<Profile id="fisma-medium-rhel6-server">
<title>FISAMA Medium for Red Hat Enterprise Linux 6</title>
<description>FISMA Medium for Red Hat Enterprise Linux 6</description>

<!-- ACCESS CONTROL (AC) -->
<!-- 	AC-2(2)
     	FISMA Refine: Accounts expire every 90 days -->
<refine-value idref="var_account_disable_post_pw_expiration" selector="90"/>
<select idref="account_disable_post_pw_expiration" selected="true" />
<select idref="account_temp_expire_date" selected="true" />

<!--	AC-2(4) -->
<select idref="audit_rules_usergroup_modification" selected="true"/>

<!--	AC-2(7) -->
<select idref="audit_rules_sysadmin_actions" selected="true"/>

<!--	AC-3, AC-3(3) -->
<select idref="enable_selinux_bootloader" selected="true" />
<select idref="selinux_state" selected="true" />
<select idref="selinux_policytype" selected="true" />
<select idref="service_restorecond_enabled" selected="true" />
<select idref="sshd_use_approved_ciphers" selected="true" />

<!--	AC-4 -->
<select idref="service_rdisc_disabled" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true" />
<select idref="sysctl_net_ipv4_tcp_syncookies" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
<select idref="service_ip6tables_enabled" selected="true" />
<select idref="service_iptables_enabled" selected="true" />

<!--	AC-6 -->
<refine-value idref="var_umask_for_daemons" selector="022"/>
<select idref="sshd_disable_root_login" selected="true" />
<select idref="umask_for_daemons" selected="true" />
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="file_owner_etc_group" selected="true" />
<select idref="file_groupowner_etc_group" selected="true" />
<select idref="file_permissions_etc_group" selected="true" />
<select idref="file_owner_etc_gshadow" selected="true" />
<select idref="file_groupowner_etc_gshadow" selected="true" />
<select idref="file_permissions_etc_gshadow" selected="true" />
<select idref="file_owner_etc_passwd" selected="true" />
<select idref="file_groupowner_etc_passwd" selected="true" />
<select idref="file_permissions_etc_passwd" selected="true" />
<select idref="file_permissions_library_dirs" selected="true" />
<select idref="file_ownership_library_dirs" selected="true" />
<select idref="file_permissions_binary_dirs" selected="true" />
<select idref="file_ownership_binary_dirs" selected="true" />
<select idref="sticky_world_writable_dirs" selected="true" />
<select idref="world_writeable_files" selected="true" />
<select idref="no_files_unowned_by_user" selected="true" />
<select idref="no_files_unowned_by_group" selected="true" />
<select idref="world_writable_files_system_ownership" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
<select idref="selinux_all_devicefiles_labeled" selected="true" />
<select idref="userowner_rsyslog_files" selected="true" />
<select idref="groupowner_rsyslog_files" selected="true" />
<select idref="file_permissions_var_log_audit" selected="true" />
<select idref="file_ownership_var_log_audit" selected="true" />
<select idref="audit_rules_immutable" selected="true" />
<select idref="accounts_no_uid_except_zero" selected="true" />
<select idref="rpm_verify_permissions" selected="true" />

<!--	AC-6(2) -->
<select idref="securetty_root_login_console_only" selected="true" />
<select idref="restrict_serial_port_logins" selected="true" />

<!--	AC-7(a)
     	FISMA Refine: 3 attempts in 15 min -->
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3"/>
<refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900" />
<select idref="accounts_passwords_pam_faillock_deny" selected="true" />
<select idref="accounts_passwords_pam_faillock_interval" selected="true" />

<!--	AC-7(b)
     	FISMA Refine: Locks until admin action
     		      Delay pw prompt for 30min -->
<!-- TODO: PASSWORD PROMPT DELAY FOR 30min, possible?! -->
<refine-value idref="var_accounts_passwords_pam_faillock_unlock_time" selector="604800"/>
<select idref="accounts_passwords_pam_faillock_unlock_time" selected="true" />

<!--	AC-8(a), AC-8(b), AC-8(c) -->
<refine-value idref="login_banner_text" selector="usgcb_default"/>
<select idref="banner_etc_issue" selected="true"/>

<!--	AC-10
     	FISMA Refine: One session -->
<refine-value idref="var_accounts_max_concurrent_login_sessions" seletor="1" />
<select idref="accounts_max_concurrent_login_sessions" selected="true" />

<!--	AC-11(a), AC-11(b)
     	FISMA Refine: Lock after 15min -->
<!-- TODO: Set 15min timeout! -->
<select idref="package_screen_installed" selected="true" />

<!--	AC-17(1) -->
<select idref="service_auditd_enabled" selected="true" />
<select idref="bootloader_audit_argument" selected="true" />

