<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:independent-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix http://oval.mitre.org/language/download/schema/version5.4/ovaldefinition/complete/unix-definitions-schema.xsd       http://oval.mitre.org/XMLSchema/oval-definitions-5#linux http://oval.mitre.org/language/download/schema/version5.4/ovaldefinition/complete/linux-definitions-schema.xsd        http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/download/schema/version5.4/ovaldefinition/complete/independent-definitions-schema.xsd       http://oval.mitre.org/XMLSchema/oval-definitions-5 http://oval.mitre.org/language/download/schema/version5.4/ovaldefinition/complete/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 http://oval.mitre.org/language/download/schema/version5.4/ovaldefinition/complete/oval-common-schema.xsd">
  <generator>
    <oval:product_name>DISA FSO</oval:product_name>
    <oval:schema_version>5.4</oval:schema_version>
    <oval:timestamp>2012-05-14T16:48:39.203-04:00</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:477" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - sched_setscheduler</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46835" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46836" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46837" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46836" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46838" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46835" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46838" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46837" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:476" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - sched_setparam</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46831" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46832" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46833" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46832" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46834" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46831" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46834" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46833" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:475" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - setdomainname</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46827" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46828" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46829" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46828" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46830" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46827" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46830" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46829" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:474" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - sethostname</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46823" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46824" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46825" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46824" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46826" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46823" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46826" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46825" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:473" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - clock_settime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46819" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46820" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46821" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46820" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46822" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46819" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46822" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46821" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:472" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - stime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46815" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46816" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46817" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46816" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46818" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46815" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46818" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46817" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:471" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - settimeofday</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46811" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46812" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46813" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46812" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46814" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46811" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46814" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46813" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:470" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - adjtime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria operator="OR" comment="admin auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:46808" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46804" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46805" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46806" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46809" />
          <criteria operator="AND" comment="all admin syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:46805" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46807" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:46810" />
          <criteria operator="OR" comment="all admin syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:46804" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:46807" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:46806" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:469" version="2">
      <metadata>
        <title>Audit all administrative, privileged, and security actions - audit.rules</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14051-7" />
        <description>Audit all administrative, privileged, and security actions</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /etc/audit.rules" test_ref="oval:mil.disa.fso.rhel:tst:46802" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/audit/audit.rules" test_ref="oval:mil.disa.fso.rhel:tst:46803" />
      </criteria>
    </definition>
    <definition class="compliance" version="6" id="oval:mil.disa.fso.rhel:def:492">
      <metadata>
        <title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - delete_module.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14688-6" />
        <description>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - delete_module.</description>
      </metadata>
      <criteria>
        <criteria operator="OR" comment="delete_module syscall auditing">
          <criteria comment="32-bit">
            <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:49105" />
            <criteria operator="OR" comment="delete_module">
              <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:49206" />
              <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:49207" />
              <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:49208" />
            </criteria>
          </criteria>
          <criteria comment="32/64-bit">
            <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:49116" />
            <criteria operator="AND" comment="delete_module">
              <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:49207" />
              <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:49210" />
            </criteria>
          </criteria>
          <criteria comment="64-bit">
            <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:49217" />
            <criteria operator="OR" comment="delete_module">
              <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:49206" />
              <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:49210" />
              <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:49208" />
            </criteria>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" version="6" id="oval:mil.disa.fso.rhel:def:491">
      <metadata>
        <title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - init_module.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14688-6" />
        <description>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - init_module.</description>
      </metadata>
      <criteria>
        <criteria operator="OR" comment="init_module, delete_module syscall auditing">
          <criteria comment="32-bit">
            <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:49105" />
            <criteria operator="OR" comment="init_module">
              <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:49103" />
              <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:49104" />
              <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:49111" />
            </criteria>
          </criteria>
          <criteria comment="32/64-bit">
            <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:49116" />
            <criteria operator="AND" comment="init_module">
              <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:49104" />
              <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:49109" />
            </criteria>
          </criteria>
          <criteria comment="64-bit">
            <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:49217" />
            <criteria operator="OR" comment="init_module">
              <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:49103" />
              <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:49109" />
              <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:49105" />
            </criteria>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" version="6" id="oval:mil.disa.fso.rhel:def:495">
      <metadata>
        <title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/rmmod.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14688-6" />
        <description>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/rmmod.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /sbin/rmmod -p x -k modules" test_ref="oval:mil.disa.fso.rhel:tst:49501" />
      </criteria>
    </definition>
    <definition class="compliance" version="6" id="oval:mil.disa.fso.rhel:def:494">
      <metadata>
        <title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/modprobe.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14688-6" />
        <description>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/modprobe.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /sbin/modprobe -p x -k modules" test_ref="oval:mil.disa.fso.rhel:tst:49402" />
      </criteria>
    </definition>
    <definition class="compliance" version="6" id="oval:mil.disa.fso.rhel:def:493">
      <metadata>
        <title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/insmod.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14688-6" />
        <description>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/insmod.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /sbin/insmod -p x -k modules" test_ref="oval:mil.disa.fso.rhel:tst:49300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:11" version="3">
      <metadata>
        <title>The system must not have special privilege accounts, such as shutdown and halt.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>unnecessary privileged accounts include halt, shutdown, reboot and who</description>
      </metadata>
      <criteria>
        <criterion comment="check for unnecessary privileged accounts in password" test_ref="oval:mil.disa.fso.rhel:tst:1100" />
        <!--        <criterion comment="check for unnecessary privileged accounts in shadow" test_ref="oval:mil.disa.fso.rhel:tst:1101" /> -->
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:15" version="2">
      <metadata>
        <title>The /etc/security/access.conf file must have a privileged group owner.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/security/access.conf file must have a privileged group owner.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="must be group owned by root, bin or sys">
        <criterion comment="Test group of /etc/security/access.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:1500" negate="false" />
        <criterion comment="Test group of /etc/security/access.conf is bin" test_ref="oval:mil.disa.fso.rhel:tst:1501" negate="false" />
        <criterion comment="Test group of /etc/security/access.conf is sys" test_ref="oval:mil.disa.fso.rhel:tst:1502" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:20" version="2">
      <metadata>
        <title>The x86 CTRL-ALT-DELETE key sequence must be disabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Undesirable reboots can occur if the CTRL-ALT-DELETE key sequence is not disabled. Such reboots may cause a loss of data or loss of access to critical information.</description>
      </metadata>
      <criteria operator="OR" comment="line is commented or points to /usr/bin/logger" negate="false">
        <criterion comment="test uncommented ctrlaltdel statements" test_ref="oval:mil.disa.fso.rhel:tst:2000" negate="false" />
        <criteria operator="AND" negate="false" comment="no uncommented lines">
          <criterion comment="Commented ctrlaltdel line" test_ref="oval:mil.disa.fso.rhel:tst:2001" />
          <criterion comment="no uncommented crtlaltdel lines exist" test_ref="oval:mil.disa.fso.rhel:tst:2002" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:30" version="6">
      <metadata>
        <title>Enable SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3977-6" source="http://cce.mitre.org" />
        <description>SELinux should be enabled</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:3000" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:3001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:39" version="3">
      <metadata>
        <title>The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="/etc/ntp.conf is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:3900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:37" version="3">
      <metadata>
        <title>The system clock must be synchronized continuously, or at least daily.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system clock must be synchronized continuously, or at least daily.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="ntpd is running" test_ref="oval:mil.disa.fso.rhel:tst:3700" />
        <criterion comment="ntpd -qg called from /etc/cron.hourly/*" test_ref="oval:mil.disa.fso.rhel:tst:3701" />
        <criterion comment="ntpd -qg called from /etc/cron.daily/*" test_ref="oval:mil.disa.fso.rhel:tst:3702" />
        <criterion comment="ntpd -qg called from /etc/cron.d/*" test_ref="oval:mil.disa.fso.rhel:tst:3703" />
        <criterion comment="ntpd -qg called from /etc/crontab" test_ref="oval:mil.disa.fso.rhel:tst:3704" />
        <criterion comment="ntpd -qg called from root crontab" test_ref="oval:mil.disa.fso.rhel:tst:3705" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:47" version="4">
      <metadata>
        <title>The system must limit the number of simultaneous logins for user accounts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must limit the number of simultaneous logins for user accounts.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="maxlogins in /etc/security/limits.conf" test_ref="oval:mil.disa.fso.rhel:tst:4700" />
        <criterion comment="maxlogins in /etc/security/limits.d/*" test_ref="oval:mil.disa.fso.rhel:tst:4701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:50" version="5">
      <metadata>
        <title>Set deny for Failed Password Attempts</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3410-8" source="http://cce.mitre.org" />
        <description>The "account deny" policy should meet minimum requirements.</description>
      </metadata>
      <criteria>
        <criterion comment="check that deny for pam_tally2 account module is configured correctly" test_ref="oval:mil.disa.fso.rhel:tst:5000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:52" version="5">
      <metadata>
        <title>Configure GUI Screen Locking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3315-9" source="http://cce.mitre.org" />
        <description>The graphical desktop environment must have idle timeout enabled</description>
      </metadata>
      <criteria>
        <criterion comment="check value of idle_activation_enabled in GCONF" test_ref="oval:mil.disa.fso.rhel:tst:5201" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:58" version="5">
      <metadata>
        <title>Set Password hashing algorithm</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14063-2" source="http://cce.mitre.org" />
        <description>The password hashing algorithm should be set correctly.</description>
      </metadata>
      <criteria>
        <criterion comment="Make sure /etc/login.defs is not set to use MD5" test_ref="oval:mil.disa.fso.rhel:tst:5801" negate="true" />
        <criterion comment="Make sure /etc/login.defs is set to use ENCRYPT_METHOD with correct algorithm" test_ref="oval:mil.disa.fso.rhel:tst:5802" />
        <criterion comment="Make sure /etc/libuser.conf is set to use hashing algorithm as crypt_style" test_ref="oval:mil.disa.fso.rhel:tst:5803" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:64" version="4">
      <metadata>
        <title>The system must require that passwords contain not more than three consecutive repeating characters.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must require that passwords contain not more than three consecutive repeating characters.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:6400" comment="maxrepeat &lt;= 3" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:67" version="2">
      <metadata>
        <title>The system must prevent the use of dictionary words for passwords.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must prevent the use of dictionary words for passwords.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:6700" comment="pam_cracklib required/requisite" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:68" version="4">
      <metadata>
        <title>Limit password reuse</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14939-3" source="http://cce.mitre.org" />
        <description>The passwords to remember should be set correctly.</description>
      </metadata>
      <criteria>
        <criterion comment="check that /etc/security/opasswd exists" test_ref="oval:mil.disa.fso.rhel:tst:6800" />
        <criterion comment="check the /etc/pam.d/system-auth password module has a remember option set appropriately" test_ref="oval:mil.disa.fso.rhel:tst:6801" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:84" version="2" class="compliance">
      <metadata>
        <title>All system command files must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Restricting permissions will protect system command files from unauthorized modification.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All system command files must have mode 0755 or less permissive.">
        <criterion comment="All files in system command directories" test_ref="oval:mil.disa.fso.rhel:tst:8400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:94" version="2" class="compliance">
      <metadata>
        <title>The /etc/resolv.conf file must have mode 0644.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/resolv.conf is 644" test_ref="oval:mil.disa.fso.rhel:tst:9400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:95" version="1" class="compliance">
      <metadata>
        <title>The /etc/hosts file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/hosts is root" test_ref="oval:mil.disa.fso.rhel:tst:9500" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:97" version="2" class="compliance">
      <metadata>
        <title>The /etc/hosts file must have mode 0644.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/hosts is 644" test_ref="oval:mil.disa.fso.rhel:tst:9700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:100" version="2" class="compliance">
      <metadata>
        <title>The /etc/nsswitch.conf file must have mode 0644.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/nsswitch.conf is 644" test_ref="oval:mil.disa.fso.rhel:tst:10000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:111" version="1">
      <metadata>
        <title>All interactive user home directories defined in the /etc/passwd file must exist.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All interactive user home directories defined in the /etc/passwd file must exist.</description>
      </metadata>
      <criteria>
        <criterion comment="interactive user home directories must exist" test_ref="oval:mil.disa.fso.rhel:tst:11100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:121" version="2" class="compliance">
      <metadata>
        <title>All run control scripts must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the startup files are writable by other users, they could modify the startup files to insert malicious commands into the startup files.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All run control scripts must have mode 0755 or less permissive.">
        <criterion comment="rc* scripts in /etc/ must be 0755" test_ref="oval:mil.disa.fso.rhel:tst:12100" />
        <criterion comment="scripts in /etc/rc*.d/* must be 0755" test_ref="oval:mil.disa.fso.rhel:tst:12101" />
        <criterion comment="scripts in /etc/init.d/* must be 0755" test_ref="oval:mil.disa.fso.rhel:tst:12102" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:132" version="3" class="compliance">
      <metadata>
        <title>Global initialization files must contain the "mesg -n" or "mesg n" commands.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the "mesg -n" or "mesg n" command is not placed into the system profile, messaging can be used to cause a denial of service attack.</description>
      </metadata>
      <criteria operator="OR" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands." negate="false">
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (bashrc)" test_ref="oval:mil.disa.fso.rhel:tst:13200" negate="false" />
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile)" test_ref="oval:mil.disa.fso.rhel:tst:13201" negate="false" />
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (environment)" test_ref="oval:mil.disa.fso.rhel:tst:13202" />
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (security/environ)" test_ref="oval:mil.disa.fso.rhel:tst:13203" />
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (.login)" test_ref="oval:mil.disa.fso.rhel:tst:13204" />
        <criterion comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile.d/.*)" test_ref="oval:mil.disa.fso.rhel:tst:13205" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:148" version="3">
      <metadata>
        <title>There must be no .netrc files on the system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>There must be no .netrc files on the system.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:14800" comment="no .rhosts, .shosts, hosts.equiv, or shosts.equiv files" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:149" version="3">
      <metadata>
        <title>There must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>There must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the system.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:14900" comment="no .rhosts, .shosts, hosts.equiv, or shosts.equiv files" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:150" version="3">
      <metadata>
        <title>All .rhosts, .shosts, .netrc, or hosts.equiv files must be accessible by only root or the owner.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All .rhosts, .shosts, .netrc, or hosts.equiv files must be accessible by only root or the owner.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:15000" comment=".rhosts, .shosts, .netrc, or hosts.equiv files have mode 0600 or less" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:168" version="2" class="compliance">
      <metadata>
        <title>The system and user default umask must be 077</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a 4-digit number, the first digit representing special access modes is typically ignored or required to be 0. This requirement applies to the globally configured system defaults and the user defaults for each account on the system.</description>
      </metadata>
      <criteria operator="AND" comment="The system and user default umask must be 077">
        <criterion comment="The user default umask must be 077 in initialization scripts($HOME/.*)" test_ref="oval:mil.disa.fso.rhel:tst:16800" />
        <criterion comment="The system default umask must be 077" test_ref="oval:mil.disa.fso.rhel:tst:16801" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:177" version="1">
      <metadata>
        <title>The audit system must alert the SA in the event of an audit processing failure.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The audit system must alert the SA in the event of an audit processing failure.</description>
      </metadata>
      <criteria>
        <criterion comment="disk_full_action" test_ref="oval:mil.disa.fso.rhel:tst:17700" />
        <criterion comment="disk_error_action" test_ref="oval:mil.disa.fso.rhel:tst:17701" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:179" version="3" class="compliance">
      <metadata>
        <title>The audit system must aleart the SA when the audit storage volume approaches its capacity.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>An accurate and current audit trail is essential for maintaining a record of system activity. If the system fails, the SA must be notified and must take prompt action to correct the problem.

Minimally, the system must log this event and the SA will receive this notification during the daily system log review. If feasible, active alerting (such as e-mail or paging) should be employed consistent with the site's established operations management systems and procedures.</description>
      </metadata>
      <criteria operator="AND" comment="space_left_action parameter" negate="false">
        <criterion comment="space_left_action is set to SYSLOG, EXEC, or EMAIL (and not to IGNORE, SINGLE, SUSPEND, or HALT)" test_ref="oval:mil.disa.fso.rhel:tst:17900" negate="false" />
        <!--				<criterion comment="space_left_action is commented out" test_ref="oval:mil.disa.fso.rhel:tst:17901" negate="false"/> -->
        <criteria operator="OR" negate="false" comment="Email configuration">
          <criterion comment="action_mail_acct is set to a well-formed email address" test_ref="oval:mil.disa.fso.rhel:tst:17902" />
          <criterion comment="action_mail_acct is commented out" test_ref="oval:mil.disa.fso.rhel:tst:17903" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:184" version="1">
      <metadata>
        <title>The audit system must be configured to audit account termination.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The audit system must be configured to audit account termination.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/userdel" test_ref="oval:mil.disa.fso.rhel:tst:18400" />
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/groupdel" test_ref="oval:mil.disa.fso.rhel:tst:18401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:183" version="1">
      <metadata>
        <title>The audit system must be configured to audit account disabling.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The audit system must be configured to audit account disabling.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /usr/bin/passwd" test_ref="oval:mil.disa.fso.rhel:tst:18300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:182" version="1">
      <metadata>
        <title>The audit system must be configured to audit account modification.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The audit system must be configured to audit account modification.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/usermod" test_ref="oval:mil.disa.fso.rhel:tst:18200" />
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/groupmod" test_ref="oval:mil.disa.fso.rhel:tst:18201" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/passwd" test_ref="oval:mil.disa.fso.rhel:tst:18202" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/group" test_ref="oval:mil.disa.fso.rhel:tst:18203" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/shadow" test_ref="oval:mil.disa.fso.rhel:tst:18204" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/gshadow" test_ref="oval:mil.disa.fso.rhel:tst:18205" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:181" version="1">
      <metadata>
        <title>The audit system must be configured to audit account creation.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The audit system must be configured to audit account creation.</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/useradd" test_ref="oval:mil.disa.fso.rhel:tst:18100" />
        <criterion comment="/etc/audit/audit.rules contains -w /usr/sbin/groupadd" test_ref="oval:mil.disa.fso.rhel:tst:18101" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/passwd" test_ref="oval:mil.disa.fso.rhel:tst:18102" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/group" test_ref="oval:mil.disa.fso.rhel:tst:18103" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/shadow" test_ref="oval:mil.disa.fso.rhel:tst:18104" />
        <criterion comment="/etc/audit/audit.rules contains -w /etc/gshadow" test_ref="oval:mil.disa.fso.rhel:tst:18105" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:186" version="4">
      <metadata>
        <title>Ensure auditd Collects Logon and Logout Events</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14904-7" source="http://cce.mitre.org" />
        <description>Audit rules about the Logon and Logout Events are enabled</description>
      </metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -w /var/log/faillog -p wa -k logins" test_ref="oval:mil.disa.fso.rhel:tst:18600" />
        <criterion comment="/etc/audit/audit.rules contains -w /var/log/lastlog -p wa -k logins" test_ref="oval:mil.disa.fso.rhel:tst:18601" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:189" version="2">
      <metadata>
        <title>The system must be configured to send audit records to a remote audit server.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must be configured to send audit records to a remote audit server.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:18901" comment="audit enabled in kernel" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:18900" comment="audit to syslog enabled" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:18902" comment="logging to a remote server is enabled" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:190" version="1">
      <metadata>
        <title>Cron Utility Accessibility</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Access to the cron utility must be controlled using the cron.allow and/or cron.deny file(s)</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check /etc/cron.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:19000" />
        <criterion comment="check /etc/cron.deny existence" test_ref="oval:mil.disa.fso.rhel:tst:19001" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:191" version="1" class="compliance">
      <metadata>
        <title>The cron.allow file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/cron.allow is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:195" version="1">
      <metadata>
        <title>GEN003050</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Crontab files must be group-owned by root</description>
      </metadata>
      <criteria>
        <criterion comment="check /var/spool/cron is is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19500" />
        <criterion comment="check /etc/cron.d is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19501" />
        <criterion comment="check /etc/crontab is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19502" />
        <criterion comment="check /etc/cron.daily is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19503" />
        <criterion comment="check /etc/cron.hourly is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19504" />
        <criterion comment="check /etc/cron.monthly is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19505" />
        <criterion comment="check /etc/cron.weekly is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:19506" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:196" version="2">
      <metadata>
        <title>Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.</description>
      </metadata>
      <criteria operator="OR" comment="cron.allow or cron.deny if cron.allow does not exist" negate="false">
        <criteria operator="AND" comment="if cron.allow exists, no system accounts may be listed" negate="false">
          <criterion comment="check /etc/cron.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:19600" />
          <criterion comment="no default system accts except root in cron.allow" test_ref="oval:mil.disa.fso.rhel:tst:19604" negate="false" />
        </criteria>
        <criteria operator="AND" comment="if cron.deny exists, cron.deny must list all system accounts" negate="false">
          <criterion comment="check /etc/cron.deny existence" test_ref="oval:mil.disa.fso.rhel:tst:19602" />
          <criterion comment="all system accounts listed in cron.deny" test_ref="oval:mil.disa.fso.rhel:tst:19603" negate="false" />
          <criterion comment="cron.allow does not exist" test_ref="oval:mil.disa.fso.rhel:tst:19600" negate="true" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:200" version="1">
      <metadata>
        <title>Cron and Crontab Directories Group Ownership.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Cron and crontab directories must be group-owned by root, sys, bin, or cron.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20000" comment="/var/spool/cron directory group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20001" comment="/etc/cron.d directory group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20002" comment="/etc/crontab file group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20003" comment="/etc/cron.daily directory group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20004" comment="/etc/cron.hourly directory group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20005" comment="/etc/cron.monthly directory group-owned by root/sys/bin/cron" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:20006" comment="/etc/cron.weekly directory group-owned by root/sys/bin/cron" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:201" version="1">
      <metadata>
        <title>Cron logging must be implemented.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Cron logging must be implemented.</description>
      </metadata>
      <criteria>
        <criterion comment="syslog cron path config found" test_ref="oval:mil.disa.fso.rhel:tst:20100" />
        <criterion comment="syslog cron file config found" test_ref="oval:mil.disa.fso.rhel:tst:20101" />
        <criterion comment="syslog cron file exists" test_ref="oval:mil.disa.fso.rhel:tst:20102" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:212" version="1">
      <metadata>
        <title>Default System Accounts and At</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="check /etc/at.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:21000" />
          <criterion comment="check /etc/at.allow is empty" test_ref="oval:mil.disa.fso.rhel:tst:21202" />
        </criteria>
        <criteria operator="AND">
          <criterion comment="check /etc/at.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:21000" />
          <criteria operator="AND">
            <criterion comment="check /etc/at.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:21000" />
            <criterion comment="check /etc/at.allow is not empty" test_ref="oval:mil.disa.fso.rhel:tst:21202" negate="true" />
            <criterion comment="default system accounts (other than root) are not listed in /etc/at.allow" test_ref="oval:mil.disa.fso.rhel:tst:21200" />
          </criteria>
        </criteria>
        <criteria operator="AND">
          <criterion comment="check /etc/at.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:21000" negate="true" />
          <criteria operator="AND">
            <criterion comment="check /etc/at.deny existence" test_ref="oval:mil.disa.fso.rhel:tst:21001" />
            <criterion comment="default system accounts (other than root) are listed in /etc/at.deny" test_ref="oval:mil.disa.fso.rhel:tst:21201" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:211" version="2">
      <metadata>
        <title>The at.deny file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The at.deny file must not be empty if it exists</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="/etc/at.deny does not exist" test_ref="oval:mil.disa.fso.rhel:tst:21001" negate="true" />
        <criterion comment="check /etc/at.deny file contents" test_ref="oval:mil.disa.fso.rhel:tst:21100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:210" version="1">
      <metadata>
        <title>At Utility Accessibility</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Access to the "at" utility must be controlled via the at.allow and/or at.deny file(s)</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check /etc/at.allow existence" test_ref="oval:mil.disa.fso.rhel:tst:21000" />
        <criterion comment="check /etc/at.deny existence" test_ref="oval:mil.disa.fso.rhel:tst:21001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:216" version="1">
      <metadata>
        <title>The at directory permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The "at" directory must have mode 0755 or less permissive</description>
      </metadata>
      <criteria>
        <criterion comment="check /var/spool/cron/atjobs permissions" test_ref="oval:mil.disa.fso.rhel:tst:21600" />
        <criterion comment="check /var/spool/atjobs permissions" test_ref="oval:mil.disa.fso.rhel:tst:21601" />
        <criterion comment="check /var/spool/at permissions" test_ref="oval:mil.disa.fso.rhel:tst:21602" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:218" version="2">
      <metadata>
        <title>The at directory ownership.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The "at" directory must be group-owned by root, bin, sys, or cron (or daemon).</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:21800" comment="/var/spool/at directory group-owned by root/bin/sys/cron/daemon" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:229" version="5">
      <metadata>
        <title>Kdump Kernel Crash Analyzer (kdump)</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3425-6" source="http://cce.mitre.org" />
        <description>The kdump service should be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion negate="true" comment="kdump is loaded" test_ref="oval:mil.disa.fso.rhel:tst:22900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:233" version="1">
      <metadata>
        <title>The system must implement non-executable program stacks.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must implement non-executable program stacks.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel.exec-shield = 1" test_ref="oval:mil.disa.fso.rhel:tst:23300" />
        <criterion comment="kernel.randomize_va_space = 1" test_ref="oval:mil.disa.fso.rhel:tst:23301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:234" version="1">
      <metadata>
        <title>Network interfaces must not be configured to allow user control.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Network interfaces must not be configured to allow user control.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="network interface userctl enabled" test_ref="oval:mil.disa.fso.rhel:tst:23400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:235" version="5">
      <metadata>
        <title>Network Parameters for Hosts and Routers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4236-6" source="http://cce.mitre.org" />
        <description>Accepting source routed packets should be disabled for all interfaces.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:23500" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:23501" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:236" version="1">
      <metadata>
        <title>GEN003601</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>TCP backlog queue sizes must be set appropriately</description>
      </metadata>
      <criteria>
        <criterion comment="net.ipv4.tcp_max_syn_backlog=1280" test_ref="oval:mil.disa.fso.rhel:tst:23600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:238" version="1">
      <metadata>
        <title>The system must not respond to ICMP timestamp requests sent to a broadcast address.</title>
        <description>The processing of Internet Control Message Protocol (ICMP) timestamp requests increases the attack surface of the system.  Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="System is configured to ignore ICMP timestamp requests sent to a broadcast address" test_ref="oval:mil.disa.fso.rhel:tst:23800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:240" version="1">
      <metadata>
        <title>GEN003607</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not accept source-routed IPv4 packets</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="net.ipv4.conf.all.accept_source_route = 0" test_ref="oval:mil.disa.fso.rhel:tst:24000" />
        <criterion comment="net.ipv4.conf.default.accept_source_route = 0" test_ref="oval:mil.disa.fso.rhel:tst:24001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:241" version="1">
      <metadata>
        <title>GEN003608</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Proxy ARP must not be enabled on the system</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="net.ipv4.conf.all.proxy_arp = 0" test_ref="oval:mil.disa.fso.rhel:tst:24100" />
        <criterion comment="net.ipv4.conf.default.proxy_arp = 0" test_ref="oval:mil.disa.fso.rhel:tst:24101" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:242" version="5">
      <metadata>
        <title>Network Parameters for Hosts and Routers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4217-6" source="http://cce.mitre.org" />
        <description>Accepting ICMP redirects should be disabled for all interfaces.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24200" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24201" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:243" version="5">
      <metadata>
        <title>Network Parameters for Hosts Only</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4155-8" source="http://cce.mitre.org" />
        <description>Sending ICMP redirects should be disabled for all interfaces.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24300" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:244" version="5">
      <metadata>
        <title>Network Parameters for Hosts and Routers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4320-8" source="http://cce.mitre.org" />
        <description>Logging of "martian" packets (those with impossible addresses) should be enabled on all interfaces.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24400" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24401" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:247" version="2" class="compliance">
      <metadata>
        <title>The system must not be configured for network bridging.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Some systems have the ability to bridge or switch frames (link-layer forwarding) between multiple interfaces. This can be useful in a variety of situations, but if enabled when not needed, has the potential to bypass network partitioning and security.</description>
      </metadata>
      <criteria operator="AND" comment="Configure the system to not use bridging.">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24700" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:253" version="1">
      <metadata>
        <title>All local file systems must employ journaling or another mechanism that ensures file system consistency.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All local file systems must employ journaling or another mechanism that ensures file system consistency.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="local fs journaling" test_ref="oval:mil.disa.fso.rhel:tst:25300" />
        <criterion comment="local fs not nolog" negate="true" test_ref="oval:mil.disa.fso.rhel:tst:25301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:251" version="1">
      <metadata>
        <title>The system must use a separate file system for /tmp.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must use a separate file system for /tmp.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="/tmp is a mountpoint" test_ref="oval:mil.disa.fso.rhel:tst:25100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:250" version="1">
      <metadata>
        <title>The system must use a separate file system for audit directory.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must use a separate file system for audit directory.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="audit directory is a mountpoint" test_ref="oval:mil.disa.fso.rhel:tst:25000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:249" version="1">
      <metadata>
        <title>The system must use a separate file system for /var.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must use a separate file system for /var.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="/var is a mountpoint" test_ref="oval:mil.disa.fso.rhel:tst:24900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:248" version="1">
      <metadata>
        <title>A separate file system must be used for user home directories (such as /home or equivalent).</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>A separate file system must be used for user home directories (such as /home or equivalent).</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="/home is a mountpoint" test_ref="oval:mil.disa.fso.rhel:tst:24800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:254" version="2">
      <metadata>
        <title>Authentication Data Logging</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must log authentication informational data</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/syslog.conf to verify authpriv.* or authpriv.info or authpriv.debug is found" test_ref="oval:mil.disa.fso.rhel:tst:25400" />
        <criterion comment="must not negate with authpriv.none" test_ref="oval:mil.disa.fso.rhel:tst:25401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:255" version="1">
      <metadata>
        <title>Xinetd must be disabled or removed if no network services utilizing them are enabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Xinetd must be disabled or removed if no network services utilizing them are enabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:25500" comment="xinetd not running" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:25501" comment="xinetd has a running service" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:257" version="1">
      <metadata>
        <title>GEN003730</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/xinetd.conf file and the /etc/xinetd.d directory must be group-owned by root, bin, or sys</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/xinetd.conf file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:25700" />
        <criterion comment="check /etc/xinetd.d directory is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:25701" />
        <criterion comment="check /etc/xinetd.d directory files are group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:25702" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:263" version="8">
      <metadata>
        <title>Xinetd logging/tracing must be enabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Xinetd logging/tracing must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26300" comment="xinetd not running" />
        <criteria operator="AND" comment="config good">
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26301" comment="global log_type" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26302" comment="global log_on_success host" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26303" comment="global log_on_success pid" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26304" comment="global log_on_success userid" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26305" comment="global log_on_success exit" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26306" comment="global log_on_failure host" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26307" comment="global log_on_failure userid" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26308" comment="local log_type" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26309" comment="local log_on_success host" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26310" comment="local log_on_success pid" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26311" comment="local log_on_success userid" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26312" comment="local log_on_success exit" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26313" comment="local log_on_failure host" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:26314" comment="local log_on_failure userid" />
          <criterion comment="test all filenames have log_type" test_ref="oval:mil.disa.fso.rhel:tst:26315" />
          <criterion comment="test all filenames have log_on_success" test_ref="oval:mil.disa.fso.rhel:tst:26316" />
          <criterion comment="test all filenames have log_on_failure" test_ref="oval:mil.disa.fso.rhel:tst:26317" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:264" version="2">
      <metadata>
        <title>The portmap or rpcbind service must not be running unless needed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The portmap or rpcbind service must not be running unless needed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26400" comment="portmap not running" />
        <!--        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26401" comment="services needing portmap are running" /> -->
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:265" version="2">
      <metadata>
        <title>The portmap or rpcbind service must not be installed unless needed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The portmap or rpcbind service must not be installed unless needed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26500" comment="portmap not installed" />
        <!--        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26501" comment="packages requiring portmap are installed" /> -->
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:266" version="8">
      <metadata>
        <title>The rsh daemon must not be running.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4141-8" />
        <description>The rsh daemon must not be running.</description>
      </metadata>
      <criteria operator="OR" comment="if file /etc/xinetd.d/rsh exists must contain disable = yes" negate="false">
        <criterion comment="/etc/xinetd.d/rsh does not exist" test_ref="oval:mil.disa.fso.rhel:tst:26600" negate="true" />
        <criterion comment="test rsh set to disable=yes" test_ref="oval:mil.disa.fso.rhel:tst:26601" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:268" version="2">
      <metadata>
        <title>The rlogin daemon must not be running.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3537-8" />
        <description>The rlogin daemon must not be running.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26800" comment="rlogin not enabled" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:271" version="1">
      <metadata>
        <title>The rexecd service must not be installed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The rexecd service must not be installed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26900" comment="rsh-server not installed" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:269" version="1">
      <metadata>
        <title>The rlogind service must not be installed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The rlogind service must not be installed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:26900" comment="rsh-server not installed" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:270" version="1">
      <metadata>
        <title>The rexec daemon must not be running.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The rexec daemon must not be running.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:27000" comment="rexec not enabled" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:279" version="1">
      <metadata>
        <title>The traceroute command ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The traceroute command owner must be root</description>
      </metadata>
      <criteria>
        <criterion comment="check /bin/traceroute is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:27900" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:283" version="1" class="compliance">
      <metadata>
        <title>The sendmail alias files must be group-owned by root, or a system group.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the aliases and aliases.db file are not group-owned by root or a system group, an unauthorized user may modify one or both of the files to add aliases to run malicious code or redirect e-mail.</description>
      </metadata>
      <criteria operator="AND" comment="The sendmail alias files must be group-owned by root, or a system group." negate="false">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:28300" />
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:28301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:287" version="16">
      <metadata>
        <title>Files executed through a mail aliases file must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Files executed through a mail aliases file must have mode 0755 or less permissive.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:28700" comment="alias execs 0755 or less permissive" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:288" version="1">
      <metadata>
        <title>Sendmail logging must not be set to less than nine in the sendmail.cf file.</title>
        <description>If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthorized use of the sendmail service.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="Sendmail logging is set to Level 9 or greater" test_ref="oval:mil.disa.fso.rhel:tst:28800" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:290" version="2" class="compliance">
      <metadata>
        <title>The SMTP service log file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the SMTP service log file is not owned by root, then unauthorized personnel may modify or delete the file to hide a system compromise.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The SMTP service log file must be owned by root.">
        <criterion comment="All mail log files must be owned by root" test_ref="oval:mil.disa.fso.rhel:tst:29000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:291" version="1">
      <metadata>
        <title>The SMTP service log file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The SMTP service log file must have mode 0644 or less permissive.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29100" comment="smtp log file perm ok" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:292" version="2">
      <metadata>
        <title>The SMTP service HELP command must not be enabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The SMTP service HELP command must not be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29200" comment="sendmail helpfile does not exist" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:293" version="2">
      <metadata>
        <title>The SMTP service's SMTP greeting must not provide version information.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The SMTP service's SMTP greeting must not provide version information.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29300" comment="sendmail greeting has no version" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29301" comment="postfix greeting has no version" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:294" version="3">
      <metadata>
        <title>The system must not use .forward files.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not use .forward files.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29400" comment="no .forward files" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29401" comment="no '0 ForwardPath' in /etc/mail/sendmail.cf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:297" version="1">
      <metadata>
        <title>The SMTP service must not have the VRFY feature active.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The SMTP service must not have the VRFY feature active.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29700" comment="vrfy disabled" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29601" comment="sendmail not installed" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:296" version="1">
      <metadata>
        <title>The SMTP service must not have the EXPN feature active.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The SMTP service must not have the EXPN feature active.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29600" comment="expn disabled" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:29601" comment="sendmail not installed" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:320" version="1">
      <metadata>
        <title>MIB File Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Management Information Base (MIB) files must have mode 0640 or less permissive</description>
      </metadata>
      <criteria>
        <criterion comment="check MIB file permissions" test_ref="oval:mil.disa.fso.rhel:tst:32000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:321" version="1">
      <metadata>
        <title>snmpd.conf ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The snmpd.conf file must be owned by root</description>
      </metadata>
      <criteria>
        <criterion comment="check snmpd.conf file permissions" test_ref="oval:mil.disa.fso.rhel:tst:32100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:322" version="7">
      <metadata>
        <title>The /etc/snmpd.conf file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/snmpd.conf file must be group-owned by root, bin or sys</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:32200" comment="/etc/snmpd.conf group-owned by root/bin/sys" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:325" version="1">
      <metadata>
        <title>/etc/syslog.conf group ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/syslog.conf file must be group-owned by root, bin, or sys</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/syslog.conf is is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:32500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:326" version="5">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4260-6" source="http://cce.mitre.org" />
        <description>Syslog logs should be sent to a remote loghost</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:32600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:329" version="1">
      <metadata>
        <title>The SSH client must be configured to only use the SSHv2 protocol</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits.  Exploits of the SSH client could provide access to the system with the privileges of the user running the SSH client.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:32900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:333" version="1">
      <metadata>
        <title>The SSH daemon must be configured to only use message authentication codes (MACs) that employ FIPS 140-2 approved cryptographic hash algorithms</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions</description>
      </metadata>
      <criteria>
        <criterion comment="SSH daemon is configured to only use hmac-sha1" test_ref="oval:mil.disa.fso.rhel:tst:33300" />
        <criterion comment="SSH daemon is configured to only use hmac-sha1" test_ref="oval:mil.disa.fso.rhel:tst:33301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:334" version="2">
      <metadata>
        <title>The SSH client must be configured to only use FIPS 140-2 approved ciphers</title>
        <description>DoD information systems are required to use FIPS 140-2 approved ciphers.  SSHv2 ciphers meeting this requirement are 3DES and AES</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:33400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:335" version="1">
      <metadata>
        <title>The SSH client must be configured not to use CBC ciphers</title>
        <description>The cipher-block chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen-plaintext attacks and must not be used</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="SSH client is configured to use non-CBC mode encryption and the Ciphers keyword is not commented out in the SSH client configuration file" test_ref="oval:mil.disa.fso.rhel:tst:33500" />
        <criterion comment="SSH client is configured to use non-CBC mode encryption and the Ciphers keyword is not commented out in the SSH client configuration file" test_ref="oval:mil.disa.fso.rhel:tst:33501" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:336" version="1">
      <metadata>
        <title>The SSH client must be configured to only use message authentication codes (MACs) that employ FIPS 140-2 approved cryptographic hash algorithms</title>
        <description>DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="SSH client is configured to only use hmac-sha1" test_ref="oval:mil.disa.fso.rhel:tst:33600" />
        <criterion comment="SSH client is configured to only use hmac-sha1" test_ref="oval:mil.disa.fso.rhel:tst:33601" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:343" version="3">
      <metadata>
        <title>The SSH daemon must restrict login ability to specific users and/or groups</title>
        <description>Restricting SSH logins to a limited group of users, such as system administrators, prevents password-guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR" comment="sshd config must restrict logins with" negate="false">
        <criteria operator="AND" negate="false" comment="AllowGroups">
          <criterion comment="AllowGroups is present " test_ref="oval:mil.disa.fso.rhel:tst:34300" negate="false" />
          <criterion comment="but not AllowGroups * " test_ref="oval:mil.disa.fso.rhel:tst:34301" negate="false" />
        </criteria>
        <criteria operator="AND" negate="false" comment="AllowUsers">
          <criterion comment="AllowUsers is present " test_ref="oval:mil.disa.fso.rhel:tst:34302" negate="false" />
          <criterion comment="but not AllowUsers * " test_ref="oval:mil.disa.fso.rhel:tst:34303" negate="false" />
        </criteria>
        <criterion comment="/etc/pam.d/sshd checks access" test_ref="oval:mil.disa.fso.rhel:tst:34304" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:346" version="1">
      <metadata>
        <title>The SSH daemon must not permit GSSAPI authentication unless needed.</title>
        <description>GSSAPI authentication is used to provide additional authentication mechanisms to applications.  Allowing GSSAPI authentication through SSH exposes the system's  GSSAPI to remote hosts, increasing the attack surface of the system.  GSSAPI authentication must be disabled unless needed.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="SSH daemon is configured to disallow GSSAPI authentication" test_ref="oval:mil.disa.fso.rhel:tst:34600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:347" version="3">
      <metadata>
        <title>The SSH client must not permit GSSAPI authentication unless needed.</title>
        <description>GSSAPI authentication is used to provide additional authentication mechanisms to applications.  Allowing GSSAPI authentication through SSH exposes the system's  GSSAPI to remote hosts, increasing the attack surface of the system.  GSSAPI authentication must be disabled unless needed.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR" negate="false" comment="must be no or not exist">
        <criterion comment="GSSAPI authentication is no" test_ref="oval:mil.disa.fso.rhel:tst:34700" negate="false" />
        <criterion comment="no GSSAPIAuthentication listed - default is no - ok" test_ref="oval:mil.disa.fso.rhel:tst:34701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:348" version="1">
      <metadata>
        <title>The SSH daemon must not permit Kerberos authentication unless needed.</title>
        <description>Kerberos authentication for SSH is often implemented using GSSAPI.  If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation.  Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation.  To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="SSH daemon is configured to disallow Kerberos authentication" test_ref="oval:mil.disa.fso.rhel:tst:34800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:356" version="1">
      <metadata>
        <title>The SSH daemon must perform strict mode checking of home directory configuration files.</title>
        <description>If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:35600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:357" version="1">
