<cce:cce_list xmlns="http://cce.mitre.org" xmlns:cce="http://cce.mitre.org" xmlns:dcterms="http://purl.org/dc/terms/" modified="2012-05-18" version="5.20120521">
  <cces><cce cce_id="CCE-3416-5" platform="rhel5" modified="2011-10-07">
      <description>The rhnsd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.1.2.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4218-4" platform="rhel5" modified="2011-10-07">
      <description>The yum-updatesd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.1.2.3.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4209-3" platform="rhel5" modified="2011-10-07">
      <description>The AIDE package should be installed or not as appropriate</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.1.3.1.1, Value: installed</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4249-9" platform="rhel5" modified="2011-10-07">
      <description>The nodev option should be enabled or disabled as appropriate for all non-root partitions.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.1.1, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3522-0" platform="rhel5" modified="2011-10-07">
      <description>The nodev option should be enabled or disabled as appropriate for all removable media.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.1.2, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">Similar to CCE-U-170</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4275-4" platform="rhel5" modified="2011-10-07">
      <description>The noexec option should be enabled or disabled as appropriate for all removable media.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.1.2, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">Similar to CCE-U-170</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4042-8" platform="rhel5" modified="2011-10-07">
      <description>The nosuid option should be enabled or disabled as appropriate for all removable media.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.1.2, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-170</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3685-5" platform="rhel5" modified="2011-10-07">
      <description>Console device ownership should be restricted to root-only as appropriate.</description>
      <parameters>
        <parameter>root-only / not root-only</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/security/console.perms.d/50-default.perms</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.1, Value: root-only</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4187-1" platform="rhel5" modified="2011-10-07">
      <description>The USB device support module should be loaded or not as appropriate</description>
      <parameters>
        <parameter>loaded / not loaded</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.2.1, Value: not loaded</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4006-3" platform="rhel5" modified="2011-10-07">
      <description>The USB device support module should be installed or not as appropriate</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via kernel</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.2.2, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4173-1" platform="rhel5" modified="2011-10-07">
      <description>USB kernel support should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/grub.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.2.3, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3944-6" platform="rhel5" modified="2011-10-07">
      <description>The ability to boot from USB devices should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via BIOS</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.2.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4072-5" platform="rhel5" modified="2011-10-07">
      <description>The autofs service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.3, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4231-7" platform="rhel5" modified="2011-10-07">
      <description>The GNOME automounter (gnome-volume-manager) should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via gconftool-2</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.2.4, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3988-3" platform="rhel5" modified="2011-10-07">
      <description>The /etc/shadow file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-23</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3883-6" platform="rhel5" modified="2011-10-07">
      <description>The /etc/group file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3276-3" platform="rhel5" modified="2011-10-07">
      <description>The /etc/group file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3932-1" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/gshadow should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: 400</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4064-2" platform="rhel5" modified="2011-10-07">
      <description>The /etc/gshadow file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4210-1" platform="rhel5" modified="2011-10-07">
      <description>The /etc/gshadow file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3918-0" platform="rhel5" modified="2011-10-07">
      <description>The /etc/shadow file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-22</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3566-7" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/passwd should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: 644</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-19</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3958-6" platform="rhel5" modified="2011-10-07">
      <description>The /etc/passwd file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-20</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3967-7" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/group should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: 644</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3495-9" platform="rhel5" modified="2011-10-07">
      <description>The /etc/passwd file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-21</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4130-1" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/shadow should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.1, Value: 400</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-24</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3399-3" platform="rhel5" modified="2011-10-07">
      <description>The sticky bit should be set or not set as appropriate for all world-writable directories.</description>
      <parameters>
        <parameter>set / not set</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.2, Value: set</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-171</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3795-2" platform="rhel5" modified="2011-10-07">
      <description>The world-write permission should be enabled or disabled as appropriate for all files.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.3, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-24</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4178-0" platform="rhel5" modified="2011-10-07">
      <description>The sgid bit should be set or not set as appropriate for all files.</description>
      <parameters>
        <parameter>set / not set</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.4, Value: not set</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3324-1" platform="rhel5" modified="2011-10-07">
      <description>The suid bit should be set or not set as appropriate for all files.</description>
      <parameters>
        <parameter>set / not set</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.4, Value: not set</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4223-4" platform="rhel5" modified="2011-10-07">
      <description>All files should be owned by a user as appropriate</description>
      <parameters>
        <parameter>user / none</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.5, Value: user</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3573-3" platform="rhel5" modified="2011-10-07">
      <description>All files should be owned by a group as appropriate</description>
      <parameters>
        <parameter>group / none</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chgrp</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.3.5, Value: group</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4220-0" platform="rhel5" modified="2011-10-07">
      <description>The daemon umask should be set as appropriate</description>
      <parameters>
        <parameter>permissions mask</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/init</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.1, Value: 027</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4225-9" platform="rhel5" modified="2011-10-07">
      <description>Core dumps for all users should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/security/limits.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4247-3" platform="rhel5" modified="2011-10-07">
      <description>Core dumps for setuid programs should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - fs.suid_dumpable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4146-7" platform="rhel5" modified="2011-10-07">
      <description>ExecShield randomized placement of virtual memory regions should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - kernel.randomize_va_space</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4168-1" platform="rhel5" modified="2011-10-07">
      <description>ExecShield should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - kernel.exec-shield</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4172-3" platform="rhel5" modified="2011-10-07">
      <description>Kernel support for the XD/NX processor feature should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via kernel-PAE</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.4.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4177-2" platform="rhel5" modified="2011-10-07">
      <description>The XD/NX processor feature should be enabled or disabled as appropriate in the BIOS</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via BIOS</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.2.4.4.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3820-8" platform="rhel5" modified="2011-10-07">
      <description>Logins through the specified virtual console interface should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/securetty</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3485-0" platform="rhel5" modified="2011-10-07">
      <description>Logins through the specified virtual console device should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/securetty</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4111-1" platform="rhel5" modified="2011-10-07">
      <description>Logins through the primary console device should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/securetty</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4256-4" platform="rhel5" modified="2011-10-07">
      <description>Login prompts on serial ports should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/securetty</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-155</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4274-7" platform="rhel5" modified="2011-10-07">
      <description>Command access to the root account should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via pam</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.2, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-15</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4044-4" platform="rhel5" modified="2011-10-07">
      <description>Sudo privileges should granted or rejected to the wheel group as appropriate</description>
      <parameters>
        <parameter>grant/reject</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>vi /etc/sudoers</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.3, Value: granted</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3987-5" platform="rhel5" modified="2011-10-07">
      <description>Login access to non-root system accounts should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/passwd</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.4, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4238-2" platform="rhel5" modified="2011-10-07">
      <description>Login access to accounts without passwords should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/shadow</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.5, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4009-7" platform="rhel5" modified="2011-10-07">
      <description>Anonymous root logins are enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/passwd</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.6, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4154-1" platform="rhel5" modified="2011-10-07">
      <description>The password minimum length should be set appropriately</description>
      <parameters>
        <parameter>length of password</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via pam_cracklib</technical_mechanism>
        <technical_mechanism>(2) via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.7, Value: 8</reference>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4180-6" platform="rhel5" modified="2011-10-07">
      <description>The "minimum password age" policy should meet minimum requirements.</description>
      <parameters>
        <parameter>number of days</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/login.defs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.7, Value: 7</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-7</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4092-3" platform="rhel5" modified="2011-10-07">
      <description>The "maximum password age" policy should meet minimum requirements.</description>
      <parameters>
        <parameter>number of days</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/login.defs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.7, Value: 180</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-8</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4097-2" platform="rhel5" modified="2011-10-07">