<!--	AC-17(7) -->
<select idref="audit_rules_time_adjtimex" selected="true" />
<select idref="audit_rules_time_settimeofday" selected="true" />
<select idref="audit_rules_time_stime" selected="true" />
<select idref="audit_rules_time_clock_settime" selected="true" />
<select idref="audit_rules_time_watch_localtime" selected="true" />
<select idref="audit_rules_usergroup_modification" selected="true" />
<select idref="audit_rules_networkconfig_modification" selected="true" />
<select idref="audit_rules_mac_modification" selected="true" />
<select idref="audit_rules_dac_modification_chmod" selected="true" />
<select idref="audit_rules_dac_modification_chown" selected="true" />
<select idref="audit_rules_dac_modification_fchmod" selected="true" />
<select idref="audit_rules_dac_modification_fchmodat" selected="true" />
<select idref="audit_rules_dac_modification_fchown" selected="true" />
<select idref="audit_rules_dac_modification_fchownat" selected="true" />
<select idref="audit_rules_dac_modification_fremovexattr" selected="true" />
<select idref="audit_rules_dac_modification_fsetxattr" selected="true" />
<select idref="audit_rules_dac_modification_lchown" selected="true" />
<select idref="audit_rules_dac_modification_lremovexattr" selected="true" />
<select idref="audit_rules_dac_modification_lsetxattr" selected="true" />
<select idref="audit_rules_dac_modification_removexattr" selected="true" />
<select idref="audit_rules_dac_modification_setxattr" selected="true" />
<select idref="audit_rules_login_events" selected="true" />
<select idref="audit_rules_session_events" selected="true" />
<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
<select idref="audit_rules_privileged_commands" selected="true" />
<select idref="audit_rules_media_export" selected="true" />
<select idref="audit_rules_file_deletion_events" selected="true" />
<select idref="audit_rules_sysadmin_actions" selected="true" />
<select idref="audit_rules_kernel_module_loading" selected="true" />
<refine-value idref="sysctl_net_ipv4_conf_all_log_martians_value" selector="0" />
<select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true" />
<select idref="sshd_allow_only_protocol2" selected="true" />

<!--	AC-17(8)
     	FISMA Refinement: [tftp, (trivial ftp); X-Windows,
     			  Sun Open Windows; FTP; TELNET; IPX/SPX;
     			  NETBIOS; Bluetooth; RPC-services, like
     			  NIS or NFS; rlogin, rsh, rexec; SMTP
     			  (Simple Mail Transfer Protocol);
     			  RIP (Routing Information Protocol);
     			  DNS (Domain Name Services);
     			  UUCP (Unix-Unix Copy Protocol);
     			  NNTP (Network News Transfer Protocol);
     			  NTP (Network Time Protocol);
     			  Peer-to-Peer] -->
<select idref="disable_xinetd" selected="true" />
<select idref="uninstall_xinetd" selected="true" />
<select idref="service_telnetd_disabled" selected="true" />
<select idref="uninstall_telnet_server" selected="true" />
<select idref="uninstall_rsh" selected="true" />
<select idref="service_rexec_disabled" selected="true" />
<select idref="service_rsh_disabled" selected="true" />
<select idref="service_rlogin_disabled" selected="true" />
<select idref="no_rsh_trust_files" selected="true" />
<select idref="uninstall_ypserv" selected="true" />
<select idref="disable_ypbind" selected="true" />
<select idref="service_tftp_disabled" selected="true" />
<select idref="uninstall_tftp-server" selected="true" />
<select idref="tftpd_uses_secure_mode" selected="true" />
<select idref="service_abrtd_disabled" selected="true" />
<select idref="service_kdump_disabled" selected="true" />
<select idref="service_netconsole_disabled" selected="true" />
<select idref="service_ntpdate_disabled" selected="true" />
<select idref="service_portreserve_disabled" selected="true" />
<select idref="service_qpidd_disabled" selected="true" />
<select idref="service_rdisc_disabled" selected="true" />
<select idref="service_rhnsd_disabled" selected="true" />
<select idref="service_saslauthd_disabled" selected="true" />
<select idref="wireless_disable_in_bios" selected="true" />
<select idref="deactivate_wireless_interfaces" selected="true" />
<select idref="service_bluetooth_disabled" selected="true" />
<select idref="kernel_module_bluetooth_disabled" selected="true" />

<!--	AC-19 -->
<select idref="mount_option_nodev_removable_partitions" selected="true" />
<select idref="mount_option_noexec_removable_partitions" selected="true" />
<select idref="mount_option_nosuid_removable_partitions" selected="true" />
<select idref="kernel_module_usb" selected="true" />
<select idref="bootloader_nousb_argument" selected="true" />
<select idref="bios_disable_usb_boot" selected="true" />
<select idref="service_autofs_disabled" selected="true" />

<!--	AU-1(b) -->
<select idref="auditd_data_retention_num_logs" selected="true" />
<select idref="auditd_data_retention_max_log_file" selected="true" />
<select idref="auditd_data_retention_max_log_file_action" selected="true" />
<select idref="auditd_data_retention_space_left_action" selected="true" />
<refine-value idref="var_auditd_admin_space_left_action" selector="halt" />
<select idref="auditd_data_retention_admin_space_left_action" selected="true" />
<select idref="auditd_data_retention_action_mail_acct" selected="true" />
<select idref="auditd_audispd_syslog_plugin_activated" selected="true" />