      <metadata>
        <title>The SSH daemon must use privilege separation.</title>
        <description>SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:35700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:358" version="5" class="compliance">
      <metadata>
        <title>The SSH daemon must not allow rhosts RSA authentication.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4370-3" />
        <description>If SSH permits rhosts RSA authentication, a user may be able to log in based on the keys of the host originating the request and not any user-specific authentication.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The SSH daemon must not allow rhosts RSA authentication.">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:35800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:359" version="3">
      <metadata>
        <title>The SSH daemon must not allow compression or must only allow compression after successful authentication.</title>
        <description>If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR" negate="false">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:35900" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:35901" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:362" version="8">
      <metadata>
        <title>The system must not be running any routing protocol daemons, unless the system is a router.</title>
        <description>Routing protocol daemons are typically used on routers to exchange network topology information with other routers.  If this software is used when not required, system network information may be unnecessarily transmitted across the network.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR" comment="select daemons should not be started" negate="false">
        <criterion comment="test for started daemons" test_ref="oval:mil.disa.fso.rhel:tst:36200" negate="false" />
        <criterion comment="no daemons found" test_ref="oval:mil.disa.fso.rhel:tst:36201" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:364" version="1">
      <metadata>
        <title>GEN005610</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="net.ipv6.conf.all.forwarding = 0" test_ref="oval:mil.disa.fso.rhel:tst:36400" />
        <criterion comment="net.ipv6.conf.default.forwarding = 0" test_ref="oval:mil.disa.fso.rhel:tst:36401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:373" version="2">
      <metadata>
        <title>The NFS server must not allow remote root access.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4544-3" />
        <description>The NFS server must not allow remote root access.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="nfs empty options" test_ref="oval:mil.disa.fso.rhel:tst:37300" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:372" version="2">
      <metadata>
        <title>The NFS server must be configured to restrict file system access to local hosts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The NFS server must be configured to restrict file system access to local hosts.</description>
      </metadata>
      <criteria operator="AND" comment="must have ( entries with no preceding blank or *" negate="false">
        <criterion comment="no entries without a (" test_ref="oval:mil.disa.fso.rhel:tst:37201" negate="false" />
        <criterion comment="no entries with a ' (' or '*('" test_ref="oval:mil.disa.fso.rhel:tst:37200" negate="true" />
        <criterion comment="no entries without a host" test_ref="oval:mil.disa.fso.rhel:tst:37202" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:371" version="1">
      <metadata>
        <title>Deny NFS Client Access Without Userid</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The NFS anonymous UID and GID must be configured to values that have no permissions.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="nfs anonuid" test_ref="oval:mil.disa.fso.rhel:tst:37100" />
        <criterion comment="nfs anongid" test_ref="oval:mil.disa.fso.rhel:tst:37101" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:370" version="1">
      <metadata>
        <title>All NFS-exported system files and system directories must be group-owned by root, bin, sys, or system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All NFS-exported system files and system directories must be group-owned by root, bin, sys, or system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="exports growned by root,bin,sys" test_ref="oval:mil.disa.fso.rhel:tst:37000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:369" version="1">
      <metadata>
        <title>All NFS-exported system files and system directories must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All NFS-exported system files and system directories must be owned by root.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="exports owned by root" test_ref="oval:mil.disa.fso.rhel:tst:36900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:374" version="2">
      <metadata>
        <title>The nosuid option must be enabled on all NFS client mounts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4024-6" />
        <description>The nosuid option must be enabled on all NFS client mounts.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:37400" comment="NFS client mounts must have nosuid enabled" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:375" version="2">
      <metadata>
        <title>The system must not run the Samba service unless needed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not run the Samba service unless needed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:37500" comment="samba not running" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:378" version="1">
      <metadata>
        <title>The /etc/samba/smb.conf file must be group-owned by root, bin, sys, or system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/samba/smb.conf file must be group-owned by root, bin, sys, or system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:37800" comment="/etc/samba/smb.conf group-owned by root/bin/sys/system" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:384" version="1">
      <metadata>
        <title>Samba must be configured to use an authentication mechanism other than share.</title>
        <description>Samba share authentication does not provide for individual user identification and must not be used.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="smb.conf is configured to use an authentication method other than share" test_ref="oval:mil.disa.fso.rhel:tst:38400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:385" version="1">
      <metadata>
        <title>Samba must be configured to use encrypted passwords.</title>
        <description>Samba must be configured to protect authenticators.  If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="smb.conf is configured to use encrypted passwords" test_ref="oval:mil.disa.fso.rhel:tst:38500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:386" version="1">
      <metadata>
        <title>Samba must be configured to not allow guest access to shares.</title>
        <description>Guest access to shares permits anonymous access and is not permitted.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="smb.conf is configured to disallow guest access" test_ref="oval:mil.disa.fso.rhel:tst:38600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:387" version="3">
      <metadata>
        <title>The system must not run an Internet Network News (INN) server.</title>
        <description>Internet Network News (INN) servers access USENET newsfeeds and store newsgroup articles.  INN servers use the Network News Transfer Protocol (NNTP) to transfer information from the USENET server and from the server to authorized remote hosts.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="System must not be running innd server" test_ref="oval:mil.disa.fso.rhel:tst:38700" />
        <criterion comment="System must not be running nnrpd server" test_ref="oval:mil.disa.fso.rhel:tst:38701" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:393" version="1">
      <metadata>
        <title>/etc/news files group ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The files in /etc/news must be group-owned by root or news</description>
      </metadata>
      <criteria>
        <criterion comment="check files in /etc/news are group-owned by root or news" test_ref="oval:mil.disa.fso.rhel:tst:39300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:394" version="2">
      <metadata>
        <title>The Network Information System (NIS) protocol must not be used.</title>
        <description>Due to numerous security vulnerabilities that exist within Linux NIS and its successor NIS+, neither should ever be used. Both NIS and NIS+ have been obsoleted by newer authentication services such as Kerberos and LDAP.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="System must not be running ypbind server" test_ref="oval:mil.disa.fso.rhel:tst:39400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:398" version="1">
      <metadata>
        <title>The system must use an access control program.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must use an access control program.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:39800" comment="tcp_wrappers installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:399" version="17" class="compliance">
      <metadata>
        <title>The system's access control program must log each system access attempt.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If access attempts are not logged, then multiple attempts to log on to the system by an unauthorized user may go undetected.</description>
      </metadata>
      <criteria operator="AND" comment="all mail and authpriv.info must be logged" negate="false">
        <criteria operator="OR" comment="mail.* or mail.debug " negate="false">
          <criterion comment="mail.* logging test" test_ref="oval:mil.disa.fso.rhel:tst:39901" />
          <criterion comment="mail.debug logging test" test_ref="oval:mil.disa.fso.rhel:tst:39902" />
        </criteria>
        <criterion comment="mail.* and mail.none not on same line" test_ref="oval:mil.disa.fso.rhel:tst:39904" negate="false" />
        <criteria operator="AND" negate="false" comment="authpriv logging">
          <criterion comment="authpriv.info logging test" test_ref="oval:mil.disa.fso.rhel:tst:39900" />
          <criterion comment="authpriv.info and authpriv.none not on same line" test_ref="oval:mil.disa.fso.rhel:tst:39905" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:400" version="2" class="compliance">
      <metadata>
        <title>The system's access control program must be configured to grant or deny system access to specific hosts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system's access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.</description>
      </metadata>
      <criteria operator="AND" comment="host.allow and host.deny must exist" negate="false">
        <criterion comment="host.deny file exists" test_ref="oval:mil.disa.fso.rhel:tst:40000" negate="false" />
        <criterion comment="host.allow file exists" test_ref="oval:mil.disa.fso.rhel:tst:40001" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:405" version="2">
      <metadata>
        <title>The AppleTalk protocol must be disabled or not installed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The AppleTalk suite of protocols is no longer in common use. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged local processes may be able to cause the system to dynamically load a protocol handler by opening a socket using the protocol.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="appletalk not installed or disabled">
        <criteria operator="AND" negate="false" comment="appletalk not installed">
          <criterion comment="appletalk not in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40500" />
          <criterion comment="appletalk not in /etc/modprobe.d" test_ref="oval:mil.disa.fso.rhel:tst:40501" />
        </criteria>
        <criteria operator="OR" negate="false" comment="appletalk is disabled">
          <criterion comment="appletalk disabled in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40502" />
          <criterion comment="appletalk disabled in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40503" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:409" version="2" class="compliance">
      <metadata>
        <title>The Bluetooth protocol handler must be disabled or not installed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Bluetooth is a personal area network (PAN) technology. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged local processes may be able to cause the kernel to dynamically load a protocol handler by opening a socket using the protocol.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="The Bluetooth protocol handler must be disabled or not installed.">
        <criterion comment="bluetooth disabled in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40900" />
        <criterion comment="bluetooth disabled in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40901" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:410" version="2" class="compliance">
      <metadata>
        <title>IPv6 is the next version of the Internet protocol. Binding this protocol to the network stack increases the attack surface of the host.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>IPv6 is the next version of the Internet protocol. Binding this protocol to the network stack increases the attack surface of the host.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="Remove the capability to use IPv6 protocol handler.">
        <criterion comment="networking_ipv6=no exists" test_ref="oval:mil.disa.fso.rhel:tst:41000" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:414" version="2">
      <metadata>
        <title>The system must not have Teredo enabled.</title>
        <description>Teredo is an IPv6 transition mechanism that involves tunneling IPv6 packets encapsulated in IPv4 packets.  Unauthorized tunneling may circumvent network security.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="System must not be running miredo" test_ref="oval:mil.disa.fso.rhel:tst:41400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:417" version="2">
      <metadata>
        <title>The DHCP client must not send dynamic DNS updates.</title>
        <description>Dynamic DNS updates transmit unencrypted information about a system including its name and address and should not be used unless needed.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria>
        <criterion comment="dhclient.conf is configured to disallow dynamic DNS updates" test_ref="oval:mil.disa.fso.rhel:tst:41700" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:418" version="1">
      <metadata>
        <title>GEN007860</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must ignore IPv6 ICMP redirect messages</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="net.ipv6.conf.all.accept_redirects = 0" test_ref="oval:mil.disa.fso.rhel:tst:41800" />
        <criterion comment="net.ipv6.conf.default.accept_redirects = 0" test_ref="oval:mil.disa.fso.rhel:tst:41801" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:420" version="1" class="compliance">
      <metadata>
        <title>The 'ldd' command must be disabled unless it protects against the execution of untrusted files.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The 'ldd' command provides a list of dependent libraries needed by a given binary, which is useful for troubleshooting software. Instead of parsing the binary file, some 'ldd' implementations invoke the program with a special environment variable set, which causes the system dynamic linker to display the list of libraries. Specially crafted binaries can specify an alternate dynamic linker which may cause a program to be executed instead of examined. If the program is from an untrusted source, such as in a user home directory, or a file suspected of involvement in a system compromise, unauthorized software may be executed with the rights of the user running 'ldd'. 

Some 'ldd' implementations include protections that prevent the execution of untrusted files. If such protections exist, this requirement is not applicable.

An acceptable method of disabling 'ldd' is changing its mode to 0000. The SA may conduct troubleshooting by temporarily changing the mode to allow execution and running the 'ldd' command as an unprivileged user upon trusted system binaries.</description>
      </metadata>
      <criteria operator="AND" comment="If the file exists and has any execute permissions, this is a finding. " negate="false">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:42000" negate="true" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:422" version="2" class="compliance">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS connection must require that the server provides a certificate and that this certificate has a valid trust path to a trusted CA.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="IF the system uses LDAP for authentication, THEN it must validate that the certificate has a valid trust path">
        <criterion negate="true" comment="The system is using NSS LDAP" test_ref="oval:mil.disa.fso.rhel:tst:42201" />
        <criterion comment="The LDAP TLS connection must require that the server provides a certificate and that this certificate has a valid trust path to a trusted CA." test_ref="oval:mil.disa.fso.rhel:tst:42200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:423" version="2">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the system must check that the LDAP server's certificate has not been revoked.</title>
        <description>LDAP can be used to provide user authentication and account information, which are vital to system security.  Communication between an LDAP server and a host using LDAP requires authentication.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR" comment="system not using ldap or tls_crlcheck is ALL" negate="false">
        <criterion comment="system is not using ldap" test_ref="oval:mil.disa.fso.rhel:tst:42300" negate="false" />
        <criteria operator="AND" negate="false" comment="x">
          <criterion comment="system is using ldap" test_ref="oval:mil.disa.fso.rhel:tst:42300" negate="true" />
          <criterion comment="tls_crlcheck is ALL" test_ref="oval:mil.disa.fso.rhel:tst:42301" negate="false" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:424" version="2" class="compliance">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.</description>
      </metadata>
      <criteria>
        <criterion comment="no bindpw in ldap.conf" test_ref="oval:mil.disa.fso.rhel:tst:42400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:428" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be owned by root.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42800" comment="CA cert file owned by root" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42801" comment="CA cert file dir owned by root" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42802" comment="CA cert dir owned by root" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42803" comment="CA cert dir files owned by root" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:429" version="2">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be group-owned by root, bin, sys, or system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be group-owned by root, bin or sys</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42900" comment="CA cert file group-owned by root, bin or sys" negate="false" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42901" comment="CA cert file dir group-owned by root, bin or sys" negate="false" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42902" comment="CA cert dir group-owned by root, bin or sys" negate="false" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:42903" comment="CA cert dir files group-owned by root, bin or sys" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:430" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must have mode 0644 (0755 for directories) or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must have mode 0644 (0755 for directories) or less permissive.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43000" comment="CA cert file perms 0644" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43001" comment="CA cert file dir perms 0755" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43002" comment="CA cert dir perms 0755" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43003" comment="CA cert dir files perms 0644" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:431" version="1">
      <metadata>
        <title>For systems using NSS LDAP, the TLS certificate file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>For systems using NSS LDAP, the TLS certificate file must be owned by root.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43100" comment="TLS cert owned by root" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:432" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must be group-owned by root, bin, sys, or system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must be group-owned by root, bin, sys, or system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43200" comment="TLS cert group-owned by root, bin, sys" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:433" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must behave mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must behave mode 0644 or less permissive.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43300" comment="TLS cert with 0644 perms" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:434" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43400" comment="TLS key file owned by root" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:435" version="2">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be group-owned by root.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Must be group owned by root, bin or sys">
        <criterion comment="Test TLS key file is group-owned by root" test_ref="oval:mil.disa.fso.rhel:tst:43500" negate="false" />
        <criterion comment="Test TLS key file is group-owned by bin" test_ref="oval:mil.disa.fso.rhel:tst:43501" negate="false" />
        <criterion comment="Test TLS key file is group-owned by sys" test_ref="oval:mil.disa.fso.rhel:tst:43502" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:436" version="1">
      <metadata>
        <title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is using LDAP for authentication or account information, the LDAP TLS key file must have mode 0600 or less permissive.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43600" comment="TLS key file with 0600 perms" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:437" version="1">
      <metadata>
        <title>GEN008420</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must use available memory address randomization techniques</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check exec-shield existence" test_ref="oval:mil.disa.fso.rhel:tst:43700" negate="false" />
        <criterion comment="exec-shield must be set to 1 if exists" test_ref="oval:mil.disa.fso.rhel:tst:43701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:438" version="2">
      <metadata>
        <title>Automated file system mounting tools must not be enabled unless needed.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4072-5" />
        <description>Automated file system mounting tools must not be enabled unless needed.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:43800" comment="autofs not running" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:439" version="1">
      <metadata>
        <title>GEN008480</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must have USB Mass Storage disabled unless needed</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check USB storage /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:43900" />
        <criterion comment="check USB storage /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:43901" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:440" version="1">
      <metadata>
        <title>GEN008500</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must have IEEE 1394 (Firewire) disabled unless needed</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:44000" />
        <criterion comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:44001" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:443" version="1" class="compliance">
      <metadata>
        <title>For systems capable of using GRUB, the system must be configured with GRUB as the default boot loader unless another boot loader has been authorized, justified, and documented using site-defined procedures.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>For systems capable of using GRUB, the system must be configured with GRUB as the default boot loader unless another boot loader has been authorized, justified, and documented using site-defined procedures.</description>
      </metadata>
      <criteria>
        <criterion comment="grub installed" test_ref="oval:mil.disa.fso.rhel:tst:44300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:445" version="1" class="compliance">
      <metadata>
        <title>The system boot loader must protect passwords using an MD5 or stronger cryptographic hash.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system boot loader must protect passwords using an MD5 or stronger cryptographic hash.</description>
      </metadata>
      <criteria>
        <criterion comment="all grub passwords encrypted with md5" test_ref="oval:mil.disa.fso.rhel:tst:44500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:454" version="3">
      <metadata>
        <title>The system must not have the unnecessary "news" account.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not have the unnecessary "news" account.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Inn installed or no news account">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:45400" comment="inn installed (news acct necessary)" />
        <criterion comment="no news acct in passwd" test_ref="oval:mil.disa.fso.rhel:tst:45401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:455" version="1">
      <metadata>
        <title>The system must not have the unnecessary "gopher" account.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not have the unnecessary "gopher" account.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:45501" comment="no gopher acct in passwd" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:45502" comment="no gopher acct in shadow" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:456" version="2">
      <metadata>
        <title>The system must not have the unnecessary "ftp" account.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not have the unnecessary "ftp" account.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:45602" comment="no ftp acct in passwd" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:458" version="4">
      <metadata>
        <title>Configure GUI Screen Locking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The graphical desktop environment must set the idle timeout to no more than 15 minutes.</description>
      </metadata>
      <criteria>
        <criterion comment="check value of idle_delay in GCONF" test_ref="oval:mil.disa.fso.rhel:tst:5200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:459" version="4">
      <metadata>
        <title>Configure GUI Screen Locking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Graphical desktop environments provided by the system must have automatic lock enabled.</description>
      </metadata>
      <criteria>
        <criterion comment="check value of lock_enabled in GCONF" test_ref="oval:mil.disa.fso.rhel:tst:5202" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:465" version="1" class="compliance">
      <metadata>
        <title>Audit failed file and program access attempts - ftruncate</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Audit failed file and program access attempts">
        <criterion comment="Audit failed file and program access attempts (success=0 b32)" test_ref="oval:mil.disa.fso.rhel:tst:46500" />
        <criterion comment="Audit failed file and program access attempts (success=0 b64)" test_ref="oval:mil.disa.fso.rhel:tst:46501" />
        <criteria operator="AND" negate="false" comment="32-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b32)" test_ref="oval:mil.disa.fso.rhel:tst:46502" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b32)" test_ref="oval:mil.disa.fso.rhel:tst:46504" />
        </criteria>
        <criteria operator="AND" negate="false" comment="64-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b64)" test_ref="oval:mil.disa.fso.rhel:tst:46503" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b64)" test_ref="oval:mil.disa.fso.rhel:tst:46505" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:464" version="1" class="compliance">
      <metadata>
        <title>Audit failed file and program access attempts - truncate</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Audit failed file and program access attempts">
        <criterion comment="Audit failed file and program access attempts (success=0 b32)" test_ref="oval:mil.disa.fso.rhel:tst:46400" />
        <criterion comment="Audit failed file and program access attempts (success=0 b64)" test_ref="oval:mil.disa.fso.rhel:tst:46401" />
        <criteria operator="AND" negate="false" comment="32-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b32)" test_ref="oval:mil.disa.fso.rhel:tst:46402" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b32)" test_ref="oval:mil.disa.fso.rhel:tst:46404" />
        </criteria>
        <criteria operator="AND" negate="false" comment="64-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b64)" test_ref="oval:mil.disa.fso.rhel:tst:46403" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b64)" test_ref="oval:mil.disa.fso.rhel:tst:46405" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:463" version="1" class="compliance">
      <metadata>
        <title>Audit failed file and program access attempts - openat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Audit failed file and program access attempts">
        <criterion comment="Audit failed file and program access attempts (success=0 b32)" test_ref="oval:mil.disa.fso.rhel:tst:46300" />
        <criterion comment="Audit failed file and program access attempts (success=0 b64)" test_ref="oval:mil.disa.fso.rhel:tst:46301" />
        <criteria operator="AND" negate="false" comment="32-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b32)" test_ref="oval:mil.disa.fso.rhel:tst:46302" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b32)" test_ref="oval:mil.disa.fso.rhel:tst:46304" />
        </criteria>
        <criteria operator="AND" negate="false" comment="64-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b64)" test_ref="oval:mil.disa.fso.rhel:tst:46303" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b64)" test_ref="oval:mil.disa.fso.rhel:tst:46305" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:462" version="1" class="compliance">
      <metadata>
        <title>Audit failed file and program access attempts - open</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Audit failed file and program access attempts">
        <criterion comment="Audit failed file and program access attempts (success=0 b32)" test_ref="oval:mil.disa.fso.rhel:tst:46200" />
        <criterion comment="Audit failed file and program access attempts (success=0 b64)" test_ref="oval:mil.disa.fso.rhel:tst:46201" />
        <criteria operator="AND" negate="false" comment="32-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b32)" test_ref="oval:mil.disa.fso.rhel:tst:46202" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b32)" test_ref="oval:mil.disa.fso.rhel:tst:46204" />
        </criteria>
        <criteria operator="AND" negate="false" comment="64-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b64)" test_ref="oval:mil.disa.fso.rhel:tst:46203" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b64)" test_ref="oval:mil.disa.fso.rhel:tst:46205" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:461" version="3" class="compliance">
      <metadata>
        <title>Audit failed file and program access attempts - creat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="Audit failed file and program access attempts">
        <criterion comment="Audit failed file and program access attempts (success=0 b32)" test_ref="oval:mil.disa.fso.rhel:tst:46100" />
        <criterion comment="Audit failed file and program access attempts (success=0 b64)" test_ref="oval:mil.disa.fso.rhel:tst:46101" />
        <criterion comment="Audit failed file and program access attempts (success=0 processor type)" test_ref="oval:mil.disa.fso.rhel:tst:46106" />
        <criteria operator="AND" negate="false" comment="32-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b32)" test_ref="oval:mil.disa.fso.rhel:tst:46102" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b32)" test_ref="oval:mil.disa.fso.rhel:tst:46104" />
        </criteria>
        <criteria operator="AND" negate="false" comment="64-bit Criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM b64)" test_ref="oval:mil.disa.fso.rhel:tst:46103" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES b64)" test_ref="oval:mil.disa.fso.rhel:tst:46105" />
        </criteria>
        <criteria operator="AND" negate="false" comment="processor type criteria">
          <criterion comment="Audit failed file and program access attempts (exit=-EPERM processor type)" test_ref="oval:mil.disa.fso.rhel:tst:46107" />
          <criterion comment="Audit failed file and program access attempts (exit=-EACCES processor type)" test_ref="oval:mil.disa.fso.rhel:tst:46108" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:467" version="1" class="compliance">
      <metadata>
        <title>Audit file and program deletion - rmdir</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="Audit file and program deletion">
        <criterion comment="Enable auditing of deletions" test_ref="oval:mil.disa.fso.rhel:tst:46700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:466" version="1" class="compliance">
      <metadata>
        <title>Audit file and program deletion - unlink</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="Audit file and program deletion">
        <criterion comment="Enable auditing of deletions" test_ref="oval:mil.disa.fso.rhel:tst:46600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:490" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47860" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47861" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47862" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47861" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47863" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47860" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47863" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47862" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:489" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - lremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47856" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47857" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47858" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47857" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47859" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47856" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47859" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47858" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:488" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - removexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47852" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47853" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47854" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47853" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47855" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47852" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47855" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47854" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:487" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47848" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47849" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47850" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47849" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47851" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47848" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47851" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47850" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:486" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - lsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47844" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47845" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47846" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47845" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47847" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47844" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47847" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47846" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:485" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - setxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47840" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47841" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47842" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47841" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47843" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47840" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47843" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47842" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:484" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - lchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47833" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47834" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47835" />
          </criteria>
          <criteria operator="OR" comment="all dac 32-bit-only syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47837" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47838" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47839" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47834" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47836" />
          </criteria>
          <criterion comment="all dac 32-bit-only syscalls / b32" test_ref="oval:mil.disa.fso.rhel:tst:47838" />
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47833" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47836" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47835" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:483" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fchownat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47829" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47830" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47831" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47830" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47832" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47829" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47832" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47831" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:482" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47822" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47823" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47824" />
          </criteria>
          <criteria operator="OR" comment="all dac 32-bit-only syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47826" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47827" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47828" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47823" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47825" />
          </criteria>
          <criterion comment="all dac 32-bit-only syscalls / b32" test_ref="oval:mil.disa.fso.rhel:tst:47827" />
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47822" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47825" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47824" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:481" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - chown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47818" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47819" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47820" />
          </criteria>
          <criteria operator="OR" comment="all dac 32-bit-only syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47804" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47805" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47806" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47819" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47821" />
          </criteria>
          <criterion comment="all dac 32-bit-only syscalls / b32" test_ref="oval:mil.disa.fso.rhel:tst:47805" />
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47818" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47821" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47820" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:480" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fchmodat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47814" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47815" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47816" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47815" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47817" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47814" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47817" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47816" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:479" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - fchmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47810" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47811" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47812" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47811" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47813" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47810" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47813" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47812" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:478" version="5">
      <metadata>
        <title>Ensure auditd Collects Discretionary Access Control Permission Modiﬁcation Events - chmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-14058-2" />
        <description>Audit rules about the Discretionary Access Control Permission Modiﬁcation Events are enabled</description>
      </metadata>
      <criteria operator="OR" comment="DAC auditing based on architecture">
        <criteria comment="32-bit">
          <criterion comment="check that arch is 32-bit" test_ref="oval:mil.disa.fso.rhel:tst:47807" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47800" />
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47801" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47802" />
          </criteria>
        </criteria>
        <criteria comment="32/64-bit">
          <criterion comment="check that arch is 32/64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47808" />
          <criteria operator="AND" comment="all dac syscalls">
            <criterion comment="b32" test_ref="oval:mil.disa.fso.rhel:tst:47801" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47803" />
          </criteria>
        </criteria>
        <criteria comment="64-bit">
          <criterion comment="check that arch is 64-bit" test_ref="oval:mil.disa.fso.rhel:tst:47809" />
          <criteria operator="OR" comment="all dac syscalls">
            <criterion comment="no arch" test_ref="oval:mil.disa.fso.rhel:tst:47800" />
            <criterion comment="b64" test_ref="oval:mil.disa.fso.rhel:tst:47803" />
            <criterion comment="arch" test_ref="oval:mil.disa.fso.rhel:tst:47802" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:497" version="1" class="compliance">
      <metadata>
        <title>Files in cron script directories must have mode 0700 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/cron.daily/* is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49700" />
        <criterion comment="Test mode of /etc/cron.hourly/* is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49701" />
        <criterion comment="Test mode of /etc/cron.monthly/* is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49702" />
        <criterion comment="Test mode of /etc/cron.weekly/* is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49703" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:496" version="1" class="compliance">
      <metadata>
        <title>Crontab files must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /var/spool/cron/* is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49600" />
        <criterion comment="Test mode of /etc/cron.d/* is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49601" />
        <criterion comment="Test mode of /etc/crontab is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:49602" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:44" version="3">
      <metadata>
        <title>The Department of Defense (DoD) login banner must be displayed prior to any login attempt.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The Department of Defense (DoD) login banner must be displayed prior to any login attempt.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="/etc/issue contains warning banner" test_ref="oval:mil.disa.fso.rhel:tst:4400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:78" version="3">
      <metadata>
        <title>The system must prevent the root account from directly logging in except from the system console.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must prevent the root account from directly logging in except from the system console.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7800" comment="/etc/securetty has only one entry and it is valid" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:13" version="2">
      <metadata>
        <title>An X server must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>These options will detract from the security of the Xwindows system.</description>
      </metadata>
      <criteria negate="true" operator="OR">
        <criterion comment="check for ac" test_ref="oval:mil.disa.fso.rhel:tst:1300" />
        <criterion comment="check for core" test_ref="oval:mil.disa.fso.rhel:tst:1301" />
        <criterion comment="check for nolock" test_ref="oval:mil.disa.fso.rhel:tst:1302" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:12" version="2">
      <metadata>
        <title>The X server must have the correct options enabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The X server must have the correct options enabled.</description>
      </metadata>
      <criteria>
        <criterion comment="check for audit" test_ref="oval:mil.disa.fso.rhel:tst:1200" />
        <criterion comment="check for auth" test_ref="oval:mil.disa.fso.rhel:tst:1201" />
        <criterion comment="check for -s" test_ref="oval:mil.disa.fso.rhel:tst:1202" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:70" version="1">
      <metadata>
        <title>The root account must be the only account having a UID of 0.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account must be the only account having a UID of 0.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7000" comment="all UID 0s are root" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:77" version="2">
      <metadata>
        <title>The root account must not have world-writable directories in its executable search path.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account must not have world-writable directories in its executable search path.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7700" comment="root executable search path no world-writable directories" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:76" version="2">
      <metadata>
        <title>The root account's list of preloaded libraries must be empty.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account's list of preloaded libraries must be empty.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7600" comment="default root library preload list" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:75" version="2">
      <metadata>
        <title>The root account's library search path must be the vendor default and must contain only absolute paths.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account's library search path must be the vendor default and must contain only absolute paths.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7500" comment="default root library search path" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:74" version="2">
      <metadata>
        <title>The root account's executable search path must be the vendor default and must contain only absolute paths.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account's executable search path must be the vendor default and must contain only absolute paths.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7400" comment="default root search path" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:72" version="2">
      <metadata>
        <title>The root account's home directory (other than /) must have mode 0700.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root account's home directory (other than /) must have mode 0700.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7200" comment="root home dir is /" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7201" comment="root home dir is 0700" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:89" version="1">
      <metadata>
        <title>Library File Permissions.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Library files must have mode 0755 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check /usr/lib permissions" test_ref="oval:mil.disa.fso.rhel:tst:8900" />
        <criterion comment="check /lib permissions" test_ref="oval:mil.disa.fso.rhel:tst:8901" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:90" version="1" class="compliance">
      <metadata>
        <title>NIS/NIS+/yp files must be owned by root, sys, or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="NIS/NIS+/yp files must be owned by root, sys, or bin.">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:9000" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:112" version="1" class="compliance">
      <metadata>
        <title>The /etc/passwd file must not contain password hashes.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The /etc/passwd file must not contain password hashes.">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:11200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:124" version="2">
      <metadata>
        <title>Run control scripts' lists of preloaded libraries must contain only absolute paths.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Run control scripts' lists of preloaded libraries must contain only absolute paths.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:12400" comment="run control scripts library preload list ok" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:12401" comment="no run control scripts library preload lists" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:136" version="2">
      <metadata>
        <title>All global initialization files' executable search paths must contain only absolute paths.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All global initialization files' executable search paths must contain only absolute paths.</description>
      </metadata>
      <criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:13600" comment="global init default search path ok" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:13601" comment="no global init default search paths" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:13602" comment="global init default search path ok" />
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:13603" comment="no global init default search paths" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:160" version="1">
      <metadata>
        <title>Audio device ownership.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Audio devices must be owned by root.</description>
      </metadata>
      <criteria>
        <criterion comment="check /dev/audio is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:16000" />
        <criterion comment="check /dev/snd is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:16001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:161" version="1">
      <metadata>
        <title>Audio device group ownership.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Audio devices must be group-owned by root, sys, bin, sys, or audio.</description>
      </metadata>
      <criteria>
        <criterion comment="check /dev/audio is group-owned by root, sys, bin, sys, or audio" test_ref="oval:mil.disa.fso.rhel:tst:16100" />
        <criterion comment="check /dev/snd is group-owned by root, sys, bin, sys, or audio" test_ref="oval:mil.disa.fso.rhel:tst:16101" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:159" version="1">
      <metadata>
        <title>Audio devices must have mode 0660 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Audio devices must have mode 0660 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check /dev/audio permissions" test_ref="oval:mil.disa.fso.rhel:tst:15900" />
        <criterion comment="check /dev/snd permissions" test_ref="oval:mil.disa.fso.rhel:tst:15901" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:171" version="1">
      <metadata>
        <title>Audit logs accessiblity.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit logs must be owned by root</description>
      </metadata>
      <criteria>
        <criterion comment="System audit logs must be owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:172" version="1">
      <metadata>
        <title>System audit logs group ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit logs must be group-owned by root, sys, or bin</description>
      </metadata>
      <criteria>
        <criterion comment="System audit logs must be group-owned by root, sys, or bin" test_ref="oval:mil.disa.fso.rhel:tst:17200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:173" version="1">
      <metadata>
        <title>Audit logs permissions.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit logs must have mode 0640 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check system audit log permissions" test_ref="oval:mil.disa.fso.rhel:tst:17300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:174" version="1">
      <metadata>
        <title>GEN002715</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit tool executables must be owned by root.</description>
      </metadata>
      <criteria>
        <criterion comment="check /sbin/auditctl is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17400" />
        <criterion comment="check /sbin/auditd is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17401" />
        <criterion comment="check /sbin/ausearch is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17402" />
        <criterion comment="check /sbin/aureport is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17403" />
        <criterion comment="check /sbin/autrace is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17404" />
        <criterion comment="check /sbin/audispd is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:17405" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:175" version="1">
      <metadata>
        <title>GEN002716</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit tool executables must be group-owned by root, bin, or sys.</description>
      </metadata>
      <criteria>
        <criterion comment="check /sbin/auditctl is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17500" />
        <criterion comment="check /sbin/auditd is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17501" />
        <criterion comment="check /sbin/ausearch is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17502" />
        <criterion comment="check /sbin/aureport is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17503" />
        <criterion comment="check /sbin/autrace is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17504" />
        <criterion comment="check /sbin/audispd is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:17505" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:176" version="1">
      <metadata>
        <title>GEN002717</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System audit tool executables must have mode 0750 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check /sbin/auditctl permissions" test_ref="oval:mil.disa.fso.rhel:tst:17600" />
        <criterion comment="check /sbin/auditd permissions" test_ref="oval:mil.disa.fso.rhel:tst:17601" />
        <criterion comment="check /sbin/ausearch permissions" test_ref="oval:mil.disa.fso.rhel:tst:17602" />
        <criterion comment="check /sbin/aureport permissions" test_ref="oval:mil.disa.fso.rhel:tst:17603" />
        <criterion comment="check /sbin/autrace permissions" test_ref="oval:mil.disa.fso.rhel:tst:17604" />
        <criterion comment="check /sbin/audispd permissions" test_ref="oval:mil.disa.fso.rhel:tst:17605" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:331" version="1">
      <metadata>
        <title>Use Only Approved Ciphers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14491-5" source="http://cce.mitre.org" />
        <description>Use only approved ciphers</description>
      </metadata>
      <criteria operator="OR" comment="SSH is not being used or conditions are met">
        <criterion comment="Check value of Ciphers in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.rhel:tst:33100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:361" version="1">
      <metadata>
        <title>Enable a Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4431-3" source="http://cce.mitre.org" />
        <description>SSH warning banner should be enabled (and dependencies are met)</description>
      </metadata>
      <criteria operator="OR" comment="SSH is not being used or conditions are met">
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:36100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:80" version="1">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4387-7" source="http://cce.mitre.org" />
        <description>Root login via SSH should be disabled</description>
      </metadata>
      <criteria operator="OR" comment="SSH is not being used or conditions are met">
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:8000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:328" version="1">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4325-7" source="http://cce.mitre.org" />
        <description>SSH version 1 protocol support should be disabled. (and dependencies are met)</description>
      </metadata>
      <criteria operator="OR" comment="SSH is not being used or conditions are met">
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:32800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:267" version="1">
      <metadata>
        <title>Remove the Rsh Server Commands from the System</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4308-3" source="http://cce.mitre.org" />
        <description>The rsh-server package should be uninstalled.</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:26700" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:26" version="1">
      <metadata>
        <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-15026-8" source="http://cce.mitre.org" />
        <description>Look for argument audit=1 in /proc/cmdline</description>
      </metadata>
      <criteria>
        <criterion comment="check for audit=1 in /proc/cmdline" test_ref="oval:mil.disa.fso.rhel:tst:2600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:170" version="2">
      <metadata>
        <title>Enable the auditd Service</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4292-9" source="http://cce.mitre.org" />
        <description>The auditd service should be running.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Auditd process is running" test_ref="oval:mil.disa.fso.rhel:tst:17000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:408" version="1">
      <metadata>
        <title>Disable Support for TIPC</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14911-2" source="http://cce.mitre.org" />
        <description>Support for TIPC should be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check for TIPC in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40800" />
        <criterion comment="check for TIPC in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40801" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:407" version="1">
      <metadata>
        <title>Disable Support for RDS</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14027-7" source="http://cce.mitre.org" />
        <description>Support for RDS should be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check for RDS in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40700" />
        <criterion comment="check for RDS in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:401" version="1">
      <metadata>
        <title>Disable Support for SCTP</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14132-5" source="http://cce.mitre.org" />
        <description>Support for SCTP should be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check for SCTP in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40100" />
        <criterion comment="check for SCTP in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40101" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:402" version="1">
      <metadata>
        <title>Disable Support for DCCP</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14268-7" source="http://cce.mitre.org" />
        <description>Support for DCCP should be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check for DCCP in /etc/modprobe.conf" test_ref="oval:mil.disa.fso.rhel:tst:40200" />
        <criterion comment="check for DCCP in /etc/modprobe.d/*" test_ref="oval:mil.disa.fso.rhel:tst:40201" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:441" version="1">
      <metadata>
        <title>Inspect and Activate Default Rules</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4189-7" source="http://cce.mitre.org" />
        <description>The iptables service should be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="iptables starts in runlevel 2" test_ref="oval:mil.disa.fso.rhel:tst:44102" />
        <criterion comment="iptables starts in runlevel 3" test_ref="oval:mil.disa.fso.rhel:tst:44103" />
        <criterion comment="iptables starts in runlevel 4" test_ref="oval:mil.disa.fso.rhel:tst:44104" />
        <criterion comment="iptables starts in runlevel 5" test_ref="oval:mil.disa.fso.rhel:tst:44105" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:411" version="1">
      <metadata>
        <title>Disable Automatic Loading of IPv6 Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3562-6" source="http://cce.mitre.org" />
        <description>Automatic loading of the IPv6 kernel module should be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:41100" comment="install ipv6 /bin/true in /etc/modprobe.conf" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:41101" comment="install ipv6 /bin/true in /etc/modprobe.d/*" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:245" version="1">
      <metadata>
        <title>Network Parameters for Hosts and Routers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4265-5" source="http://cce.mitre.org" />
        <description>Sending TCP syncookies should be enabled.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:24500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:237" version="1">
      <metadata>
        <title>Network Parameters for Hosts and Routers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3644-2" source="http://cce.mitre.org" />
        <description>Ignoring ICMP echo requests (pings) sent to broadcast / multicast addresses should be enabled or disabled as appropriate.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:23700" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:363" version="1">
      <metadata>
        <title>Network Parameters for Hosts Only</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3561-8" source="http://cce.mitre.org" />
        <description>IP forwarding should be disabled.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:36300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:31" version="1">
      <metadata>
        <title>Require Authentication for Single-User Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4241-6" source="http://cce.mitre.org" />
        <description>The requirement for a password to boot into single-user mode should be configured correctly.</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:3100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:444" version="1">
      <metadata>
        <title>Set Boot Loader Password</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3818-2" source="http://cce.mitre.org" />
        <description>The grub boot loader should have password protection enabled</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:44400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:448" version="1">
      <metadata>
        <title>Set Boot Loader Password</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4197-0" source="http://cce.mitre.org" />