      <description>The password warn age should be set appropriately</description>
      <parameters>
        <parameter>number of days</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/login.defs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.7, Value: 8</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4114-5" platform="rhel5" modified="2011-10-07">
      <description>NIS file inclusions should be set appropriately in the /etc/passwd file</description>
      <parameters>
        <parameter>allowed/not allowed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via Text editor</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.1.8, Value:</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3762-2" platform="rhel5" modified="2011-10-07" deprecated="true">
      <description>DEPRECATED in favor of CCE-14113-5, CCE-14672-0, CCE-14712-4, CCE-14122-6.  Was: The password strength should meet minimum requirements</description>
      <parameters/>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.3.1, Value:</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3410-8" platform="rhel5" modified="2011-10-07">
      <description>The "account lockout threshold" policy should meet minimum requirements.</description>
      <parameters>
        <parameter>number of attempts</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via PAM</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.3.2, Value:</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-4</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4185-5" platform="rhel5" modified="2011-10-07">
      <description>The /usr/sbin/userhelper file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chgrp</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.3.4, Value: usergroup</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3952-9" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /usr/sbin/userhelper should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.3.4, Value: 4710</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3301-9" platform="rhel5" modified="2011-10-07">
      <description>The PATH variable should be set correctly for user root</description>
      <parameters>
        <parameter>path</parameter>
      </parameters>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.4.1, Value:</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-26</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4090-7" platform="rhel5" modified="2011-10-07">
      <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.4.2, Value: g-w,o-rwx</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-162</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3844-8" platform="rhel5" modified="2011-10-07">
      <description>The default umask for all users should be set correctly for the bash shell</description>
      <parameters>
        <parameter>umask</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>umask</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.4.4, Value: 077</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-31</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4227-5" platform="rhel5" modified="2011-10-07">
      <description>The default umask for all users should be set correctly for the csh shell</description>
      <parameters/>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.4.4, Value: 077</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-31</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3870-3" platform="rhel5" modified="2011-10-07">
      <description>The default umask for all users should be set correctly</description>
      <parameters/>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.4.4, Value: 077</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-31</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4144-2" platform="rhel5" modified="2011-10-07">
      <description>The /etc/grub.conf file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3923-0" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/grub.conf should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.2, Value: 600</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3818-2" platform="rhel5" modified="2011-10-07">
      <description>The grub boot loader should have password protection enabled or disabled as appropriate</description>
      <parameters>
        <parameter>password</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/grub.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.2, Value:</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4197-0" platform="rhel5" modified="2011-10-07">
      <description>The /etc/grub.conf file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4241-6" platform="rhel5" modified="2011-10-07">
      <description>The requirement for a password to boot into single-user mode should be configured correctly.</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/inittab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.3, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-1</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4245-7" platform="rhel5" modified="2011-10-07">
      <description>The ability for users to perform interactive startups should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/init</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3689-7" platform="rhel5" modified="2011-10-07">
      <description>The idle time-out value for the default /bin/tcsh shell should meet the minimum requirements.</description>
      <parameters>
        <parameter>number of minutes</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via autolockout</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.5, Value: 10</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3707-7" platform="rhel5" modified="2011-10-07">
      <description>The idle time-out value for the default /bin/bash shell should meet the minimum requirements.</description>
      <parameters>
        <parameter>number of minutes</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/profile.d</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.5, Value: 10</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3315-9" platform="rhel5" modified="2011-10-07">
      <description>The allowed period of inactivity gnome desktop lockout should be configured correctly.</description>
      <parameters>
        <parameter>number of minutes</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via gconftool-2</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.6.1, Value: 10</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-6</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3910-7" platform="rhel5" modified="2011-10-07">
      <description>The vlock package should be installed or not as appropriate</description>
      <parameters>
        <parameter>number of minutes</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via gconftool-2</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.5.6.1, Value:</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4060-0" platform="rhel5" modified="2011-10-07">
      <description>The system login banner text should be set correctly.</description>
      <parameters>
        <parameter>banner text</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/motd</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.7.1, Value:</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4188-9" platform="rhel5" modified="2011-10-07">
      <description>The direct gnome login warning banner should be set correctly.</description>
      <parameters>
        <parameter>banner text/xml</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via RHEL.xml</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.3.7.2, Value:</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3977-6" platform="rhel5" modified="2011-10-07">
      <description>SELinux should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enforcing / permissive / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/selinux/config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3999-0" platform="rhel5" modified="2011-10-07">
      <description>The SELinux state should be set appropriately.</description>
      <parameters>
        <parameter>enforcing / permissive / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/selinux/config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.2, Value: enforcing</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3624-4" platform="rhel5" modified="2011-10-07">
      <description>The SELinux policy should be set appropriately.</description>
      <parameters>
        <parameter>targeted / strict / mls</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/selinux/config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.2, Value: targeted</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4254-9" platform="rhel5" modified="2011-10-07">
      <description>The setroubleshoot service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4148-3" platform="rhel5" modified="2011-10-07">
      <description>The setroubleshoot package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.3.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3668-1" platform="rhel5" modified="2011-10-07">
      <description>The mcstrans service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.3.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4129-3" platform="rhel5" modified="2011-10-07">
      <description>The restorecond service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.4.3.3, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4151-7" platform="rhel5" modified="2011-10-07">
      <description>The default setting for sending ICMP redirects should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.default.send_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4155-8" platform="rhel5" modified="2011-10-07">
      <description>Sending ICMP redirects should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.send_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3561-8" platform="rhel5" modified="2011-10-07">
      <description>IP forwarding should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.ip_forward</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-134</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3472-8" platform="rhel5" modified="2011-10-07">
      <description>Accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.secure_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4217-6" platform="rhel5" modified="2011-10-07">
      <description>Accepting ICMP redirects should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.accept_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4133-5" platform="rhel5" modified="2011-10-07">
      <description>Ignoring bogus ICMP responses to broadcasts should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.icmp_ignore_bogus_error_messages</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4265-5" platform="rhel5" modified="2011-10-07">
      <description>Sending TCP syncookies should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.tcp_syncookies</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3644-2" platform="rhel5" modified="2011-10-07">
      <description>Ignoring ICMP echo requests (pings) sent to broadcast / multicast addresses should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.icmp_echo_ignore_broadcasts</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4186-3" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting ICMP redirects should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.default.accept_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4080-8" platform="rhel5" modified="2011-10-07">
      <description>Performing source validation by reverse path should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.rp_filter</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3339-9" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting "secure" ICMP redirects (those from gateways listed in the default gateways list) should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.default.secure_redirects</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4320-8" platform="rhel5" modified="2011-10-07">
      <description>Logging of "martian" packets (those with impossible addresses) should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.log_martians</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3840-6" platform="rhel5" modified="2011-10-07">
      <description>The default setting for performing source validation by reverse path should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.default.rp_filter</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4091-5" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting source routed packets should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.default.accept_source_route</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4236-6" platform="rhel5" modified="2011-10-07">
      <description>Accepting source routed packets should be enabled or disabled for all interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv4.conf.all.accept_source_route</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3628-5" platform="rhel5" modified="2011-10-07">
      <description>All wireless devices should be enabled or disabled in the BIOS as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via BIOS menus</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.2.2.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4276-2" platform="rhel5" modified="2011-10-07">
      <description>All wireless interfaces should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via ifconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.2.2.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4170-7" platform="rhel5" modified="2011-10-07">
      <description>Device drivers for wireless devices should be included or excluded from the kernel as appropriate.</description>
      <parameters>
        <parameter>included / excluded</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via modprobe</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.2.2.3, Value: excluded</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3562-6" platform="rhel5" modified="2011-10-07">
