shm Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14306-5</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500114"/>
			</check>
		</Rule>
		<Rule id="noexec_option_on_dev_shm" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14703-3:Add noexec Option to /dev/shm Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14703-3</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500115"/>
			</check>
		</Rule>
		<Rule id="noexec_option_on_tmp" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14927-8:Add noexec Option to /tmp Partition</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14927-8</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500116"/>
			</check>
		</Rule>
		<Rule id="bind_mount_var_tmp_to_tmp" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14584-7:Bind mount the /var/tmp directory to /var</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14584-7</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500117"/>
			</check>
		</Rule>
		<Rule id="network_sniffer" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-15013-6:Disable the network sniffer</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-15013-6</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500118"/>
			</check>
		</Rule>
		<Rule id="isdn4k_utils_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14825-4:The isdn4k-utils package should not be installed</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14825-4</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573893"/>
			</check>
		</Rule>
		<Rule id="ipsec_tools_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-01">draft</status>
			<version update="1"/>
			<title override="0">CCE-18031-5:The ipsec-tools package should be installed or uninstalled as appropriate.</title>
			<description override="0">The ipsec-tools package should be installed or uninstalled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-18031-5</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573894"/>
			</check>
		</Rule>
		<Rule id="sendmail_package_installation" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14495-6:The sendmail package should not be installed</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14495-6</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573892"/>
			</check>
		</Rule>
		<Rule id="postfix_package_installation" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-14068-1:The postfix package should be installed</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-14068-1</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573891"/>
			</check>
		</Rule>
		<Rule id="postfix_network_listening" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2010-08-22">draft</status>
			<version update="1"/>
			<title override="0">CCE-15018-5:Postfix network listening should be disabled</title>
			<description override="0">TODO::INSERT</description>
			<ident system="http://cce.mitre.org">CCE-15018-5</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:500119"/>
			</check>
		</Rule>
		<Rule id="pam_ccreds_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-01">draft</status>
			<version update="1"/>
			<title override="0">CCE-17250-2:The pam_ccreds package should be installed or uninstalled as appropriate.</title>
			<description override="0">The pam_ccreds package should be installed or uninstalled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-17250-2</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573895"/>
			</check>
		</Rule>
		<Rule id="talk_server_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-01">draft</status>
			<version update="1"/>
			<title override="0">CCE-18151-1:The talk-server package should be installed or uninstalled as appropriate.</title>
			<description override="0">The talk-server package should be installed or uninstalled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-18151-1</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573896"/>
			</check>
		</Rule>
		<Rule id="talk_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-01">draft</status>
			<version update="1"/>
			<title override="0">CCE-18200-6:The talk package should be installed or uninstalled as appropriate.</title>
			<description override="0">The talk package should be installed or uninstalled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-18200-6</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573897"/>
			</check>
		</Rule>
		<Rule id="irda_tools_package" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-01">draft</status>
			<version update="1"/>
			<title override="0">CCE-17504-2:The irda-utils package should be installed or uninstalled as appropriate.</title>
			<description override="0">The irda-utils package should be installed or uninstalled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-17504-2</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:573898"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-18244-4" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-18244-4:The irda service should be enabled or disabled as appropriate.</title>
			<description override="0">The irda service should be enabled or disabled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-18244-4</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:182444"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-3649-1" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-3649-1:Firewall access to printing service should be enabled or disabled as appropriate</title>
			<description override="0">Firewall access to printing service should be enabled or disabled as appropriate</description>
			<ident system="http://cce.mitre.org">CCE-3649-1</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:36491"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-18037-2" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-18037-2:The firewall should allow or reject access to the avahi service.</title>
			<description override="0">The firewall should allow or reject access to the avahi service.</description>
			<ident system="http://cce.mitre.org">CCE-18037-2</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:180372"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-4072-5" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-4072-5:The autofs service should be enabled or disabled as appropriate.</title>
			<description override="0">The autofs service should be enabled or disabled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-4072-5</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:40725"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-18156-0" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-18156-0:The rawdevices service should be enabled or disabled as appropriate.</title>
			<description override="0">The rawdevices service should be enabled or disabled as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-18156-0</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:181560"/>
			</check>
		</Rule>
		<Rule id="usgcb-rhel5desktop-rule-CCE-17816-0" selected="false" weight="10.0" prohibitChanges="false" abstract="false" hidden="false" role="full" severity="unknown">
			<status date="2011-02-09">draft</status>
			<version update="1"/>
			<title override="0">CCE-17816-0:The libuser library imports login_defs from a file as appropriate.</title>
			<description override="0">The libuser library imports login_defs from a file as appropriate.</description>
			<ident system="http://cce.mitre.org">CCE-17816-0</ident>
			<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" selector="">
				<check-content-ref href="usgcb-rhel5desktop-oval.xml" name="oval:gov.nist.usgcb.rhel:def:178160"/>
			</check>
		</Rule>
	</Group>
</Benchmark>