        <description>The /etc/grub.conf file should be owned by the appropriate group.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:44800" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:115" version="1">
      <metadata>
        <title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4090-7" source="http://cce.mitre.org" />
        <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      </metadata>
      <criteria>
        <criterion comment="Home directories mode" test_ref="oval:mil.disa.fso.rhel:tst:11500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:66" version="1">
      <metadata>
        <title>Set Password difok Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14701-7" source="http://cce.mitre.org" />
        <description>The password difok should meet minimum requirements using pam_cracklib</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions for difok are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:61" version="1">
      <metadata>
        <title>Set Password lcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14712-4" source="http://cce.mitre.org" />
        <description>The password lcredit should meet minimum requirements using pam_cracklib</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions for lcredit are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:63" version="1">
      <metadata>
        <title>Set Password ocredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14122-6" source="http://cce.mitre.org" />
        <description>The password ocredit should meet minimum requirements using pam_cracklib</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions for ocredit are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:60" version="1">
      <metadata>
        <title>Set Password ucredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14672-0" source="http://cce.mitre.org" />
        <description>The password ucredit should meet minimum requirements using pam_cracklib</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions for ucredit are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6000" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:62" version="1">
      <metadata>
        <title>Set Password dcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-14113-5" source="http://cce.mitre.org" />
        <description>The password dcredit should meet minimum requirements using pam_cracklib</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions for dcredit are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:65" version="1">
      <metadata>
        <title>Maximum Password Age</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4092-3" source="http://cce.mitre.org" />
        <description>The "maximum password age" policy should meet minimum requirements.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:6500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:54" version="1">
      <metadata>
        <title>Minimum Password Age</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4180-6" source="http://cce.mitre.org" />
        <description>The "minimum password age" policy should meet minimum requirements.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:5400" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:5401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:56" version="1">
      <metadata>
        <title>Minimum Password Length</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4154-1" source="http://cce.mitre.org" />
        <description>The password minimum length should be set appropriately</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:5600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:69" version="1">
      <metadata>
        <title>Limit command Access to the Root Account</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-15047-4" />
        <description>Command access to the root account should be restricted to the wheel group.</description>
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.rhel:tst:6900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:224" version="1">
      <metadata>
        <title>Disable Core Dumps</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4225-9" source="http://cce.mitre.org" />
        <description>Core dumps for all users should be disabled</description>
      </metadata>
      <criteria>
        <criterion comment="Are core dumps disabled" test_ref="oval:mil.disa.fso.rhel:tst:22400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:109" version="1">
      <metadata>
        <title>Verify permissions on 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4130-1" source="http://cce.mitre.org" />
        <description>File permissions for /etc/shadow should be set correctly.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:10900" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:2" version="1">
      <metadata>
        <title>Verify group who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-4064-2" source="http://cce.mitre.org" />
        <description>The /etc/gshadow file should be owned by the appropriate group.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:107" version="1">
      <metadata>
        <title>Verify user who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference ref_id="CCE-3918-0" source="http://cce.mitre.org" />
        <description>The /etc/shadow file should be owned by the appropriate user.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:10700" comment="Check file ownership of /etc/shadow" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:79" version="1">
      <metadata>
        <title>The root shell must be located in the / file system.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root shell must be located in the / file system.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7900" comment="root shell is in / fs" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:32" version="1">
      <metadata>
        <title>The operating system must be a supported release.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The operating system must be a supported release.</description>
      </metadata>
      <criteria>
        <criterion comment="check for red hat 5" test_ref="oval:mil.disa.fso.rhel:tst:3200" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:131" version="2">
      <metadata>
        <title>Global Initialization Files Group Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All global initialization files must be group-owned by root, bin, or sys.</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/csh.cshrc file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13100" />
        <criterion comment="check /etc/profile file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13101" />
        <criterion comment="check /etc/bashrc file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13102" />
        <criterion comment="check /etc/environment file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13103" />
        <criterion comment="check /etc/csh.login file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13104" />
        <criterion comment="check /etc/csh.logout file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13105" />
        <criterion comment="check /etc/ksh.kshrc file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13106" />
        <criterion comment="check /etc/suid_profile file is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13107" />
        <criterion comment="check /etc/profile.d directory is group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13108" />
        <criterion comment="check /etc/profile.d directory files are group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:13109" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:130" version="2">
      <metadata>
        <title>Global Initialization Files Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All global initialization files must be owned by root.</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/csh.cshrc file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13000" />
        <criterion comment="check /etc/profile file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13001" />
        <criterion comment="check /etc/bashrc file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13002" />
        <criterion comment="check /etc/environment file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13003" />
        <criterion comment="check /etc/csh.login file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13004" />
        <criterion comment="check /etc/csh.logout file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13005" />
        <criterion comment="check /etc/ksh.kshrc file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13006" />
        <criterion comment="check /etc/suid_profile file is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13007" />
        <criterion comment="check /etc/profile.d directory is owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13008" />
        <criterion comment="check /etc/profile.d directory files are owned by root" test_ref="oval:mil.disa.fso.rhel:tst:13009" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:129" version="2">
      <metadata>
        <title>Global Initialization Files Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All global initialization files must have mode 0644 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check /etc/csh.cshrc file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12900" />
        <criterion comment="check /etc/profile file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12901" />
        <criterion comment="check /etc/bashrc file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12902" />
        <criterion comment="check /etc/environment file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12903" />
        <criterion comment="check /etc/csh.login file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12904" />
        <criterion comment="check /etc/csh.logout file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12905" />
        <criterion comment="check /etc/ksh.kshrc file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12906" />
        <criterion comment="check /etc/suid_profile file permissions" test_ref="oval:mil.disa.fso.rhel:tst:12907" />
        <criterion comment="check /etc/profile.d directory files permissions" test_ref="oval:mil.disa.fso.rhel:tst:12909" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:142" version="2">
      <metadata>
        <title>All local initialization files' executable search paths must contain only absolute paths.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All local initialization files' executable search paths must contain only absolute paths.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:14200" comment="local init default search path ok" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:14201" comment="no local init default search paths" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:151" version="1" class="compliance">
      <metadata>
        <title>The .rhosts file must not be supported in PAM</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model and should never be used. The ability to use .rhosts files, which are used to specify a list of hosts that are permitted remote access to a particular account without authenticating, should be disabled.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The .rhosts file must not be supported in PAM">
        <criterion comment="The .rhosts file must not be supported in PAM" test_ref="oval:mil.disa.fso.rhel:tst:15100" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:308" version="2">
      <metadata>
        <title>All FTP users must have a default umask of 077.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All FTP users must have a default umask of 077.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:30800" comment="xinetd gssftp umask 077" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:30801" comment="vsftpd no bad anon umask" />
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:30802" comment="vsftpd no bad local umask" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:24" version="2" class="compliance">
      <metadata>
        <title>The /etc/securetty file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The securetty file contains the list of terminals that permit direct root logins. It must be protected from unauthorized modification.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The /etc/securetty file must have mode 0600 or less permissive.">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:2400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:41" version="3" class="compliance">
      <metadata>
        <title>The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not protected, unauthorized modifications could result in the failure of time synchronization.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.">
        <criterion comment="Default comment, please change" test_ref="oval:mil.disa.fso.rhel:tst:4100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:57" version="2" class="compliance">
      <metadata>
        <title>The system must enforce the correctness of the entire password during authentication.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Some common password hashing schemes only process the first eight characters of a user's password, which reduces the effective strength of the password.</description>
      </metadata>
      <criteria operator="AND" comment="The system must enforce the correctness of the entire password during authentication." negate="false">
        <criterion comment="password file entries begin with underscore or dollar sign" test_ref="oval:mil.disa.fso.rhel:tst:5700" />
        <criterion comment="shadow password file entries begin with underscore or dollar sign" test_ref="oval:mil.disa.fso.rhel:tst:5701" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:59" version="3" class="compliance">
      <metadata>
        <title>The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Systems must employ crptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes that are more vulnerable to compromise.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm">
        <criterion comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm" test_ref="oval:mil.disa.fso.rhel:tst:5900" negate="false" />
        <criterion comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm" test_ref="oval:mil.disa.fso.rhel:tst:5901" negate="false" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:113" version="3" class="compliance">
      <metadata>
        <title>The /etc/group file must not contain any group password hashes.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Group passwords are typically shared and should not be used. Additionally, if password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The /etc/group file must not contain any group password hashes.">
        <criterion comment="all /etc/group hashes disabled" test_ref="oval:mil.disa.fso.rhel:tst:11300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:114" version="3" class="compliance">
      <metadata>
        <title>The /etc/gshadow file must not contain any group password hashes.</title>
        <affected family="unix">
          <platform>Red Hap Enterprise Linux 5</platform>
        </affected>
        <description>Group passwords are typically shared and should not be used.</description>
      </metadata>
      <criteria operator="AND" comment="The /etc/gshadow file must not contain any group password hashes.">
        <criterion comment="gshadow no hashes" test_ref="oval:mil.disa.fso.rhel:tst:11400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:316" version="4" class="compliance">
      <metadata>
        <title>The SNMP service must use only SNMPv3 or its successor</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an attacker or other unauthorized users may gain access to detailed system management information and use that information to launch attacks against the system.</description>
      </metadata>
      <criteria operator="OR" comment="References v1, v2c, community, and com2sec should not exist" negate="false">
        <criterion comment="Checking for v1, v2c, community or com2sec references" test_ref="oval:mil.disa.fso.rhel:tst:31600" negate="false" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:299" version="7">
      <metadata>
        <title>Mail relaying must be restricted.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Mail relaying must be restricted.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" negate="false" comment="sendmail tests">
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:29900" comment="sendmail not installed" />
          <criteria operator="OR" comment="sendmail is installed" negate="false">
            <criterion comment="DaemonPortOptions are loopbacks" test_ref="oval:mil.disa.fso.rhel:tst:29901" negate="false" />
            <criterion comment="no sendmail promisc_relay" test_ref="oval:mil.disa.fso.rhel:tst:29902" />
          </criteria>
        </criteria>
        <criteria operator="OR" negate="false" comment="postfix tests">
          <criterion test_ref="oval:mil.disa.fso.rhel:tst:29903" comment="postfix not installed" />
          <criteria operator="OR" negate="false" comment="postfix is installed">
            <criterion comment="inet_interfaces are loopbacks" test_ref="oval:mil.disa.fso.rhel:tst:29904" negate="false" />
            <criteria operator="AND" comment="inet interfaces are not loopback" negate="false">
              <criterion comment="postfix smtpd_client_restrictions has reject" test_ref="oval:mil.disa.fso.rhel:tst:29905" />
              <criterion comment="postfix smtpd_client_restrictions no permit before reject" test_ref="oval:mil.disa.fso.rhel:tst:29906" />
            </criteria>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:126" version="1" class="compliance">
      <metadata>
        <title>All system start-up files must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify them for unauthorized purposes. This could lead to system and network compromise.</description>
      </metadata>
      <criteria operator="AND" comment="All system start-up files must be owned by root or bin." negate="false">
        <criterion comment="All system start-up files must be owned by root or bin. (/etc/rc*)" test_ref="oval:mil.disa.fso.rhel:tst:12601" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:127" version="1" class="compliance">
      <metadata>
        <title>All system start-up files must be owned by a system group.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify them for unauthorized purposes. This could lead to system and network compromise.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All system start-up files must be owned by a system group.">
        <criterion comment="All system start-up files must be owned by a system group." test_ref="oval:mil.disa.fso.rhel:tst:12701" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:306" version="1">
      <metadata>
        <title>Anonymous FTP accounts must not have a functional shell.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Anonymous FTP accounts must not have a functional shell.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:30600" comment="ftp account has appropriate shell" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:314" version="1">
      <metadata>
        <title>Disable UUCP</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The system must not have the UUCP service active</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:31400" comment="uucp is not enabled" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:55" version="3" class="compliance">
      <metadata>
        <title>An account on the system is not password protected</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. If the root user is configured without a password, the entire system may be compromised. For user accounts not using password authentication, the account must be configured with a password lock value instead of a blank or null value.</description>
      </metadata>
      <criteria operator="AND" comment="The system must not have accounts configured with blank or null passwords" negate="false">
        <criterion comment="The system must not have accounts configured with blank or null passwords" test_ref="oval:mil.disa.fso.rhel:tst:5500" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:71" version="1">
      <metadata>
        <title>The root user's home directory must not be the root directory (/).</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The root user's home directory must not be the root directory (/).</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.rhel:tst:7100" comment="root home dir is not /" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:43" version="1">
      <metadata>
        <title>All GIDs referenced in the /etc/passwd file must be defined in the /etc/group file.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All GIDs referenced in the /etc/passwd file must be defined in the /etc/group file.</description>
      </metadata>
      <criteria>
        <criterion comment="check for that all referenced GIDs exist" test_ref="oval:mil.disa.fso.rhel:tst:4300" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:87" version="3">
      <metadata>
        <title>System Log File Permissions.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>System log files must have mode 0640 or less permissive.</description>
      </metadata>
      <criteria>
        <criterion comment="check /var/log permissions" test_ref="oval:mil.disa.fso.rhel:tst:8700" />
        <criterion comment="check /var/log/syslog permissions" test_ref="oval:mil.disa.fso.rhel:tst:8701" />
        <criterion comment="check /var/adm permissions" test_ref="oval:mil.disa.fso.rhel:tst:8702" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:133" version="2" class="compliance">
      <metadata>
        <title>Default/Skeleton Dot Files Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All skeleton files must have mode 0644 or less permissive.">
        <criterion comment="All skeleton files must have mode 0644 or less permissive." test_ref="oval:mil.disa.fso.rhel:tst:13300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:134" version="2" class="compliance">
      <metadata>
        <title>All skeleton files and directories must be owned by root or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All skeleton files and directories must be owned by root or bin.">
        <criterion comment="All skeleton files and directories must be owned by root or bin." test_ref="oval:mil.disa.fso.rhel:tst:13400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:135" version="2" class="compliance">
      <metadata>
        <title>All skeleton files must be group-owned by root, bin, sys, system, or other.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All skeleton files must be group-owned by root, bin, sys, system, or other.">
        <criterion comment="All skeleton files must be group-owned by root, bin, sys, system, or other." test_ref="oval:mil.disa.fso.rhel:tst:13500" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:91" version="1" class="compliance">
      <metadata>
        <title>The NIS/NIS+/yp command files must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Unauthorized modification of these files could compromise these processes and the system.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="The NIS/NIS+/yp command files must have mode 0755 or less permissive">
        <criterion comment="The NIS/NIS+/yp command files must have mode 0755 or less permissive." test_ref="oval:mil.disa.fso.rhel:tst:9100" negate="false" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:85" version="2" class="compliance">
      <metadata>
        <title>System Files, Programs, and Directories Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Restricting permissions will protect the files from authorized modification.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="System files, programs, and directories must be group-owned by a system group">
        <criterion comment="All system files, programs, and directories must be owned by a system account (/etc)" test_ref="oval:mil.disa.fso.rhel:tst:8500" negate="false" />
        <criterion comment="System files and directories under /etc" test_ref="oval:mil.disa.fso.rhel:tst:8501" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8502" negate="false" />
        <criterion comment="System files and directories under /bin" test_ref="oval:mil.disa.fso.rhel:tst:8503" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8504" negate="false" />
        <criterion comment="System files and directories under /sbin" test_ref="oval:mil.disa.fso.rhel:tst:8505" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/usr/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8506" negate="false" />
        <criterion comment="System files and directories under /usr/bin" test_ref="oval:mil.disa.fso.rhel:tst:8507" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/usr/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8508" negate="false" />
        <criterion comment="System files and directories under /usr/sbin" test_ref="oval:mil.disa.fso.rhel:tst:8509" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/usr/local/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8510" negate="false" />
        <criterion comment="System files and directories under /usr/local/bin" test_ref="oval:mil.disa.fso.rhel:tst:8511" />
        <criterion comment="All system files, programs, and directories must be owned by a system account (/usr/local/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8512" negate="false" />
        <criterion comment="System files and directories under /usr/local/sbin" test_ref="oval:mil.disa.fso.rhel:tst:8513" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:86" version="2" class="compliance">
      <metadata>
        <title>System Files, Programs, and Directories Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Restricting permissions will protect the files from authorized modification.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="System files, programs, and directories must be group-owned by a system group">
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/etc)" test_ref="oval:mil.disa.fso.rhel:tst:8600" />
        <criterion comment="System files and directories under /etc" test_ref="oval:mil.disa.fso.rhel:tst:8601" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8602" />
        <criterion comment="System files and directories under /bin" test_ref="oval:mil.disa.fso.rhel:tst:8603" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8604" />
        <criterion comment="System files and directories under /sbin" test_ref="oval:mil.disa.fso.rhel:tst:8605" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/usr/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8606" />
        <criterion comment="System files and directories under /usr/bin" test_ref="oval:mil.disa.fso.rhel:tst:8607" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/usr/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8608" />
        <criterion comment="System files and directories under /usr/sbin" test_ref="oval:mil.disa.fso.rhel:tst:8609" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/usr/local/bin)" test_ref="oval:mil.disa.fso.rhel:tst:8610" />
        <criterion comment="System files and directories under /usr/local/bin" test_ref="oval:mil.disa.fso.rhel:tst:8611" />
        <criterion comment="System files, programs, and directories must be group-owned by a system group (/usr/local/sbin)" test_ref="oval:mil.disa.fso.rhel:tst:8612" />
        <criterion comment="System files and directories under /usr/local/sbin" test_ref="oval:mil.disa.fso.rhel:tst:8613" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:301" version="2">
      <metadata>
        <title>The ftpusers file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The ftpusers file must exist</description>
      </metadata>
      <criteria operator="AND">
        <criteria comment="gssftp" operator="OR">
          <criterion comment="gssftp not installed" test_ref="oval:mil.disa.fso.rhel:tst:30103" />
          <criterion comment="gssftp disabled" test_ref="oval:mil.disa.fso.rhel:tst:30105" />
          <criterion comment="check /etc/ftpusers existence" test_ref="oval:mil.disa.fso.rhel:tst:30100" />
        </criteria>
        <criteria comment="vsftpd" operator="OR">
          <criterion comment="vsftpd not installed" test_ref="oval:mil.disa.fso.rhel:tst:30104" />
          <criterion comment="vsftpd not running" test_ref="oval:mil.disa.fso.rhel:tst:30106" />
          <criterion comment="check /etc/vsftpd.ftpusers existence" test_ref="oval:mil.disa.fso.rhel:tst:30101" />
          <criterion comment="check /etc/vsftpd/ftpusers existence" test_ref="oval:mil.disa.fso.rhel:tst:30102" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:310" version="2">
      <metadata>
        <title>The TFTP daemon must operate in secure mode which provides access only to a single directory on the host file system.</title>
        <description>Secure mode limits TFTP requests to a specific directory.  If TFTP is not running in secure mode, it may be able to write to any file or directory and may seriously impair system integrity, confidentiality, and availability.</description>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
      </metadata>
      <criteria operator="OR">
        <criterion comment="TFTP is configured for secure mode operation." test_ref="oval:mil.disa.fso.rhel:tst:31000" />
        <criterion comment="no TFTP via XINETD" test_ref="oval:mil.disa.fso.rhel:tst:31001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:311" version="2">
      <metadata>
        <title>TFTP SUID/SGID Bit</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The TFTP daemon must have mode 0755 or less permissive</description>
      </metadata>
      <criteria>
        <criterion comment="The TFTP daemon must have mode 0755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:31100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:110" version="3" class="compliance">
      <metadata>
        <title>All users must be assigned a home directory in the /etc/passwd file.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>If users do not have a valid home directory, there is no place for the storage and control of files they own.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="All users must be assigned a home directory in the /etc/passwd file.">
        <criterion comment="All users must be assigned a home directory in the /etc/passwd file." test_ref="oval:mil.disa.fso.rhel:tst:11000" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:152" version="1" class="compliance">
      <metadata>
        <title>The /etc/shells (or equivalent) file must exist</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The shells file (or equivalent) lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized shell that may not be secure.</description>
      </metadata>
      <criteria operator="AND" negate="false" comment="/etc/shells file must exist">
        <criterion comment="/etc/shells file must exist" test_ref="oval:mil.disa.fso.rhel:tst:152" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:156" version="1">
      <metadata>
        <title>Shell Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All shell files must have mode 0755 or less permissive</description>
      </metadata>
      <criteria>
        <criterion comment="check shell files have mode 0755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:15600" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:155" version="1">
      <metadata>
        <title>GEN002210</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All shell files must be group-owned by root, bin, or sys</description>
      </metadata>
      <criteria>
        <criterion comment="check shell files are group-owned by root, bin, or sys" test_ref="oval:mil.disa.fso.rhel:tst:15500" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:154" version="1">
      <metadata>
        <title>Shell Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All shell files must be owned by root or bin</description>
      </metadata>
      <criteria>
        <criterion comment="check shell files are owned by root or bin" test_ref="oval:mil.disa.fso.rhel:tst:15400" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.rhel:def:157" version="1">
      <metadata>
        <title>Device files and directories must only be writable by users with a system account or as configured by the vendor.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Device files and directories must only be writable by users with a system account or as configured by the vendor.</description>
      </metadata>
      <criteria>
        <criterion comment="device files not world-writable" test_ref="oval:mil.disa.fso.rhel:tst:15700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:103" version="6" class="compliance">
      <metadata>
        <title>The /etc/passwd must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3566-7" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/passwd is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:10300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:256" version="6" class="compliance">
      <metadata>
        <title>The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be owned by root or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/xinetd.conf">
          <criterion comment="Test owner of /etc/xinetd.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:25600" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/xinetd.conf is bin" test_ref="oval:mil.disa.fso.rhel:tst:25602" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/xinetd.d/*">
          <criterion comment="Test owner of /etc/xinetd.d/* is root" test_ref="oval:mil.disa.fso.rhel:tst:25603" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/xinetd.d/* is bin" test_ref="oval:mil.disa.fso.rhel:tst:25604" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:258" version="6" class="compliance">
      <metadata>
        <title>The inetd.conf and xinetd.conf files must have mode 0440 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/xinetd.conf is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:25800" />
        <criterion comment="Test mode of /etc/xinetd.d/* is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:25801" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:260" version="6" class="compliance">
      <metadata>
        <title>The services file must be owned by root or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/services">
          <criterion comment="Test owner of /etc/services is root" test_ref="oval:mil.disa.fso.rhel:tst:26000" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/services is bin" test_ref="oval:mil.disa.fso.rhel:tst:26001" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:262" version="6" class="compliance">
      <metadata>
        <title>The services file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/services is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:26200" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:276" version="6" class="compliance">
      <metadata>
        <title>The printers.conf (or equivalent) file must be owned by root</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/cups/printers.conf">
          <criterion comment="Test owner of /etc/cups/printers.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:27600" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:278" version="6" class="compliance">
      <metadata>
        <title>The hosts.lpd (or equivalent) must have mode 0664 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/hosts.lpd is 664 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:27800" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:282" version="6" class="compliance">
      <metadata>
        <title>The alias file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/aliases is root" test_ref="oval:mil.disa.fso.rhel:tst:28200" />
        <criterion comment="Test owner of /etc/aliases.db is root" test_ref="oval:mil.disa.fso.rhel:tst:28201" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:284" version="6" class="compliance">
      <metadata>
        <title>The alias file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/aliases is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:28400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:303" version="6" class="compliance">
      <metadata>
        <title>The ftpusers file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30300" />
        <criterion comment="Test owner of /etc/vsftpd.ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30301" />
        <criterion comment="Test owner of /etc/vsftpd/ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30302" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:305" version="6" class="compliance">
      <metadata>
        <title>The ftpusers file must have mode 0640 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/ftpusers is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:30500" />
        <criterion comment="Test mode of /etc/vsftpd.ftpusers is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:30501" />
        <criterion comment="Test mode of /etc/vsftpd/ftpusers is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:30502" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:366" version="6" class="compliance">
      <metadata>
        <title>The NFS export configuration file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/exports is root" test_ref="oval:mil.disa.fso.rhel:tst:36600" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:368" version="6" class="compliance">
      <metadata>
        <title>The NFS export configuration file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/exports is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:36800" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:198" version="6" class="compliance">
      <metadata>
        <title>Cron and crontab directories must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /var/spool/cron is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19800" />
        <criterion comment="Test mode of /etc/cron.d is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19801" />
        <criterion comment="Test mode of /etc/cron.daily is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19802" />
        <criterion comment="Test mode of /etc/cron.hourly is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19803" />
        <criterion comment="Test mode of /etc/cron.monthly is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19804" />
        <criterion comment="Test mode of /etc/cron.weekly is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:19805" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:199" version="6" class="compliance">
      <metadata>
        <title>Cron and crontab directories must be owned by root or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /var/spool/cron">
          <criterion comment="Test owner of /var/spool/cron is root" test_ref="oval:mil.disa.fso.rhel:tst:19900" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /var/spool/cron is bin" test_ref="oval:mil.disa.fso.rhel:tst:19901" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/cron.d">
          <criterion comment="Test owner of /etc/cron.d is root" test_ref="oval:mil.disa.fso.rhel:tst:19902" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.d is bin" test_ref="oval:mil.disa.fso.rhel:tst:19903" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/cron.daily">
          <criterion comment="Test owner of /etc/cron.daily is root" test_ref="oval:mil.disa.fso.rhel:tst:19904" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.daily is bin" test_ref="oval:mil.disa.fso.rhel:tst:19905" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/cron.hourly">
          <criterion comment="Test owner of /etc/cron.hourly is root" test_ref="oval:mil.disa.fso.rhel:tst:19906" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.hourly is bin" test_ref="oval:mil.disa.fso.rhel:tst:19907" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/cron.monthly">
          <criterion comment="Test owner of /etc/cron.monthly is root" test_ref="oval:mil.disa.fso.rhel:tst:19908" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.monthly is bin" test_ref="oval:mil.disa.fso.rhel:tst:19909" />
          </criteria>
        </criteria>
        <criteria operator="OR" comment="Test ownership of /etc/cron.weekly">
          <criterion comment="Test owner of /etc/cron.weekly is root" test_ref="oval:mil.disa.fso.rhel:tst:19910" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.weekly is bin" test_ref="oval:mil.disa.fso.rhel:tst:19911" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:202" version="6" class="compliance">
      <metadata>
        <title>The cronlog file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /var/log/cron is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:20200" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:213" version="6" class="compliance">
      <metadata>
        <title>The at.allow file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/at.allow is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:21300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:319" version="6" class="compliance">
      <metadata>
        <title>The snmpd.conf file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/snmpd.conf is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:31900" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:14" version="6" class="compliance">
      <metadata>
        <title>The /etc/access.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/login.access is root" test_ref="oval:mil.disa.fso.rhel:tst:1400" />
        <criterion comment="Test owner of /etc/security/access.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:1401" />
        <criterion comment="Test owner of /etc/access.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:1402" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:377" version="6" class="compliance">
      <metadata>
        <title>The /etc/smb.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/smb.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:37700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:379" version="6" class="compliance">
      <metadata>
        <title>The /etc/smb.conf file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/smb.conf is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:37900" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:380" version="7" class="compliance">
      <metadata>
        <title>The /etc/samba/passwd.tdb file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/samba/passwd.tdb is root" test_ref="oval:mil.disa.fso.rhel:tst:38000" />
        <criterion comment="Test owner of /etc/samba/secrets.tdb is root" test_ref="oval:mil.disa.fso.rhel:tst:38001" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:16" version="6" class="compliance">
      <metadata>
        <title>The /etc/access.conf file must have mode 0640 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/login.access is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:1600" />
        <criterion comment="Test mode of /etc/security/access.conf is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:1601" />
        <criterion comment="Test mode of /etc/access.conf is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:1602" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:381" version="12" class="compliance">
      <metadata>
        <title>The /etc/samba/passwd.tdb file must be group-owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test group of /etc/samba/passwd.tdb is root" test_ref="oval:mil.disa.fso.rhel:tst:38100" />
        <criterion comment="Test group of /etc/samba/secrets.tdb is root" test_ref="oval:mil.disa.fso.rhel:tst:38103" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:382" version="7" class="compliance">
      <metadata>
        <title>The /etc/samba/passwd.tdb file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/samba/passwd.tdb is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:38200" />
        <criterion comment="Test mode of /etc/samba/secrets.tdb is 600 or less" test_ref="oval:mil.disa.fso.rhel:tst:38201" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:446" version="2" class="compliance">
      <metadata>
        <title>The grub.conf file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3923-0" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /boot/grub/grub.conf is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:44600" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:390" version="6" class="compliance">
      <metadata>
        <title>The /etc/news/readers.conf (or equivalent) must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/news/readers.conf is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:39000" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:391" version="6" class="compliance">
      <metadata>
        <title>The /etc/news/passwd.nntp file (or equivalent) must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/news/passwd.nntp is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:39100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:17" version="6" class="compliance">
      <metadata>
        <title>The /etc/sysctl.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/sysctl.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:1700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:18" version="6" class="compliance">
      <metadata>
        <title>The /etc/sysctl.conf file must be group-owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test group of /etc/sysctl.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:1800" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:19" version="6" class="compliance">
      <metadata>
        <title>The /etc/sysctl.conf file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/sysctl.conf is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:1900" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:203" version="6" class="compliance">
      <metadata>
        <title>The cron.deny file must have mode 0700 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/cron.deny is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:20300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:205" version="6" class="compliance">
      <metadata>
        <title>The cron.allow file must be owned by root, bin, or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/cron.allow">
          <criterion comment="Test owner of /etc/cron.allow is root" test_ref="oval:mil.disa.fso.rhel:tst:20500" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.allow is bin" test_ref="oval:mil.disa.fso.rhel:tst:20501" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of user sys" test_ref="oval:mil.disa.fso.rhel:tst:27602" />
            <criterion comment="Test owner of /etc/cron.allow is sys" test_ref="oval:mil.disa.fso.rhel:tst:20502" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:220" version="6" class="compliance">
      <metadata>
        <title>The at.allow file must be owned by root, bin, or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/at.allow">
          <criterion comment="Test owner of /etc/at.allow is root" test_ref="oval:mil.disa.fso.rhel:tst:22000" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/at.allow is bin" test_ref="oval:mil.disa.fso.rhel:tst:22001" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of user sys" test_ref="oval:mil.disa.fso.rhel:tst:27602" />
            <criterion comment="Test owner of /etc/at.allow is sys" test_ref="oval:mil.disa.fso.rhel:tst:22002" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:222" version="6" class="compliance">
      <metadata>
        <title>The at.deny file must be owned by root, bin, or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/at.deny">
          <criterion comment="Test owner of /etc/at.deny is root" test_ref="oval:mil.disa.fso.rhel:tst:22200" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/at.deny is bin" test_ref="oval:mil.disa.fso.rhel:tst:22201" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of user sys" test_ref="oval:mil.disa.fso.rhel:tst:27602" />
            <criterion comment="Test owner of /etc/at.deny is sys" test_ref="oval:mil.disa.fso.rhel:tst:22202" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:280" version="6" class="compliance">
      <metadata>
        <title>The traceroute command must be group-owned by sys, bin, or root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test group ownership of /usr/sbin/traceroute">
          <criteria operator="AND">
            <criterion comment="Test existence of group sys" test_ref="oval:mil.disa.fso.rhel:tst:38101" />
            <criterion comment="Test group of /usr/sbin/traceroute is sys" test_ref="oval:mil.disa.fso.rhel:tst:28000" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of group bin" test_ref="oval:mil.disa.fso.rhel:tst:38102" />
            <criterion comment="Test group of /usr/sbin/traceroute is bin" test_ref="oval:mil.disa.fso.rhel:tst:28001" />
          </criteria>
          <criterion comment="Test group of /usr/sbin/traceroute is root" test_ref="oval:mil.disa.fso.rhel:tst:28002" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:281" version="6" class="compliance">
      <metadata>
        <title>The traceroute file must have mode 0700 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /usr/sbin/traceroute is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:28100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:324" version="6" class="compliance">
      <metadata>
        <title>The /etc/syslog.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/syslog.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:32400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:208" version="6" class="compliance">
      <metadata>
        <title>The cron.deny file must be owned by root, bin, or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test ownership of /etc/cron.deny">
          <criterion comment="Test owner of /etc/cron.deny is root" test_ref="oval:mil.disa.fso.rhel:tst:20800" />
          <criteria operator="AND">
            <criterion comment="Test existence of user bin" test_ref="oval:mil.disa.fso.rhel:tst:25601" />
            <criterion comment="Test owner of /etc/cron.deny is bin" test_ref="oval:mil.disa.fso.rhel:tst:20801" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of user sys" test_ref="oval:mil.disa.fso.rhel:tst:27602" />
            <criterion comment="Test owner of /etc/cron.deny is sys" test_ref="oval:mil.disa.fso.rhel:tst:20802" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:230" version="6" class="compliance">
      <metadata>
        <title>The kernel core dump data directory must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /var/crash is root" test_ref="oval:mil.disa.fso.rhel:tst:23000" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:23" version="6" class="compliance">
      <metadata>
        <title>The /etc/securetty file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/securetty is root" test_ref="oval:mil.disa.fso.rhel:tst:2300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:92" version="6" class="compliance">
      <metadata>
        <title>The /etc/resolv.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/resolv.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:9200" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:98" version="6" class="compliance">
      <metadata>
        <title>The /etc/nsswitch.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/nsswitch.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:9800" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:99" version="7" class="compliance">
      <metadata>
        <title>The /etc/nsswitch.conf file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="must be group owned by root, bin or sys">
        <criterion comment="Test group of /etc/nsswitch.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:9900" />
        <criterion comment="Test group of /etc/nsswitch.conf is bin" test_ref="oval:mil.disa.fso.rhel:tst:9901" />
        <criterion comment="Test group of /etc/nsswitch.conf is sys" test_ref="oval:mil.disa.fso.rhel:tst:9902" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:101" version="6" class="compliance">
      <metadata>
        <title>The /etc/passwd file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3958-6" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/passwd is root" test_ref="oval:mil.disa.fso.rhel:tst:10100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:102" version="7" class="compliance">
      <metadata>
        <title>The /etc/passwd file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR" comment="must be group owned by root, bin or sys" negate="false">
        <criterion comment="Test group of /etc/passwd is root" test_ref="oval:mil.disa.fso.rhel:tst:10200" />
        <criterion comment="Test group of /etc/passwd is bin" test_ref="oval:mil.disa.fso.rhel:tst:10201" />
        <criterion comment="Test group of /etc/passwd is sys" test_ref="oval:mil.disa.fso.rhel:tst:10202" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:104" version="6" class="compliance">
      <metadata>
        <title>The /etc/group file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3276-3" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/group is root" test_ref="oval:mil.disa.fso.rhel:tst:10400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:105" version="7" class="compliance">
      <metadata>
        <title>The /etc/group file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3495-9" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="must be owned by root, bin or sys">
        <criterion comment="Test group of /etc/group is root" test_ref="oval:mil.disa.fso.rhel:tst:10500" />
        <criterion comment="Test group of /etc/group is bin" test_ref="oval:mil.disa.fso.rhel:tst:10501" />
        <criterion comment="Test group of /etc/group is sys" test_ref="oval:mil.disa.fso.rhel:tst:10502" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:106" version="6" class="compliance">
      <metadata>
        <title>The /etc/group file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3967-7" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/group is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:10600" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:108" version="7" class="compliance">
      <metadata>
        <title>The /etc/shadow file (or equivalent) must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3988-3" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR" negate="false" comment="must be group owned by root, bin or sys">
        <criterion comment="Test group of /etc/shadow is root" test_ref="oval:mil.disa.fso.rhel:tst:10800" />
        <criterion comment="Test group of /etc/shadow is bin" test_ref="oval:mil.disa.fso.rhel:tst:10801" />
        <criterion comment="Test group of /etc/shadow is sys" test_ref="oval:mil.disa.fso.rhel:tst:10802" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:1" version="6" class="compliance">
      <metadata>
        <title>The /etc/gshadow file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4210-1" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/gshadow is root" test_ref="oval:mil.disa.fso.rhel:tst:100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:3" version="6" class="compliance">
      <metadata>
        <title>The /etc/gshadow file must have mode 0400 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-3932-1" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/gshadow is 400 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:206" version="6" class="compliance">
      <metadata>
        <title>The cron.allow file must be group-owned by root, bin, or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test group ownership of /etc/cron.allow">
          <criterion comment="Test group of /etc/cron.allow is root" test_ref="oval:mil.disa.fso.rhel:tst:20600" />
          <criteria operator="AND">
            <criterion comment="Test existence of group bin" test_ref="oval:mil.disa.fso.rhel:tst:38102" />
            <criterion comment="Test group of /etc/cron.allow is bin" test_ref="oval:mil.disa.fso.rhel:tst:20601" />
          </criteria>
          <criteria operator="AND">
            <criterion comment="Test existence of group sys" test_ref="oval:mil.disa.fso.rhel:tst:38101" />
            <criterion comment="Test group of /etc/cron.allow is sys" test_ref="oval:mil.disa.fso.rhel:tst:20602" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:207" version="6" class="compliance">
      <metadata>
        <title>The at.deny file must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/at.deny is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:20700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:231" version="6" class="compliance">
      <metadata>
        <title>The kernel core dump data directory must be group-owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test group of /var/crash is root" test_ref="oval:mil.disa.fso.rhel:tst:23100" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:232" version="6" class="compliance">
      <metadata>
        <title>The kernel core dump data directory must have mode 0700 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /var/crash is 700 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:23200" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:259" version="6" class="compliance">
      <metadata>
        <title>The xinetd.d directory must have mode 0755 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/xinetd.d is 755 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:25900" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:261" version="6" class="compliance">
      <metadata>
        <title>The services file must be group-owned by root or bin.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR" comment="Test group ownership of /etc/services">
          <criterion comment="Test group of /etc/services is root" test_ref="oval:mil.disa.fso.rhel:tst:26100" />
          <criteria operator="AND">
            <criterion comment="Test existence of group bin" test_ref="oval:mil.disa.fso.rhel:tst:38102" />
            <criterion comment="Test group of /etc/services is bin" test_ref="oval:mil.disa.fso.rhel:tst:26101" />
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:277" version="6" class="compliance">
      <metadata>
        <title>The printers.conf file must be group-owned by lp.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test group of /etc/hosts.lpd is lp" test_ref="oval:mil.disa.fso.rhel:tst:27700" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:304" version="6" class="compliance">
      <metadata>
        <title>The ftpusers file must be group-owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test group of /etc/ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30400" />
        <criterion comment="Test group of /etc/vsftpd.ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30401" />
        <criterion comment="Test group of /etc/vsftpd/ftpusers is root" test_ref="oval:mil.disa.fso.rhel:tst:30402" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:323" version="6" class="compliance">
      <metadata>
        <title>The /etc/syslog.conf file must have mode 0640 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/syslog.conf is 640 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:32300" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:344" version="6" class="compliance">
      <metadata>
        <title>The SSH public host key files must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/ssh/*key.pub is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:34400" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:345" version="6" class="compliance">
      <metadata>
        <title>The SSH private host key files must have mode 0600 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/ssh/*key is 600 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:34500" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:367" version="7" class="compliance">
      <metadata>
        <title>The NFS export configuration file must be group-owned by root, bin or sys.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="Test group of /etc/exports is root" test_ref="oval:mil.disa.fso.rhel:tst:36700" />
        <criterion comment="Test group of /etc/exports is bin" test_ref="oval:mil.disa.fso.rhel:tst:36701" />
        <criterion comment="Test group of /etc/exports is sys" test_ref="oval:mil.disa.fso.rhel:tst:36702" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:425" version="6" class="compliance">
      <metadata>
        <title>For systems using NSS LDAP, the /etc/ldap.conf (or equivalent) file must have mode 0644 or less permissive.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test mode of /etc/ldap.conf is 644 or less permissive" test_ref="oval:mil.disa.fso.rhel:tst:42500" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:426" version="6" class="compliance">
      <metadata>
        <title>For systems using NSS LDAP, the /etc/ldap.conf (or equivalent) file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /etc/ldap.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:42600" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:427" version="6" class="compliance">
      <metadata>
        <title>For systems using NSS LDAP, the /etc/ldap.conf (or equivalent) file must be group-owned by root, bin or sys</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="OR" comment="must be group-owned by root, bin or sys" negate="false">
        <criterion comment="Test group of /etc/ldap.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:42700" />
        <criterion comment="Test group of /etc/ldap.conf is bin" test_ref="oval:mil.disa.fso.rhel:tst:42701" negate="false" />
        <criterion comment="Test group of /etc/ldap.conf is sys" test_ref="oval:mil.disa.fso.rhel:tst:42702" negate="false" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.rhel:def:447" version="2" class="compliance">
      <metadata>
        <title>The grub.conf file must be owned by root.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-4144-2" />
        <description>Tests for compliance with the requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion comment="Test owner of /boot/grub/grub.conf is root" test_ref="oval:mil.disa.fso.rhel:tst:44700" />
      </criteria>
    </definition>
  </definitions>
  <tests>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46804" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46805" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46806" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46807" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46800" version="1" check="all" comment="/etc/auditd.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46801" version="1" check="all" comment="/etc/audit/auditd.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46802" version="1" check="all" comment="/etc/audit.rules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46803" version="1" check="all" comment="/etc/audit/audit.rules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46804" />
    </ind-def:textfilecontent54_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:46808" version="1" check="all" comment="check architecture is 32 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:46805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:46804" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:46809" version="1" check="all" comment="check architecture is 32/64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:46805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:46805" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:46810" version="1" check="all" comment="check architecture is 64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:46805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:46806" />
    </unix-def:uname_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46811" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46807" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46812" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46808" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46813" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46809" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46814" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46810" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46815" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46811" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46816" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46812" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46817" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46813" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46818" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46814" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46819" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46815" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46820" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46816" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46821" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46817" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46822" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46818" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46823" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46819" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46824" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46820" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46825" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46821" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46826" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46822" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46827" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46823" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46828" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46824" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46829" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46825" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46830" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46826" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46831" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46827" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46832" version="1" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46828" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46833" version="1" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46829" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46834" version="1" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46830" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46835" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46831" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46836" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46832" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46837" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46833" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:46838" version="1" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:46800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:46834" />