      <description>Automatic loading of the IPv6 kernel module should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.1.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3377-9" platform="rhel5" modified="2011-10-07">
      <description>Global IPv6 initialization should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/network</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4296-0" platform="rhel5" modified="2011-10-07">
      <description>IPv6 configuration should be enabled or disabled as appropriate for all interfaces.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via NETWORKING_IPV6 in /etc/sysconfig/network</technical_mechanism>
        <technical_mechanism>via IPV6INIT in /etc/sysconfig/network</technical_mechanism>
        <technical_mechanism>via IPV6INIT in /etc/sysconfig/network-scripts/ifcfg-&lt;interface&gt;</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3381-1" platform="rhel5" modified="2011-10-07">
      <description>The default setting for IPv6 configuration should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via IPV6_AUTOCONF in /etc/sysconfig/network</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4269-7" platform="rhel5" modified="2011-10-07">
      <description>Accepting IPv6 router advertisements should be enabled or disabled as appropriate for all network interfaces.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl -w net.ipv6.conf.default.accept_ra=1</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4291-1" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting IPv6 router advertisements should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via IPV6_AUTOCONF in /etc/sysconfig/network</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4313-3" platform="rhel5" modified="2011-10-07">
      <description>Accepting redirects from IPv6 routers should be enabled or disabled as appropriate for all network interfaces.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl -w net.ipv6.conf.default.accept_redirects=1</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4198-8" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting redirects from IPv6 routers should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via IPV6_AUTOCONF in /etc/sysconfig/network</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3842-2" platform="rhel5" modified="2011-10-07">
      <description>IPv6 privacy extensions should be configured appropriately for all interfaces.</description>
      <parameters>
        <parameter>disabled / lightweight / rfc3041 (alias yes)</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via IPV6_PRIVACY in /etc/sysconfig/network-scripts/ifcfg-&lt;interface&gt;</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.3, Value: rfc3041</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4221-8" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting router preference via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.accept_ra_rtr_pref</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4137-6" platform="rhel5" modified="2011-10-07">
      <description>The default number of global unicast IPv6 addresses allowed per network interface should be set appropriately.</description>
      <parameters>
        <parameter>number</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.max_addresses</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: 1</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4159-0" platform="rhel5" modified="2011-10-07">
      <description>The default number of IPv6 router solicitations for network interfaces to send should be set appropriately.</description>
      <parameters>
        <parameter>number</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.router_solicitations</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: 0</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3895-0" platform="rhel5" modified="2011-10-07">
      <description>The default number of IPv6 duplicate address detection solicitations for network interfaces to send per configured address should be set appropriately.</description>
      <parameters>
        <parameter>number</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.dad_transmits</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: 0</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4287-9" platform="rhel5" modified="2011-10-07">
      <description>The default setting for autoconfiguring network interfaces using prefix information in IPv6 router advertisements should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.autoconf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4058-4" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting prefix information via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.accept_ra_pinfo</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4128-5" platform="rhel5" modified="2011-10-07">
      <description>The default setting for accepting a default router via IPv6 router advertisement should be enabled or disabled for network interfaces as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via sysctl - net.ipv6.conf.default.accept_ra_defrtr</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.3.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4167-3" platform="rhel5" modified="2011-10-07">
      <description>The ip6tables service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.5.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4189-7" platform="rhel5" modified="2011-10-07">
      <description>The iptables service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.5.5.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3679-8" platform="rhel5" modified="2011-10-07">
      <description>The syslog service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3701-0" platform="rhel5" modified="2011-10-07">
      <description>All syslog log files should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202?</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4233-3" platform="rhel5" modified="2011-10-07">
      <description>File permissions for all syslog log files should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.2, Value: 600</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200?</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4366-1" platform="rhel5" modified="2011-10-07">
      <description>All syslog log files should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201?</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4260-6" platform="rhel5" modified="2011-10-07">
      <description>Syslog logs should be sent to a remote loghost or not as appropriate</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/syslog.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.3, Value: sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3382-9" platform="rhel5" modified="2011-10-07">
      <description>Syslogd should accept remote messages or not as appropriate</description>
      <parameters>
        <parameter>accept / reject</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/syslog</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.4, Value: accept</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-131</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4182-2" platform="rhel5" modified="2011-10-07">
      <description>The logrotate (syslog rotater) service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via cron</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.5, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4323-2" platform="rhel5" modified="2011-10-07">
      <description>The logwatch service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via cron</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.1.6, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4292-9" platform="rhel5" modified="2011-10-07">
      <description>The auditd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 2.6.2.1, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4234-1" platform="rhel5" modified="2011-10-07">
      <description>The inetd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-72</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4252-3" platform="rhel5" modified="2011-10-07">
      <description>The xinetd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-73</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4023-8" platform="rhel5" modified="2011-10-07">
      <description>The inetd package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4164-0" platform="rhel5" modified="2011-10-07">
      <description>The xinetd package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3390-2" platform="rhel5" modified="2011-10-07">
      <description>The telnet service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-104</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4330-7" platform="rhel5" modified="2011-10-07">
      <description>The telnet-server package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.2, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3974-3" platform="rhel5" modified="2011-10-07">
      <description>The rcp service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4141-8" platform="rhel5" modified="2011-10-07">
      <description>The rsh service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-83</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3537-8" platform="rhel5" modified="2011-10-07">
      <description>The rlogin service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-82</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4308-3" platform="rhel5" modified="2011-10-07">
      <description>The rsh package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.3.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3705-1" platform="rhel5" modified="2011-10-07">
      <description>The ypbind service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.4, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4348-9" platform="rhel5" modified="2011-10-07">
      <description>The ypserv package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.4, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4273-9" platform="rhel5" modified="2011-10-07">
      <description>The tftp service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.5, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-118</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3916-4" platform="rhel5" modified="2011-10-07">
      <description>The tftp-server package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.2.5, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3412-4" platform="rhel5" modified="2011-10-07">
      <description>The firstboot service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4229-1" platform="rhel5" modified="2011-10-07">
      <description>The gpm service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4123-6" platform="rhel5" modified="2011-10-07">
      <description>The irqbalance service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.3, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4286-1" platform="rhel5" modified="2011-10-07">
      <description>The isdn service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.4, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3425-6" platform="rhel5" modified="2011-10-07">
      <description>The kdump service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.5, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4211-9" platform="rhel5" modified="2011-10-07">
      <description>The kudzu service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.6, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3854-7" platform="rhel5" modified="2011-10-07">
      <description>The mdmonitor service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.7, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4356-2" platform="rhel5" modified="2011-10-07">
      <description>The microcode_ctl service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.8, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4369-5" platform="rhel5" modified="2011-10-07">
      <description>The network service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.9, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4100-4" platform="rhel5" modified="2011-10-07">
      <description>The pcscd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.10, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3455-3" platform="rhel5" modified="2011-10-07">
      <description>The smartd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.11, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4421-4" platform="rhel5" modified="2011-10-07">
      <description>The readahead_early service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.12, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4302-6" platform="rhel5" modified="2011-10-07">
      <description>The readahead_later service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.12, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3822-4" platform="rhel5" modified="2011-10-07">
      <description>The messagebus service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.13.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4364-6" platform="rhel5" modified="2011-10-07">
      <description>The haldaemon service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.13.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4355-4" platform="rhel5" modified="2011-10-07">
      <description>The bluetooth service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.14.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4377-8" platform="rhel5" modified="2011-10-07">
      <description>The hidd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.14.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4289-5" platform="rhel5" modified="2011-10-07">
      <description>The apmd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.15.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4298-6" platform="rhel5" modified="2011-10-07">
      <description>The acpid service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.15.2, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4051-9" platform="rhel5" modified="2011-10-07">
      <description>The cpuspeed service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.3.15.3, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4324-0" platform="rhel5" modified="2011-10-07">
