<Group id="base">
<title>Base Services</title>
<description>This section addresses the base services that are installed on a
Red Hat Enterprise Linux 6 default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required.</description>

<Rule id="service_kdump_disabled">
<title>Disable KDump Kernel Crash Analyzer (kdump)</title>
<description>The <tt>kdump</tt> service provides a kernel crash dump analyzer. It uses the <tt>kexec</tt>
system call to boot a secondary kernel ("capture" kernel) following a system
crash, which can load information from the crashed kernel for analysis.
<service-disable-macro service="kdump" />
</description>
<ocil><service-disable-check-macro service="kdump" /></ocil>
<rationale>Unless the system is used for kernel development or testing, there
is little need to run the kdump service.</rationale>
<ident stig="GEN003510" />
<oval id="service_kdump_disabled" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="service_yum-updatesd_disabled">
<title>Disable Automatic Updates</title>
<description>
<service-disable-macro service="yum-updatesd" />
</description>
<ocil><service-disable-check-macro service="yum-updatesd" /></ocil>
<rationale>System package management tools can obtain a list 
of updates and patches from a package repository and make this 
information available to the SA for review and action. Using a 
package repository outside of the organization's control presents 
a risk of malicious packages being introduced.</rationale>
<ident stig="GEN008820" />
<oval id="service_yum-updatesd_disabled" />
<ref nist="ECSC-1" disa="1233" />
</Rule>

</Group>