    </ind-def:textfilecontent54_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:49105" version="5" check="all" comment="check architecture is 32 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:49105" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:49100" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:49116" version="5" check="all" comment="check architecture is 32/64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:49105" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:49101" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:49217" version="5" check="all" comment="check architecture is 64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:49105" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:49102" />
    </unix-def:uname_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49300" version="5" check="all" comment="/etc/audit/audit.rules contains -w /sbin/insmod -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49501" version="5" check="all" comment="/etc/audit/audit.rules contains -w /sbin/rmmod -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49501" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49402" version="5" check="all" comment="/etc/audit/audit.rules contains -w /sbin/modprobe -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49402" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49103" version="5" check="all" comment="init_module / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49103" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49104" version="5" check="all" comment="init_module / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49104" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49111" version="5" check="all" comment="init_module / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49110" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49206" version="5" check="all" comment="delete_module / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49206" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49207" version="5" check="all" comment="delete_module / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49207" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49208" version="5" check="all" comment="delete_module / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49208" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49109" version="5" check="all" comment="init_module / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49109" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:49210" version="5" check="all" comment="delete_module / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:49109" />
    </ind-def:textfilecontent54_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:1100" version="3" check="all" comment="check for unnecessary privileged accounts in password">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1100" />
    </password_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:1500" version="2" check="all" comment="Test group of /etc/security/access.conf is root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1500" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1501" version="1" check="all" comment="Test group of /etc/security/access.conf  is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1502" version="1" check="all" comment="Test group of /etc/security/access.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:2000" version="2" check="all" comment="uncommented ctrlaltdel specifies /usr/bin/logger" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:2000" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:2001" version="1" check="all" comment="Commented ctrlaltdel line" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2001" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:2002" version="1" check="all" comment="no uncommented crtlaltdel lines exist" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2000" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:3000" version="5" check="all" comment="Tests if selinux is enforcing">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3000" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:3000" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:3001" version="5" check="all" comment="Tests if selinux is targeted or strict">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3001" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:3001" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:3900" version="3" check="all" comment="/etc/ntp.conf is owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:3900" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:3900" />
    </unix-def:file_test>
    <unix-def:process_test check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3700" version="8" check="all" comment="ntpd is running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:3700" />
    </unix-def:process_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3701" version="8" check="all" comment="cron.hourly has ntpd -qg">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3701" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3702" version="8" check="all" comment="cron.daily has ntpd -qg">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3702" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3703" version="8" check="all" comment="cron.d has ntpd -qg">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3703" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3704" version="8" check="all" comment="/etc/crontab has ntpd -qg">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3704" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3705" version="8" check="all" comment="/etc/crontab has ntpd -qg">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3705" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3801" version="8" check="all" comment="cron.hourly has ntpd -qg -a">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3802" version="8" check="all" comment="cron.daily has ntpd -qg -a">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3803" version="8" check="all" comment="cron.d has ntpd -qg -a">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3804" version="8" check="all" comment="/etc/crontab has ntpd -qg -a">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3804" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:3805" version="8" check="all" comment="/etc/crontab has ntpd -qg -a">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3805" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:4700" version="4" check="all" comment="maxlogins in /etc/security/limits.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:4700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:4700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:4701" version="4" check="all" comment="maxlogins in /etc/security/limits.d/*">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:4701" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:4700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:5000" version="4" check="all" comment="check system-auth pam_tally2 deny">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5000" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5000" />
    </ind-def:textfilecontent54_test>
    <ind-def:xmlfilecontent_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:5201" version="4" check="all" comment="idle_activation_enabled = true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5201" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5201" />
    </ind-def:xmlfilecontent_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:5801" version="4" check="all" comment="check the /etc/login.defs file for MD5_CRYPT_ENAB setting">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:5802" version="4" check="all" comment="check the /etc/login.defs file for ENCRYPT_METHOD setting">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:5803" version="4" check="all" comment="check the /etc/libuser.conf file for the crypt_style setting">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6400" version="4" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6700" version="2" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6700" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:6800" version="4" check="all" comment="check that the /etc/security/opasswd exists" check_existence="all_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:6800" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:6801" version="4" check="all" comment="check that remember is set appropriately in /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6801" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8400" version="2" check="all" comment="All files in system command directories" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9400" version="2" check="all" comment="Test mode of /etc/resolv.conf is 644" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:9400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9500" version="1" check="all" comment="Test owner of /etc/hosts is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9700" version="2" check="all" comment="Test mode of /etc/hosts is 644" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:9400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10000" version="2" check="all" comment="Test mode of /etc/nsswitch.conf is 644" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:9400" />
    </file_test>
    <unix-def:file_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:11100" version="1" check="all" comment="interactive user home directories must exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:11100" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12100" version="2" check="all" comment="rc scripts must be 0755" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12101" version="2" check="all" comment="rc.d scripts must be 0755" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12101" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12102" version="2" check="all" comment="init.d scripts must be 0755" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12102" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12100" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13205" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile.d/.*)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13205" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13204" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (.login)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13204" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13203" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (security/environ)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13203" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13202" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (environment)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13202" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13201" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13201" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13200" version="3" check="all" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (bashrc)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13200" />
    </textfilecontent54_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:14800" version="3" check="all" check_existence="none_exist" comment="no .netrc files">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:14800" />
    </unix-def:file_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:14900" version="3" check="all" check_existence="none_exist" comment="no .rhosts, .shosts, hosts.equiv, or shosts.equiv files">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:14900" />
    </unix-def:file_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:15000" version="3" check="all" check_existence="any_exist" comment=".rhosts, .shosts, .netrc, or hosts.equiv files have mode 0600 or less">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:14900" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:15000" />
    </unix-def:file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:16800" version="2" check="all" comment="The user default umask must be 077 in user-initialization scripts ($HOME/.*)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16800" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:16801" version="2" check="all" comment="The system default umask must be 077" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16800" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:17700" version="1" check="all" comment="disk_full_action">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:17700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:17700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:17701" version="1" check="all" comment="disk_error_action">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:17701" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:17700" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:17900" version="3" check="all" comment="space_left_action parameter SYSLOG, EXEC, or EMAIL (and not to IGNORE, SINGLE, SUSPEND, or HALT)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17900" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:17901" version="3" check="all" comment="space_left_action keyword is commented out" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17901" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:17902" version="3" check="all" comment="action_mail_acct is populated" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17902" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:17903" version="3" check="all" comment="action_mail_acct is commented out" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17903" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18100" version="1" check="all" comment="/usr/sbin/useradd">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18101" version="1" check="all" comment="/usr/sbin/groupadd">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18101" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18102" version="1" check="all" comment="/etc/passwd">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18102" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18103" version="1" check="all" comment="/etc/group">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18103" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18104" version="1" check="all" comment="/etc/shadow">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18104" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18105" version="1" check="all" comment="/etc/gshadow">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18105" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18200" version="1" check="all" comment="/usr/sbin/usermod">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18200" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18201" version="1" check="all" comment="/usr/sbin/groupmod">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18201" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18202" version="1" check="all" comment="/etc/passwd">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18202" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18203" version="1" check="all" comment="/etc/group">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18203" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18204" version="1" check="all" comment="/etc/shadow">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18204" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18205" version="1" check="all" comment="/etc/gshadow">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18205" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18300" version="1" check="all" comment="/usr/bin/passwd">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18400" version="1" check="all" comment="/usr/sbin/userdel">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18401" version="1" check="all" comment="/usr/sbin/groupdel">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18401" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18501" version="4" check="all" comment="admin / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18505" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18502" version="4" check="all" comment="admin / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18506" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18503" version="4" check="all" comment="admin / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18503" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18504" version="4" check="all" comment="admin / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18504" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18510" version="4" check="all" comment="/etc/auditd.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18510" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18511" version="4" check="all" comment="/etc/audit/auditd.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18511" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18512" version="4" check="all" comment="/etc/audit.rules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18512" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18513" version="4" check="all" comment="/etc/audit/audit.rules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18513" />
    </ind-def:textfilecontent54_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:18505" version="4" check="all" comment="check architecture is 32 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:18505" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:18500" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:18506" version="4" check="all" comment="check architecture is 32/64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:18505" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:18501" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:18507" version="4" check="all" comment="check architecture is 64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:18505" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:18502" />
    </unix-def:uname_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18600" version="4" check="all" comment="/etc/audit/audit.rules contains -w /var/log/faillog -p wa -k logins">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18601" version="4" check="all" comment="/etc/audit/audit.rules contains -w /var/log/lastlog -p wa -k logins">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18601" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18700" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18701" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18701" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18702" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18702" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18703" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18703" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18704" version="4" check="all" comment="32-bit-only dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18704" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18705" version="4" check="all" comment="32-bit-only dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18705" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18706" version="4" check="all" comment="32-bit-only dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18706" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18800" version="4" check="all" comment="/etc/audit/audit.rules contains -w /sbin/insmod -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18801" version="4" check="all" comment="/etc/audit/audit.rules contains -w /sbin/rmmod -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18802" version="4" check="all" comment="/etc/audit/audit.rules contains -w /sbin/modprobe -p x -k modules">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18803" version="4" check="all" comment="init_module / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18804" version="4" check="all" comment="init_module / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18804" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18805" version="4" check="all" comment="init_module / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18805" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18806" version="4" check="all" comment="delete_module / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18806" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18807" version="4" check="all" comment="delete_module / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18807" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18808" version="4" check="all" comment="delete_module / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18808" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18809" version="4" check="all" comment="init_module / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18809" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:18810" version="4" check="all" comment="delete_module / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18809" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:18900" version="2" check="all" check_existence="at_least_one_exists" comment="audit to syslog enabled">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18900" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:18900" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:18901" version="2" check="all" check_existence="at_least_one_exists" comment="audit enabled in kernel">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18901" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:18902" version="2" check="all" check_existence="at_least_one_exists" comment="logging to a remote server is enabled">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:18902" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19000" version="1" check="all" comment="check /etc/cron.allow existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19001" version="1" check="all" comment="check /etc/cron.deny existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19100" version="1" check="all" comment="Test mode of /etc/cron.allow is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19500" version="1" check="all" comment="check /var/spool/cron is is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19501" version="1" check="all" comment="check /etc/cron.d is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19501" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19502" version="1" check="all" comment="check /etc/crontab is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19502" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19503" version="1" check="all" comment="check /etc/cron.daily is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19503" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19504" version="1" check="all" comment="check /etc/cron.hourly is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19504" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19505" version="1" check="all" comment="check  /etc/cron.monthly is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19505" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19506" version="1" check="all" comment="check /etc/cron.weekly is group-owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19506" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19600" version="1" check="all" comment="check /etc/cron.allow existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19602" version="1" check="all" comment="check /etc/cron.deny existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19601" />
    </file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:19604" version="1" check="all" check_existence="any_exist" comment="test cron.allow for all system accounts">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:19602" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:19600" />
    </ind-def:textfilecontent54_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:19603" version="1" check="all" check_existence="none_exist" comment="all system accounts exist in deny (filtered out)">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:19603" />
    </unix-def:password_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20000" version="1" check="all" comment="/var/spool/cron directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20000" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20001" version="1" check="all" comment="/etc/cron.d directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20001" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20002" version="1" check="all" comment="/etc/crontab file group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20002" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20003" version="1" check="all" comment="/etc/cron.daily directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20003" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20004" version="1" check="all" comment="/etc/cron.hourly directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20004" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20005" version="1" check="all" comment="/etc/cron.monthly directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20005" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:20006" version="1" check="all" comment="/etc/cron.weekly directory group-owned by root/sys/bin/cron">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20006" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:20000" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:20100" version="1" check="all" comment="syslog cron path config found">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:20100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:20101" version="1" check="all" comment="syslog cron file config found">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:20101" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:20102" version="1" check="all" comment="syslog cron file exists">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:20102" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21000" version="1" check="all" comment="check /etc/at.allow existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21001" version="1" check="all" comment="check /etc/at.deny existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21001" />
    </file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:21100" version="1" check="all" check_existence="at_least_one_exists" comment="/etc/at.deny file contents">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:21100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:21200" version="1" check="all" check_existence="any_exist" comment="all default system accts except root in at.allow">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:21202" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:21202" />
    </ind-def:textfilecontent54_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:21201" version="1" check="all" check_existence="none_exist" comment="no system accounts listed in at.deny">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:21203" />
    </unix-def:password_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:21202" version="1" check="all" check_existence="none_exist" comment="at.allow has no contents">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:21202" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21600" version="1" check="all" comment="check /var/spool/cron/atjobs permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:21600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21601" version="1" check="all" comment="check /var/spool/atjobs permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21601" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:21600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21602" version="1" check="all" comment="check /var/spool/at permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21602" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:21600" />
    </file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:21800" version="2" check="all" comment="/var/spool/at directory group-owned by root/sys/bin/cron/daemon">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:21700" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:21800" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:22900" version="5" check="all" comment="kdump is enabled">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:22900" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:23300" version="1" check="all" comment="kernel.exec-shield = 1" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:23300" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:23301" version="1" check="all" comment="kernel.randomize_va_space = 1" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:23301" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:23400" version="1" check="all" comment="network interface userctl" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23400" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:23500" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/all/accept_source_route file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:23500" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:23500" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:23501" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/default/accept_source_route file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:23501" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:23500" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:23600" version="1" check="all" comment="net.ipv4.tcp_max_syn_backlog=1280" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:23600" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:23800" version="1" check="all" comment="Check icmp_echo_ignore_broadcasts in /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:23800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:23800" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24000" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:24000" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24001" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:24000" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24100" version="1" check="all" comment="net.ipv4.conf.all.proxy_arp = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:24100" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24101" version="1" check="all" comment="net.ipv4.conf.default.proxy_arp = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24101" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:24100" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24200" version="4" check="all" comment="Tests the value of the ipv4 accept_redirects">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24200" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24200" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24201" version="4" check="all" comment="Tests the value of the ipv4 accept_redirects">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24201" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24200" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24300" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/all/send_redirects file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24300" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24301" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/default/send_redirects file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24301" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24400" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/all/log_martians file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24401" version="4" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/conf/default/log_martians file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24401" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24400" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:24700" version="2" check="all" check_existence="none_exist" comment="none">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24700" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24701" version="2" check="all" check_existence="none_exist" comment="none">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24701" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24800" version="1" check="all" comment="/home mountpoint" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24800" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:24900" version="1" check="all" comment="/var mountpoint" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:24900" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25000" version="1" check="all" comment="audit dir mountpoint" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25000" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25100" version="1" check="all" comment="/tmp mountpoint" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25100" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25300" version="1" check="all" comment="local fs supports journaling" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25300" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25301" version="1" check="at least one" comment="local fs nolog" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25201" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25400" version="1" check="all" comment="check /etc/syslog.conf to verify authpriv.* or authpriv.info or authpriv.debug is found" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25400" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:25401" version="1" check="all" comment="must not negate with authpriv.none" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25401" />
    </textfilecontent54_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:25500" version="1" check="all" check_existence="none_exist" comment="xinetd not running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:25500" />
    </unix-def:process_test>
    <unix-def:xinetd_test id="oval:mil.disa.fso.rhel:tst:25501" version="1" check="at least one" check_existence="at_least_one_exists" comment="xinetd has a running service">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:25501" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:25500" />
    </unix-def:xinetd_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25700" version="1" check="all" comment="check /etc/xinetd.conf file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25701" version="1" check="all" comment="check /etc/xinetd.d directory is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25701" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25702" version="1" check="all" comment="check /etc/xinetd.d directory files are group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25702" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26317" version="6" check="all" comment="test all filenames have log_on_failure" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26310" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26316" version="6" check="all" comment="test all filenames have log_on_success" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26309" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26315" version="6" check="all" comment="test all filenames have log_type" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26308" />
    </file_test>
    <unix-def:process_test check="at least one" comment="xinetd running" version="7" id="oval:mil.disa.fso.rhel:tst:26300" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:26300" />
    </unix-def:process_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26301" version="7" check="all" comment="global log_type">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26301" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26302" version="7" check="at least one" comment="global log_on_success host">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26302" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26303" version="7" check="at least one" comment="global log_on_success pid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26302" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26301" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26304" version="7" check="at least one" comment="global log_on_success userid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26302" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26302" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26305" version="7" check="at least one" comment="global log_on_success exit">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26302" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26303" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26306" version="7" check="at least one" comment="global log_on_failure host">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26303" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26307" version="7" check="at least one" comment="global log_on_failure userid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26303" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26302" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26308" version="8" check="all" comment="local log_type">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26304" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26309" version="8" check="all" comment="local log_on_success host">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26305" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26310" version="8" check="all" comment="local log_on_success pid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26305" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26301" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26311" version="8" check="all" comment="local log_on_success userid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26305" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26302" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26312" version="8" check="all" comment="local log_on_success exit">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26305" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26303" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26313" version="8" check="all" comment="local log_on_failure host">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26306" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:26314" version="8" check="all" comment="local log_on_failure userid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:26306" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:26302" />
    </ind-def:textfilecontent54_test>
    <unix-def:runlevel_test id="oval:mil.disa.fso.rhel:tst:26400" version="2" comment="portmap not running" check="all" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:26400" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:26400" />
    </unix-def:runlevel_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:tst:26500" version="2" comment="portmap not installed" check="all" check_existence="none_exist">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:26500" />
    </lin-def:rpminfo_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26600" version="6" check="all" comment="test /etc/xinetd.d/rsh exists" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26600" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:26601" version="6" check="all" comment="test rsh set to disable=yes" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26601" />
    </textfilecontent54_test>
    <unix-def:xinetd_test id="oval:mil.disa.fso.rhel:tst:26800" version="1" comment="rlogin not enabled" check="all" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:26800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:26800" />
    </unix-def:xinetd_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:tst:26900" version="1" comment="rsh-server not installed" check="all" check_existence="none_exist">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:26900" />
    </lin-def:rpminfo_test>
    <unix-def:xinetd_test id="oval:mil.disa.fso.rhel:tst:27000" version="1" comment="rexec not enabled" check="all" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:27000" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:27000" />
    </unix-def:xinetd_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27900" version="1" check="all" comment="check /bin/traceroute is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28301" version="1" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:28301" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28300" version="1" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:28300" />
    </file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:28700" version="16" check="all" comment="alias execs 0755 or less permissive">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:28702" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:28700" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:28800" version="1" check="all" comment="Check that LogLevel is set to 9 or greater in /etc/mail/sendmail.cf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:28800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:28800" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:29000" version="2" check="all" comment="All mail log files must be owned by root" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:29000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:29000" />
    </file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:29100" version="1" check="all" comment="smtp log file perm ok">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:29102" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:29100" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29200" version="2" check="all" comment="sendmail helpfile does not exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:29200" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29300" version="2" check="all" comment="sendmail greeting has no version">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:29300" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29301" version="2" check="all" comment="postfix greeting has no version">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:29301" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29400" version="3" check="all" comment="no .forward files">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:29400" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="no '0 ForwardPath' in /etc/mail/sendmail.cf" version="3" id="oval:mil.disa.fso.rhel:tst:29401" check_existence="none_exist">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29402" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29600" version="1" check="all" comment="expn disabled">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29600" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:29600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29700" version="1" check="all" comment="vrfy disabled">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29600" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:29700" />
    </ind-def:textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29601" version="1" check="all" comment="sendmail not installed">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:29601" />
    </lin-def:rpminfo_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:32000" version="1" check="all" comment="check MIB file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:32000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:32000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:32100" version="1" check="all" comment="check snmpd.conf file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:32100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:32100" />
    </file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:32200" version="1" check="all" comment="/etc/snmpd.conf group-owned by root/sys/bin">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:32200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:32200" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:32500" version="1" check="all" comment="check /etc/syslog.conf is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:32500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:32500" />
    </file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:32600" version="4" check="all" comment="Checks for remote syslog server in /etc/syslog.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:32600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:32900" version="1" check="all" comment="Verifies that the Protocol parameter is set to the value of 2 in the /etc/ssh/ssh_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:32900" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:33300" version="1" check="all" comment="Check /etc/ssh/sshd_config file to ensure that the SSH daemon is configured to use hmac-sha1">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:33301" version="1" check="all" comment="Verifies that no disallowed Macs parameters exist in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33301" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:33400" version="2" check="all" comment="Check for the existence of aes and 3des in the ciphers listed in the ssh_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:33400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:33500" version="1" check="all" comment="Check /etc/ssh/ssh_config file for the presence of CBC ciphers">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33500" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:33501" version="1" check="all" comment="Check /etc/ssh/ssh_config file for the presence of a Cipher keyword">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33501" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:33600" version="1" check="all" comment="Check /etc/ssh/ssh_config file to ensure that the SSH client is configured to use hmac-sha1">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:33601" version="1" check="all" comment="Verifies that no disallowed Macs parameters exist in the /etc/ssh/ssh_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33601" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:34300" version="3" check="all" comment="Test that AllowGroups keyword is present ">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:34301" version="3" check="all" comment="Test that AllowGroups * not present">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34301" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:34302" version="1" check="all" comment="Test that AllowUsers keyword is present ">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34302" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:34303" version="1" check="all" comment="Test that AllowUsers * not present">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34303" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="/etc/pam.d/sshd checks access" version="2" id="oval:mil.disa.fso.rhel:tst:34304" check_existence="at_least_one_exists">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34304" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:34600" version="1" check="all" comment="Check /etc/ssh/sshd_config file to ensure that the GSSAPIAuthentication keyword is present and set to no">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34600" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:34701" version="1" check="all" comment="no GSSAPIAuthentication listed - default is no - ok" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:34700" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:34700" version="3" check="all" comment="Check /etc/ssh/ssh_config file to ensure that the GSSAPIAuthentication keyword is either not present or set to no">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:34700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:34800" version="1" check="all" comment="Check /etc/ssh/sshd_config file to ensure that the KerberosAuthentication keyword is present and set to no">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:34800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:35600" version="1" check="all" comment="Verifies that the StrictModes parameter is set to the value of yes in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:35600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:35700" version="1" check="all" comment="Verifies that the UsePrivilegeSeparation parameter is set to yes in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:35700" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:35800" version="5" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:35800" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:35900" version="3" check="all" comment="Verifies that the Compression parameter is set to no in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:35900" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:35901" version="1" check="all" comment="Verifies that the Compression parameter is set to delayed in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:35901" />
    </ind-def:textfilecontent54_test>
    <runlevel_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36201" version="6" check="all" comment="no daemons found" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36200" />
    </runlevel_test>
    <runlevel_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36200" version="7" check="all" comment="test list to see if daemons are running" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:36200" />
    </runlevel_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:36400" version="1" check="all" comment="net.ipv6.conf.all.forwarding = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:36400" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:36401" version="1" check="all" comment="net.ipv6.conf.default.forwarding = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:36400" />
    </textfilecontent54_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:36900" version="1" check="all" comment="exports owned by root" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:36901" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:36900" />
    </unix-def:file_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:37000" version="1" check="all" comment="exports growned by root,bin,sys" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:36901" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:37000" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37100" version="1" check="all" comment="nfs anonuid" check_existence="any_exist">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:37100" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:37100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37101" version="1" check="all" comment="nfs anongid" check_existence="any_exist">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:37101" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:37100" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37202" version="2" check="all" comment="test that ( must exist" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:37202" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:37200" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37201" version="2" check="all" comment="test no entries without ( exist" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:37201" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37200" version="2" check="at least one" comment="test that no entries have ' (' or '*('" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:37202" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:37201" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:37300" version="1" check="at least one" comment="nfs option no_root_squash" check_existence="at_least_one_exists">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:37201" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:37300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:37400" version="1" check="all" comment="NFS mounts with nosuid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:37400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:37400" />
    </ind-def:textfilecontent54_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:37500" version="2" comment="samba not running" check="all" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:37500" />
    </unix-def:process_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:37800" version="1" check="all" comment="/etc/samba/smb.conf group-owned by root/sys/bin/system">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:37800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:37800" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:38400" version="1" check="all" comment="Check the security mode of in /etc/samba/smb.conf - make sure it is not set to share">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:38400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:38500" version="1" check="all" comment="Check the encrypt passwords setting in /etc/samba/smb.conf to verify it is set to yes">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:38500" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:38600" version="1" check="all" comment="Check the guest ok parameter in /etc/samba/smb.conf to verify it is set to no">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:38600" />
    </ind-def:textfilecontent54_test>
    <unix-def:process_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:38700" version="2" check="all" comment="Check that innd service is not running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:38700" />
    </unix-def:process_test>
    <unix-def:process_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:38701" version="3" check="all" comment="Check that nnrpd service is not running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:38701" />
    </unix-def:process_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:39300" version="1" check="all" comment="check files in /etc/news are group-owned by root or news" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:39300" />
    </file_test>
    <unix-def:process_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:39400" version="2" check="all" comment="Check that innd service is not running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:39400" />
    </unix-def:process_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:39800" version="1" check="all" comment="tcp_wrappers installed">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:39800" />
    </lin-def:rpminfo_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:39905" version="16" check="all" comment="authpriv.info and authpriv.none not on same line" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39905" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:39904" version="16" check="all" comment="mail.* and mail.none on same line" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39904" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:39900" version="17" check="all" comment="authpriv.info logging test" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39900" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:39901" version="17" check="all" comment="mail.* logging test" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39901" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:39902" version="16" check="all" comment="mail.debug logging test" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39902" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40000" version="2" check="all" comment="test for host.deny existance and content" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40000" />
    </textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:40001" version="2" check="all" comment="test for host.allow existance" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40001" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40500" version="1" check="all" comment="appletalk not in /etc/modprobe.conf" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40500" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40501" version="1" check="all" comment="appletalk not in /etc/modprobe.d" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40501" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40503" version="2" check="all" comment="appletalk disabled in /etc/modprobe.d/*" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40501" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:40500" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40502" version="3" check="all" comment="appletalk disabled in /etc/modprobe.conf" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:40500" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40901" version="2" check="all" comment="bluetooth disabled in /etc/modprobe.d/*" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40901" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40900" version="2" check="all" comment="bluetooth disabled in /etc/modprobe.conf" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:40900" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:41000" version="1" check="all" comment="test for networking_ivp6=no" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:41000" />
    </textfilecontent54_test>
    <unix-def:process_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:41400" version="1" check="all" comment="Check that miredo service is not running">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:41400" />
    </unix-def:process_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:41700" version="2" check="all" comment="Check the do-forward-updates setting in /etc/dhclient.conf to verify it is set to false">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:41700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:41700" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:41800" version="1" check="all" comment="net.ipv6.conf.all.accept_redirects = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:41800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:41800" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:41801" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects = 0" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:41801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:41800" />
    </textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42000" version="1" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:42000" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:42200" version="2" check="all" comment="tls_checkpeer is enabled" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42200" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:42201" version="2" check="all" comment="system uses NSS LDAP" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42201" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:42300" version="1" check="all" comment="Check for ldap entries in /etc/nsswitch.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:42300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:42301" version="1" check="all" comment="Check for tls_check entry in /etc/ldap.conf">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:42301" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:42400" version="1" check="all" comment="no bindpw in ldap.conf" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42400" />
    </textfilecontent54_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42800" version="1" check="all" comment="CA cert file owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42802" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42800" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42801" version="1" check="all" comment="CA cert file dir owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42803" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42800" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42802" version="1" check="all" comment="CA cert dir owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42800" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42803" version="1" check="all" comment="CA cert dir files owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42806" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42800" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42900" version="2" check="all" comment="CA cert file group-owned by root, bin or sys">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42802" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42900" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42901" version="2" check="all" comment="CA cert file group-owned by root, bin or sys">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42803" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42900" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42902" version="2" check="all" comment="CA cert dir group-owned by root, bin or sys">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42900" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:42903" version="1" check="all" comment="CA cert dir files group-owned by root, bin or sys">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42806" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:42900" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43000" version="1" check="all" comment="CA cert file perms 0644">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42802" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43001" version="1" check="all" comment="CA cert file dir perms 0755">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42803" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43002" version="1" check="all" comment="CA cert dir perms 0755">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42805" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43003" version="1" check="all" comment="CA cert dir files perms 0644">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:42806" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43000" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43100" version="1" check="all" comment="TLS cert file owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43102" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43100" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43200" version="1" check="all" comment="TLS cert file group-owned by root, bin, sys, or system">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43102" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43200" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43300" version="1" check="all" comment="TLS cert file with 0644 perms">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43102" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43300" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43400" version="1" check="all" comment="TLS key file owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43402" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43400" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43500" version="2" check="all" comment="Test TLS key file is group-owned by root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43502" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:43501" version="1" check="all" comment="Test TLS key file is group-owned by bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43502" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:43502" version="1" check="all" comment="Test TLS key file is group-owned by sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43502" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:43600" version="1" check="all" comment="TLS key file with 0600 perms">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43402" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43600" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:43700" version="1" check="all" comment="check exec-shield existence" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43700" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:43701" version="1" check="all" comment="/proc/sys/kernel/exec-shield" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43701" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:43700" />
    </textfilecontent54_test>
    <unix-def:runlevel_test id="oval:mil.disa.fso.rhel:tst:43800" version="1" comment="autofs not running" check="all" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:43800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:43800" />
    </unix-def:runlevel_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:43900" version="1" check="at least one" comment="check USB storage /etc/modprobe.conf" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43900" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:43901" version="1" check="at least one" comment="check USB storage /etc/modprobe.d/*" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:43901" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:44000" version="1" check="at least one" comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.conf" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44000" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:44001" version="1" check="at least one" comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.d/*" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44001" />