      <description>The crond service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4406-5" platform="rhel5" modified="2011-10-07">
      <description>The anacron service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4428-9" platform="rhel5" modified="2011-10-07">
      <description>The anacron package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4322-4" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.monthly file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4450-3" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/cron.daily should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 700</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4331-5" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.weekly file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3851-3" platform="rhel5" modified="2011-10-07">
      <description>The /etc/crontab file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4379-4" platform="rhel5" modified="2011-10-07">
      <description>The /etc/anacrontab file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4388-5" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/crontab should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 600</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4054-3" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.hourly file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4441-2" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.monthly file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4212-7" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.d file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4380-2" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.d file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3833-1" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.weekly file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3604-6" platform="rhel5" modified="2011-10-07">
      <description>The /etc/anacrontab file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4106-1" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/cron.hourly should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 700</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3983-4" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.hourly file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3626-9" platform="rhel5" modified="2011-10-07">
      <description>The /etc/crontab file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4022-0" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.daily file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4304-2" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/anacrontab should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 600</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4203-6" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/cron.weekly should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 700</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4251-5" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/cron.monthly should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 700</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3481-9" platform="rhel5" modified="2011-10-07">
      <description>The /etc/cron.daily file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4250-7" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/cron.d should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.4.2, Value: 700</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4268-9" platform="rhel5" modified="2011-10-07">
      <description>The sshd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4272-1" platform="rhel5" modified="2011-10-07">
      <description>SSH should be installed or uninstalled as appropriate</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.1.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4295-2" platform="rhel5" modified="2011-10-07">
      <description>Inbound connections to the ssh port should be allowed or denied as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>/etc/sysconfig/iptables</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.1.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4325-7" platform="rhel5" modified="2011-10-07">
      <description>SSH version 1 protocol support should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>permitted / not permitted</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.1, Value: not permitted</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-132</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3845-5" platform="rhel5" modified="2011-10-07">
      <description>The SSH idle timout interval should be set to an appropriate value</description>
      <parameters>
        <parameter>integer (seconds)</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.3, Value: no suggestion</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4475-0" platform="rhel5" modified="2011-10-07">
      <description>Emulation of the rsh command through the ssh server should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4370-3" platform="rhel5" modified="2011-10-07">
      <description>SSH host-based authentication should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4387-7" platform="rhel5" modified="2011-10-07">
      <description>Root login via SSH should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.6, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3660-8" platform="rhel5" modified="2011-10-07">
      <description>Remote connections from accounts with empty passwords should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.7, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4431-3" platform="rhel5" modified="2011-10-07">
      <description>SSH warning banner should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.5.2.8, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4462-8" platform="rhel5" modified="2011-10-07">
      <description>X Windows should be enabled or disabled at system boot as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/inittab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.6.1.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4422-2" platform="rhel5" modified="2011-10-07">
      <description>X Windows should be installed or removed as appropriate</description>
      <parameters>
        <parameter>installed/removed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.6.1.2, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4303-4" platform="rhel5" modified="2011-10-07">
      <description>DEPRECTATED in favor of CCE-4448-7</description>
      <parameters/>
      <technical_mechanisms/>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: , Value:</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4448-7" platform="rhel5" modified="2011-10-07">
      <description>The xfs service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.6.1.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4074-1" platform="rhel5" modified="2011-10-07">
      <description>X Windows System Listening for remote connections should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/X11/xinit/xserverrc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.6.1.3.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3717-6" platform="rhel5" modified="2011-10-07">
      <description>Warning banners for gui login users should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/gdm/custom.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.6.2.1, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4365-3" platform="rhel5" modified="2011-10-07">
      <description>The avahi-daemon service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4136-8" platform="rhel5" modified="2011-10-07">
      <description>The Avahi daemon should be configured to serve via Ipv6 or not as appropriate</description>
      <parameters>
        <parameter>serve / not serve</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.1, Value: no suggestion</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4409-9" platform="rhel5" modified="2011-10-07">
      <description>The Avahi daemon should be configured to serve via Ipv4 or not as appropriate</description>
      <parameters>
        <parameter>serve / not serve</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.1, Value: no suggestion</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4426-3" platform="rhel5" modified="2011-10-07">
      <description>Avahi should be configured to accept packets with a TTL field not equal to 255 or not as appropriate</description>
      <parameters>
        <parameter>accept / reject</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.2, Value: reject</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4193-9" platform="rhel5" modified="2011-10-07">
      <description>Avahi should be configured to allow other stacks from binding to port 5353 or not as appropriate</description>
      <parameters>
        <parameter>allow / disallow</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.3, Value: disallow</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4444-6" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of local information should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4352-1" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of local information by user applications should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4433-9" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of hardware information should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4451-1" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of workstation name should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4341-4" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of IP addresses should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4358-8" platform="rhel5" modified="2011-10-07">
      <description>Avahi publishing of domain name should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/avahi/avahi-daemon.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.7.2.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4112-9" platform="rhel5" modified="2011-10-07">
      <description>The cups service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3755-6" platform="rhel5" modified="2011-10-07">
      <description>CUPS service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled/disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3649-1" platform="rhel5" modified="2011-10-07">
      <description>Firewall access to printing service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/iptables</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.2, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4420-6" platform="rhel5" modified="2011-10-07">
      <description>Remote print browsing should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/cups/cupsd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.3.1.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4407-3" platform="rhel5" modified="2011-10-07">
      <description>CUPS should be allowed or denied the ability to listen for Incoming printer information as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/cups/cupsd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.3.1.1, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4425-5" platform="rhel5" modified="2011-10-07">
      <description>The hplip service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.8.4.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4191-3" platform="rhel5" modified="2011-10-07">
      <description>The dhcp client service should be enabled or disabled as appropriate for each interface.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/network-scripts/ifcfg-IFACE</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4336-4" platform="rhel5" modified="2011-10-07">
      <description>The dhcpd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.3, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4464-4" platform="rhel5" modified="2011-10-07">
      <description>The dhcp package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.3, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4257-2" platform="rhel5" modified="2011-10-07">
      <description>The dynamic DNS feature of the DHCP server should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4403-2" platform="rhel5" modified="2011-10-07">
      <description>DHCPDECLINE messages should be accepted or denied by the DHCP server as appropriate</description>
      <parameters>
        <parameter>accepted / denied</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.2, Value: denied</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4345-5" platform="rhel5" modified="2011-10-07">
      <description>BOOTP queries should be accepted or denied by the DHCP server as appropriate</description>
      <parameters>
        <parameter>accepted / denied</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.3, Value: denied</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3724-2" platform="rhel5" modified="2011-10-07">
      <description>Domain name server information should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4243-2" platform="rhel5" modified="2011-10-07">
      <description>Default routers should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4389-3" platform="rhel5" modified="2011-10-07">
      <description>Domain name should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3913-1" platform="rhel5" modified="2011-10-07">
      <description>NIS domain should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4169-9" platform="rhel5" modified="2011-10-07">
      <description>NIS servers should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4318-2" platform="rhel5" modified="2011-10-07">
      <description>Time offset should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4319-0" platform="rhel5" modified="2011-10-07">
      <description>NTP servers should be sent or not sent by the DHCP server as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dhcpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.4, Value: not sent</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3733-3" platform="rhel5" modified="2011-10-07">