<!--	AU-4 -->
<select idref="partition_for_var_log_audit" selected="true" />

<!--	AU-8 -->
<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="ntpd_specify_multiple_servers" selected="true" />

<!--	AU-9 -->
<select idref="package_rsyslog_installed" selected="true" />
<select idref="rsyslog_accept_remote_messages_none" selected="true" />
<select idref="ensure_logrotate_activated" selected="true" />
<select idref="file_ownership_var_log_audit" selected="true" />
<select idref="partition_for_var_log" selected="true" />

<!--	CM-3 -->
<select idref="package_aide_installed" selected="true" />
<select idref="aide_build_database" selected="true" />
<select idref="aide_periodic_cron_checking" selected="true" />

<!--	CM-7 -->
<select idref="service_acpid_disabled" selected="true" />
<select idref="service_certmonger_disabled" selected="true" />
<select idref="service_cgconfig_disabled" selected="true" />
<select idref="service_cgred_disabled" selected="true" />
<select idref="service_cpuspeed_disabled" selected="true" />
<select idref="service_haldaemon_disabled" selected="true" />
<select idref="service_irqbalance_enabled" selected="true" />
<select idref="service_mdmonitor_disabled" selected="true" />
<select idref="service_messagebus_disabled" selected="true" />
<select idref="service_oddjobd_disabled" selected="true" />
<select idref="service_quota_nld_disabled" selected="true" />
<select idref="service_rhsmcertd_disabled" selected="true" />
<select idref="service_smartd_disabled" selected="true" />
<select idref="service_sysstat_disabled" selected="true" />
<select idref="service_crond_enabled" selected="true" />
<select idref="service_atd_disabled" selected="true" />
<select idref="disable_avahi" selected="true" />
<select idref="mount_option_nodev_nonroot_local_partitions" selected="true" />
<select idref="mount_option_tmp_nodev" selected="true" />
<select idref="mount_option_tmp_noexec" selected="true" />
<select idref="mount_option_tmp_nosuid" selected="true" />
<select idref="mount_option_dev_shm_nodev" selected="true" />
<select idref="mount_option_dev_shm_noexec" selected="true" />
<select idref="mount_option_dev_shm_nosuid" selected="true" />
<select idref="mount_option_var_tmp_bind" selected="true" />
<select idref="kernel_module_cramfs_disabled" selected="true" />
<select idref="kernel_module_freevxfs_disabled" selected="true" />
<select idref="kernel_module_jffs2_disabled" selected="true" />
<select idref="kernel_module_hfs_disabled" selected="true" />
<select idref="kernel_module_hfsplus_disabled" selected="true" />
<select idref="kernel_module_squashfs_disabled" selected="true" />
<select idref="kernel_module_udf_disabled" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_send_redirects" selected="true" />
<select idref="sysctl_ipv4_ip_forward" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true" />
<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true" />
<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" />
<select idref="set_ip6tables_default_rule" selected="true" />
<select idref="set_iptables_default_rule" selected="true" />
<select idref="set_iptables_default_rule_forward" selected="true" />
<select idref="kernel_module_dccp_disabled" selected="true" />
<select idref="kernel_module_sctp_disabled" selected="true" />
<select idref="kernel_module_rds_disabled" selected="true" />
<select idref="kernel_module_tipc_disabled" selected="true" />
<select idref="network_disable_zeroconf" selected="true" />
<select idref="network_sniffer_disabled" selected="true" />
<select idref="kernel_module_ipv6_option_disabled" selected="true" />
<select idref="network_ipv6_disable_rpc" selected="true" />
<select idref="sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
<select idref="sysctl_net_ipv6_conf_default_accept_redirects" selected="true" />

<!--	IA-2(1) -->
<select idref="bootloader_password" selected="true" />

<!--	IA-5 -->
<select idref="accounts_password_pam_retry" selected="true" />
<select idref="accounts_password_pam_cracklib_maxrepeat" selected="true" />
<select idref="accounts_password_pam_ucredit" selected="true" />
<select idref="accounts_password_pam_ocredit" selected="true" />
<select idref="accounts_password_pam_lcredit" selected="true" />
<select idref="accounts_password_pam_difok" selected="true" />
<refine-value idref="var_password_pam_unix_remember" selector="24" />
<select idref="accounts_password_pam_unix_remember" selected="true" />
<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
<select idref="set_password_hashing_algorithm_logindefs" selected="true" />
<select idref="set_password_hashing_algorithm_libuserconf" selected="true" />
<select idref="no_empty_passwords" selected="true" />
<select idref="accounts_password_all_shadowed" selected="true" />
<select idref="no_netrc_files" selected="true" />
<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
<select idref="accounts_password_minlen_login_defs" selected="true" />
<select idref="accounts_minimum_age_login_defs" selected="true" />
<select idref="accounts_maximum_age_login_defs" selected="true" />
<select idref="accounts_password_warn_age_login_defs" selected="true" />
<select idref="require_singleuser_auth" selected="true" />
<refine-value idref="var_password_pam_difok" selector="1" />
<select idref="accounts_password_pam_difok" selected="true" />

</Profile>