    </textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:44300" version="1" check="all" comment="grub installed" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44300" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:44500" version="1" check="all" comment="all grub passwords encrypted with md5" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:44500" />
    </textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:tst:45400" version="2" comment="inn installed (news acct necessary)" check="all" check_existence="at_least_one_exists">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:45400" />
    </lin-def:rpminfo_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:45401" version="2" comment="no news acct in passwd" check="all" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:45401" />
    </unix-def:password_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:45501" version="1" comment="no gopher acct in passwd" check="all" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:45501" />
    </unix-def:password_test>
    <unix-def:shadow_test id="oval:mil.disa.fso.rhel:tst:45502" version="1" comment="no gopher acct in shadow" check="all" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:45502" />
    </unix-def:shadow_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:45602" version="2" comment="no ftp acct in passwd" check="all" check_existence="none_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:45602" />
    </unix-def:password_test>
    <ind-def:xmlfilecontent_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:5200" version="4" check="all" comment="idle_timeout &lt;= 15, not 0">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5200" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5200" />
    </ind-def:xmlfilecontent_test>
    <ind-def:xmlfilecontent_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:5202" version="4" check="all" comment="lock_enabled = true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5202" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5202" />
    </ind-def:xmlfilecontent_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46100" version="6" check="all" comment="Audit failed file and program access attempts (success=0 b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46100" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46101" version="6" check="all" comment="Audit failed file and program access attempts (success=0 b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46101" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46102" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46102" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46103" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46103" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46104" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46104" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46105" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46105" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46106" version="6" check="all" comment="Audit failed file and program access attempts (success=0 processor type)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46106" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46107" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EPERM processor type)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46107" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46108" version="6" check="all" comment="Audit failed file and program access attempts (exit=-EACCES processor type)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46108" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46200" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46200" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46201" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46201" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46202" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46202" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46203" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46203" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46204" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46204" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46205" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46205" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46300" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46300" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46301" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46301" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46302" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46302" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46303" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46303" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46304" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46304" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46305" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46305" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46400" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46400" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46401" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46401" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46402" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46402" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46403" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46403" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46404" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46404" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46405" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46405" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46500" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46500" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46501" version="1" check="all" comment="Audit failed file and program access attempts (success=0 b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46501" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46502" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46502" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46503" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EPERM b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46503" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46504" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b32)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46504" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46505" version="1" check="all" comment="Audit failed file and program access attempts (exit=-EACCES b64)" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46505" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46600" version="1" check="all" comment="Enable auditing of deletions" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46600" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:46700" version="1" check="all" comment="Enable auditing of deletions" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:46700" />
    </textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47800" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47801" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47802" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47802" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47803" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47803" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47804" version="4" check="all" comment="32-bit-only dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47804" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47805" version="4" check="all" comment="32-bit-only dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47805" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47806" version="4" check="all" comment="32-bit-only dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47806" />
    </ind-def:textfilecontent54_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:47807" version="9" check="all" comment="check architecture is 32 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:47800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:47807" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:47808" version="9" check="all" comment="check architecture is 32/64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:47800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:47808" />
    </unix-def:uname_test>
    <unix-def:uname_test id="oval:mil.disa.fso.rhel:tst:47809" version="9" check="all" comment="check architecture is 64 bit">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:47800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:47809" />
    </unix-def:uname_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47810" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47810" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47811" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47811" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47812" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47812" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47813" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47813" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47814" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47814" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47815" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47815" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47816" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47816" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47817" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47817" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47818" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47818" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47819" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47819" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47820" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47820" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47821" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47821" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47822" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47822" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47823" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47823" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47824" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47824" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47825" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47825" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47826" version="4" check="all" comment="32-bit-only dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47826" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47827" version="4" check="all" comment="32-bit-only dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47827" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47828" version="4" check="all" comment="32-bit-only dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47828" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47829" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47829" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47830" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47830" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47831" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47831" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47832" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47832" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47833" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47833" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47834" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47834" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47835" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47835" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47836" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47836" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47837" version="4" check="all" comment="32-bit-only dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47837" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47838" version="4" check="all" comment="32-bit-only dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47838" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47839" version="4" check="all" comment="32-bit-only dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47839" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47840" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47840" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47841" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47841" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47842" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47842" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47843" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47843" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47844" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47844" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47845" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47845" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47846" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47846" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47847" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47847" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47848" version="4" check="all" comment="dac / no arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47848" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47849" version="4" check="all" comment="dac / b32">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47849" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47850" version="4" check="all" comment="dac / arch">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47850" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47851" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47851" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47852" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47852" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47853" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47853" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47854" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47854" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47855" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47855" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47856" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47856" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47857" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47857" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47858" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47858" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47859" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47859" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47860" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47860" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47861" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47861" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47862" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47862" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:47863" version="4" check="all" comment="dac / b64">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:47801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:47863" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49600" version="1" check="all" comment="Test mode of /var/spool/cron/* is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49601" version="1" check="all" comment="Test mode of /etc/cron.d/* is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49601" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49602" version="1" check="all" comment="Test mode of /etc/crontab is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49602" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49700" version="1" check="all" comment="Test mode of /etc/cron.daily/* is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49701" version="1" check="all" comment="Test mode of /etc/cron.hourly/* is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49701" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49702" version="1" check="all" comment="Test mode of /etc/cron.monthly/* is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49702" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:49703" version="1" check="all" comment="Test mode of /etc/cron.weekly/* is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:49703" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:49700" />
    </file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:4400" version="3" check="all" comment="/etc/issue contains warning banner">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:4400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:7800" version="3" check="all" check_existence="any_exist" comment="/etc/securetty has only one entry and it is valid">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:7800" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:7800" />
    </ind-def:textfilecontent54_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1200" version="2" comment="check for audit" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1200" />
    </unix-def:process_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1201" version="2" comment="check for auth" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1201" />
    </unix-def:process_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1202" version="2" comment="check for -s" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1202" />
    </unix-def:process_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1300" version="2" comment="check for ac" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1300" />
    </unix-def:process_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1301" version="2" comment="check for core" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1301" />
    </unix-def:process_test>
    <unix-def:process_test id="oval:mil.disa.fso.rhel:tst:1302" version="2" comment="check for nolock" check_existence="any_exist" check="all">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:1200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:1302" />
    </unix-def:process_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:7000" version="1" check="all" check_existence="any_exist" comment="all UID 0s are root">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:7001" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:7000" />
    </unix-def:password_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:7200" version="2" check="all" check_existence="any_exist" comment="root home dir is /">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:7200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:7200" />
    </unix-def:password_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:7201" version="2" check="all" check_existence="any_exist" comment="root home dir is 0700">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:7201" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:7201" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:7400" version="2" check="all" check_existence="any_exist" comment="root default search path">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:7400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:7400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:7500" version="2" check="all" check_existence="none_exist" comment="root default library search path">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:7500" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:7600" version="2" check="all" check_existence="none_exist" comment="root default library preload list">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:7600" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:7700" version="3" check="all" check_existence="any_exist" comment="root exec search directories not world writable">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:7701" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:7700" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8900" version="1" check="all" comment="check /usr/lib permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8901" version="1" check="all" comment="check /lib permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8901" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9000" version="1" check="all" comment="Default comment, please change" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:9000" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:11200" version="1" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:11200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:11200" />
    </password_test>
    <ind-def:variable_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:12400" version="2" check="all" check_existence="any_exist" comment="run control scripts library preload list ok">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:12401" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:12400" />
    </ind-def:variable_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:12401" version="2" check="all" check_existence="none_exist" comment="no run control scripts library preload lists">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:12400" />
    </ind-def:textfilecontent54_test>
    <ind-def:variable_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13600" version="2" check="all" check_existence="any_exist" comment="global init default search path ok">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:13601" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:13600" />
    </ind-def:variable_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13601" version="2" check="all" check_existence="none_exist" comment="no global init default search paths">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:13600" />
    </ind-def:textfilecontent54_test>
    <ind-def:variable_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13602" version="2" check="all" check_existence="any_exist" comment="global init default search path ok">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:13603" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:13600" />
    </ind-def:variable_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:13603" version="2" check="all" check_existence="none_exist" comment="no global init default search paths">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:13602" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:16000" version="1" check="all" comment="check /dev/audio is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:16001" version="1" check="all" comment="check /dev/snd is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:16100" version="1" check="all" comment="check /dev/audio is group-owned by root, sys, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:16101" version="1" check="all" comment="check /dev/snd is group-owned by root, sys, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:16100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:15900" version="1" check="all" comment="check /dev/audio permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:15901" version="1" check="all" comment="check /dev/snd permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:16001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17100" version="1" check="all" comment="check system audit logs are owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17200" version="1" check="all" comment="check system audit logs are group-owned by root, sys, or bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17300" version="1" check="all" comment="check system audit logs permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17400" version="1" check="all" comment="check /sbin/auditctl is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17401" version="1" check="all" comment="check /sbin/auditd is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17402" version="1" check="all" comment="check /sbin/ausearch is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17402" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17403" version="1" check="all" comment="check /sbin/aureport is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17403" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17404" version="1" check="all" comment="check /sbin/autrace is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17404" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17405" version="1" check="all" comment="check /sbin/audispd is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17405" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17500" version="1" check="all" comment="check /sbin/auditctl is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17501" version="1" check="all" comment="check /sbin/auditd is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17502" version="1" check="all" comment="check /sbin/ausearch is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17402" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17503" version="1" check="all" comment="check /sbin/aureport is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17403" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17504" version="1" check="all" comment="check /sbin/autrace is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17404" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17505" version="1" check="all" comment="check /sbin/audispd is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17405" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17600" version="1" check="all" comment="check /sbin/auditctl permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17601" version="1" check="all" comment="check /sbin/auditd permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17602" version="1" check="all" comment="check /sbin/ausearch permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17402" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17603" version="1" check="all" comment="check /sbin/aureport permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17403" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17604" version="1" check="all" comment="check /sbin/autrace permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17404" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:17605" version="1" check="all" comment="check /sbin/audispd permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:17405" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:17600" />
    </file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:5600" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5600" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6200" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6200" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6200" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6100" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6100" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6600" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6600" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6600" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40200" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.conf for line install dccp /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40200" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40201" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.d/* for line install dccp /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40201" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40100" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.conf for line install sctp /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40101" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.d/* for line install sctp /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40101" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40700" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.conf for line install rds /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40701" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.d/* for line install rds /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40701" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40800" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.conf for line install tipc /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:40801" check_existence="at_least_one_exists" version="1" check="all" comment="Check /etc/modprobe.d/* for line install tipc /bin/true">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:40801" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:10700" version="1" check="all" comment="Testing user ownership of /etc/shadow">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:10700" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:10700" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:200" version="1" check="all" comment="Testing gshadow ownership">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:200" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:200" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:10900" version="1" check="all" comment="Testing file permissions of /etc/shadow">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:10700" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:10900" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:22400" version="1" check="all" comment="Tests the value of the ^[ &#x9;&#xA;&#xD;]*\*[ &#x9;&#xA;&#xD;]+hard[ &#x9;&#xA;&#xD;]+core[ &#x9;&#xA;&#xD;]+([0-9]+) setting in the /etc/security/limits.conf file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:22400" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:22400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:6900" version="1" check="all" comment="Tests the value of the &lt;:begin:&gt;auth[ &#x9;&#xA;&#xD;]+required[ &#x9;&#xA;&#xD;]+pam_wheel.so[ &#x9;&#xA;&#xD;]+use_uid&lt;:end:&gt; setting in the /etc/pam.d/su file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6900" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:5601" version="1" check="all" comment="Tests the value of the PASS_MIN_LEN[ &#x9;&#xA;&#xD;]*=[ &#x9;&#xA;&#xD;]*(.*) expression in the /etc/login.defs file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:5601" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:5600" />
    </ind-def:textfilecontent54_test>
    <unix-def:shadow_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:5400" version="1" check="all" comment="Tests the value of the minimum pw age for each account">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:6501" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:5400" />
    </unix-def:shadow_test>
    <unix-def:shadow_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:5401" version="1" check="all" comment="Tests the value of the minimum pw age for each account">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:6501" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:5401" />
    </unix-def:shadow_test>
    <unix-def:shadow_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:6500" version="1" check="all" comment="password lifetime for all non-locked users must be 60 days or less">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:6501" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:6500" />
    </unix-def:shadow_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6000" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6000" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6000" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:6300" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:6300" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:6300" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:11500" version="1" check="all" comment="home directories are group writeable">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:11500" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:11500" />
    </unix-def:file_test>
    <unix-def:file_test check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:44800" version="1" check="all" comment="Testing group ownership">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:44800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:44800" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:44400" version="2" check="all" comment="Tests for the password entry in the /boot.grub/grub.conf file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:44400" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:3100" version="1" check="all" comment="Tests the value of the ~~:S:wait:/sbin/sulogin setting in the /etc/inittab file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:3100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:36300" version="1" check="all" comment="Tests the value of the ^[ &#x9;&#xA;&#xD;]*net\.ipv4\.ip_forward[ &#x9;&#xA;&#xD;]*=([ &#x9;&#xA;&#xD;]*) expression in the /etc/sysctl.conf file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:36300" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:36300" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:23700" version="1" check="all" comment="Tests the value of the /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:23700" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:23700" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:24500" version="1" check="all" comment="Tests the contents of the /proc/sys/net/ipv4/tcp_syncookies file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:24500" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:24500" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:41100" version="1" check="all" comment="install ipv6 /bin/true in /etc/modprobe.conf" check_existence="at_least_one_exists">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:41100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:41101" version="1" check="all" comment="install ipv6 /bin/true in /etc/modprobe.d/*" check_existence="at_least_one_exists">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:41101" />
    </ind-def:textfilecontent54_test>
    <unix-def:runlevel_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:44102" version="1" check="all" comment="iptables starts in runlevel 2">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:44102" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:44100" />
    </unix-def:runlevel_test>
    <unix-def:runlevel_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:44103" version="1" check="all" comment="iptables starts in runlevel 3">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:44103" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:44100" />
    </unix-def:runlevel_test>
    <unix-def:runlevel_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:44104" version="1" check="all" comment="iptables starts in runlevel 4">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:44104" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:44100" />
    </unix-def:runlevel_test>
    <unix-def:runlevel_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:44105" version="1" check="all" comment="iptables starts in runlevel 5">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:44105" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:44100" />
    </unix-def:runlevel_test>
    <unix-def:process_test check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:17000" version="1" check="all" comment="auditd process">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:17000" />
    </unix-def:process_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:2600" version="1" check="all" comment="check for audit=1 in /proc/cmdline">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:2600" />
    </ind-def:textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:26700" version="1" check="all" comment="The rsh-server package should be installed or not as appropriate">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:26700" />
    </lin-def:rpminfo_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:32800" version="1" check="all" comment="Tests the value of the Protocol[ &#x9;&#xA;&#xD;]&lt;:nocomment:&gt;1 setting in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:32800" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:8000" version="1" check="all" comment="Tests the value of the PermitRootLogin[ &#x9;&#xA;&#xD;]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:8000" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:36100" version="1" check="all" comment="Tests the content of the referenced banner file.">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:36102" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:33100" version="1" check="all" comment="Check value of Ciphers in /etc/ssh/sshd_config">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:33100" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:33100" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:7900" version="1" check="none satisfy" check_existence="any_exist" comment="root shell is in / fs">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:7900" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:7900" />
    </ind-def:textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:3200" version="1" check="all" comment="check for redhat 5">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:3200" />
      <lin-def:state state_ref="oval:mil.disa.fso.rhel:ste:3200" />
    </lin-def:rpminfo_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12900" version="2" check="all" comment="check /etc/csh.cshrc file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12901" version="2" check="all" comment="check /etc/profile file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12901" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12902" version="2" check="all" comment="check /etc/bashrc file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12902" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12903" version="2" check="all" comment="check /etc/environment file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12903" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12904" version="2" check="all" comment="check /etc/csh.login file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12904" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12905" version="2" check="all" comment="check /etc/csh.logout file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12905" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12906" version="2" check="all" comment="check /etc/ksh.kshrc file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12906" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12907" version="2" check="all" comment="check /etc/suid_profile file permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12907" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12909" version="2" check="all" comment="check /etc/profile.d directory files permissions" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12909" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12900" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13000" version="2" check="all" comment="check /etc/csh.cshrc file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13001" version="2" check="all" comment="check /etc/profile file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12901" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13002" version="2" check="all" comment="check /etc/bashrc file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12902" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13003" version="2" check="all" comment="check /etc/environment file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12903" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13004" version="2" check="all" comment="check /etc/csh.login file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12904" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13005" version="2" check="all" comment="check /etc/csh.logout file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12905" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13006" version="2" check="all" comment="check /etc/ksh.kshrc file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12906" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13007" version="2" check="all" comment="check /etc/suid_profile file is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12907" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13008" version="2" check="all" comment="check /etc/profile.d directory is owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12908" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13009" version="2" check="all" comment="check /etc/profile.d directory files are owned by root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12909" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13000" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13100" version="2" check="all" comment="check /etc/csh.cshrc file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13101" version="2" check="all" comment="check /etc/profile file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12901" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13102" version="2" check="all" comment="check /etc/bashrc file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12902" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13103" version="2" check="all" comment="check /etc/environment file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12903" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13104" version="2" check="all" comment="check /etc/csh.login file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12904" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13105" version="2" check="all" comment="check /etc/csh.logout file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12905" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13106" version="2" check="all" comment="check /etc/ksh.kshrc file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12906" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13107" version="2" check="all" comment="check /etc/suid_profile file is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12907" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13108" version="2" check="all" comment="check /etc/profile.d directory is group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12908" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13109" version="2" check="all" comment="check /etc/profile.d directory files are group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12909" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13100" />
    </file_test>
    <ind-def:variable_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:14200" version="2" check="all" check_existence="any_exist" comment="local init default search path ok">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:14201" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:14200" />
    </ind-def:variable_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:14201" version="2" check="all" check_existence="none_exist" comment="no local init default search paths">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:14200" />
    </ind-def:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:15100" version="1" check="all" comment="The .rhosts file must not be supported in PAM" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:15100" />
    </textfilecontent54_test>
    <unix-def:xinetd_test id="oval:mil.disa.fso.rhel:tst:30800" version="2" check="all" check_existence="any_exist" comment="xinetd gssftp umask 077">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:30800" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:30800" />
    </unix-def:xinetd_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:30801" version="2" check="all" check_existence="any_exist" comment="vsftpd no bad anon umask">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:30801" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:30801" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:30802" version="2" check="all" check_existence="any_exist" comment="vsftpd no bad local umask">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:30802" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:30801" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:2400" version="2" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:2400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:4100" version="3" check="all" comment="ntp.conf 0640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:4100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:4100" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:5700" version="2" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:5700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:5700" />
    </password_test>
    <shadow_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:5701" version="2" check="all" comment="Default comment, please change" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:5701" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:5701" />
    </shadow_test>
    <shadow_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:5900" version="3" check="all" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:5900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:5900" />
    </shadow_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:5901" version="3" check="all" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:5901" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:5901" />
    </password_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:11300" version="3" check="all" comment="all /etc/group hashes disabled" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:11300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:11300" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:11400" version="3" check="all" comment="gshadow entries" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:11400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:11400" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:31600" version="4" check="all" comment="Checking for v1, v2c, community or com2sec references" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:31600" />
    </textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:4601" version="4" check="all" comment="VSFTP not installed">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:4603" />
    </lin-def:rpminfo_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:4602" version="4" check="all" comment="gssftp not installed">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:4604" />
    </unix-def:file_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:4603" version="4" check="all" comment="gssftp warning banner">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:4605" />
    </ind-def:textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29900" version="6" check="all" comment="sendmail not installed">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:29900" />
    </lin-def:rpminfo_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29901" version="6" check="all" comment="sendmail DaemonPortOptions">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29901" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:29901" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29902" version="7" check="all" comment="no sendmail promisc_relay">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29902" />
    </ind-def:textfilecontent54_test>
    <lin-def:rpminfo_test xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:29903" version="6" check="all" comment="postfix not installed">
      <lin-def:object object_ref="oval:mil.disa.fso.rhel:obj:29903" />
    </lin-def:rpminfo_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29904" version="6" check="all" comment="postfix inet_interfaces">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29904" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:29902" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29905" version="6" check="all" comment="postfix smtpd_client_restrictions has reject">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29905" />
    </ind-def:textfilecontent54_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:29906" version="6" check="none satisfy" comment="postfix smtpd_client_restrictions no permit before reject">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:29905" />
      <ind-def:state state_ref="oval:mil.disa.fso.rhel:ste:29903" />
    </ind-def:textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12601" version="1" check="all" comment="All system start-up files must be owned by root or bin. (/etc/rc*)" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12601" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:12701" version="1" check="all" comment="All system start-up files must be owned by a system group." check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:12701" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:12700" />
    </file_test>
    <unix-def:password_test check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:30600" version="1" check="all" comment="ftp account has appropriate shell">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:30600" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:30600" />
    </unix-def:password_test>
    <unix-def:xinetd_test id="oval:mil.disa.fso.rhel:tst:31400" version="1" comment="uucp is not enabled" check="all" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:31400" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:31400" />
    </unix-def:xinetd_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:5500" version="3" check="all" comment="The system must not have accounts configured with blank or null passwords" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:5500" />
    </textfilecontent54_test>
    <unix-def:password_test id="oval:mil.disa.fso.rhel:tst:7100" version="1" check="all" check_existence="any_exist" comment="root home dir is not /">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:7100" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:7100" />
    </unix-def:password_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check_existence="any_exist" id="oval:mil.disa.fso.rhel:tst:4300" version="1" check="all" comment="check for unnecessary privileged accounts">
      <object object_ref="oval:mil.disa.fso.rhel:obj:4300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:4300" />
    </password_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:8700" version="3" check="all" comment="check /var/log permissions" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:8703" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:8700" />
    </unix-def:file_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:8701" version="3" check="all" comment="check /var/log/syslog permissions" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:8701" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:8700" />
    </unix-def:file_test>
    <unix-def:file_test id="oval:mil.disa.fso.rhel:tst:8702" version="3" check="all" comment="check /var/adm permissions" check_existence="any_exist">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:8702" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:8700" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13500" version="2" check="all" comment="All skeleton files must be group-owned by root, bin, sys, system, or other." check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13400" version="2" check="all" comment="All skeleton files and directories must be owned by root or bin." check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:13300" version="2" check="all" comment="All skeleton files must have mode 0644 or less permissive." check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:13300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:13300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9100" version="1" check="all" comment="The NIS/NIS+/yp command files must have mode 0755 or less permissive." check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:9100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8500" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/etc)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8501" version="2" check="all" comment="System files and directories under /etc" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8501" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8502" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8502" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8503" version="2" check="all" comment="System files and directories under /bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8503" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8504" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8504" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8505" version="2" check="all" comment="System files and directories under /sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8505" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8506" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/usr/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8506" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8507" version="2" check="all" comment="System files and directories under /usr/bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8507" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8508" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/usr/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8508" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8509" version="2" check="all" comment="System files and directories under /usr/sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8509" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8510" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/usr/local/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8510" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8511" version="2" check="all" comment="System files and directories under /usr/local/bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8511" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8512" version="2" check="all" comment="All system files, programs, and directories must be owned by a system account (/usr/local/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8512" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8513" version="2" check="all" comment="System files and directories under /usr/local/sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8513" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8600" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/etc)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8601" version="2" check="all" comment="System files and directories under /etc" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8501" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8602" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8502" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8603" version="2" check="all" comment="System files and directories under /bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8503" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8604" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8504" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8605" version="2" check="all" comment="System files and directories under /sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8505" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8606" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/usr/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8506" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8607" version="2" check="all" comment="System files and directories under /usr/bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8507" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8608" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/usr/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8508" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8609" version="2" check="all" comment="System files and directories under /usr/sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8509" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8610" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/usr/local/bin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8510" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8611" version="2" check="all" comment="System files and directories under /usr/local/bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8511" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8612" version="2" check="all" comment="System files, programs, and directories must be group-owned by a system group (/usr/local/sbin)" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8512" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:8613" version="2" check="all" comment="System files and directories under /usr/local/sbin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:8513" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:8600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30100" version="2" check="all" comment="check /etc/ftpusers existence existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30101" version="2" check="all" comment="check /etc/vsftpd.ftpusers existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30101" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30102" version="2" check="all" comment="check /etc/vsftpd/ftpusers existence" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30102" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30103" version="2" check="all" comment="check /etc/xinetd.d/gssftp existence" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30103" />
    </file_test>
    <rpminfo_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:tst:30104" version="2" check="all" comment="vsftpd not installed" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30104" />
    </rpminfo_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:30105" version="2" check="all" comment="vsftpd disabled" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30105" />
    </textfilecontent54_test>
    <process_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30106" version="2" check="all" comment="vsftpd not running" check_existence="none_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30106" />
    </process_test>
    <ind-def:textfilecontent54_test xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check_existence="all_exist" id="oval:mil.disa.fso.rhel:tst:31000" version="2" check="all" comment="Check for server_args = -s in /etc/xinetd.d/tftp">
      <ind-def:object object_ref="oval:mil.disa.fso.rhel:obj:31000" />
    </ind-def:textfilecontent54_test>
    <unix-def:file_test check_existence="none_exist" id="oval:mil.disa.fso.rhel:tst:31001" version="2" check="all" comment="no TFTP via XINETD">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:31001" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:31100" version="2" check="all" comment="TFTP daemon must have mode 0755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:31100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:31100" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:11000" version="3" check="all" comment="All users must be assigned a home directory in the /etc/password file." check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:11000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:11000" />
    </password_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:152" version="1" check="all" comment="/etc/shells file must exist" check_existence="all_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:15200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:15400" version="1" check="all" comment="check shell files are owned by root or bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:15400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15400" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:15500" version="1" check="all" comment="check shell files are group-owned by root, bin, or sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:15400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:15600" version="1" check="all" comment="check shell files have mode 0755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:15400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:15600" />
    </file_test>
    <unix-def:file_test check_existence="at_least_one_exists" id="oval:mil.disa.fso.rhel:tst:15700" version="1" check="all" comment="device files not world-writable">
      <unix-def:object object_ref="oval:mil.disa.fso.rhel:obj:15701" />
      <unix-def:state state_ref="oval:mil.disa.fso.rhel:ste:15703" />
    </unix-def:file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10300" version="6" check="all" comment="Test mode of /etc/passwd is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25600" version="6" check="all" comment="Test owner of /etc/xinetd.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25601" version="6" check="all" comment="Test existence of user bin" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25601" />
    </password_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25602" version="6" check="all" comment="Test owner of /etc/xinetd.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25603" version="6" check="all" comment="Test owner of /etc/xinetd.d/* is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25602" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25604" version="6" check="all" comment="Test owner of /etc/xinetd.d/* is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25602" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25800" version="6" check="all" comment="Test mode of /etc/xinetd.conf is 440 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25801" version="6" check="all" comment="Test mode of /etc/xinetd.d/* is 440 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25602" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26000" version="6" check="all" comment="Test owner of /etc/services is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26001" version="6" check="all" comment="Test owner of /etc/services is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26200" version="6" check="all" comment="Test mode of /etc/services is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27600" version="6" check="all" comment="Test owner of /etc/cups/printers.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27601" version="6" check="all" comment="Test owner of /etc/cups/printers.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27602" version="6" check="all" comment="Test existence of user sys" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27601" />
    </password_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21703" version="6" check="all" comment="Test existence of user daemon" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21701" />
    </password_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27603" version="6" check="all" comment="Test owner of /etc/cups/printers.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27600" />
    </file_test>
    <password_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27604" version="6" check="all" comment="Test existence of user lp" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27602" />
    </password_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27605" version="6" check="all" comment="Test owner of /etc/hosts.lpd is lp" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27800" version="6" check="all" comment="Test mode of /etc/hosts.lpd is 664 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28200" version="6" check="all" comment="Test owner of /etc/mail/aliases is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28201" version="6" check="all" comment="Test owner of /etc/mail/aliases.db is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28201" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28400" version="6" check="all" comment="Test mode of /etc/aliases is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30300" version="6" check="all" comment="Test owner of /etc/ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30301" version="6" check="all" comment="Test owner of /etc/vsftpd.ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30302" version="6" check="all" comment="Test owner of /etc/vsftpd/ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30302" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30500" version="6" check="all" comment="Test mode of /etc/ftpusers is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30501" version="6" check="all" comment="Test mode of /etc/vsftpd.ftpusers is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30502" version="6" check="all" comment="Test mode of /etc/vsftpd/ftpusers is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30302" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36600" version="6" check="all" comment="Test owner of /etc/exports is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36800" version="6" check="all" comment="Test mode of /etc/exports is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19800" version="6" check="all" comment="Test mode of /var/spool/cron is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19801" version="6" check="all" comment="Test mode of /etc/cron.d is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19802" version="6" check="all" comment="Test mode of /etc/cron.daily is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19803" version="6" check="all" comment="Test mode of /etc/cron.hourly is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19804" version="6" check="all" comment="Test mode of /etc/cron.monthly is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19805" version="6" check="all" comment="Test mode of /etc/cron.weekly is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19900" version="6" check="all" comment="Test owner of /var/spool/cron is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19901" version="6" check="all" comment="Test owner of /var/spool/cron is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19902" version="6" check="all" comment="Test owner of /etc/cron.d is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19903" version="6" check="all" comment="Test owner of /etc/cron.d is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19904" version="6" check="all" comment="Test owner of /etc/cron.daily is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19905" version="6" check="all" comment="Test owner of /etc/cron.daily is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19906" version="6" check="all" comment="Test owner of /etc/cron.hourly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19907" version="6" check="all" comment="Test owner of /etc/cron.hourly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19908" version="6" check="all" comment="Test owner of /etc/cron.monthly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19909" version="6" check="all" comment="Test owner of /etc/cron.monthly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19910" version="6" check="all" comment="Test owner of /etc/cron.weekly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:19911" version="6" check="all" comment="Test owner of /etc/cron.weekly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:38101" version="6" check="all" comment="Test existence of group sys" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38100" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:tst:38102" version="6" check="all" comment="Test existence of group bin" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38102" />