      <description>dhcpd logging should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/syslog.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.9.4.5, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4376-0" platform="rhel5" modified="2011-10-07">
      <description>The ntpd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.2.2.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4134-3" platform="rhel5" modified="2011-10-07">
      <description>Network access to ntpd should be allowed or denied as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ntp.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.2.2.2, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4385-1" platform="rhel5" modified="2011-10-07">
      <description>A remote NTP Server for time synchronization should be specified or not as appropriate</description>
      <parameters>
        <parameter>ip address</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ntp.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.2.2.3, Value: no suggestion</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4032-9" platform="rhel5" modified="2011-10-07">
      <description>OpenNTPD should be installed or uninstalled as appropriate</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via openntpd package</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.3.1, Value: no suggestion</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4424-8" platform="rhel5" modified="2011-10-07">
      <description>The ntp daemon should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/rc.local</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.3.2.1, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3487-6" platform="rhel5" modified="2011-10-07">
      <description>The ntp daemon synchronization server should be set appropriately</description>
      <parameters>
        <parameter>local ntp server</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /usr/local/etc/ntpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.10.3.2.2, Value: ntp server</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4416-4" platform="rhel5" modified="2011-10-07">
      <description>The sendmail service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.11, Value: enabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4293-7" platform="rhel5" modified="2011-10-07">
      <description>The listening sendmail daemon should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/sendmail</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.11.2.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3501-4" platform="rhel5" modified="2011-10-07">
      <description>The ldap service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4360-4" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/pki/tls/CA/cacert.pem should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: 644</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4378-6" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/pki/tls/ldap/serverkey.pem should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: 755</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4492-5" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4263-0" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/pki/tls/ldap/servercert.pem should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: 755</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3502-2" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap/serverkey.pem file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4449-5" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/CA/cacert.pem file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4361-2" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/pki/tls/ldap should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: 755</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4427-1" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/CA/cacert.pem file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4321-6" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap/serverkey.pem file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: ldap</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4339-8" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4105-3" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap/servercert.pem file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3718-4" platform="rhel5" modified="2011-10-07">
      <description>The /etc/pki/tls/ldap/servercert.pem file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.4.2, Value: ldap</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4484-2" platform="rhel5" modified="2011-10-07">
      <description>The /var/lib/ldap/* files should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.7, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4502-1" platform="rhel5" modified="2011-10-07">
      <description>The /var/lib/ldap/* files should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.12.3.7, Value: ldap</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4396-8" platform="rhel5" modified="2011-10-07">
      <description>The nfslock service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3535-2" platform="rhel5" modified="2011-10-07">
      <description>The rpcgssd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3568-3" platform="rhel5" modified="2011-10-07">
      <description>The rpcidmapd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.1.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4533-6" platform="rhel5" modified="2011-10-07">
      <description>The netfs service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.1.2, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4550-0" platform="rhel5" modified="2011-10-07">
      <description>The portmap service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.1.3, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4559-1" platform="rhel5" modified="2011-10-07">
      <description>The lockd service should be configured to use a static port or a dynamic portmapper port for TCP as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4015-4" platform="rhel5" modified="2011-10-07">
      <description>The statd service should be configured to use an outgoing static port or an outgoing dynamic portmapper port as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3667-3" platform="rhel5" modified="2011-10-07">
      <description>The statd service should be configured to use a static port or a dynamic portmapper port as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4310-9" platform="rhel5" modified="2011-10-07">
      <description>The lockd service should be configured to use a static port or a dynamic portmapper port for UDP as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4438-8" platform="rhel5" modified="2011-10-07">
      <description>The mountd service should be configured to use a static port or a dynamic portmapper port as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3579-0" platform="rhel5" modified="2011-10-07">
      <description>The rquotad service should be configured to use a static port or a dynamic portmapper port as appropriate</description>
      <parameters>
        <parameter>static / dynamic</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/nfs</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.2.3, Value: static</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4473-5" platform="rhel5" modified="2011-10-07">
      <description>The nfs service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.3.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4491-7" platform="rhel5" modified="2011-10-07">
      <description>The rpcsvcgssd service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.3.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4368-7" platform="rhel5" modified="2011-10-07">
      <description>The nodev option should be enabled or disabled for all NFS mounts as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.3.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4024-6" platform="rhel5" modified="2011-10-07">
      <description>The nosuid option should be enabled or disabled for all NFS mounts as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.3.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4526-0" platform="rhel5" modified="2011-10-07">
      <description>The noexec option should be enabled or disabled for all NFS mounts as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.3.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4544-3" platform="rhel5" modified="2011-10-07">
      <description>Root squashing should be enabled or disabled as appropriate for all NFS shares</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/exports</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.4.1.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4465-1" platform="rhel5" modified="2011-10-07">
      <description>Restriction of NFS clients to privileged ports should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/exports</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.4.1.3, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4350-5" platform="rhel5" modified="2011-10-07">
      <description>Write access to NFS shares should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/exports</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.13.4.1.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3578-2" platform="rhel5" modified="2011-10-07">
      <description>The named service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4219-2" platform="rhel5" modified="2011-10-07">
      <description>The bind package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3985-9" platform="rhel5" modified="2011-10-07">
      <description>The /var/named/chroot/etc/named.conf file should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.3.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4487-5" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /var/named/chroot/etc/named.conf should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.3.2, Value: 644</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4258-0" platform="rhel5" modified="2011-10-07">
      <description>The /var/named/chroot/etc/named.conf file should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.3.2, Value: root</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-201</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4399-2" platform="rhel5" modified="2011-10-07">
      <description>LDAP's dynamic updates feature should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/named.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.14.4.5, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3919-8" platform="rhel5" modified="2011-10-07">
      <description>The vsftpd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.15.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4549-2" platform="rhel5" modified="2011-10-07">
      <description>Logging of vsftpd transactions should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/vsftpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.15.3.1, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4554-2" platform="rhel5" modified="2011-10-07">
      <description>A warning banner for all FTP users should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/vsftpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.15.3.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4443-8" platform="rhel5" modified="2011-10-07">
      <description>Local user login to the vsftpd service should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/vsftpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.15.3.3.1, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4461-0" platform="rhel5" modified="2011-10-07">
      <description>File uploads via vsftpd should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/vsftpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.15.3.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4338-0" platform="rhel5" modified="2011-10-07">
      <description>The httpd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4514-6" platform="rhel5" modified="2011-10-07">
      <description>The httpd package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4346-3" platform="rhel5" modified="2011-10-07">
      <description>The apache 2 server software should be installed or removed as appropriate</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.2.1, Value: installed</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4474-3" platform="rhel5" modified="2011-10-07">
      <description>The apache2 server's ServerTokens value should be set appropriately</description>
      <parameters>
        <parameter>text</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/httpd/conf/httpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.3.1, Value: Prod</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3756-4" platform="rhel5" modified="2011-10-07">
      <description>The apache2 server's ServerSignature value should be set appropriately</description>
      <parameters/>
      <technical_mechanisms>
        <technical_mechanism>via /etc/httpd/conf/httpd.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.3.1, Value: Off</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4509-6" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/httpd/conf should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.5.1, Value: 750</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4386-9" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /etc/httpd/conf/* should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.5.1, Value: 640</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4029-5" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /usr/sbin/httpd should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.5.1, Value: 511</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3581-6" platform="rhel5" modified="2011-10-07">
      <description>The /etc/httpd/conf/* files should be owned by the appropriate group.</description>
      <parameters/>
      <technical_mechanisms>
        <technical_mechanism>via chgrp</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.5.1, Value: apache</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-202</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4574-0" platform="rhel5" modified="2011-10-07">