    </textfilecontent54_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20007" version="6" check="all" comment="Test group of /etc/cron.d is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19801" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20008" version="6" check="all" comment="Test group of /etc/cron.daily is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20009" version="6" check="all" comment="Test group of /etc/cron.daily is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20010" version="6" check="all" comment="Test group of /etc/cron.daily is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19802" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20011" version="6" check="all" comment="Test group of /etc/cron.hourly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20012" version="6" check="all" comment="Test group of /etc/cron.hourly is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20013" version="6" check="all" comment="Test group of /etc/cron.hourly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19803" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20014" version="6" check="all" comment="Test group of /etc/cron.monthly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20015" version="6" check="all" comment="Test group of /etc/cron.monthly is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20016" version="6" check="all" comment="Test group of /etc/cron.monthly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19804" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20017" version="6" check="all" comment="Test group of /etc/cron.weekly is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20018" version="6" check="all" comment="Test group of /etc/cron.weekly is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20019" version="6" check="all" comment="Test group of /etc/cron.weekly is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19805" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20200" version="6" check="all" comment="Test mode of /var/log/cron is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:20200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21300" version="6" check="all" comment="Test mode of /etc/at.allow is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:31900" version="6" check="all" comment="Test mode of /etc/snmpd.conf is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:31900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1400" version="6" check="all" comment="Test owner of /etc/login.access is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1401" version="6" check="all" comment="Test owner of /etc/security/access.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1402" version="6" check="all" comment="Test owner of /etc/access.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1402" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:37700" version="6" check="all" comment="Test owner of /etc/smb.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:37700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:37900" version="6" check="all" comment="Test mode of /etc/smb.conf is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:37700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38000" version="6" check="all" comment="Test owner of /etc/samba/passwd.tdb is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38001" version="1" check="all" comment="Test owner of /etc/samba/secrets.tdb is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1600" version="6" check="all" comment="Test mode of /etc/login.access is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1601" version="6" check="all" comment="Test mode of /etc/security/access.conf is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1401" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1602" version="6" check="all" comment="Test mode of /etc/access.conf is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1402" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38100" version="12" check="all" comment="Test group of /etc/samba/passwd.tdb is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38103" version="6" check="all" comment="Test group of /etc/samba/secrets.tdb is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38200" version="6" check="all" comment="Test mode of /etc/samba/passwd.tdb is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:38201" version="1" check="all" comment="Test mode of /etc/samba/secrets.tdb is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:38001" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:44600" version="2" check="all" comment="Test mode of /boot/grub/grub.conf is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:39000" version="6" check="all" comment="Test mode of /etc/news/readers.conf is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:39100" version="6" check="all" comment="Test mode of /etc/news/passwd.nntp is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:39100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1700" version="6" check="all" comment="Test owner of /etc/sysctl.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1800" version="6" check="all" comment="Test group of /etc/sysctl.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:1900" version="6" check="all" comment="Test mode of /etc/sysctl.conf is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:1700" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20300" version="6" check="all" comment="Test mode of /etc/cron.deny is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:20300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20500" version="6" check="all" comment="Test owner of /etc/cron.allow is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20501" version="6" check="all" comment="Test owner of /etc/cron.allow is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20502" version="6" check="all" comment="Test owner of /etc/cron.allow is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22000" version="6" check="all" comment="Test owner of /etc/at.allow is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22001" version="6" check="all" comment="Test owner of /etc/at.allow is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22002" version="6" check="all" comment="Test owner of /etc/at.allow is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22200" version="6" check="all" comment="Test owner of /etc/at.deny is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:22200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22201" version="6" check="all" comment="Test owner of /etc/at.deny is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:22200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:22202" version="6" check="all" comment="Test owner of /etc/at.deny is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:22200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28000" version="6" check="all" comment="Test group of /usr/sbin/traceroute is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28001" version="6" check="all" comment="Test group of /usr/sbin/traceroute is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28002" version="6" check="all" comment="Test group of /usr/sbin/traceroute is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:28100" version="6" check="all" comment="Test mode of /usr/sbin/traceroute is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:28000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:32400" version="6" check="all" comment="Test owner of /etc/syslog.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:32400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20800" version="6" check="all" comment="Test owner of /etc/cron.deny is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:20300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20801" version="6" check="all" comment="Test owner of /etc/cron.deny is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:20300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25601" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20802" version="6" check="all" comment="Test owner of /etc/cron.deny is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:20300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:23000" version="6" check="all" comment="Test owner of /var/crash is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:2201" version="6" check="all" comment="Test group of /etc/securetty is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:2202" version="6" check="all" comment="Test group of /etc/securetty is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:2300" version="6" check="all" comment="Test owner of /etc/securetty is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:2200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:4001" version="6" check="all" comment="Test group of /etc/ntp.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:4000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:4002" version="6" check="all" comment="Test group of /etc/ntp.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:4000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9200" version="6" check="all" comment="Test owner of /etc/resolv.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9301" version="6" check="all" comment="Test group of /etc/resolv.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9302" version="6" check="all" comment="Test group of /etc/resolv.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9601" version="1" check="all" comment="Test group of /etc/hosts is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9602" version="1" check="all" comment="Test group of /etc/hosts is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9800" version="6" check="all" comment="Test owner of /etc/nsswitch.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9900" version="6" check="all" comment="Test group of /etc/nsswitch.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9901" version="1" check="all" comment="Test group of /etc/nsswitch.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:9902" version="1" check="all" comment="Test group of /etc/nsswitch.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:9800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10100" version="6" check="all" comment="Test owner of /etc/passwd is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10200" version="6" check="all" comment="Test group of /etc/passwd is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10201" version="1" check="all" comment="Test group of /etc/passwd is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10202" version="1" check="all" comment="Test group of /etc/passwd is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10400" version="6" check="all" comment="Test owner of /etc/group is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10500" version="6" check="all" comment="Test group of /etc/group is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10501" version="1" check="all" comment="Test group of /etc/group is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10502" version="1" check="all" comment="Test group of /etc/group is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10600" version="6" check="all" comment="Test mode of /etc/group is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10800" version="6" check="all" comment="Test group of /etc/shadow is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10801" version="1" check="all" comment="Test group of /etc/shadow is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:10802" version="1" check="all" comment="Test group of /etc/shadow is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:10800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:100" version="6" check="all" comment="Test owner of /etc/gshadow is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:300" version="6" check="all" comment="Test mode of /etc/gshadow is 400 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20600" version="6" check="all" comment="Test group of /etc/cron.allow is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20601" version="6" check="all" comment="Test group of /etc/cron.allow is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20602" version="6" check="all" comment="Test group of /etc/cron.allow is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:19100" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:20700" version="6" check="all" comment="Test mode of /etc/at.deny is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:22200" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21801" version="2" check="all" comment="Test group of /var/spool/at is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:21802" version="2" check="all" comment="Test group of /var/spool/at is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:21800" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20001" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:23100" version="6" check="all" comment="Test group of /var/crash is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:23200" version="6" check="all" comment="Test mode of /var/crash is 700 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:23000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:25900" version="6" check="all" comment="Test mode of /etc/xinetd.d is 755 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:25900" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19800" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26100" version="6" check="all" comment="Test group of /etc/services is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:26101" version="6" check="all" comment="Test group of /etc/services is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:26000" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:20002" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:27700" version="6" check="all" comment="Test group of /etc/cups/printers.conf is lp" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:27600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:27700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30400" version="6" check="all" comment="Test group of /etc/ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30300" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30401" version="6" check="all" comment="Test group of /etc/vsftpd.ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30301" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:30402" version="6" check="all" comment="Test group of /etc/vsftpd/ftpusers is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:30302" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:32300" version="6" check="all" comment="Test mode of /etc/syslog.conf is 640 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:32400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:30500" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:34400" version="6" check="all" comment="Test mode of /etc/ssh/*key.pub is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:34400" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:34500" version="6" check="all" comment="Test mode of /etc/ssh/*key is 600 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:34500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:19100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36700" version="6" check="all" comment="Test group of /etc/exports is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36701" version="1" check="all" comment="Test group of /etc/exports is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:36702" version="1" check="all" comment="Test group of /etc/exports is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:36600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42500" version="6" check="all" comment="Test mode of /etc/ldap.conf is 644 or less permissive" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10300" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42600" version="6" check="all" comment="Test owner of /etc/ldap.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42700" version="6" check="all" comment="Test group of /etc/ldap.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:38100" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42701" version="1" check="all" comment="Test group of /etc/ldap.conf is bin" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10200" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:42702" version="1" check="all" comment="Test group of /etc/ldap.conf is sys" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:42500" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:10201" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:tst:44700" version="2" check="all" comment="Test owner of /boot/grub/grub.conf is root" check_existence="any_exist">
      <object object_ref="oval:mil.disa.fso.rhel:obj:44600" />
      <state state_ref="oval:mil.disa.fso.rhel:ste:25600" />
    </file_test>
  </tests>
  <objects>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46801" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46800" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46802" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46801" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46803" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46802" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46804" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46803" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:uname_object id="oval:mil.disa.fso.rhel:obj:46805" version="1" />
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46800" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(-[aA][ -~&#xD;
]*)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:uname_object id="oval:mil.disa.fso.rhel:obj:49105" version="5" />
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49300" version="5">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49302" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49501" version="5">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49503" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49402" version="5">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49404" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49103" version="5" comment="init_module / no arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49123" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49104" version="5" comment="init_module / b32">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49124" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49110" version="5" comment="init_module / arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49125" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49206" version="5" comment="delete_module / no arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49226" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49207" version="5" comment="delete_module / b32">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49227" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49208" version="5" comment="delete_module / arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49228" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:49109" version="5" comment="init_module / b64">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:49129" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:1100" version="3" comment="unnecessary priv accts in password">
      <username datatype="string" operation="pattern match">^(halt|shutdown|reboot|who)$</username>
    </password_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:1500" version="1" comment="/etc/security/access.conf">
      <unix-def:path datatype="string">/etc/security</unix-def:path>
      <unix-def:filename datatype="string">access.conf</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:2000" version="2" comment="all uncommented ctrlaltdel statements">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">inittab</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^ca:.*:ctrlaltdel:(.+)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:2001" version="1" comment="all commented ctrlaltdel statements">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">inittab</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^(#ca:).*:ctrlaltdel:</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3000" version="5">
      <ind-def:path datatype="string">/etc/sysconfig</ind-def:path>
      <ind-def:filename datatype="string">selinux</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^SELINUX=(.*)[ 	]*[^
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3001" version="5">
      <ind-def:path datatype="string">/etc/sysconfig</ind-def:path>
      <ind-def:filename datatype="string">selinux</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^SELINUXTYPE=(.*)[ 	]*[^
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:3900" version="3" comment="/etc/ntp.conf">
      <unix-def:path datatype="string">/etc</unix-def:path>
      <unix-def:filename datatype="string">ntp.conf</unix-def:filename>
    </unix-def:file_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:3700" version="8">
      <unix-def:command datatype="string" operation="pattern match">^ntpd([ 	]|$)</unix-def:command>
    </unix-def:process_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3701" version="8">
      <ind-def:path datatype="string">/etc/cron.hourly</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">ntpd -qg</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3702" version="8">
      <ind-def:path datatype="string">/etc/cron.daily</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">ntpd -qg</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3703" version="8">
      <ind-def:path datatype="string">/etc/cron.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^# 	]+[ 	]+[^#]*ntpd -qg[^#]*</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3704" version="8">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">crontab</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^# 	]+[ 	]+[^#]*ntpd -qg[^#]*</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3705" version="8">
      <ind-def:path datatype="string">/var/spool/cron</ind-def:path>
      <ind-def:filename datatype="string">root</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^#]*ntpd -qg[^#]*</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3801" version="8">
      <ind-def:path datatype="string">/etc/cron.hourly</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">ntpd -qg[^#]*[ 	]-a[ 	]+[0-9]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3802" version="8">
      <ind-def:path datatype="string">/etc/cron.daily</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">ntpd -qg[^#]*[ 	]-a[ 	]+[0-9]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3803" version="8">
      <ind-def:path datatype="string">/etc/cron.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^# 	]+[ 	]+[^#]*ntpd -qg[^#]*[ 	]-a[ 	]+[0-9]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3804" version="8">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">crontab</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^# 	]+[ 	]+[^#]*ntpd -qg[^#]*[ 	]-a[ 	]+[0-9]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3805" version="8">
      <ind-def:path datatype="string">/var/spool/cron</ind-def:path>
      <ind-def:filename datatype="string">root</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([0-9]+|\*)[ 	]+([0-9]+|\*)[ 	]+\*[ 	]+\*[ 	]+\*[ 	]+[^#]*ntpd -qg[^#]*[ 	]-a[ 	]+[0-9]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4700" version="4" comment="maxlogins in /etc/security/limits.conf">
      <ind-def:path datatype="string">/etc/security</ind-def:path>
      <ind-def:filename datatype="string">limits.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:4700" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4701" version="4" comment="maxlogins in /etc/security/limits.d/*">
      <ind-def:path datatype="string">/etc/security/limits.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:4700" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5000" version="4">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">^(system-auth|system-auth-ac|system-auth-local)$</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:5001" />
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:xmlfilecontent_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5201" version="4" comment="mandatory idle_activation_enabled">
      <ind-def:path datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver</ind-def:path>
      <ind-def:filename datatype="string">%gconf.xml</ind-def:filename>
      <ind-def:xpath datatype="string">/gconf/entry[@name='idle_activation_enabled']/@value</ind-def:xpath>
    </ind-def:xmlfilecontent_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5801" version="4" comment="login.defs: MD5_CRYPT_ENAB">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">login.defs</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|\n)[ 	]*MD5_CRYPT_ENAB[ 	]+[Yy][Ee][Ss][ 	]*(\n|$)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5802" version="4" comment="login.defs: ENCRYPT_METHOD = sha256 or sha512">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">^(system-auth|system-auth-ac|system-auth-local)$</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|\n)[ 	]*password[ 	]+(sufficient|required)[ 	]+pam_unix\.so[ 	]+([^ 	
&#xD;]+[ 	]+)?(sha256|sha512)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5803" version="4" comment="libuser.conf: crypt_style = sha256 or sha512">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">libuser.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|\n)[ 	]*crypt_style = [Ss][Hh][Aa](256|512)[ 	]*(\n|$)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6400" version="4" comment="maxrepeat">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">^system-auth($|-ac$|-local$)</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6400" />
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6700" version="2" comment="cracklib">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*password[ 	]+(required|requisite)[ 	]+pam_cracklib.so</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:6800" version="4">
      <unix-def:path datatype="string">/etc/security</unix-def:path>
      <unix-def:filename datatype="string">opasswd</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6801" version="4">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">^(system-auth|system-auth-ac|system-auth-local)$</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6801" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8400" version="2" comment="All files in system command directories">
      <path var_ref="oval:mil.disa.fso.rhel:var:8400" var_check="at least one" datatype="string" />
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:9200" version="1" comment="File /etc/resolv.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">resolv.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:9500" version="1" comment="File /etc/hosts">
      <path datatype="string">/etc</path>
      <filename datatype="string">hosts</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:9800" version="1" comment="File /etc/nsswitch.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">nsswitch.conf</filename>
    </file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:11100" version="1" comment="interactive user home directories">
      <unix-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:11100" />
      <unix-def:filename datatype="string" xsi:nil="true" />
    </unix-def:file_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:11101" version="1" comment="all users">
      <unix-def:username datatype="string" operation="pattern match">.*</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:11102" version="1" comment="interactive (non-system/app) accounts">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:11101</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:11100</filter>
      </oval-def:set>
    </unix-def:password_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12100" version="2" comment="/etc/rc* scripts">
      <behaviors recurse_direction="down" />
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="pattern match">^rc</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12101" version="2" comment="/etc/rc*.d/* scripts">
      <behaviors recurse_direction="down" />
      <path datatype="string" operation="pattern match">^/etc/rc[0-9]*\.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12102" version="2" comment="/etc/init.d/* scripts">
      <behaviors recurse_direction="down" />
      <path datatype="string" operation="equals">/etc/init.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13205" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile.d/.*)">
      <path datatype="string" operation="equals">/etc/profile.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13204" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (.login)">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">.login</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13203" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (security/environ)">
      <path datatype="string" operation="equals">/etc/security</path>
      <filename datatype="string" operation="equals">environ</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13202" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (environment)">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">environment</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13201" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (profile)">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">profile</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13200" version="3" comment="Global initialization files must contain the &quot;mesg -n&quot; or &quot;mesg n&quot; commands. (bashrc)">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">bashrc</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*mesg -?n</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:14800" version="3" comment=".netrc files">
      <unix-def:behaviors recurse_direction="down" recurse_file_system="local" recurse="files and directories" />
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:14800" datatype="string" />
      <unix-def:filename datatype="string">.netrc</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:14801" version="3" comment="root directories">
      <unix-def:behaviors max_depth="1" recurse_direction="down" />
      <unix-def:path datatype="string">/</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:14802" version="3" comment="filtered root directories">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:14801</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:14800</filter>
        <filter>oval:mil.disa.fso.rhel:ste:14801</filter>
        <filter>oval:mil.disa.fso.rhel:ste:14802</filter>
        <filter>oval:mil.disa.fso.rhel:ste:14803</filter>
        <filter>oval:mil.disa.fso.rhel:ste:14804</filter>
      </oval-def:set>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:14900" version="3" comment=".rhosts, .shosts, hosts.equiv, or shosts.equiv files">
      <unix-def:behaviors recurse_direction="down" recurse_file_system="local" recurse="files and directories" />
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:14800" datatype="string" />
      <unix-def:filename operation="pattern match" datatype="string">^(\.rhosts|\.shosts|hosts.equiv|shosts.equiv)$</unix-def:filename>
    </unix-def:file_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:16800" version="2" comment="Users home directory">
      <username datatype="string" operation="not equal">gdm</username>
    </password_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:16801" version="2" comment="The user default umask must be 077 in user-initialization scripts ($HOME/.*)">
      <path datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:16800" var_check="at least one" />
      <filename datatype="string" operation="pattern match">^\.</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*(umask[ 	]+[0-7][0-7][0-7])[^
]*</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:16802" version="2" comment="The system default umask must be 077">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*(umask[ 	]+[0-7][0-7][0-7])[^
]*</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17700" version="1" comment="/etc/audit/auditd.conf for disk_full_action">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">auditd.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*disk_full_action[ 	]*=[ 	]*([a-z]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17701" version="1" comment="/etc/audit/auditd.conf for disk_error_action">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">auditd.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*disk_error_action[ 	]*=[ 	]*([a-z]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17900" version="3" comment="space_left_action = acceptable parameter">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">auditd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*space_left_action[ 	]*=[ 	]*(([Ss][Yy][Ss][Ll][Oo][Gg])|([Ee][Xx][Ee][Cc])|([Ee][Mm][Aa][Ii][Ll]))</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17901" version="3" comment="space_left_action keyword is commented out">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">auditd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*[#]+[ 	
&#xD;]*space_left_action[ 	]*=[ 	]*</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17902" version="3" comment="action_mail_acct set to sys admin email">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">auditd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*action_mail_acct[ 	]*=[ 	]*([A-Za-z0-9._%+-]+(@[A-Za-z0-9.-])?,?)+$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17903" version="3" comment="action_mail_acct is commented out">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">auditd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*#[^
&#xD;]*action_mail_acct[ 	]*=[ 	]*</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18100" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/useradd">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18100" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18101" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/groupadd">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18103" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18102" version="1" comment="/etc/audit/audit.rules for -w /etc/passwd">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18105" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18103" version="1" comment="/etc/audit/audit.rules for -w /etc/group">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18106" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18104" version="1" comment="/etc/audit/audit.rules for -w /etc/shadow">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18107" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18105" version="1" comment="/etc/audit/audit.rules for -w /etc/gshadow">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18108" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18200" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/usermod">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18200" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18201" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/groupmod">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18203" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18202" version="1" comment="/etc/audit/audit.rules for -w /etc/passwd">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18205" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18203" version="1" comment="/etc/audit/audit.rules for -w /etc/group">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18206" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18204" version="1" comment="/etc/audit/audit.rules for -w /etc/shadow">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18207" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18205" version="1" comment="/etc/audit/audit.rules for -w /etc/gshadow">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18208" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18300" version="1" comment="/etc/audit/audit.rules for -w /usr/bin/passwd">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18300" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18400" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/userdel">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18400" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18401" version="1" comment="/etc/audit/audit.rules for -w /usr/sbin/groupdel">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18401" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18510" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18510" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18511" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18511" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18512" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18512" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18513" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18513" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:uname_object id="oval:mil.disa.fso.rhel:obj:18505" version="4" />
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18700" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(-[aA][ -~&#xD;
]*)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18600" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18601" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18601" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18602" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18800" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18802" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18801" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18803" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18802" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18804" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18803" version="4" comment="init_module / no arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18823" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18804" version="4" comment="init_module / b32">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18824" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18805" version="4" comment="init_module / arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18825" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18806" version="4" comment="delete_module / no arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18826" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18807" version="4" comment="delete_module / b32">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18827" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18808" version="4" comment="delete_module / arch">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18828" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18809" version="4" comment="init_module / b64">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18829" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18900" version="2" comment="audisp syslog active option">
      <ind-def:path datatype="string">/etc/audisp/plugins.d</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*active[ 	]*=[ 	]*([a-z]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18901" version="2" comment="audit boot param in kernel">
      <ind-def:path datatype="string">/boot/grub</ind-def:path>
      <ind-def:filename datatype="string">grub.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]+kernel[ 	]*[^#
&#xD;]*audit=1</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18902" version="2" comment="audisp syslog active option">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">^r?syslog.conf$</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^\*\.\*[ 	]+[^#
&#xD;]*@[A-Za-z0-9]</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19000" version="2" comment="/etc/cron.allow existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">cron.allow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19001" version="2" comment="/etc/cron.deny existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">cron.deny</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19100" version="1" comment="File /etc/cron.allow">
      <path datatype="string">/etc</path>
      <filename datatype="string">cron.allow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19500" version="1" comment="/var/spool/cron">
      <path datatype="string" operation="equals">/var/spool/cron</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19501" version="1" comment="/etc/cron.d">
      <path datatype="string" operation="equals">/etc/cron.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19502" version="1" comment="/etc/crontab">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">crontab</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19503" version="1" comment="/etc/cron.daily">
      <path datatype="string" operation="equals">/etc/cron.daily</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19504" version="1" comment="/etc/cron.hourly">
      <path datatype="string" operation="equals">/etc/cron.hourly</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19505" version="1" comment="/etc/cron.monthly">
      <path datatype="string" operation="equals">/etc/cron.monthly</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19506" version="1" comment="/etc/cron.weekly">
      <path datatype="string" operation="equals">/etc/cron.weekly</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19600" version="1" comment="/etc/cron.allow existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">cron.allow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19601" version="1" comment="/etc/cron.deny existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">cron.deny</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:19604" version="1" comment="/etc/cron.deny file contents">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">cron.deny</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^([^ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:19602" version="1" comment="/etc/cron.allow all entries">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">cron.allow</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^([^ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:19605" version="1" comment="all users">
      <unix-def:username datatype="string" operation="pattern match">.*</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:19606" version="1" comment="all system accounts except root">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:19605</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:19601</filter>
        <filter>oval:mil.disa.fso.rhel:ste:19602</filter>
      </oval-def:set>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:19603" version="1" comment="all system accounts except root and cron.deny entries (should be empty)">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:19605</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:19601</filter>
        <filter>oval:mil.disa.fso.rhel:ste:19602</filter>
        <filter>oval:mil.disa.fso.rhel:ste:19603</filter>
      </oval-def:set>
    </unix-def:password_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20000" version="1" comment="/var/spool/cron">
      <unix-def:path datatype="string">/var/spool/cron</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20001" version="1" comment="/etc/crontab">
      <unix-def:path datatype="string">/etc</unix-def:path>
      <unix-def:filename datatype="string">crontab</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20002" version="1" comment="/etc/cron.d">
      <unix-def:path datatype="string">/etc/cron.d</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20003" version="1" comment="/etc/cron.daily">
      <unix-def:path datatype="string">/etc/cron.daily</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20004" version="1" comment="/etc/cron.hourly">
      <unix-def:path datatype="string">/etc/cron.hourly</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20005" version="1" comment="/etc/cron.monthly">
      <unix-def:path datatype="string">/etc/cron.monthly</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20006" version="1" comment="/etc/cron.weekly">
      <unix-def:path datatype="string">/etc/cron.weekly</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:20100" version="1" comment="syslog cron log path pattern">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*cron\.\*[ 	]+([^ 	]*)/[^/ 	
]+</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:20101" version="1" comment="syslog cron log file pattern">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*cron\.\*[ 	]+[^ 	]*/([^/ 	
]+)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:20102" version="1" comment="cron log file(s)">
      <unix-def:path var_ref="oval:mil.disa.fso.rhel:var:20100" var_check="at least one" datatype="string" />
      <unix-def:filename var_ref="oval:mil.disa.fso.rhel:var:20101" var_check="at least one" datatype="string" />
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21000" version="1" comment="/etc/cron.allow existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">at.allow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21001" version="1" comment="/etc/cron.deny existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">at.deny</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:21100" version="1" comment="/etc/at.deny file contents">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">at.deny</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^([^ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:21202" version="1" comment="/etc/at.allow all entries">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">at.allow</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^([^ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:21200" version="1" comment="all users">
      <unix-def:username datatype="string" operation="pattern match">.*</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:21201" version="1" comment="all system accounts except root">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:21200</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:21200</filter>
        <filter>oval:mil.disa.fso.rhel:ste:21201</filter>
      </oval-def:set>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:21203" version="1" comment="all system accounts except root and at.deny entries">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:21200</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:21200</filter>
        <filter>oval:mil.disa.fso.rhel:ste:21201</filter>
        <filter>oval:mil.disa.fso.rhel:ste:21203</filter>
      </oval-def:set>
    </unix-def:password_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21600" version="1" comment="/var/spool/cron/atjobs">
      <path datatype="string" operation="equals">/var/spool/cron/atjobs</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21601" version="1" comment="/var/spool/atjobs">
      <path datatype="string" operation="equals">/var/spool/atjobs</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21602" version="1" comment="/var/spool/at">
      <path datatype="string" operation="equals">/var/spool/at</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:21700" version="2" comment="/var/spool/at">
      <unix-def:path datatype="string">/var/spool/at</unix-def:path>
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:22900" version="5">
      <ind-def:path datatype="string">/sys/kernel</ind-def:path>
      <ind-def:filename datatype="string">kexec_crash_loaded</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^1$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23300" version="1" comment="kernel.exec-shield">
      <path datatype="string" operation="equals">/proc/sys/kernel</path>
      <filename datatype="string" operation="equals">exec-shield</filename>
      <pattern datatype="string" operation="pattern match">([0-9]+)</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23301" version="1" comment="kernel.randomize_va_space">
      <path datatype="string" operation="equals">/proc/sys/kernel</path>
      <filename datatype="string" operation="equals">randomize_va_space</filename>
      <pattern datatype="string" operation="pattern match">([0-9]+)</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23400" version="1" comment="userctl">
      <path datatype="string" operation="equals">/etc/sysconfig/network-scripts</path>
      <filename datatype="string" operation="pattern match">^ifcfg.*</filename>
      <pattern datatype="string" operation="pattern match">[ 	]*USERCTL[ 	]*=[ 	]*yes</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23500" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/all</ind-def:path>
      <ind-def:filename datatype="string">accept_source_route</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23501" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/default</ind-def:path>
      <ind-def:filename datatype="string">accept_source_route</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23600" version="1" comment="net.ipv4.tcp_max_syn_backlog=1280">
      <path datatype="string" operation="equals">/proc/sys/net/ipv4</path>
      <filename datatype="string" operation="equals">tcp_max_syn_backlog</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23800" version="1">
      <ind-def:path datatype="string">/proc/sys/net/ipv4</ind-def:path>
      <ind-def:filename datatype="string">icmp_echo_ignore_broadcasts</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-1])</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24000" version="1" comment="net.ipv4.conf.all.accept_source_route = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv4/conf/all</path>
      <filename datatype="string" operation="equals">accept_source_route</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24001" version="1" comment="net.ipv4.conf.default.accept_source_route = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv4/conf/default</path>
      <filename datatype="string" operation="equals">accept_source_route</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24100" version="1" comment="net.ipv4.conf.all.proxy_arp = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv4/conf/all</path>
      <filename datatype="string" operation="equals">proxy_arp</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24101" version="1" comment="net.ipv4.conf.default.proxy_arp = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv4/conf/default</path>
      <filename datatype="string" operation="equals">proxy_arp</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24200" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/all</ind-def:path>
      <ind-def:filename datatype="string">accept_redirects</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24201" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/default</ind-def:path>
      <ind-def:filename datatype="string">accept_redirects</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24300" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/all</ind-def:path>
      <ind-def:filename datatype="string">send_redirects</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24301" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/default</ind-def:path>
      <ind-def:filename datatype="string">send_redirects</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24400" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/all</ind-def:path>
      <ind-def:filename datatype="string">log_martians</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24401" version="4">
      <ind-def:path datatype="string">/proc/sys/net/ipv4/conf/default</ind-def:path>
      <ind-def:filename datatype="string">log_martians</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:24700" version="2">
      <path datatype="string" operation="equals">/proc/sys/net/bridge</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24701" version="2">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">modules</filename>
      <pattern datatype="string" operation="pattern match">^bridge</pattern>
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24800" version="1" comment="/home mountpoint">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^[^ ]+ /home[ ]</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24900" version="1" comment="/var mountpoint">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^[^ ]+ /var[ ]</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25000" version="1" comment="audit dir mountpoint">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:25000" />
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25001" version="1" comment="audit dir">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">auditd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]*log_file[ 	]*=[ 	]*(/.*)/[^/]*[ 	&#xD;]?</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25100" version="2" comment="/tmp mountpoint">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">fstab</filename>
      <pattern datatype="string" operation="pattern match">.+/tmp.+</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25200" version="1" comment="/ file system type(s)">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^[^ ]+ / ([^ ]+)[ ]</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25201" version="1" comment="/ file system options">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^[^ ]+ / [^ ]+[ ]([^ ]+)[ ]</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25300" version="1" comment="local file system type(s)">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^/dev[^ ]+ [^ ]+ ([^ ]+)[ ]</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25301" version="1" comment="local file system options">
      <path datatype="string" operation="equals">/proc</path>
      <filename datatype="string" operation="equals">mounts</filename>
      <pattern datatype="string" operation="pattern match">^/dev[^ ]+ [^ ]+ [^ ]+[ ]([^ ]+)[ ]</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25400" version="3" comment="authpriv.* or authpriv.info or authpriv.debug">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]*([A-Za-z0-9\.\*;]*)authpriv\.(\*|debug|info)([A-Za-z0-9\.\*;]*)[ 	 &#xD;]+-?/</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:25401" version="1" comment="authpriv.none">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]*([A-Za-z0-9\.\*;]*)authpriv\.(\*|debug|info)([A-Za-z0-9\.\*;]*)authpriv.none([A-Za-z0-9\.\*;]*)[ 	  ]+-?/</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:25500" version="1" comment="xinetd process">
      <unix-def:command operation="pattern match" datatype="string">^xinetd.*</unix-def:command>
    </unix-def:process_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:25501" version="1" comment="all xinetd services">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name operation="pattern match" datatype="string">.*</unix-def:service_name>
    </unix-def:xinetd_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25700" version="1" comment="/etc/xinetd.conf file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">xinetd.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25701" version="1" comment="/etc/xinetd.d directory">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25702" version="1" comment="/etc/xinetd.d directory files">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26310" version="6" comment="list of filenames with no log_on_failure">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.rhel:obj:26307</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:26306</filter>
      </set>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26309" version="6" comment="list of filenames with no log_on_success">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.rhel:obj:26307</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:26305</filter>
      </set>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26308" version="6" comment="list of filenames with no log_type">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.rhel:obj:26307</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:26304</filter>
      </set>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26307" version="6" comment="list of all filenames in /etc/xinetd.d">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <unix-def:process_object version="7" id="oval:mil.disa.fso.rhel:obj:26300" comment="xinetd process">
      <unix-def:command datatype="string" operation="pattern match">^xinetd([ 	]|$)</unix-def:command>
    </unix-def:process_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26301" version="7" comment="global log_type">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">xinetd.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_type[ 	]+[+]?=[ 	]+SYSLOG[ 	]+authpriv([ 	]+info)?[ 	]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26302" version="7" comment="global log_on_success">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">xinetd.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26303" version="7" comment="global log_on_failure">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">xinetd.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26304" version="7" comment="local log_type">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_type[ 	]+[+]?=[ 	]+SYSLOG[ 	]+authpriv([ 	]+info)?[ 	]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26305" version="9" comment="local log_on_success">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_on_success[ 	]+[+]?=[ 	]+([A-Z 	]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26306" version="7" comment="local log_on_failure">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*log_on_failure[ 	]+[+]?=[ 	]+([A-Z 	]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">0</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:26400" version="2" comment="portmap runlevel">
      <unix-def:service_name datatype="string">portmap</unix-def:service_name>
      <unix-def:runlevel operation="pattern match" datatype="string">.*</unix-def:runlevel>
    </unix-def:runlevel_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:26500" version="2" comment="portmap runlevel">
      <lin-def:name datatype="string">portmap</lin-def:name>
    </lin-def:rpminfo_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26600" version="6" comment="/etc/xinetd.d/rsh ">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" operation="equals">rsh</filename>
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:26601" version="6" comment="disable = yes">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" operation="equals">rsh</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]*[Dd][Ii][Ss][Aa][Bb][Ll][Ee][		]*=[ 	]*[Yy][Ee][Ss][ 	
]*$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:26800" version="1" comment="rlogin xinetd">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name datatype="string">login</unix-def:service_name>
    </unix-def:xinetd_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:26900" version="1" comment="rsh-server rpminfo">
      <lin-def:name datatype="string">rsh-server</lin-def:name>
    </lin-def:rpminfo_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:27000" version="1" comment="rexec xinetd">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name datatype="string">exec</unix-def:service_name>
    </unix-def:xinetd_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:27900" version="1" comment="/bin/traceroute">
      <path datatype="string" operation="equals">/bin</path>
      <filename datatype="string" operation="equals">traceroute</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28301" version="2" comment="Default comment, please change">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">aliases.db</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28300" version="1" comment="Default comment, please change">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">aliases</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:28700" version="18" comment="alias exec paths">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">aliases</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^/#]+((/[a-z0-9\._]+)+)/</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:28701" version="18" comment="alias exec files">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">aliases</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^/#]+/[a-z0-9\._]+(/[a-z0-9\._]+)+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:28702" version="16" comment="exec files">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:28700" datatype="string" />
      <unix-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:28701" datatype="string" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:28800" version="1">
      <ind-def:path datatype="string">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string">sendmail.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^O[ 	
&#xD;]*LogLevel[ 	
&#xD;]*=[ 	
&#xD;]*([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:29000" version="2" comment="All mail log files">
      <path datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:29000" var_check="at least one" />
      <filename datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:29002" var_check="at least one" />
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="2" id="oval:mil.disa.fso.rhel:obj:29001" comment="Mail log files' directories as identified in /etc/syslog.conf">
      <ind-def:path datatype="string" operation="equals">/etc/</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">syslog.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">mail\.[^n][^/]*(/.*)/[^/
]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="2" id="oval:mil.disa.fso.rhel:obj:29002" comment="Mail log files' filenames as identified in /etc/syslog.conf">
      <ind-def:path datatype="string" operation="equals">/etc/</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">syslog.conf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">mail\.[^n][^/]*/.*/([^/
]*)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29100" version="1" comment="smtp log file path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^#]*mail\.[^n][^/]+(/[^ 	&#xD;
]+)-?/[^/ 	&#xD;
]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29101" version="1" comment="smtp log file filename">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^#]*mail\.[^n][^/]+/[^ 	&#xD;
]+-?/([^/ 	&#xD;
]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:29102" version="1" comment="smtp log file">
      <unix-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:29100" />
      <unix-def:filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:29101" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:29200" version="1" comment="sendmail help file">
      <unix-def:path datatype="string">/etc/mail</unix-def:path>
      <unix-def:filename datatype="string">helpfile</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29300" version="2" comment="sendmail greeting version tags">
      <ind-def:path datatype="string">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string">sendmail.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^O SmtpGreetingMessage=.*([$]v|[$]Z)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29301" version="2" comment="postfix smtpd_banner">
      <ind-def:path datatype="string">/etc/postfix</ind-def:path>
      <ind-def:filename datatype="string">main.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^smtpd_banner[ 	]*=[^#

]*[$]mail_version</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:29400" version="4" comment=".forward files">
      <unix-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:29400" operation="equals" />
      <unix-def:filename datatype="string" operation="equals">.forward</unix-def:filename>
    </unix-def:file_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:29401" version="3" comment="all users">
      <unix-def:username operation="pattern match" datatype="string">.*</unix-def:username>
    </unix-def:password_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="3" id="oval:mil.disa.fso.rhel:obj:29402" comment="'0 ForwardPath' in /etc/sendmail.cf">
      <ind-def:path datatype="string" operation="equals">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">sendmail.cf</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[^#
]*[Oo][ 	]*[Ff][oO][rR][wW][aA][rR][dD][Pp][aA][tT][hH][^
]*$</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29600" version="1" comment="sendmail PrivacyOptions">
      <ind-def:path datatype="string">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string">sendmail.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^O PrivacyOptions=([^ 	&#xD;
]*)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:29601" version="1" comment="sendmail rpm">
      <lin-def:name datatype="string">sendmail</lin-def:name>
    </lin-def:rpminfo_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:32000" version="1" comment="MIB file permissions">
      <behaviors recurse_file_system="local" />
      <path datatype="string" operation="pattern match">.*</path>
      <filename datatype="string" operation="pattern match">^.*mib$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:32100" version="1" comment="snmpd.conf file permissions">
      <behaviors recurse_file_system="local" />
      <path datatype="string" operation="pattern match">.*</path>
      <filename datatype="string" operation="equals">snmpd.conf</filename>
    </file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:32200" version="1" comment="/etc/snmpd.conf">
      <unix-def:path datatype="string">/etc</unix-def:path>
      <unix-def:filename datatype="string">snmpd.conf</unix-def:filename>
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:32500" version="1" comment="/etc/syslog.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:32600" version="5">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">syslog.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^#]+@.+$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:32900" version="1" comment="ssh_config">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Pp][Rr][Oo][Tt][Oo][Cc][Oo][lL][ 	
&#xD;]*2[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33300" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Mm][Aa][Cc][Ss][ 	
&#xD;]+hmac-sha1[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33301" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Mm][Aa][Cc][Ss][ -~]+\b(hmac-md5|hmac-ripemd160|hmac-96)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33400" version="2">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss][ 	
&#xD;]+([^ 	
&#xD;]*)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33500" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss]([ -~]*cbc\b|[ 	
&#xD;]*$)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33501" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss][ -~]+[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33600" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Mm][Aa][Cc][Ss][ 	
&#xD;]+hmac-sha1[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33601" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Mm][Aa][Cc][Ss][ -~]+\b(hmac-md5|hmac-ripemd160|hmac-96)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34300" version="3" comment="AllowGroups statement">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[		]*[Aa][Ll][Ll][Oo][Ww][Gg][Rr][Oo][Uu][Pp][Ss][		]*([a-zA-Z0-9\*\? ]*)$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34301" version="3" comment="AllowGroups *">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	 &#xD;]*[Aa][Ll][Ll][Oo][Ww][Gg][Rr][Oo][Uu][Pp][Ss][  &#xD;]*\*[ ]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34302" version="1" comment="AllowUsers statement">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[		]*[Aa][Ll][Ll][Oo][Ww][Uu][Ss][Ee][Rr][Ss][		]*([a-zA-Z0-9\*\? ]*)$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34303" version="1" comment="AllowUsers *">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	 &#xD;]*[Aa][Ll][Ll][Oo][Ww][Uu][Ss][Ee][Rr][Ss][  &#xD;]*\*[ ]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="2" id="oval:mil.disa.fso.rhel:obj:34304" comment="pam access">
      <ind-def:path datatype="string" operation="equals">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">sshd</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[^#]*account[ 	
&#xD;]+required[ 	
&#xD;]+pam_access.so</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34600" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Gg][Ss]{2}[Aa][Pp][Ii][Aa][Uu][Tt][Hh][Ee][Nn][Tt][Ii][Cc][Aa][Tt][Ii][Oo][Nn][ 	
&#xD;]+no[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34700" version="3">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">ssh_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	 &#xD;]*[Gg][Ss]{2}[Aa][Pp][Ii][Aa][Uu][Tt][Hh][Ee][Nn][Tt][Ii][Cc][Aa][Tt][Ii][Oo][Nn][ 	 &#xD;]+([A-Za-z ]+)$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:34800" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Kk][Ee][Rr][Bb][Ee][Rr][Oo][Ss][Aa][Uu][Tt][Hh][Ee][Nn][Tt][Ii][Cc][Aa][Tt][Ii][Oo][Nn][ 	
&#xD;]+no[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:35600" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Ss][Tt][Rr][Ii][Cc][Tt][Mm][Oo][Dd][Ee][Ss][ 	
&#xD;]+yes[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:35700" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Uu][Ss][Ee][Pp][Rr][Ii][Vv][Ii][Ll][Ee][Gg][Ee][Ss][Ee][Pp][Aa][Rr][Aa][Tt][Ii][Oo][Nn][ 	
&#xD;]+yes[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:35800" version="5" comment="Default comment, please change">
      <path datatype="string" operation="equals">/etc/ssh</path>
      <filename datatype="string" operation="equals">sshd_config</filename>
      <pattern datatype="string" operation="pattern match">^[R]hosts[R][S][A][A]uthentication[ ]no$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:35900" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Cc][Oo][Mm][Pp][Rr][Ee][Ss][Ss][Ii][Oo][Nn][ 	
&#xD;]+no[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:35901" version="2">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Cc][Oo][Mm][Pp][Rr][Ee][Ss][Ss][Ii][Oo][Nn][ 	
&#xD;]+[Dd][Ee][Ll][Aa][Yy][Ee][Dd][ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <runlevel_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:36200" version="7" comment="list of daemons and runlevels found">
      <service_name datatype="string" operation="pattern match">.*ospf.*|.*route.*|.*bgp.*|.*zebra.*|.*quagga.*</service_name>
      <runlevel datatype="string" operation="pattern match">[0-6]</runlevel>
    </runlevel_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36400" version="1" comment="net.ipv6.conf.all.forwarding = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv6/conf/all</path>
      <filename datatype="string" operation="equals">forwarding</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36401" version="1" comment="net.ipv6.conf.default.forwarding = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv6/conf/default</path>
      <filename datatype="string" operation="equals">forwarding</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36900" version="1" comment="exports">
      <ind-def:path datatype="string" operation="equals">/etc</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">exports</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*([^ 	]+)[ 	]</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:36901" version="1" comment="exported directories">
      <unix-def:path datatype="string" operation="equals" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:36900" />
      <unix-def:filename datatype="string" xsi:nil="true" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37100" version="1" comment="anonuid">
      <ind-def:path datatype="string" operation="equals">/etc</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">exports</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">anonuid=([-0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37101" version="1" comment="anongid">
      <ind-def:path datatype="string" operation="equals">/etc</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">exports</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">anongid=([-0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37201" version="2" comment="filter out any entry with a (">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.rhel:obj:37200</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:37200</filter>
      </set>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37202" version="1" comment="all entries with (">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.rhel:obj:37200</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:37202</filter>
      </set>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37200" version="2" comment="all line in /etc/exports except commented lines">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">exports</filename>
      <pattern datatype="string" operation="pattern match">^([/][^
]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:37400" version="1" comment="NFS mount options">
      <ind-def:path datatype="string">/proc</ind-def:path>
      <ind-def:filename datatype="string">mounts</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:37400" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:37500" version="2" comment="samba process">
      <unix-def:command operation="pattern match" datatype="string">[^ ]*smbd.*</unix-def:command>
    </unix-def:process_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:37800" version="1" comment="/etc/samba/smb.conf">
      <unix-def:path datatype="string">/etc/samba</unix-def:path>
      <unix-def:filename datatype="string">smb.conf</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:38400" version="1">
      <ind-def:path datatype="string">/etc/samba</ind-def:path>
      <ind-def:filename datatype="string">smb.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^;#][ 	
&#xD;]*security[ 	
&#xD;]*=[ 	
&#xD;]*share[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:38500" version="1">
      <ind-def:path datatype="string">/etc/samba</ind-def:path>
      <ind-def:filename datatype="string">smb.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^;#][ 	
&#xD;]*[Ee][Nn][Cc][Rr][Yy][Pp][Tt][ 	
&#xD;]*[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][ 	
&#xD;]*=[ 	
&#xD;]*yes[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:38600" version="1">
      <ind-def:path datatype="string">/etc/samba</ind-def:path>
      <ind-def:filename datatype="string">smb.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^;#][ 	
&#xD;]*[Gg][Uu][Ee][Ss][Tt][ 	
&#xD;]*[Oo][Kk][ 	
&#xD;]*=[ 	
&#xD;]*yes[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:38700" version="2">
      <unix-def:command operation="pattern match" datatype="string">^.*innd.*$</unix-def:command>
    </unix-def:process_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:38701" version="3">
      <unix-def:command operation="pattern match" datatype="string">^.*nnrpd.*$</unix-def:command>
    </unix-def:process_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:39300" version="1" comment="/etc/news file(s) permissions">
      <path datatype="string" operation="equals">/etc/news</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:39400" version="2">
      <unix-def:command operation="pattern match" datatype="string">.*ypbind.*</unix-def:command>
    </unix-def:process_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:39800" version="1" comment="tcp_wrappers rpm">
      <lin-def:name datatype="string">tcp_wrappers</lin-def:name>
    </lin-def:rpminfo_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:39905" version="16" comment="authpriv.info or *.info followed by authpriv.none on same line">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">(^[ ]*authpriv\.info|^[ ]*\*\.info);[a-zA-z\.\*;]*authpriv\.none</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:39904" version="16" comment="mail.*;mail.none on same line">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ ]*mail\.[a-zA-z\*]*;[a-zA-z\.\*;]*mail\.none</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:39900" version="17" comment="authpriv.info logging">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ ]*(authpriv\.info|^[ ]*\*\.info);?</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:39901" version="17" comment="mail.* logging">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ ]*(mail\.\*);?</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:39902" version="16" comment="mail debug logging">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">syslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[ ]*(mail\.debug);?</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40000" version="2" comment="host.deny file with ALL: ALL content">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">hosts.deny</filename>
      <pattern datatype="string" operation="pattern match">ALL\:[ 	]*ALL</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:40001" version="2" comment="host.allow file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">hosts.allow</filename>
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40501" version="3" comment="appletalk disabled in /etc/modprobe.d/*">
      <path datatype="string" operation="equals">/etc/modprobe.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]+appletalk[ 	]+([\/a-zA-Z0-9]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40500" version="3" comment="appletalk disabled in /etc/modprobe.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">modprobe.conf</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]+appletalk[ 	]+([\/a-zA-Z0-9]+)</pattern>
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40901" version="2" comment="bluetooth disabled in /etc/modprobe.d/*">
      <path datatype="string" operation="equals">/etc/modprobe.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^install[ &amp;#x9;]+bluetooth[ &amp;#x9;]+\/bin\/true$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40900" version="2" comment="bluetooth disabled in /etc/modprobe.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">modprobe.conf</filename>
      <pattern datatype="string" operation="pattern match">^install[ &amp;#x9;]+bluetooth[ &amp;#x9;]+\/bin\/true$</pattern>
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41000" version="2" comment="networking_ivp6=no">
      <path datatype="string" operation="equals">/etc/sysconfig</path>
      <filename datatype="string" operation="equals">network</filename>
      <pattern datatype="string" operation="pattern match">^[ ]*[Nn][Ee][Tt][Ww][Oo][Rr][Kk][Ii][Nn][Gg]_[Ii][Pp][Vv]6[ ]*=[ ]*[Nn][Oo]</pattern>
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:41400" version="1">
      <unix-def:command operation="pattern match" datatype="string">^.*miredo.*$</unix-def:command>
    </unix-def:process_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41700" version="3">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename operation="pattern match" datatype="string">^dhclient\S*\.conf$</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^#]*?[ 	
&#xD;]*[Dd][Oo]-[Ff][Oo][Rr][Ww][Aa][Rr][Dd]-[Uu][Pp][Dd][Aa][Tt][Ee][Ss][ 	
&#xD;]+([^# 	
&#xD;;]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41800" version="1" comment="net.ipv6.conf.all.accept_redirects = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv6/conf/all</path>
      <filename datatype="string" operation="equals">accept_redirects</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41801" version="1" comment="net.ipv6.conf.default.accept_redirects = 0">
      <path datatype="string" operation="equals">/proc/sys/net/ipv6/conf/default</path>
      <filename datatype="string" operation="equals">accept_redirects</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:42000" version="1" comment="Default comment, please change">
      <path datatype="string" operation="equals">/usr/bin</path>
      <filename datatype="string" operation="equals">ldd</filename>
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42200" version="2" comment="tls_checkpeer yes in /etd/ldap.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">ldap.conf</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*tls_checkpeer[ 	]+yes</pattern>
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42201" version="2" comment="LDAP used in /etc/nsswitch.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">nsswitch.conf</filename>
      <pattern datatype="string" operation="pattern match">^[^#
&#xD;]*ldap</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42300" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">nsswitch.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^#].*ldap</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42301" version="2">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">[^#][Tt][Ll][Ss]_[Cc][Rr][Ll][Cc][Hh][Ee][Cc][Kk][ 	]+[Aa][Ll][Ll]$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42400" version="2" comment="ldap.conf bindpw">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string">ldap.conf</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*bindpw</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42800" version="1" comment="CA cert file directory path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[cC][aA][cC][eE][rR][tT][fF][iI][lL][eE][ 	]+([^ 	]+)/</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42801" version="1" comment="CA cert file">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[cC][aA][cC][eE][rR][tT][fF][iI][lL][eE][ 	]+[^ 	]+/([^ 	
/]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:42802" version="1" comment="CA cert file">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:42800" datatype="string" />
      <unix-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:42801" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:42803" version="1" comment="CA cert file directory path">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:42800" datatype="string" />
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:42804" version="1" comment="CA cert dir path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[cC][aA][cC][eE][rR][tT][dD][iI][rR][ 	]+([^ 	
]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:42805" version="1" comment="CA cert dir">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:42802" datatype="string" />
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:42806" version="1" comment="CA cert dir files">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:42802" datatype="string" />
      <unix-def:filename operation="pattern match" datatype="string">.*</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43100" version="1" comment="TLS cert file path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[cC][eE][rR][tT][ 	]+([^ 	]+)/</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43101" version="1" comment="TLS cert file name">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[cC][eE][rR][tT][ 	]+[^ 	]+/([^ 	
/]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:43102" version="1" comment="TLS cert file">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:43100" datatype="string" />
      <unix-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:43101" datatype="string" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43400" version="1" comment="TLS key file directory path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[kK][eE][yY][ 	]+([^ 	]+)/</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43401" version="1" comment="TLS key file name">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[tT][lL][sS]_[kK][eE][yY][ 	]+[^ 	]+/([^ 	
/]+)$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:43402" version="1" comment="TLS key file">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:43400" datatype="string" />
      <unix-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:43401" datatype="string" />
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:43700" version="1" comment="File existence">
      <path datatype="string" operation="equals">/proc/sys/kernel</path>
      <filename datatype="string" operation="equals">exec-shield</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43500" version="1" comment="TLS key file directory path">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">[tT][lL][sS]_[kK][eE][yY][ ]+([^ ]+)/</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43501" version="1" comment="TLS key file name">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">ldap.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">[tT][lL][sS]_[kK][eE][yY][ ]+[^ 	]+/([^ \n]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:43502" version="1" comment="TLS key file">
      <unix-def:path var_ref="oval:mil.disa.fso.rhel:var:43500" datatype="string" />
      <unix-def:filename var_ref="oval:mil.disa.fso.rhel:var:43501" datatype="string" />
    </unix-def:file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43701" version="1" comment="/proc/sys/kernel/exec-shield">
      <path datatype="string" operation="equals">/proc/sys/kernel</path>
      <filename datatype="string" operation="equals">exec-shield</filename>
      <pattern datatype="string" operation="pattern match">^([0-9]+)$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:43800" version="1" comment="autofs runlevel">
      <unix-def:service_name datatype="string">autofs</unix-def:service_name>
      <unix-def:runlevel operation="pattern match" datatype="string">.*</unix-def:runlevel>
    </unix-def:runlevel_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43900" version="1" comment="check USB storage /etc/modprobe.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">modprobe.conf</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]usb-storage[ 	]/bin/true$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:43901" version="1" comment="check USB storage /etc/modprobe.d/*">
      <path datatype="string" operation="equals">/etc/modprobe.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]usb-storage[ 	]/bin/true$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:44000" version="1" comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">modprobe.conf</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]ieee1394[ 	]/bin/true$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:44001" version="1" comment="check IEEE 1394 (Firewire) is disabled /etc/modprobe.d/*">
      <path datatype="string" operation="equals">/etc/modprobe.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^install[ 	]ieee1394[ 	]/bin/true$</pattern>
      <instance operation="greater than or equal" datatype="int">1</instance>
    </textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:44300" version="1" comment="grub config">
      <path datatype="string" operation="equals">/boot/grub</path>
      <filename datatype="string">grub.conf</filename>
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:44500" version="1" comment="grub password options">
      <path datatype="string" operation="equals">/boot/grub</path>
      <filename datatype="string" operation="pattern match">^(menu.lst|grub.conf)$</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]*password[ 	]+([^ 	]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:45400" version="2" comment="inn rpm">
      <lin-def:name datatype="string">inn</lin-def:name>
    </lin-def:rpminfo_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:45401" version="2" comment="news acct passwd">
      <unix-def:username datatype="string">news</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:45501" version="1" comment="gopher acct passwd">
      <unix-def:username datatype="string">gopher</unix-def:username>
    </unix-def:password_object>
    <unix-def:shadow_object id="oval:mil.disa.fso.rhel:obj:45502" version="1" comment="gopher acct shadow">
      <unix-def:username datatype="string">gopher</unix-def:username>
    </unix-def:shadow_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:45602" version="2" comment="ftp acct passwd">
      <unix-def:username datatype="string">ftp</unix-def:username>
    </unix-def:password_object>
    <ind-def:xmlfilecontent_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5200" version="4" comment="mandatory idle_delay">
      <ind-def:path datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver</ind-def:path>
      <ind-def:filename datatype="string">%gconf.xml</ind-def:filename>
      <ind-def:xpath datatype="string">/gconf/entry[@name='idle_delay']/@value</ind-def:xpath>
    </ind-def:xmlfilecontent_object>
    <ind-def:xmlfilecontent_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5202" version="4" comment="mandatory lock_enabled">
      <ind-def:path datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver</ind-def:path>
      <ind-def:filename datatype="string">%gconf.xml</ind-def:filename>
      <ind-def:xpath datatype="string">/gconf/entry[@name='lock_enabled']/@value</ind-def:xpath>
    </ind-def:xmlfilecontent_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46100" version="6" comment="success=0 b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46112" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46101" version="6" comment="success=0 b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46113" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46102" version="6" comment="exit=-EPERM b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46114" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46103" version="6" comment="exit=-EPERM b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46115" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46104" version="6" comment="exit=-EACCES b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46116" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46105" version="6" comment="exit=-EACCES b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46117" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46106" version="6" comment="success=0 processor type">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46118" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46107" version="6" comment="exit=-EPERM processor type">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46119" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46108" version="6" comment="exit=-EACCES processor type">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46120" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46200" version="1" comment="success=0 b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46200" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46201" version="1" comment="success=0 b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46201" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46202" version="1" comment="exit=-EPERM b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46202" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46203" version="1" comment="exit=-EPERM b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46203" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46204" version="1" comment="exit=-EACCES b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46204" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46205" version="1" comment="exit=-EACCES b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46205" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46300" version="1" comment="success=0 b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46300" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46301" version="1" comment="success=0 b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46301" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46302" version="1" comment="exit=-EPERM b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46302" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46303" version="1" comment="exit=-EPERM b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46303" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46304" version="1" comment="exit=-EACCES b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46304" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46305" version="1" comment="exit=-EACCES b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46305" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46400" version="1" comment="success=0 b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46400" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46401" version="1" comment="success=0 b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46401" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46402" version="1" comment="exit=-EPERM b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46402" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46403" version="1" comment="exit=-EPERM b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46403" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46404" version="1" comment="exit=-EACCES b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46404" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46405" version="1" comment="exit=-EACCES b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46405" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46500" version="1" comment="success=0 b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46500" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46501" version="1" comment="success=0 b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46501" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46502" version="1" comment="exit=-EPERM b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46502" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46503" version="1" comment="exit=-EPERM b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46503" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46504" version="1" comment="exit=-EACCES b32">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46504" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46505" version="1" comment="exit=-EACCES b64">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46505" var_check="at least one" />
      <instance datatype="int" operation="equals">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46600" version="1" comment="Enable auditing of deletions">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46603" var_check="at least one" />
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:46700" version="1" comment="Enable auditing of deletions">
      <path datatype="string" operation="equals">/etc/audit</path>
      <filename datatype="string" operation="equals">audit.rules</filename>
      <pattern datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:46604" var_check="at least one" />
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:uname_object id="oval:mil.disa.fso.rhel:obj:47800" version="9" comment="processor type" />
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:47801" version="4">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(-[aA][ -~&#xD;
]*)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49600" version="1" comment="File /var/spool/cron/*">
      <path datatype="string">/var/spool/cron</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49601" version="1" comment="File /etc/cron.d/*">
      <path datatype="string">/etc/cron.d</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49602" version="1" comment="File /etc/crontab">
      <path datatype="string">/etc</path>
      <filename datatype="string">crontab</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49700" version="1" comment="File /etc/cron.daily/*">
      <path datatype="string">/etc/cron.daily</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49701" version="1" comment="File /etc/cron.hourly/*">
      <path datatype="string">/etc/cron.hourly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49702" version="1" comment="File /etc/cron.monthly/*">
      <path datatype="string">/etc/cron.monthly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:49703" version="1" comment="File /etc/cron.weekly/*">
      <path datatype="string">/etc/cron.weekly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4400" version="3" comment="/etc/issue">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">issue</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">(You[ 	
&#xD;]+are[ 	
&#xD;]+accessing[ 	
&#xD;]+a[ 	
&#xD;]+U\.S\.[ 	
&#xD;]+Government[ 	
&#xD;]+\(USG\)[ 	
&#xD;]+Information[ 	
&#xD;]+System[ 	
&#xD;]+\(IS\)[ 	
&#xD;]+that[ 	
&#xD;]+is[ 	
&#xD;]+provided[ 	
&#xD;]+for[ 	
&#xD;]+USG[-—]authorized[ 	
&#xD;]+use[ 	
&#xD;]+only\.[ 	
&#xD;]+By[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+\(which[ 	
&#xD;]+includes[ 	
&#xD;]+any[ 	
&#xD;]+device[ 	
&#xD;]+attached[ 	
&#xD;]+to[ 	
&#xD;]+this[ 	
&#xD;]+IS\),[ 	
&#xD;]+you[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+the[ 	
&#xD;]+following[ 	
&#xD;]+conditions:[ 	
&#xD;]+-The[ 	
&#xD;]+USG[ 	
&#xD;]+routinely[ 	
&#xD;]+intercepts[ 	
&#xD;]+and[ 	
&#xD;]+monitors[ 	
&#xD;]+communications[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+for[ 	
&#xD;]+purposes[ 	
&#xD;]+including,[ 	
&#xD;]+but[ 	
&#xD;]+not[ 	
&#xD;]+limited[ 	
&#xD;]+to,[ 	
&#xD;]+penetration[ 	
&#xD;]+testing,[ 	
&#xD;]+COMSEC[ 	
&#xD;]+monitoring,[ 	
&#xD;]+network[ 	
&#xD;]+operations[ 	
&#xD;]+and[ 	
&#xD;]+defense,[ 	
&#xD;]+personnel[ 	
&#xD;]+misconduct[ 	
&#xD;]+\(PM\),[ 	
&#xD;]+law[ 	
&#xD;]+enforcement[ 	
&#xD;]+\(LE\),[ 	
&#xD;]+and[ 	
&#xD;]+counterintelligence[ 	
&#xD;]+\(CI\)[ 	
&#xD;]+investigations\.[ 	
&#xD;]+-At[ 	
&#xD;]+any[ 	
&#xD;]+time,[ 	
&#xD;]+the[ 	
&#xD;]+USG[ 	
&#xD;]+may[ 	
&#xD;]+inspect[ 	
&#xD;]+and[ 	
&#xD;]+seize[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS\.[ 	
&#xD;]+-Communications[ 	
&#xD;]+using,[ 	
&#xD;]+or[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on,[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+are[ 	
&#xD;]+not[ 	
&#xD;]+private,[ 	
&#xD;]+are[ 	
&#xD;]+subject[ 	
&#xD;]+to[ 	
&#xD;]+routine[ 	
&#xD;]+monitoring,[ 	
&#xD;]+interception,[ 	
&#xD;]+and[ 	
&#xD;]+search,[ 	
&#xD;]+and[ 	
&#xD;]+may[ 	
&#xD;]+be[ 	
&#xD;]+disclosed[ 	
&#xD;]+or[ 	
&#xD;]+used[ 	
&#xD;]+for[ 	
&#xD;]+any[ 	
&#xD;]+USG-authorized[ 	
&#xD;]+purpose\.[ 	
&#xD;]+[-—]This[ 	
&#xD;]+IS[ 	
&#xD;]+includes[ 	
&#xD;]+security[ 	
&#xD;]+measures[ 	
&#xD;]+\(e\.g\.,[ 	
&#xD;]+authentication[ 	
&#xD;]+and[ 	
&#xD;]+access[ 	
&#xD;]+controls\)[ 	
&#xD;]+to[ 	
&#xD;]+protect[ 	
&#xD;]+USG[ 	
&#xD;]+interests[—-]+not[ 	
&#xD;]+for[ 	
&#xD;]+your[ 	
&#xD;]+personal[ 	
&#xD;]+benefit[ 	
&#xD;]+or[ 	
&#xD;]+privacy\.[ 	
&#xD;]+[—-]Notwithstanding[ 	
&#xD;]+the[ 	
&#xD;]+above,[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+does[ 	
&#xD;]+not[ 	
&#xD;]+constitute[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+PM,[ 	
&#xD;]+LE[ 	
&#xD;]+or[ 	
&#xD;]+CI[ 	
&#xD;]+investigative[ 	
&#xD;]+searching[ 	
&#xD;]+or[ 	
&#xD;]+monitoring[ 	
&#xD;]+of[ 	
&#xD;]+the[ 	
&#xD;]+content[ 	
&#xD;]+of[ 	
&#xD;]+privileged[ 	
&#xD;]+communications,[ 	
&#xD;]+or work product,[ 	
&#xD;]+related[ 	
&#xD;]+to[ 	
&#xD;]+personal[ 	
&#xD;]+representation[ 	
&#xD;]+or[ 	
&#xD;]+services[ 	
&#xD;]+by[ 	
&#xD;]+attorneys,[ 	
&#xD;]+psychotherapists,[ 	
&#xD;]+or[ 	
&#xD;]+clergy,[ 	
&#xD;]+and[ 	
&#xD;]+their[ 	
&#xD;]+assistants\.[ 	
&#xD;]+Such[ 	
&#xD;]+communications[ 	
&#xD;]+and[ 	
&#xD;]+work[ 	
&#xD;]+product[ 	
&#xD;]+are[ 	
&#xD;]+private[ 	
&#xD;]+and[ 	
&#xD;]+confidential\.[ 	
&#xD;]+See[ 	
&#xD;]+User[ 	
&#xD;]+Agreement[ 	
&#xD;]+for[ 	
&#xD;]+details\.|I've[ 	
&#xD;]+read[ 	
&#xD;]+&amp;[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+terms[ 	
&#xD;]+in[ 	
&#xD;]+IS[ 	
&#xD;]+user[ 	
&#xD;]+agreem't\.)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7800" version="3" comment="/etc/securetty valid entries">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">securetty</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*([^ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:1200" version="2" comment="Xorg process">
      <unix-def:command operation="pattern match" datatype="string">^/usr/bin/Xorg</unix-def:command>
    </unix-def:process_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:7000" version="1" comment="all users">
      <unix-def:username operation="pattern match" datatype="string">.*</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:7001" version="1" comment="uid 0 and not root">
      <set>
        <object_reference>oval:mil.disa.fso.rhel:obj:7000</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:7001</filter>
      </set>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:7200" version="2" comment="root user">
      <unix-def:username datatype="string">root</unix-def:username>
    </unix-def:password_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:7201" version="2" comment="root home directory (as file)">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7200" datatype="string" />
      <unix-def:filename datatype="string" xsi:nil="true" />
    </unix-def:file_object>
    <environmentvariable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7700" version="3" comment="Get PATH variable">
      <name datatype="string" operation="equals">PATH</name>
    </environmentvariable_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:7701" version="1" comment="root exec search path directories">
      <unix-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7700" datatype="string" />
      <unix-def:filename datatype="string" xsi:nil="true" />
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7400" version="2" comment="~root/.* PATH=">
      <ind-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7200" datatype="string" />
      <ind-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7400" datatype="string" />
      <ind-def:pattern datatype="string" operation="pattern match">^PATH=([^ 	&#xD;
]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7500" version="2" comment="~root/.* LD_LIBRARY_PATH=something">
      <ind-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7200" datatype="string" />
      <ind-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7400" datatype="string" />
      <ind-def:pattern datatype="string" operation="pattern match">^LD_LIBRARY_PATH=([^ 	&#xD;
]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7600" version="2" comment="~root/.* LD_PRELOAD=something">
      <ind-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7200" datatype="string" />
      <ind-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7400" datatype="string" />
      <ind-def:pattern datatype="string" operation="pattern match">^LD_PRELOAD=([^ 	&#xD;
]+)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8900" version="3" comment="/usr/lib">
      <behaviors recurse_direction="down" />
      <path datatype="string" operation="equals">/usr/lib</path>
      <filename datatype="string" operation="pattern match">.*\.(so|a).*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8901" version="3" comment="/lib">
      <behaviors recurse_direction="down" />
      <path datatype="string" operation="equals">/lib</path>
      <filename datatype="string" operation="pattern match">.*\.(so|a).*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:9000" version="1" comment="Default comment, please change">
      <path datatype="string" operation="equals">/var/yp</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:11200" version="1" comment="Default comment, please change">
      <username datatype="string" operation="pattern match">.*</username>
    </password_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:12400" version="2" comment="run control scripts LD_PRELOAD=something">
      <ind-def:path datatype="string">/etc/rc.d/init.d</ind-def:path>
      <ind-def:filename operation="pattern match" datatype="string">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^LD_PRELOAD=([^ 	
&#xD;]*)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:variable_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:12401" version="2" comment="RCS preload paths">
      <ind-def:var_ref datatype="string">oval:mil.disa.fso.rhel:var:12400</ind-def:var_ref>
    </ind-def:variable_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13600" version="2" comment="run control scripts PATH=">
      <ind-def:path datatype="string">/etc/profile.d</ind-def:path>
      <ind-def:filename operation="pattern match" datatype="string">.*</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:13603" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:variable_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13601" version="2" comment="global init paths">
      <ind-def:var_ref datatype="string">oval:mil.disa.fso.rhel:var:13600</ind-def:var_ref>
    </ind-def:variable_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13602" version="2" comment="run control scripts PATH=">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:13602" datatype="string" />
      <ind-def:pattern datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:13603" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:variable_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:13603" version="2" comment="global init paths">
      <ind-def:var_ref datatype="string">oval:mil.disa.fso.rhel:var:13601</ind-def:var_ref>
    </ind-def:variable_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:16000" version="1" comment="/dev/audio">
      <path datatype="string" operation="equals">/dev</path>
      <filename datatype="string" operation="pattern match">^.*audio.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:16001" version="1" comment="/dev/snd">
      <path datatype="string" operation="equals">/dev/snd</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17100" version="1" comment="var">
      <oval-def:set>
        <oval-def:object_reference>oval:mil.disa.fso.rhel:obj:17101</oval-def:object_reference>
      </oval-def:set>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17101" version="1" comment="var">
      <path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:17100" />
      <filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:17101" />
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17102" version="1" comment="system audit logs path">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">auditd.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*log_file[ 	]*=[ 	]*([^ 	
&#xD;]+)/[^/]</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:17103" version="1" comment="system audit log file">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">auditd.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*log_file[ 	]*=[ 	]*[^ 	
&#xD;]+/([^/	
&#xD;]+)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17400" version="1" comment="/sbin/auditctl">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">auditctl</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17401" version="1" comment="/sbin/auditd">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">auditd</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17402" version="1" comment="/sbin/ausearch">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">ausearch</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17403" version="1" comment="/sbin/aureport">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">aureport</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17404" version="1" comment="/sbin/autrace">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">autrace</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:17405" version="1" comment="/sbin/audispd">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">audispd</filename>
    </file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:10700" version="1" comment="/etc/shadow">
      <unix-def:path datatype="string">/etc</unix-def:path>
      <unix-def:filename datatype="string">shadow</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:200" version="1" comment="/etc/gshadow">
      <unix-def:path datatype="string">/etc</unix-def:path>
      <unix-def:filename datatype="string">gshadow</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:22400" version="1">
      <ind-def:path datatype="string">/etc/security</ind-def:path>
      <ind-def:filename datatype="string">limits.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*\*[ 	
&#xD;]+hard[ 	
&#xD;]+core[ 	
&#xD;]+([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6900" version="1">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">su</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|\n)[ 	
&#xD;]*auth[ 	
&#xD;]+required[ 	
&#xD;]+pam_wheel\.so.*(\n|$)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5601" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">login.defs</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*PASS_MIN_LEN[ 	
&#xD;]*([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:shadow_object id="oval:mil.disa.fso.rhel:obj:6500" version="1" comment="all shadow users">
      <unix-def:username operation="pattern match" datatype="string">.*</unix-def:username>
    </unix-def:shadow_object>
    <unix-def:shadow_object id="oval:mil.disa.fso.rhel:obj:6501" version="1" comment="all shadow users with non-locked passwords">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:6500</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:6501</filter>
      </oval-def:set>
    </unix-def:shadow_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:11500" version="1" comment="all user home directories">
      <unix-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:11500" />
      <unix-def:filename xsi:nil="true" datatype="string" />
    </unix-def:file_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:11501" version="1" comment="all user home directories">
      <unix-def:username datatype="string" operation="pattern match">.*</unix-def:username>
    </unix-def:password_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:11502" version="1" comment="all human user home directories">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:11501</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:11501</filter>
        <filter>oval:mil.disa.fso.rhel:ste:11502</filter>
      </oval-def:set>
    </unix-def:password_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:44400" version="2">
      <ind-def:path datatype="string">/boot/grub</ind-def:path>
      <ind-def:filename datatype="string">grub.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ ]*password[ 	
	]+--md5[ 	
	]+[^ 
]*</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:44800" version="1" comment="/boot/grub/grub.conf">
      <unix-def:path datatype="string">/boot/grub</unix-def:path>
      <unix-def:filename datatype="string">grub.conf</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:3100" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">inittab</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">~:S:wait:/sbin/sulogin</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36300" version="1">
      <ind-def:path datatype="string">/proc/sys/net/ipv4</ind-def:path>
      <ind-def:filename datatype="string">ip_forward</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:23700" version="1">
      <ind-def:path datatype="string">/proc/sys/net/ipv4</ind-def:path>
      <ind-def:filename datatype="string">icmp_echo_ignore_broadcasts</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:24500" version="1">
      <ind-def:path datatype="string">/proc/sys/net/ipv4</ind-def:path>
      <ind-def:filename datatype="string">tcp_syncookies</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">([0-9]+)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41100" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">modprobe.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+ipv6[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:41101" version="1">
      <ind-def:path datatype="string">/etc/modprobe.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+ipv6[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:44102" version="1">
      <unix-def:service_name datatype="string">iptables</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">2</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:44103" version="1">
      <unix-def:service_name datatype="string">iptables</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">3</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:44104" version="1">
      <unix-def:service_name datatype="string">iptables</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">4</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:44105" version="1">
      <unix-def:service_name datatype="string">iptables</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">5</unix-def:runlevel>
    </unix-def:runlevel_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40200" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">modprobe.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+dccp[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40201" version="1">
      <ind-def:path datatype="string">/etc/modprobe.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+dccp[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40100" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">modprobe.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+sctp[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40101" version="1">
      <ind-def:path datatype="string">/etc/modprobe.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+sctp[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40700" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">modprobe.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+rds[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40701" version="1">
      <ind-def:path datatype="string">/etc/modprobe.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+rds[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40800" version="1">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">modprobe.conf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+tipc[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:40801" version="1">
      <ind-def:path datatype="string">/etc/modprobe.d</ind-def:path>
      <ind-def:filename datatype="string" operation="pattern match">.*</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*install[ 	
&#xD;]+tipc[ 	
&#xD;]+/bin/true</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:process_object id="oval:mil.disa.fso.rhel:obj:17000" version="2">
      <unix-def:command datatype="string">auditd</unix-def:command>
    </unix-def:process_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:2600" version="1">
      <ind-def:path datatype="string">/proc</ind-def:path>
      <ind-def:filename datatype="string">cmdline</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|[ 	
&#xD;])audit=1([ 	
&#xD;]|$)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18501" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18501" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18502" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18502" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18503" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18503" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18504" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18504" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18701" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18701" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18702" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18702" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18703" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18703" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18704" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18704" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18705" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18705" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18706" version="1">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18706" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:18810" version="1" comment="delete_module / b64">
      <ind-def:path datatype="string">/etc/audit</ind-def:path>
      <ind-def:filename datatype="string">audit.rules</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:18830" var_check="at least one" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:26700" version="1">
      <lin-def:name datatype="string">rsh-server</lin-def:name>
    </lin-def:rpminfo_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22901" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">1</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22902" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">2</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22903" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">3</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22904" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">4</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22905" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">5</unix-def:runlevel>
    </unix-def:runlevel_object>
    <unix-def:runlevel_object id="oval:mil.disa.fso.rhel:obj:22906" version="1">
      <unix-def:service_name datatype="string">kdump</unix-def:service_name>
      <unix-def:runlevel operation="equals" datatype="string">6</unix-def:runlevel>
    </unix-def:runlevel_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:32800" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Pp][Rr][Oo][Tt][Oo][Cc][Oo][lL][ 	
&#xD;]+2[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:8000" version="1" comment="PermitRootLogin no">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">(^|\n)[ 	
&#xD;]*[Pp][Ee][Rr][Mm][Ii][Tt][Rr][Oo][Oo][Tt][Ll][Oo][Gg][Ii][Nn][ 	
&#xD;]+no[ 	
&#xD;]*(\n|$)</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36100" version="1" comment="SSH Banner Path">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Bb][Aa][Nn][Nn][Ee][Rr][ 	
&#xD;]+(.*)/[^/]+$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36101" version="1" comment="SSH Banner File">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Bb][Aa][Nn][Nn][Ee][Rr][ 	
&#xD;]+.*/([^/ 	
&#xD;]+)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:36102" version="1" comment="SSH Banner File">
      <ind-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:36100" />
      <ind-def:filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:36101" />
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:36102" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:33100" version="1">
      <ind-def:path datatype="string">/etc/ssh</ind-def:path>
      <ind-def:filename datatype="string">sshd_config</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*[Cc][Ii][Pp][Hh][Ee][Rr][Ss][ 	
&#xD;]+([^ 	
&#xD;]*)[ 	
&#xD;]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6100" version="1" comment="lcredit">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6100" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6300" version="1" comment="ocredit">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.rhel:var:6300" var_check="at least one" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6200" version="1" comment="dcredit">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6200" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5600" version="1">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:5600" />
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6000" version="1" comment="ucredit">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6000" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:6600" version="1" comment="difok">
      <ind-def:path datatype="string">/etc/pam.d</ind-def:path>
      <ind-def:filename datatype="string">system-auth</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:6600" />
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7900" version="1" comment="fstab mounts">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">fstab</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	]*[^# 	]+[ 	]+([^# 	]+)[ 	]+</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:7901" version="1" comment="root shell">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">passwd</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^root:[^:]*:[^:]*:[^:]*:[^:]*:[^:]*:(/[^/]*)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:3200" version="1">
      <lin-def:name datatype="string">redhat-release</lin-def:name>
    </lin-def:rpminfo_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12900" version="2" comment="/etc/csh.cshrc file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">csh.cshrc</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12901" version="2" comment="/etc/profile file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">profile</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12902" version="2" comment="/etc/bashrc file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">bashrc</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12903" version="2" comment="/etc/environment file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">environment</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12904" version="2" comment="/etc/csh.login file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">csh.login</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12905" version="2" comment="/etc/csh.logout file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">csh.logout</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12906" version="2" comment="/etc/ksh.kshrc file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">ksh.kshrc</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12907" version="2" comment="/etc/suid_profile file">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">suid_profile</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12908" version="2" comment="/etc/profile.d directory">
      <path datatype="string" operation="equals">/etc/profile.d</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12909" version="2" comment="/etc/profile.d directory files">
      <path datatype="string" operation="equals">/etc/profile.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:14200" version="2" comment="run control scripts PATH=">
      <ind-def:path var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:14202" datatype="string" />
      <ind-def:filename operation="pattern match" datatype="string">^\.</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:14203" />
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:variable_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:14201" version="2" comment="local init paths">
      <ind-def:var_ref datatype="string">oval:mil.disa.fso.rhel:var:14200</ind-def:var_ref>
    </ind-def:variable_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:14202" version="2" comment="all passwd entries except gdm (gdm has .gdmfifo, the reading of which causes collection to hang)">
      <unix-def:username operation="not equal" datatype="string">gdm</unix-def:username>
    </unix-def:password_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:15100" version="1" comment="The .rhosts file must not be supported in PAM">
      <path datatype="string" operation="equals">/etc/pam.d</path>
      <filename datatype="string" operation="pattern match">.*</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*(rhosts_auth)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:30800" version="2" comment="xinetd ftp (gssftp) services">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name datatype="string">ftp</unix-def:service_name>
    </unix-def:xinetd_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:30801" version="2" comment="vsftp anon umask">
      <path datatype="string">/etc/vsftpd</path>
      <filename datatype="string">vsftpd.conf</filename>
      <pattern datatype="string" operation="pattern match">^anon_umask=([0-9]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:30802" version="2" comment="vsftp local umask">
      <path datatype="string">/etc/vsftpd</path>
      <filename datatype="string">vsftpd.conf</filename>
      <pattern datatype="string" operation="pattern match">^local_umask=([0-9]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:2400" version="2" comment="Default comment, please change">
      <path datatype="string" operation="equals">/etc/</path>
      <filename datatype="string" operation="equals">securetty</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:4100" version="3" comment="ntp.conf">
      <path datatype="string" operation="equals">/etc/</path>
      <filename datatype="string" operation="equals">ntp.conf</filename>
    </file_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:5700" version="2" comment="all password entries">
      <username datatype="string" operation="pattern match">.*</username>
    </password_object>
    <shadow_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:5701" version="2" comment="all shadow entries">
      <username datatype="string" operation="pattern match">.*</username>
    </shadow_object>
    <shadow_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:5900" version="3" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm">
      <username datatype="string" operation="pattern match">.*</username>
    </shadow_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:5901" version="3" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm">
      <username datatype="string" operation="pattern match">.*</username>
    </password_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:11300" version="3" comment="/etc/group hashes">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">group</filename>
      <pattern datatype="string" operation="pattern match">^[^:]*:([^:]*):</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:11400" version="3" comment="gshadow hashes">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">gshadow</filename>
      <pattern datatype="string" operation="pattern match">^[^:]+:([^:]+)</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:31600" version="4" comment="Examine snmpd.conf">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">snmpd.conf</filename>
      <pattern datatype="string" operation="pattern match">^[^#]*([Vv]1|[Vv]2[Cc]|[Cc][Oo][Mm][Mm][Uu][Nn][Ii][Tt][Yy]|[Cc][Oo][Mm]2[Ss][Ee][Cc])</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:4603" version="4" comment="VSFTP rpm">
      <lin-def:name datatype="string">vsftpd</lin-def:name>
    </lin-def:rpminfo_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:4604" version="4" comment="gssftp xinetd file">
      <unix-def:path datatype="string">/etc/xinetd.d</unix-def:path>
      <unix-def:filename datatype="string">gssftp</unix-def:filename>
    </unix-def:file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4605" version="4" comment="gssftp FTP Banner File">
      <ind-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:4603" />
      <ind-def:filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:4604" />
      <ind-def:pattern operation="pattern match" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:4602" />
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4606" version="4" comment="gssftp FTP Banner Path">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string">gssftp</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*banner[ 	]+=[ 	]+(.*)/[^/]+$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4607" version="4" comment="gssftp FTP Banner File">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string">gssftp</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*banner[ 	]+=[ 	]+.*/([^/ 	
&#xD;]+)[ ]*$</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:29900" version="6" comment="sendmail rpm">
      <lin-def:name datatype="string">sendmail</lin-def:name>
    </lin-def:rpminfo_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29901" version="6" comment="sendmail DaemonPortOptions">
      <ind-def:path datatype="string">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string">sendmail.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^O DaemonPortOptions=[^#
&#xD;]*Addr=([-_A-Za-z.0-9]*)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29902" version="7" comment="sendmail promisc_relay">
      <ind-def:path datatype="string">/etc/mail</ind-def:path>
      <ind-def:filename datatype="string">sendmail.mc</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*FEATURE\('promiscuous_relay'\)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:29903" version="6" comment="postfix rpm">
      <lin-def:name datatype="string">postfix</lin-def:name>
    </lin-def:rpminfo_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29904" version="7" comment="postfix inet_interfaces">
      <ind-def:path datatype="string">/etc/postfix</ind-def:path>
      <ind-def:filename datatype="string">main.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*inet_interfaces[ 	]*=[ 	]*([-A-Za-z0-9:\.]+[, 	]*)</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:29905" version="7" comment="postfix smtp_client_restrictions">
      <ind-def:path datatype="string">/etc/postfix</ind-def:path>
      <ind-def:filename datatype="string">main.cf</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	]*smtpd_client_restrictions[ 	]*=[ 	]*([a-zA-Z0-9\._ ]*[, ]*)reject[^_]$</ind-def:pattern>
      <ind-def:instance datatype="int" operation="greater than or equal">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12601" version="1" comment="All system start-up files must be owned by root or bin.">
      <path datatype="string" operation="pattern match">^\/etc\/rc.*$</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:12701" version="1" comment="All system start-up files must be owned by a system group.">
      <path datatype="string" operation="pattern match">^\/etc\/rc(.*)$</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:30600" version="1" comment="ftp user(s)">
      <unix-def:username operation="pattern match" datatype="string">^ftp</unix-def:username>
    </unix-def:password_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:31400" version="1" comment="uucp service">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name datatype="string">uucp</unix-def:service_name>
    </unix-def:xinetd_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:5500" version="3" comment="The system must not have accounts configured with blank or null passwords">
      <path datatype="string" operation="equals">/etc/pam.d</path>
      <filename datatype="string" operation="pattern match">^system-auth(-ac)?$</filename>
      <pattern datatype="string" operation="pattern match">^[^#]+nullok.*$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:7100" version="1" comment="root user">
      <unix-def:username datatype="string">root</unix-def:username>
    </unix-def:password_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:4300" version="1">
      <username datatype="string" operation="pattern match">.*</username>
    </password_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:4301" version="2" comment="all local groups">
      <path datatype="string">/etc</path>
      <filename datatype="string">group</filename>