      <description>File permissions for /var/log/httpd should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.16.5.1, Value: 750</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-200</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3847-1" platform="rhel5" modified="2011-10-07">
      <description>The dovecot service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4239-0" platform="rhel5" modified="2011-10-07">
      <description>The dovecot package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4384-4" platform="rhel5" modified="2011-10-07">
      <description>Dovecot should be configured to support the imaps protocol or not as necessary</description>
      <parameters>
        <parameter>support / not support</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.1, Value: not support</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3887-7" platform="rhel5" modified="2011-10-07">
      <description>Dovecot should be configured to support the pop3s protocol or not as necessary</description>
      <parameters>
        <parameter>support / not support</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.1, Value: not support</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4530-2" platform="rhel5" modified="2011-10-07">
      <description>Dovecot should be configured to support the pop3 protocol or not as necessary</description>
      <parameters>
        <parameter>support / not support</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.1, Value: not support</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4547-6" platform="rhel5" modified="2011-10-07">
      <description>Dovecot should be configured to support the imap protocol or not as necessary</description>
      <parameters>
        <parameter>support / not support</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.1, Value: not support</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4552-6" platform="rhel5" modified="2011-10-07">
      <description>Dovecot plaintext authentication of clients should be enabled or disabled as necessary</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.2.4, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4371-1" platform="rhel5" modified="2011-10-07">
      <description>The Dovecot option to drop privileges to user before executing mail process should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4410-7" platform="rhel5" modified="2011-10-07">
      <description>The Dovecot option to spawn a new login process per connection should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/dovecot.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.17.2.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4551-8" platform="rhel5" modified="2011-10-07">
      <description>The smb service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.18.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4556-7" platform="rhel5" modified="2011-10-07">
      <description>The squid service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-160</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4076-6" platform="rhel5" modified="2011-10-07">
      <description>The squid package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4454-5" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to force FTP passive connections should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4353-9" platform="rhel5" modified="2011-10-07">
      <description>The Squid max request HTTP header length should be set to an appropriate value</description>
      <parameters>
        <parameter>data length</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: 20kb</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4503-9" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to check for RFC compliant hostnames should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3585-7" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to ignore unknown nameservers should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4419-8" platform="rhel5" modified="2011-10-07">
      <description>The Squid max reply HTTP header length should be set to an appropriate value</description>
      <parameters>
        <parameter>data length</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: 20kb</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3692-1" platform="rhel5" modified="2011-10-07">
      <description>The Squid EUID should be set to an appropriate user</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: squid</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4459-4" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to perform FTP sanity checks should be enabled or not as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4476-8" platform="rhel5" modified="2011-10-07">
      <description>The Squid GUID should be set to an appropriate group</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.2, Value: squid</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4181-4" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to show proxy client IP addresses in HTTP headers should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.3, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4577-3" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to log HTTP MIME headers should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4344-8" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to allow underscores in hostnames should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.3, Value: disabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4494-1" platform="rhel5" modified="2011-10-07">
      <description>The Squid option to suppress the httpd version string should be enabled or disabled as appropriate</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.3, Value: enabled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4511-2" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow gss-http traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4529-4" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow https traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: allow</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3610-3" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow wais traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4466-9" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow multiling http traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4607-8" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow http traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: allow</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4255-6" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow ftp traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: allow</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4127-7" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow gopher traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4519-5" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow filemaker traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4413-1" platform="rhel5" modified="2011-10-07">
      <description>Squid proxy access to localhost should be allowed or denied as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4373-7" platform="rhel5" modified="2011-10-07">
      <description>Squid should be configured to allow http-mgmt traffic or not as appropriate</description>
      <parameters>
        <parameter>allow / deny</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/squid/squid.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.19.2.5, Value: deny</reference>
      </references>
    </cce>
    <cce cce_id="CCE-3765-5" platform="rhel5" modified="2011-10-07">
      <description>The snmpd service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.20.1, Value: disabled</reference>
        <reference resource_id="Old &quot;Unix-CCE-DRAFT-2&quot; ID">CCE-U-203</reference>
      </references>
    </cce>
    <cce cce_id="CCE-4404-0" platform="rhel5" modified="2011-10-07">
      <description>The net-smtp package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot;">Section: 3.20.1, Value: uninstalled</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14113-5" platform="rhel5" modified="2011-10-07">
      <description>The minimum number of digits required for new passwords should be set as appropriate.</description>
      <parameters>
        <parameter>number of digits</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via pam_cracklib</technical_mechanism>
        <technical_mechanism>via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14672-0" platform="rhel5" modified="2011-10-07">
      <description>The minimum number of upper case characters required for new passwords should be set as appropriate.</description>
      <parameters>
        <parameter>number of upper characters</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via pam_cracklib</technical_mechanism>
        <technical_mechanism>via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14712-4" platform="rhel5" modified="2011-10-07">
      <description>The minimum number of lower case characters required for new passwords should be set as appropriate.</description>
      <parameters>
        <parameter>number of lower characters</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via pam_cracklib</technical_mechanism>
        <technical_mechanism>via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14122-6" platform="rhel5" modified="2011-10-07">
      <description>The minimum number of special characters required for new passwords should be set as appropriate.</description>
      <parameters>
        <parameter>number of special characters</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via pam_cracklib</technical_mechanism>
        <technical_mechanism>via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14412-1" platform="rhel5" modified="2011-10-07">
      <description>The nodev option should be enabled or disabled as appropriate for /tmp.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.1 - Add nodev Option to /tmp</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15007-8" platform="rhel5" modified="2011-10-07">
      <description>The nodev option should be enabled or disabled for /dev/shm.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.2 - Add nodev Option to /dev/shm</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14161-4" platform="rhel5" modified="2011-10-07">
      <description>/tmp should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.1.1.1 - Create Separate Partition or Logical Volume for /tmp</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14777-7" platform="rhel5" modified="2011-10-07">
      <description>/var should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.1.1.2 - Create Separate Partition or Logical Volume for /var</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14011-1" platform="rhel5" modified="2011-10-07">
      <description>/var/log should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.1.1.3 - Create Separate Partition or Logical Volume for /var/log</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14171-3" platform="rhel5" modified="2011-10-07">
      <description>/var/log/audit should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.1.1.4 - Create Separate Partition or Logical Volume for /var/log/audit</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14559-9" platform="rhel5" modified="2011-10-07">
      <description>/home should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.1.1.5 - Create Separate Partition or Logical Volume for /home if Using Local Home Directories</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14440-2" platform="rhel5" modified="2011-10-07">
      <description>The GPG Key for Red Hat Network should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via rpm</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.2.1.1 - Ensure that GPG Key for Red Hat Network is Installed</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14914-6" platform="rhel5" modified="2011-10-07">
      <description>Package signature checking should be globally activated or deactivated as appropriate.</description>
      <parameters>
        <parameter>activated / deactivated</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>/etc/yum.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.2.3.3 - Ensure Package Signature Checking is Globally Activated</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14813-0" platform="rhel5" modified="2011-10-07">
      <description>Package signature checking should be activated or deactivated as appropriate for all configured repositories.</description>
      <parameters>
        <parameter>activated / deactivated</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via all files in /etc/yum.repos.d</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.2.3.4 - Ensure Package Signature Checking is Not Disabled For Any Repos</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14931-0" platform="rhel5" modified="2011-10-07">
      <description>All installed software packages verify or do not verify against the package database.</description>
      <parameters>
        <parameter>verify / don't verify</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via rpm</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.1.3.2 - Verify Package Integrity Using RPM</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14940-1" platform="rhel5" modified="2011-10-07">
      <description>The nosuid option should be enabled or disabled as appropriate  for /tmp.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.1 - Add nosuid Option to /tmp</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14927-8" platform="rhel5" modified="2011-10-07">
      <description>The noexec option should be enabled or disabled as appropriate for /tmp.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.1 - Add noexec Option to /tmp</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14306-5" platform="rhel5" modified="2011-10-07">
      <description>The nosuid option should be enabled or disabled for /dev/shm.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.2 - Add nosuid Option to /dev/shm</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14703-3" platform="rhel5" modified="2011-10-07">
      <description>The noexec option should be enabled or disabled for /dev/shm.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.3.2 - Add noexec Option to /dev/shm</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14584-7" platform="rhel5" modified="2011-10-07">
      <description>/var/tmp should be configured on an appropriate filesystem partition.</description>
      <parameters>
        <parameter>partition</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.1.4 - Bind-mount /var/tmp to /tmp</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14089-7" platform="rhel5" modified="2011-10-07">
      <description>Support for cramfs filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14457-6" platform="rhel5" modified="2011-10-07">
      <description>Support for freevxfs filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15087-0" platform="rhel5" modified="2011-10-07">
      <description>Support for hfs filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14093-9" platform="rhel5" modified="2011-10-07">
      <description>Support for hfsplus filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14853-6" platform="rhel5" modified="2011-10-07">
      <description>Support for jffs2 filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14118-4" platform="rhel5" modified="2011-10-07">
      <description>Support for squashfs filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14871-8" platform="rhel5" modified="2011-10-07">
      <description>Support for udf filesystems should be enabeld or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via /etc/modprobe.conf</technical_mechanism>
        <technical_mechanism>(2) via configuration file in /etc/modprobe.d</technical_mechanism>
        <technical_mechanism>(3) via MODPROBE_OPTIONS environment variable</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.2.5 - Disable Mounting of Uncommon Filesystem Types</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14794-2" platform="rhel5" modified="2011-10-07">
      <description>All world-writable directories should be owned by an appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.3.6 - Verify that All World-Writable Directories Have Proper Ownership</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14300-8" platform="rhel5" modified="2011-10-07">
      <description>Password hashes are shadowed or not shadowed for all accounts in /etc/passwd as appropriate.</description>
      <parameters>
        <parameter>shadowed / not shadowed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/password</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.5.2 - Verify that All Account Password Hashes are Shadowed</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14675-3" platform="rhel5" modified="2011-10-07">
      <description>NIS file inclusions should be set appropriately in the /etc/group file</description>
      <parameters>
        <parameter>allowed / not allowed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/group</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.8 - Remove Legacy + Entries from Password Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14071-5" platform="rhel5" modified="2011-10-07">
      <description>NIS file inclusions should be set appropriately in the /etc/shadow file</description>
      <parameters>
        <parameter>allowed / not allowed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/shadow</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.8 - Remove Legacy + Entries from Password Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14701-7" platform="rhel5" modified="2011-10-07">
      <description>The password strength parameters should require new passwords to differ from old ones by the appropriate minimum number of characters.</description>
      <parameters>
        <parameter>number of characters</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via PAM</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - via PAM</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14063-2" platform="rhel5" modified="2011-10-07">
      <description>The password hashing algorithm should be configured as appropriate.</description>
      <parameters>
        <parameter>hashing algorithm</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via PAM</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.5 - Upgrade Password Hashing Algorithm to SHA-512</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14939-3" platform="rhel5" modified="2011-10-07">
      <description>The "password reuse" policy should meet minimum requirements.</description>
      <parameters>
        <parameter>number of passwords</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via PAM</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.6 - Limit Password Reuse</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14340-4" platform="rhel5" modified="2011-10-07">
      <description>Files with the setuid attribute enabled should be reviewed as appropriate to determine whether that condition is correct.</description>
      <parameters>
        <parameter>(1) set of files to review</parameter>
        <parameter>(2) description of which files should be setuid</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via find</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.3.4b - Find Unauthorized SUID/SGID System Executables</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14970-8" platform="rhel5" modified="2011-10-07">
      <description>Files with the setgid attribute enabled should be reviewed as appropriate to determine whether that condition is correct.</description>
      <parameters>
        <parameter>(1) set of files to review</parameter>
        <parameter>(2) description of which files should be setgid</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via find</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.2.3.4a - Find Unauthorized SUID/SGID System Executables</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14957-5" platform="rhel5" modified="2011-10-07">
      <description>The PATH variable for root includes or does not include any world-writable or group-writable directories as appropriate.</description>
      <parameters>
        <parameter>Includes / does not include</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via echo $PATH</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.4.1.2 - Ensure that no dangerous directories exist in root's path</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14107-7" platform="rhel5" modified="2011-10-07">
      <description>The default umask for all users should be set correctly in /etc/login.defs</description>
      <parameters>
        <parameter>umask</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/login.def</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.4.4 - Ensure that Users Have Sensible Umask Values</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14860-1" platform="rhel5" modified="2011-10-07" deprecated="true">
      <description>DEPRECATED in favor of CCE-14107-7.  Was: The default umask for all users should be set correctly in /etc/login.defs</description>
      <parameters/>
      <technical_mechanisms/>
      <references/>
    </cce>
    <cce cce_id="CCE-14847-8" platform="rhel5" modified="2011-10-07">
      <description>The default umask for all users should be set correctly in /etc/profile</description>
      <parameters>
        <parameter>umask</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/profile</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.4.4 - Ensure that Users Have Sensible Umask Values</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14604-3" platform="rhel5" modified="2011-10-07">
      <description>The gnome desktop screensaver should be enabled or disabled as appropriate as a mandatory setting for all users.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via gconftool-2</technical_mechanism>
        <technical_mechanism>(2) via /etc/gconf/gconf.xml.mandatory</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.5.6.1 - Configure GUI Screen Locking</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14023-6" platform="rhel5" modified="2011-10-07">
      <description>The screen lock (password protection) function of the gnome desktop screensaver should be enabled or disabled as appropriate as a mandatory setting for all users.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via gconftool-2</technical_mechanism>
        <technical_mechanism>(2) via /etc/gconf/gconf.xml.mandatory</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.5.6.1 - Configure GUI Screen Locking</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14735-5" platform="rhel5" modified="2011-10-07">
      <description>The screen blanking function of the gnome desktop screensaver should be enabled or disabled as appropriate as a mandatory setting for all users.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via gconftool-2</technical_mechanism>
        <technical_mechanism>(2) via /etc/gconf/gconf.xml.mandatory</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.5.6.1 - Configure GUI Screen Locking</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14991-4" platform="rhel5" modified="2011-10-07">
      <description>The system includes or does not include any device files with the unlabeled SELinux type.</description>
      <parameters>
        <parameter>includes / does not include</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.4.5 - Check for Unlabeled Device Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15013-6" platform="rhel5" modified="2011-10-07">
      <description>The system should act as a network sniffer or not as appropriate.</description>
      <parameters>
        <parameter>yes / no</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /proc/net/packet</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.1.3 - Ensure System is Not Acting as a Network Sniffer</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14264-6" platform="rhel5" modified="2011-10-07">
      <description>The default policy for iptables INPUT table should be set as appropriate.</description>
      <parameters>
        <parameter>ACCEPT / DROP / QUEUE /RETURN</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/iptables</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.5.3.1 - Change the Default Policies</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14268-7" platform="rhel5" modified="2011-10-07">
      <description>Disable or enable support for DCCP as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.7.1 - Disable Support for DCCP</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14132-5" platform="rhel5" modified="2011-10-07">
      <description>Disable or enable support for SCTP as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.7.2 - Disable Support for SCTP</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14027-7" platform="rhel5" modified="2011-10-07">
      <description>Disable or enable support for RDS as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.7.3 - Disable Support for RDS</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14911-2" platform="rhel5" modified="2011-10-07">
      <description>Disable or enable support for TIPC as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.7.4 - Disable Support for TIPC</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15026-8" platform="rhel5" modified="2011-10-07">
      <description>The kernel arguments should enable or disable auditing early in the boot process as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via grub.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.3 - Enable Auditing for Processes which Start Prior to the Audit Daemon</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14051-7" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record date and time modification events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.1 - Records Events that Modify Date and Time Information</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14829-6" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record user/group information modification events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.2 - Record Events that Modify User/Group Information</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14816-3" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record changes to the system network environment as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.3 - Record Events that Modify the System&#8217;s Network Environment</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14821-3" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record changes to the system's mandatory access controls as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.4 - Record Events that Modify the System&#8217;s Mandatory Access Controls</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14904-7" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record logon and logout events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.5 - Audit Logon and Logout Events</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14679-5" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record process and session initiation events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.6 - Audit Process and Session initiation</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14058-2" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record changes to discretionary access control permissions as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.7 - Audit Discretionary Access Control Permissions for Changes</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14917-9" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record unauthorized attempts to access files as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.8 - Audit for Unauthorized Attempts to Access Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14296-8" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record use of privileged commands as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.9 - Audit for the Use of Privileged Commands</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14569-8" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record data export to media events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.10 - Audit for Exporting Data to Media</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14820-5" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record file and program deletion events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.11 - Audit for Files and Programs Deleted by the User</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14824-7" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record administrator and security personnel action events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.12 - Audit All Administrator and Security Personnel Actions</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14688-6" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to record kernel module loading and unloading events as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.13 - Ensure auditd Collects Information on Kernel Module Loading and Unloading</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14692-8" platform="rhel5" modified="2011-10-07">
      <description>Auditing should be configured to make auditd configuration immutable as appropriate.</description>
      <parameters>
        <parameter>audit enabled / audit disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/audit/audit.rules or auditctl</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.2.4.14 - Make auditd configuration immutable</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14948-4" platform="rhel5" modified="2011-10-07">
      <description>Bluetooth kernel modules should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.14.3 - Disable Bluetooth Kernel Modules</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14825-4" platform="rhel5" modified="2011-10-07">
      <description>The isdn4k-utils package should installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.4 - ISDN Support (isdn)</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14054-1" platform="rhel5" modified="2011-10-07">
      <description>Zeroconf networking should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/network</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.9.3 - Disable Zeroconf Networking</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14466-7" platform="rhel5" modified="2011-10-07">
      <description>The at daemon should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.4.3 - Disable at service if Possible</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14061-6" platform="rhel5" modified="2011-10-07">
      <description>The SSH 'keep alive' message count should be set to an appropriate value.</description>
      <parameters>
        <parameter>number of messages</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.5.2.3 - Set Idle Timeout Interval for User Logins</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14716-5" platform="rhel5" modified="2011-10-07">
      <description>Users should be allowed or not allowed to set environment options for SSH as appropriate.</description>
      <parameters>
        <parameter>allowed / not allowed</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.5.2.9 - Do Not Allow Users to Set Environment Options</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14491-5" platform="rhel5" modified="2011-10-07">
      <description>Appropriate ciphers should be used for SSH.</description>
      <parameters>
        <parameter>approved ciphers</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ssh/sshd_config</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.5.2.10 - Use Only Approved Ciphers</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14495-6" platform="rhel5" modified="2011-10-07">
      <description>The sendmail package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.11.1.1 - Select Postfix as Mail Server Software</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14068-1" platform="rhel5" modified="2011-10-07">
      <description>The postfix package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.11.1.1 - Select Postfix as Mail Server Software</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15018-5" platform="rhel5" modified="2011-10-07">
      <description>Postfix network listening should be enabled or disabled for as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/postfix/main.cf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.11.2.1.1 - Disable Postfix Network Listening</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14894-0" platform="rhel5" modified="2011-10-07">
      <description>LDAP client requires or does not require LDAP servers to use TLS for SSL communications as appropriate.</description>
      <parameters>
        <parameter>requires / does not require</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/ldap.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.12.2.2 - Con&#64257;gure LDAP to Use TLS for All Transactions</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14881-7" platform="rhel5" modified="2011-10-07">
      <description>The vsftpd package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.15.1 - Disable vsftpd if Possible</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14075-6" platform="rhel5" modified="2011-10-07">
      <description>Client SMB packet signing should be required or not required for smbclient as appropriate.</description>
      <parameters>
        <parameter>required / not required</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/samba/smb.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.18.2.10 - Require Client SMB Packet Signing, if using smbclient</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15029-2" platform="rhel5" modified="2011-10-07">
      <description>Client SMB packet signing should be required or not required for mount.cifs as appropriate.</description>
      <parameters>
        <parameter>required / not required</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/fstab</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.18.2.11 - Require Client SMB Packet Signing, if using mount.cifs</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14081-4" platform="rhel5" modified="2011-10-07">
      <description>The net-snmpd package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.20.1 - Disable SNMP Server if Possible</reference>
      </references>
    </cce>
    <cce cce_id="CCE-14088-9" platform="rhel5" modified="2011-10-07">
      <description>The 'wheel' group should exist or not as appropriate</description>
      <parameters>
        <parameter>exist / not exist</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/group</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.2 - Limit su Access to the Root Account</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15047-4" platform="rhel5" modified="2011-10-07">
      <description>Access to the root account via su should be restricted to the wheel group or not as appropriate.</description>
      <parameters>
        <parameter>restricted / not restricted</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/pam.d/su</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.2 - Limit su Access to the Root Account</reference>
      </references>
    </cce>
    <cce cce_id="CCE-15054-0" platform="rhel5" modified="2011-10-07">
      <description>The number of times a user is prompted to provide a new password if it fails to meet configured password strength requirements (also known as the retry value) should be set appropriately.</description>
      <parameters>
        <parameter>number of retry attempts</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>(1) via pam_cracklib</technical_mechanism>
        <technical_mechanism>(2) via pam_passwdqc</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.1.1 - Set Password Quality Requirements</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17742-8" platform="rhel5" modified="2011-10-07">
      <description>The rsyslog package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.1 - Install the rsyslog Package</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17698-2" platform="rhel5" modified="2011-10-07">
      <description>The rsyslog service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.2 - Ensure the rsyslog Service is Activated</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18095-0" platform="rhel5" modified="2011-10-07">
      <description>File permissions for all rsyslog log files should be set correctly.</description>
      <parameters>
        <parameter>permissions</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chmod</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.4 - Confirm Existence and Permissions of Log Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18240-2" platform="rhel5" modified="2011-10-07">
      <description>All rsyslog log files should be owned by the appropriate group.</description>
      <parameters>
        <parameter>group</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.4 - Confirm Existence and Permissions of Log Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17857-4" platform="rhel5" modified="2011-10-07">
      <description>All rsyslog log files should be owned by the appropriate user.</description>
      <parameters>
        <parameter>user</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chown</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.4 - Confirm Existence and Permissions of Log Files</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17248-6" platform="rhel5" modified="2011-10-07">
      <description>Rsyslog logs should be sent to a remote loghost or not as appropriate.</description>
      <parameters>
        <parameter>sent / not sent</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/rsyslog.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.5 - Send Logs to a Remote Host Using Reliable Transport</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17639-6" platform="rhel5" modified="2011-10-07">
      <description>Rsyslog should accept remote messages or not as appropriate.</description>
      <parameters>
        <parameter>accept / reject</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/rsyslog.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.6.1.2.6 - Enable rsyslog to Accept Remote Messages on Loghosts Only</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18031-5" platform="rhel5" modified="2011-10-07">
      <description>The ipsec-tools package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.8.1.2 - Remove the ipsec-tools Package</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17250-2" platform="rhel5" modified="2011-10-07">
      <description>The pam_ccreds package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.3.7 - Remove the pam_ccreds Package</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18151-1" platform="rhel5" modified="2011-10-07">
      <description>The talk-server package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.2.6.1 - Remove the talk-server Package</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18200-6" platform="rhel5" modified="2011-10-07">
      <description>The talk package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.2.6.2 - Remove the talk Package</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18244-4" platform="rhel5" modified="2011-10-07">
      <description>The irda service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.16.1 - Disable the irda Service if Possible</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17504-2" platform="rhel5" modified="2011-10-07">
      <description>The irda-utils package should be installed or uninstalled as appropriate.</description>
      <parameters>
        <parameter>installed / uninstalled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via yum</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.16.2 - Remove the irda-utils Package if Possible</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18037-2" platform="rhel5" modified="2011-10-07">
      <description>The firewall should allow or reject access to the avahi service.</description>
      <parameters>
        <parameter>accept / reject</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/sysconfig/iptables</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.7.1.2 - Remove Avahi Server iptables Firewall Exception</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18156-0" platform="rhel5" modified="2011-10-07">
      <description>The rawdevices service should be enabled or disabled as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via chkconfig</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 3.3.17.1 - Disable rawdevices Service</reference>
      </references>
    </cce>
    <cce cce_id="CCE-17816-0" platform="rhel5" modified="2011-10-07">
      <description>The libuser library "login_defs" variable should be set correctly in libuser.conf.</description>
      <parameters>
        <parameter>path to login.defs</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/libuser.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.7.1  - Ensure Libuser Uses Settings from login.defs</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18412-7" platform="rhel5" modified="2011-10-07">
      <description>User accounts may or may not be inactivated a specified number of days after account expiration.</description>
      <parameters>
        <parameter>number of days</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via /etc/default/useradd</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.3.1.9, Value: 30</reference>
      </references>
    </cce>
    <cce cce_id="CCE-18455-6" platform="rhel5" modified="2011-10-07">
      <description>The IPv6 protocol should be enabled or disabed as appropriate.</description>
      <parameters>
        <parameter>enabled / disabled</parameter>
      </parameters>
      <technical_mechanisms>
        <technical_mechanism>via modprobe.conf</technical_mechanism>
      </technical_mechanisms>
      <references>
        <reference resource_id="NSA &quot;Guide to the Secure Configuration of Red Hat Enterprise Linux 5&quot; - Revision 4, September 14, 2010">Section: 2.5.3.1.3, Value: 1</reference>
      </references>
    </cce>
    </cces><resources/></cce:cce_list>