      <pattern datatype="string" operation="pattern match">^[^:]*:[^:]*:([0-9]+):</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:8700" version="3" comment="/var/log">
      <unix-def:behaviors recurse_direction="down" />
      <unix-def:path datatype="string" operation="equals">/var/log</unix-def:path>
      <unix-def:filename datatype="string" operation="pattern match">.*</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:8701" version="3" comment="/var/log/syslog">
      <unix-def:behaviors recurse_direction="down" />
      <unix-def:path datatype="string" operation="equals">/var/log/syslog</unix-def:path>
      <unix-def:filename datatype="string" operation="pattern match">.*</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:8702" version="3" comment="/var/adm">
      <unix-def:behaviors recurse_direction="down" />
      <unix-def:path datatype="string" operation="equals">/var/adm</unix-def:path>
      <unix-def:filename datatype="string" operation="pattern match">.*</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:8703" version="3" comment="filename not wtmp">
      <set>
        <object_reference>oval:mil.disa.fso.rhel:obj:8700</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:8701</filter>
      </set>
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:13300" version="2" comment="Skeleton files (/etc/skel)">
      <path datatype="string" operation="equals">/etc/skel</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:9100" version="1" comment="The NIS/NIS+/yp command files must have mode 0755 or less permissive.">
      <path datatype="string" operation="equals">/var/yp</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8500" version="2" comment="All system files, programs, and directories must be owned by a system account (/etc)">
      <path datatype="string" operation="equals">/etc</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8501" version="2" comment="System files and directories under /etc">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8502" version="2" comment="All system files, programs, and directories must be owned by a system account (/bin)">
      <path datatype="string" operation="equals">/bin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8503" version="2" comment="System files and directories under /bin">
      <path datatype="string" operation="equals">/bin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8504" version="2" comment="All system files, programs, and directories must be owned by a system account (/sbin)">
      <path datatype="string" operation="equals">/sbin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8505" version="2" comment="System files and directories under /sbin">
      <path datatype="string" operation="equals">/sbin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8506" version="2" comment="All system files, programs, and directories must be owned by a system account (/usr/bin)">
      <path datatype="string" operation="equals">/usr/bin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8507" version="2" comment="System files and directories under /usr/bin">
      <path datatype="string" operation="equals">/usr/bin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8508" version="2" comment="All system files, programs, and directories must be owned by a system account (/usr/sbin)">
      <path datatype="string" operation="equals">/usr/sbin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8509" version="2" comment="System files and directories under /usr/sbin">
      <path datatype="string" operation="equals">/usr/sbin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8510" version="2" comment="All system files, programs, and directories must be owned by a system account (/usr/local/bin)">
      <path datatype="string" operation="equals">/usr/local/bin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8511" version="2" comment="System files and directories under /usr/local/bin">
      <path datatype="string" operation="equals">/usr/local/bin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8512" version="2" comment="All system files, programs, and directories must be owned by a system account (/usr/local/sbin)">
      <path datatype="string" operation="equals">/usr/local/sbin</path>
      <filename xsi:nil="true" datatype="string" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:8513" version="2" comment="System files and directories under /usr/local/sbin">
      <path datatype="string" operation="equals">/usr/local/sbin</path>
      <filename datatype="string" operation="pattern match">.*</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30100" version="2" comment="/etc/ftpusers existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30101" version="2" comment="/etc/vsftpd.ftpusers existence">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">vsftpd.ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30102" version="2" comment="/etc/vsftpd/ftpusers existence">
      <path datatype="string" operation="equals">/etc/vsftpd</path>
      <filename datatype="string" operation="equals">ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30103" version="2" comment="/etc/xinetd.d/gssftp">
      <path datatype="string" operation="equals">/etc/xinetd.d</path>
      <filename datatype="string" operation="equals">gssftp</filename>
    </file_object>
    <rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:30104" version="2" comment="vsftpd package">
      <name datatype="string">vsftpd</name>
    </rpminfo_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:30105" version="2" comment="gssftp disabled">
      <path datatype="string">/etc/xinetd.d</path>
      <filename datatype="string">gssftp</filename>
      <pattern datatype="string" operation="pattern match">^[ 	]+disable[ 	]*=[ 	]*yes</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <process_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30106" version="2" comment="vsftpd process">
      <command datatype="string" operation="pattern match">^/usr/sbin/vsftpd</command>
    </process_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:31000" version="2">
      <ind-def:path datatype="string">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string">tftp</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[ 	
&#xD;]*server_args[ 	
&#xD;]*=[ 	
&#xD;]*-s</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:31001" version="2">
      <unix-def:path datatype="string">/etc/xinetd.d</unix-def:path>
      <unix-def:filename datatype="string">tftp</unix-def:filename>
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:31100" version="2" comment="Referenced object">
      <oval-def:set>
        <oval-def:object_reference>oval:mil.disa.fso.rhel:obj:31101</oval-def:object_reference>
      </oval-def:set>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:31101" version="2" comment="Variables">
      <path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:31100" />
      <filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:31101" />
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:31102" version="2" comment="TFTP daemon path">
      <ind-def:path datatype="string" operation="equals">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">tftp</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*server[ 	]*=[ 	]*([^ 	
&#xD;]+)/[^/]</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:31103" version="2" comment="TFTP daemon file">
      <ind-def:path datatype="string" operation="equals">/etc/xinetd.d</ind-def:path>
      <ind-def:filename datatype="string" operation="equals">tftp</ind-def:filename>
      <ind-def:pattern datatype="string" operation="pattern match">^[ 	
&#xD;]*server[ 	]*=[ 	]*[^ 	
&#xD;]+/([^/	
&#xD;]+)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <lin-def:rpminfo_object xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:obj:31200" version="2" comment="tftp-server rpm">
      <lin-def:name datatype="string">tftp-server</lin-def:name>
    </lin-def:rpminfo_object>
    <unix-def:xinetd_object id="oval:mil.disa.fso.rhel:obj:31201" version="2" comment="xinetd tftp">
      <unix-def:protocol operation="pattern match" datatype="string">.*</unix-def:protocol>
      <unix-def:service_name datatype="string">tftp</unix-def:service_name>
    </unix-def:xinetd_object>
    <unix-def:password_object id="oval:mil.disa.fso.rhel:obj:31202" version="2" comment="tftp user">
      <unix-def:username datatype="string">tftp</unix-def:username>
    </unix-def:password_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:11000" version="3" comment="All users must be assigned a home directory in the /etc/password file.">
      <username datatype="string" operation="pattern match">.+</username>
    </password_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:15200" version="1" comment="/etc/shells file must exist">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">shells</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:15400" version="1" comment="user ownership">
      <oval-def:set>
        <oval-def:object_reference>oval:mil.disa.fso.rhel:obj:15403</oval-def:object_reference>
        <oval-def:filter>oval:mil.disa.fso.rhel:ste:15401</oval-def:filter>
      </oval-def:set>
    </file_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:15401" version="2" comment="user ownership">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">shells</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^([^ 	
&#xD;]*)/[^/ 	
&#xD;]+</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <ind-def:textfilecontent54_object xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:15402" version="2" comment="user ownership">
      <ind-def:path datatype="string">/etc</ind-def:path>
      <ind-def:filename datatype="string">shells</ind-def:filename>
      <ind-def:pattern operation="pattern match" datatype="string">^[^ 	
&#xD;]*/([^/ 	
&#xD;]+)</ind-def:pattern>
      <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:15403" version="1" comment="user ownership">
      <path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:15400" />
      <filename datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:15401" />
    </file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:15700" version="1" comment="device directories">
      <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" />
      <unix-def:path datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:15700" />
      <unix-def:filename datatype="string" operation="pattern match">.*</unix-def:filename>
    </unix-def:file_object>
    <unix-def:file_object id="oval:mil.disa.fso.rhel:obj:15701" version="1" comment="devices, less those known authorized as world-writable">
      <oval-def:set>
        <object_reference>oval:mil.disa.fso.rhel:obj:15700</object_reference>
        <filter>oval:mil.disa.fso.rhel:ste:15700</filter>
        <filter>oval:mil.disa.fso.rhel:ste:15701</filter>
        <filter>oval:mil.disa.fso.rhel:ste:15702</filter>
      </oval-def:set>
    </unix-def:file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:10300" version="6" comment="File /etc/passwd">
      <path datatype="string">/etc</path>
      <filename datatype="string">passwd</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25600" version="6" comment="File /etc/xinetd.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">xinetd.conf</filename>
    </file_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25601" version="6" comment="User bin">
      <username datatype="string">bin</username>
    </password_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25602" version="6" comment="File /etc/xinetd.d/*">
      <path datatype="string">/etc/xinetd.d</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:26000" version="6" comment="File /etc/services">
      <path datatype="string">/etc</path>
      <filename datatype="string">services</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:27600" version="6" comment="File /etc/cups/printers.conf">
      <path datatype="string">/etc/cups</path>
      <filename datatype="string">printers.conf</filename>
    </file_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:27601" version="6" comment="User sys">
      <username datatype="string">sys</username>
    </password_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21701" version="6" comment="User daemon">
      <username datatype="string">daemon</username>
    </password_object>
    <password_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:27602" version="6" comment="User lp">
      <username datatype="string">lp</username>
    </password_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28200" version="6" comment="File /etc/aliases">
      <path datatype="string">/etc</path>
      <filename datatype="string">aliases</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28201" version="6" comment="File /etc/aliases.db">
      <path datatype="string">/etc</path>
      <filename datatype="string">aliases.db</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28400" version="6" comment="File /etc/aliases">
      <path datatype="string">/etc</path>
      <filename datatype="string">aliases</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30300" version="6" comment="File /etc/ftpusers">
      <path datatype="string">/etc</path>
      <filename datatype="string">ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30301" version="6" comment="File /etc/vsftpd.ftpusers">
      <path datatype="string">/etc</path>
      <filename datatype="string">vsftpd.ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:30302" version="6" comment="File /etc/vsftpd/ftpusers">
      <path datatype="string">/etc/vsftpd</path>
      <filename datatype="string">ftpusers</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:36600" version="6" comment="File /etc/exports">
      <path datatype="string">/etc</path>
      <filename datatype="string">exports</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19700" version="6" comment="File /var/spool/cron/*">
      <path datatype="string">/var/spool/cron</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19701" version="6" comment="File /etc/cron.d/*">
      <path datatype="string">/etc/cron.d</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19702" version="6" comment="File /etc/crontab">
      <path datatype="string">/etc</path>
      <filename datatype="string">crontab</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19703" version="6" comment="File /etc/cron.daily/*">
      <path datatype="string">/etc/cron.daily</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19704" version="6" comment="File /etc/cron.hourly/*">
      <path datatype="string">/etc/cron.hourly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19705" version="6" comment="File /etc/cron.monthly/*">
      <path datatype="string">/etc/cron.monthly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19706" version="6" comment="File /etc/cron.weekly/*">
      <path datatype="string">/etc/cron.weekly</path>
      <filename datatype="string" operation="pattern match">^.*$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19800" version="2" comment="File /var/spool/cron">
      <path datatype="string">/var/spool/cron</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19801" version="2" comment="File /etc/cron.d">
      <path datatype="string">/etc/cron.d</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19802" version="2" comment="File /etc/cron.daily">
      <path datatype="string">/etc/cron.daily</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19803" version="2" comment="File /etc/cron.hourly">
      <path datatype="string">/etc/cron.daily</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19804" version="2" comment="File /etc/cron.monthly">
      <path datatype="string">/etc/cron.monthly</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:19805" version="2" comment="File /etc/cron.weekly">
      <path datatype="string">/etc/cron.weekly</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:38100" version="3" comment="/etc/group for sys">
      <path datatype="string">/etc</path>
      <filename datatype="string">group</filename>
      <pattern datatype="string" operation="pattern match">^sys:[^:]*:([0-9]+):</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:obj:38102" version="3" comment="/etc/group for bin">
      <path datatype="string">/etc</path>
      <filename datatype="string">group</filename>
      <pattern datatype="string" operation="pattern match">^bin:[^:]*:([0-9]+):</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:20200" version="6" comment="File /var/log/cron">
      <path datatype="string">/var/log</path>
      <filename datatype="string">cron</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21300" version="6" comment="File /etc/at.allow">
      <path datatype="string">/etc</path>
      <filename datatype="string">at.allow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:31900" version="2" comment="File /etc/snmp/snmpd.conf">
      <path datatype="string">/etc/snmp</path>
      <filename datatype="string">snmpd.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:1400" version="6" comment="File /etc/login.access">
      <path datatype="string">/etc</path>
      <filename datatype="string">login.access</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:1401" version="6" comment="File /etc/security/access.conf">
      <path datatype="string">/etc/security</path>
      <filename datatype="string">access.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:1402" version="6" comment="File /etc/access.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">access.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:37700" version="6" comment="File /etc/smb.conf">
      <path datatype="string">/etc/samba</path>
      <filename datatype="string">smb.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:38000" version="12" comment="File /etc/samba/passwd.tdb">
      <path datatype="string">/etc/samba</path>
      <filename datatype="string">passwd.tdb</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:38001" version="6" comment="File /etc/samba/secrets.tdb">
      <path datatype="string" operation="equals">/etc/samba</path>
      <filename datatype="string" operation="equals">secrets.tdb</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:44600" version="2" comment="File /boot/grub/grub.conf">
      <path datatype="string">/boot/grub</path>
      <filename datatype="string">grub.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:39000" version="6" comment="File /etc/news/readers.conf">
      <path datatype="string">/etc/news</path>
      <filename datatype="string">readers.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:39100" version="6" comment="File /etc/news/passwd.nntp">
      <path datatype="string">/etc/news</path>
      <filename datatype="string">passwd.nntp</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:1700" version="6" comment="File /etc/sysctl.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">sysctl.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:20300" version="6" comment="File /etc/cron.deny">
      <path datatype="string">/etc</path>
      <filename datatype="string">cron.deny</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:22200" version="6" comment="File /etc/at.deny">
      <path datatype="string">/etc</path>
      <filename datatype="string">at.deny</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:28000" version="2" comment="File /bin/traceroute">
      <path datatype="string">/bin</path>
      <filename datatype="string">traceroute</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:32400" version="6" comment="File /etc/syslog.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">syslog.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:23000" version="2" comment="File /var/crash">
      <path datatype="string">/var/crash</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:2200" version="6" comment="File /etc/securetty">
      <path datatype="string">/etc</path>
      <filename datatype="string">securetty</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:4000" version="6" comment="File /etc/ntp.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">ntp.conf</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:10400" version="6" comment="File /etc/group">
      <path datatype="string">/etc</path>
      <filename datatype="string">group</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:10800" version="6" comment="File /etc/shadow">
      <path datatype="string">/etc</path>
      <filename datatype="string">shadow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:100" version="6" comment="File /etc/gshadow">
      <path datatype="string">/etc</path>
      <filename datatype="string">gshadow</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:21800" version="6" comment="File /var/spool/at">
      <path datatype="string">/var/spool/at</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:25900" version="2" comment="File /etc/xinetd.d">
      <path datatype="string">/etc/xinetd.d</path>
      <filename datatype="string" xsi:nil="true" />
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:34400" version="6" comment="File /etc/ssh/*key.pub">
      <path datatype="string">/etc/ssh</path>
      <filename datatype="string" operation="pattern match">^.*key\.pub$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:34500" version="6" comment="File /etc/ssh/*key">
      <path datatype="string">/etc/ssh</path>
      <filename datatype="string" operation="pattern match">^.*key$</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:obj:42500" version="6" comment="File /etc/ldap.conf">
      <path datatype="string">/etc</path>
      <filename datatype="string">ldap.conf</filename>
    </file_object>
  </objects>
  <states>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:46804" version="1" comment="32-bit archs">
      <unix-def:processor_type operation="pattern match">^i386$|^i686$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:46805" version="1" comment="32/64-bit dual archs">
      <unix-def:processor_type operation="pattern match">^x86_64$|^amd64$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:46806" version="1" comment="64-bit archs">
      <unix-def:processor_type operation="pattern match">^ia64$</unix-def:processor_type>
    </unix-def:uname_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46800" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46840" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46801" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46841" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46802" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46842" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46803" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46843" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46807" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46824" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46808" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46825" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46809" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46826" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46810" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46827" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46811" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46804" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46812" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46805" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46813" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46806" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46814" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46807" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46815" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46848" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46816" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46849" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46817" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46850" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46818" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46851" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46819" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46844" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46820" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46845" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46821" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46846" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46822" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46847" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46823" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46828" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46824" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46829" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46825" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46830" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46826" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46831" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46827" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46832" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46828" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46833" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46829" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46834" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46830" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46835" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46831" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46836" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46832" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46837" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46833" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46838" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:46834" version="1">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:46839" />
    </ind-def:textfilecontent54_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:49100" version="5" comment="32-bit archs">
      <unix-def:processor_type operation="pattern match">^i386$|^i686$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:49101" version="5" comment="32/64-bit dual archs">
      <unix-def:processor_type operation="pattern match">^x86_64$|^amd64$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:49102" version="5" comment="64-bit archs">
      <unix-def:processor_type operation="pattern match">^ia64$</unix-def:processor_type>
    </unix-def:uname_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:3000" version="5">
      <ind-def:subexpression datatype="string" operation="equals">enforcing</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:3001" version="5">
      <ind-def:subexpression datatype="string" operation="pattern match">^(targeted|strict)$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:3900" version="3" comment="owned by root for ntp.conf">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:4700" version="4" comment="maxlogins">
      <ind-def:subexpression datatype="int" operation="less than or equal">10</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:5000" version="4" comment="deny">
      <ind-def:instance datatype="int">1</ind-def:instance>
      <ind-def:subexpression operation="less than or equal" datatype="int" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:5000" />
    </ind-def:textfilecontent54_state>
    <ind-def:xmlfilecontent_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:5201" version="4" comment="idle_activation_enabled">
      <ind-def:value_of datatype="string" operation="equals">true</ind-def:value_of>
    </ind-def:xmlfilecontent_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6400" version="4" comment="pam_cracklib maxrepeat">
      <ind-def:subexpression operation="pattern match" datatype="string">^[1-3]$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6801" version="4">
      <ind-def:subexpression datatype="int" var_check="all" operation="greater than or equal" var_ref="oval:mil.disa.fso.rhel:var:6800" />
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:8300" version="2" comment="0755 permissions or less permissive">
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:9400" version="1" comment="File has mode 644">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uread datatype="boolean" operation="equals">true</uread>
      <uwrite datatype="boolean" operation="equals">true</uwrite>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gread datatype="boolean" operation="equals">true</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">true</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:25600" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals">0</user_id>
    </file_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:11100" version="1" comment="UID &lt; 500 (system/app accts)">
      <unix-def:user_id operation="pattern match" datatype="string">^(0*[0-9]{0,2}|^0*[0-4][0-9][0-9])$</unix-def:user_id>
    </unix-def:password_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:12100" version="2" comment="perms 0755 or less">
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:15000" version="3" comment="mode 0600 or less">
      <unix-def:suid datatype="boolean" operation="equals">false</unix-def:suid>
      <unix-def:sgid datatype="boolean" operation="equals">false</unix-def:sgid>
      <unix-def:uexec datatype="boolean" operation="equals">false</unix-def:uexec>
      <unix-def:gread datatype="boolean" operation="equals">false</unix-def:gread>
      <unix-def:gwrite datatype="boolean" operation="equals">false</unix-def:gwrite>
      <unix-def:gexec datatype="boolean" operation="equals">false</unix-def:gexec>
      <unix-def:oread datatype="boolean" operation="equals">false</unix-def:oread>
      <unix-def:owrite datatype="boolean" operation="equals">false</unix-def:owrite>
      <unix-def:oexec datatype="boolean" operation="equals">false</unix-def:oexec>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:14800" version="3" comment="proc">
      <unix-def:path operation="pattern match">^/?proc/?$</unix-def:path>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:14801" version="3" comment="sys">
      <unix-def:path operation="pattern match">^/?sys/?$</unix-def:path>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:14802" version="3" comment="dev">
      <unix-def:path operation="pattern match">^/?dev/?$</unix-def:path>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:14803" version="3" comment="/">
      <unix-def:path operation="pattern match">^//?$</unix-def:path>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:14804" version="3" comment="selinux">
      <unix-def:path operation="pattern match">^/?selinux/?$</unix-def:path>
    </unix-def:file_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:16800" version="2" comment="umask value">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">umask[ 	]+[0][7][7]</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:17700" version="1" comment="valid full/error actions">
      <ind-def:subexpression operation="pattern match">^(syslog|exec|single|halt)$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:18500" version="4" comment="32-bit archs">
      <unix-def:processor_type operation="pattern match">^i386$|^i686$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:18501" version="4" comment="32/64-bit dual archs">
      <unix-def:processor_type operation="pattern match">^x86_64$|^amd64$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:18502" version="4" comment="64-bit archs">
      <unix-def:processor_type operation="pattern match">^ia64$</unix-def:processor_type>
    </unix-def:uname_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18505" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18501" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18506" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18502" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18503" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18503" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18504" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:18504" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18700" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18700" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18701" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18701" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18702" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18702" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18703" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18703" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18704" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18704" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18705" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18705" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18706" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:18706" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:18900" version="2" comment="audips syslog active yes">
      <ind-def:subexpression datatype="string">yes</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19100" version="1" comment="File has mode 600 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19500" version="1" comment="Files must be group-owned by root">
      <group_id datatype="string" operation="equals" entity_check="all" var_check="all">0</group_id>
    </file_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19601" version="1" comment="UID greater than or equal to 500">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^0*([5-9][0-9][0-9]|[1-9][0-9][0-9][0-9]+)$</user_id>
    </password_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19602" version="1" comment="root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </password_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:19600" version="1" comment="not any default system accounts (except root)">
      <subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:19600" />
    </textfilecontent54_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19603" version="1" comment="cron.deny entries">
      <username operation="equals" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:19601" />
    </password_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:20000" version="1" comment="group-owned by root, bin, sys, or cron">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:21200" version="1" comment="UID greater than or equal to 500">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^0*([5-9][0-9][0-9]|[1-9][0-9][0-9][0-9]+)$</user_id>
    </password_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:21201" version="1" comment="root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </password_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:21202" version="1" comment="not any default system accounts (except root)">
      <subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:mil.disa.fso.rhel:var:21200" />
    </textfilecontent54_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:21203" version="1" comment="at.deny entries">
      <username operation="equals" datatype="string" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:21201" />
    </password_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:21600" version="1" comment="File has mode 0755 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:21700" version="2" comment="owned by root, sys, or bin (or daemon)">
      <unix-def:user_id operation="pattern match">^(0|1|2|3)$</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:21800" version="2" comment="group-owned by root, bin, sys, or cron (or daemon)">
      <unix-def:group_id operation="pattern match">^(0|1|2|3)$</unix-def:group_id>
    </unix-def:file_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23300" version="1" comment="kernel.exec-shield = 1">
      <subexpression datatype="string" operation="equals">1</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23301" version="1" comment="kernel.randomize_va_space = 1">
      <subexpression datatype="string" operation="equals">1</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23500" version="4">
      <ind-def:subexpression operation="equals" datatype="int">0</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23600" version="1" comment="Setting">
      <subexpression datatype="int" operation="greater than or equal">1280</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23800" version="1">
      <ind-def:subexpression datatype="int" operation="equals">1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24000" version="1" comment="Setting">
      <subexpression datatype="string" operation="equals">0</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24100" version="1" comment="Setting">
      <subexpression datatype="string" operation="equals">0</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24200" version="4">
      <ind-def:subexpression operation="equals">0</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24300" version="4">
      <ind-def:subexpression datatype="int" operation="equals">0</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24400" version="4">
      <ind-def:subexpression datatype="int" operation="equals">1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:25200" version="1" comment="journaling or excepted types for root">
      <subexpression datatype="string" operation="pattern match">^(rootfs|jfs|vxfs|hfs|xfs|reiserfs|ext3|ext4)$</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:25300" version="1" comment="journaling or excepted types for local">
      <subexpression datatype="string" operation="pattern match">^(rootfs|jfs|vxfs|hfs|xfs|reiserfs|ext3|ext4|iso9660|udf)$</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:25201" version="1" comment="nolog option">
      <subexpression datatype="string" operation="pattern match">(^|,)nolog(,|$)</subexpression>
    </textfilecontent54_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:25500" version="1" comment="not disabled">
      <unix-def:disabled datatype="boolean">false</unix-def:disabled>
    </unix-def:xinetd_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:25700" version="1" comment="xinetd.conf file, xinetd.d directory, and xinetd.d directory files are group-owned by user root, bin, or sys">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:26306" version="6" comment="filter out filenames with log_on_failure">
      <filename datatype="string" operation="equals" entity_check="all" var_ref="oval:mil.disa.fso.rhel:var:26302" var_check="at least one" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:26305" version="6" comment="filter out filenames with log_on_success">
      <filename datatype="string" operation="equals" entity_check="all" var_ref="oval:mil.disa.fso.rhel:var:26301" var_check="at least one" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:26304" version="6" comment="filter out filenames with log_type">
      <filename datatype="string" operation="equals" entity_check="all" var_ref="oval:mil.disa.fso.rhel:var:26300" var_check="at least one" />
    </file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:26300" version="7" comment="xinetd HOST">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|[ 	])HOST([ 	]|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:26301" version="7" comment="xinetd PID">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|[ 	])PID([ 	]|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:26302" version="7" comment="xinetd USERID">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|[ 	])USERID([ 	]|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:26303" version="7" comment="xinetd EXIT">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|[ 	])EXIT([ 	]|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:runlevel_state id="oval:mil.disa.fso.rhel:ste:26400" version="2" comment="not running">
      <unix-def:start datatype="boolean">false</unix-def:start>
    </unix-def:runlevel_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:26600" version="1" comment="xinetd disabled">
      <unix-def:disabled datatype="boolean">true</unix-def:disabled>
    </unix-def:xinetd_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:26800" version="1" comment="xinetd disabled">
      <unix-def:disabled datatype="boolean">true</unix-def:disabled>
    </unix-def:xinetd_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:27000" version="1" comment="xinetd disabled">
      <unix-def:disabled datatype="boolean">true</unix-def:disabled>
    </unix-def:xinetd_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:27900" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:28301" version="1" comment="Default comment, please change">
      <group_id datatype="string" operation="equals" entity_check="all" var_check="all">51</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:28300" version="1" comment="Default comment, please change">
      <group_id datatype="string" operation="equals" entity_check="all" var_check="all">0</group_id>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:28700" version="16" comment="0755 or less">
      <unix-def:suid datatype="boolean">false</unix-def:suid>
      <unix-def:sgid datatype="boolean">false</unix-def:sgid>
      <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
      <unix-def:owrite datatype="boolean">false</unix-def:owrite>
    </unix-def:file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:28800" version="1">
      <ind-def:subexpression datatype="int" operation="greater than or equal">9</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:29000" version="2" comment="owned by root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:29100" version="1" comment="File has mode 644 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:29600" version="1" comment="sendmail noexpn">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|,)(noexpn|goaway)(,|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:29700" version="1" comment="sendmail novrfy">
      <ind-def:subexpression datatype="string" operation="pattern match">(^|,)(novrfy|goaway)(,|$)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:32000" version="1" comment="MIB files must be mode 640 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:32100" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:32200" version="1" comment="group-owned by root, bin, or sys">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:32500" version="1" comment="syslog.conf file is group-owned by root, bin, or sys">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <runlevel_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:36200" version="7" comment="not started">
      <start datatype="boolean" operation="equals" entity_check="all" var_check="all">false</start>
    </runlevel_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:36400" version="1" comment="Setting">
      <subexpression datatype="string" operation="equals">0</subexpression>
    </textfilecontent54_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:36900" version="1" comment="owned by root">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:37000" version="1" comment="growned by root,bin,sys">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37100" version="1" comment="allowed anonuid/anongid">
      <ind-def:subexpression datatype="string" operation="pattern match">^(-1|60001|65534|65535)$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37202" version="1" comment="filter to remove lines with no (">
      <subexpression datatype="string" operation="equals" entity_check="all" var_ref="oval:mil.disa.fso.rhel:var:37200" var_check="all" />
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37200" version="2" comment="( must exist">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">.*\(.*</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37201" version="1" comment="invalid (">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">[ ]+\(|[\*]\(</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37300" version="1" comment="nfs option no_root_squash">
      <ind-def:subexpression datatype="string" operation="pattern match">no_root_squash</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:37400" version="1" comment="contains nosuid option">
      <ind-def:subexpression datatype="string" operation="pattern match">nosuid</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:37800" version="1" comment="group-owned by root, bin, or sys">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:39300" version="1" comment="files in /etc/news must be group-owned by root or news">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|13)$</group_id>
    </file_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:40500" version="1" comment="executable must be bin/true">
      <subexpression datatype="string" operation="equals" entity_check="all" var_check="all">/bin/true</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:41700" version="2">
      <ind-def:subexpression operation="equals">false</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:41800" version="1" comment="Setting">
      <subexpression datatype="string" operation="equals">0</subexpression>
    </textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:42000" version="1" comment="Default comment, please change">
      <uexec datatype="boolean" operation="equals" entity_check="all" var_check="all">true</uexec>
      <gexec datatype="boolean" operation="equals" entity_check="all" var_check="all">true</gexec>
      <oexec datatype="boolean" operation="equals" entity_check="all" var_check="all">true</oexec>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:42800" version="1" comment="owned by root">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:42900" version="1" comment="group-owned by root, bin or sys">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43000" version="1" comment="perms 0644/0755 (umask 022)">
      <unix-def:suid datatype="boolean">false</unix-def:suid>
      <unix-def:sgid datatype="boolean">false</unix-def:sgid>
      <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
      <unix-def:owrite datatype="boolean">false</unix-def:owrite>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43100" version="1" comment="owned by root">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43200" version="1" comment="group-owned by root, bin, sys, or system">
      <unix-def:group_id operation="pattern match">^(0|1|3)$</unix-def:group_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43300" version="1" comment="perms 0644/0755 (umask 022)">
      <unix-def:suid datatype="boolean">false</unix-def:suid>
      <unix-def:sgid datatype="boolean">false</unix-def:sgid>
      <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
      <unix-def:owrite datatype="boolean">false</unix-def:owrite>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43400" version="1" comment="owned by root">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:43600" version="1" comment="perms 0600">
      <unix-def:suid datatype="boolean">false</unix-def:suid>
      <unix-def:sgid datatype="boolean">false</unix-def:sgid>
      <unix-def:gread datatype="boolean">false</unix-def:gread>
      <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
      <unix-def:gexec datatype="boolean">false</unix-def:gexec>
      <unix-def:oread datatype="boolean">false</unix-def:oread>
      <unix-def:owrite datatype="boolean">false</unix-def:owrite>
      <unix-def:oexec datatype="boolean">false</unix-def:oexec>
    </unix-def:file_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:43700" version="1" comment="Setting">
      <subexpression datatype="string" operation="equals">1</subexpression>
    </textfilecontent54_state>
    <unix-def:runlevel_state id="oval:mil.disa.fso.rhel:ste:43800" version="1" comment="not running">
      <unix-def:start datatype="boolean">false</unix-def:start>
    </unix-def:runlevel_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:44500" version="1" comment="grub md5 option">
      <subexpression datatype="string">--md5</subexpression>
    </textfilecontent54_state>
    <ind-def:xmlfilecontent_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:5200" version="4" comment="idle_delay (time before activation in minutes)">
      <ind-def:value_of datatype="string" operation="pattern match">^[1-9]$|^1[0-5]$</ind-def:value_of>
    </ind-def:xmlfilecontent_state>
    <ind-def:xmlfilecontent_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:5202" version="4" comment="lock_enabled">
      <ind-def:value_of datatype="string" operation="equals">true</ind-def:value_of>
    </ind-def:xmlfilecontent_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47800" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47806" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47801" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47807" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47802" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47808" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47803" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47809" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47804" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47810" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47805" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47811" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47806" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47812" />
    </ind-def:textfilecontent54_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:47807" version="9" comment="32-bit archs">
      <unix-def:processor_type operation="pattern match">^i386$|^i686$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:47808" version="9" comment="32/64-bit dual archs">
      <unix-def:processor_type operation="pattern match">^x86_64$|^amd64$</unix-def:processor_type>
    </unix-def:uname_state>
    <unix-def:uname_state id="oval:mil.disa.fso.rhel:ste:47809" version="9" comment="64-bit archs">
      <unix-def:processor_type operation="pattern match">^ia64$</unix-def:processor_type>
    </unix-def:uname_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47810" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47829" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47811" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47830" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47812" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47831" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47813" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47832" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47814" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47833" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47815" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47834" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47816" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47835" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47817" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47836" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47818" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47837" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47819" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47838" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47820" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47839" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47821" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47840" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47822" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47841" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47823" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47842" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47824" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47843" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47825" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47844" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47826" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47845" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47827" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47846" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47828" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47847" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47829" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47848" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47830" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47849" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47831" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47850" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47832" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47851" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47833" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47852" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47834" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47853" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47835" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47854" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47836" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47855" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47837" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47856" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47838" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47857" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47839" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47858" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47840" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47859" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47841" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47860" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47842" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47861" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47843" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47862" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47844" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47863" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47845" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47864" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47846" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47865" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47847" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47866" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47848" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47867" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47849" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47868" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47850" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47869" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47851" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47870" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47852" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47871" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47853" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47872" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47854" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47873" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47855" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47874" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47856" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47875" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47857" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47876" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47858" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47877" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47859" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47878" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47860" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47879" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47861" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47880" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47862" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47881" />
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:47863" version="4">
      <ind-def:subexpression operation="pattern match" datatype="string" var_check="all" entity_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:47882" />
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:49600" version="1" comment="File has mode 600 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:49700" version="1" comment="File has mode 700 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:7800" version="3" comment="valid and only 1">
      <ind-def:instance datatype="int" operation="equals">1</ind-def:instance>
      <ind-def:subexpression operation="pattern match" datatype="string">^console$|^tty1$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1200" version="2" comment="correct audit param">
      <unix-def:command operation="pattern match">-audit +4( |$)</unix-def:command>
    </unix-def:process_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1201" version="2" comment="auth param">
      <unix-def:command operation="pattern match">-auth</unix-def:command>
    </unix-def:process_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1202" version="2" comment="screensaver param">
      <unix-def:command operation="pattern match">-s +([1-9]|1[0-5])( |$)</unix-def:command>
    </unix-def:process_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1300" version="2" comment="ac param">
      <unix-def:command operation="pattern match">-ac( |$)</unix-def:command>
    </unix-def:process_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1301" version="2" comment="core param">
      <unix-def:command operation="pattern match">-core( |$)</unix-def:command>
    </unix-def:process_state>
    <unix-def:process_state id="oval:mil.disa.fso.rhel:ste:1302" version="2" comment="nolock param">
      <unix-def:command operation="pattern match">-nolock( |$)</unix-def:command>
    </unix-def:process_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:7000" version="1" comment="root">
      <unix-def:username>root</unix-def:username>
    </unix-def:password_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:7001" version="1" comment="uid not 0">
      <unix-def:user_id operation="not equal">0</unix-def:user_id>
    </unix-def:password_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:7200" version="2" comment="home dir /">
      <unix-def:home_dir>/</unix-def:home_dir>
    </unix-def:password_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:7201" version="2" comment="File has mode 0700">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uread datatype="boolean" operation="equals">true</uread>
      <uwrite datatype="boolean" operation="equals">true</uwrite>
      <uexec datatype="boolean" operation="equals">true</uexec>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:7400" version="2" comment="$PATH:$HOME/bin (default)">
      <ind-def:subexpression datatype="string" operation="pattern match">^\$PATH:\$HOME/bin[ 	]*$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:7700" version="2" comment="not world writable">
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:8900" version="1" comment="File has mode 0755 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:9000" version="1" comment="Default comment, please change">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</user_id>
    </file_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:11200" version="1" comment="Default comment, please change">
      <password datatype="string" operation="pattern match" entity_check="all" var_check="all">^x$</password>
    </password_state>
    <ind-def:variable_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:12400" version="2" comment="non-empty, absolute path, or self-reference">
      <ind-def:value operation="pattern match">^/["']?|^[$]LD_PRELOAD$</ind-def:value>
    </ind-def:variable_state>
    <ind-def:variable_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:13600" version="2" comment="non-empty, absolute path, or self-reference, or $1 for pathmunge">
      <ind-def:value operation="pattern match">^["']?/|^"?[$]PATH"?$|^"?[$][{]PATH[}]"?$|^"?[$]1"?$</ind-def:value>
    </ind-def:variable_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:16000" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:16100" version="1" comment="/dev/audio and /dev/snd are group-owned by root, sys, bin, sys, or audio">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3|63)$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15900" version="1" comment="File has mode 0660 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17100" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17200" version="1" comment="system audit logs are group-owned by root, sys, or bin">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17300" version="1" comment="audit log has mode 640 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17400" version="1" comment="File owned by user root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17500" version="1" comment="File group-owned by user root, bin, or sys">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:17600" version="1" comment="File has mode 0750 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:10700" version="1">
      <unix-def:user_id>0</unix-def:user_id>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:200" version="1">
      <unix-def:group_id>0</unix-def:group_id>
    </unix-def:file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:22400" version="1">
      <ind-def:subexpression operation="equals">0</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:5600" version="1">
      <ind-def:subexpression operation="greater than or equal" datatype="int">14</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:shadow_state id="oval:mil.disa.fso.rhel:ste:5400" version="1">
      <unix-def:chg_allow operation="pattern match" datatype="string">[0-9]+</unix-def:chg_allow>
    </unix-def:shadow_state>
    <unix-def:shadow_state id="oval:mil.disa.fso.rhel:ste:5401" version="1">
      <unix-def:chg_allow operation="not equal" datatype="string">0</unix-def:chg_allow>
    </unix-def:shadow_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6600" version="1" comment="pam_cracklib difok">
      <ind-def:subexpression operation="greater than or equal" datatype="int">4</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6000" version="1" comment="pam_cracklib ucredit">
      <ind-def:subexpression operation="less than or equal" datatype="int">-1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6100" version="1" comment="pam_cracklib lcredit">
      <ind-def:subexpression operation="less than or equal" datatype="int">-1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6200" version="1" comment="pam_cracklib dcredit">
      <ind-def:subexpression operation="less than or equal" datatype="int">-1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6300" version="1" comment="pam_cracklib ocredit">
      <ind-def:subexpression operation="less than or equal" datatype="int">-1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:shadow_state id="oval:mil.disa.fso.rhel:ste:6500" version="1" comment="chg_req is 60 or less">
      <unix-def:chg_req datatype="string" operation="pattern match">^0*(60|[1-5]?[0-9])$</unix-def:chg_req>
    </unix-def:shadow_state>
    <unix-def:shadow_state id="oval:mil.disa.fso.rhel:ste:6501" version="1" comment="locked passwords">
      <unix-def:password operation="pattern match" datatype="string">\*|^!</unix-def:password>
    </unix-def:shadow_state>
    <ind-def:variable_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:6800" version="1" comment="remember is set to 0">
      <ind-def:value datatype="int">0</ind-def:value>
    </ind-def:variable_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:44800" version="1">
      <unix-def:group_id>0</unix-def:group_id>
    </unix-def:file_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:36300" version="1">
      <ind-def:subexpression datatype="int" operation="equals">0</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:24500" version="1">
      <ind-def:subexpression operation="equals" datatype="int">1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:23700" version="1">
      <ind-def:subexpression datatype="int" operation="equals">1</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:33100" version="1">
      <ind-def:subexpression operation="pattern match">^((aes|3des)[^,]*,?)+$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:33400" version="1">
      <ind-def:subexpression operation="pattern match">^((aes|3des)[^,]*,?)+$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:35800" version="1">
      <ind-def:subexpression operation="equals" datatype="string">no</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:10900" version="1">
      <unix-def:uread var_check="all" datatype="boolean">true</unix-def:uread>
      <unix-def:uwrite var_check="all" datatype="boolean">false</unix-def:uwrite>
      <unix-def:uexec var_check="all" datatype="boolean">false</unix-def:uexec>
      <unix-def:gread var_check="all" datatype="boolean">false</unix-def:gread>
      <unix-def:gwrite var_check="all" datatype="boolean">false</unix-def:gwrite>
      <unix-def:gexec var_check="all" datatype="boolean">false</unix-def:gexec>
      <unix-def:oread var_check="all" datatype="boolean">false</unix-def:oread>
      <unix-def:owrite var_check="all" datatype="boolean">false</unix-def:owrite>
      <unix-def:oexec var_check="all" datatype="boolean">false</unix-def:oexec>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:11500" version="1" comment="750 or less">
      <unix-def:gwrite var_check="all" datatype="boolean">false</unix-def:gwrite>
      <unix-def:oread var_check="all" datatype="boolean">false</unix-def:oread>
      <unix-def:owrite var_check="all" datatype="boolean">false</unix-def:owrite>
      <unix-def:oexec var_check="all" datatype="boolean">false</unix-def:oexec>
    </unix-def:file_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:11501" version="1" comment="UID &lt; 500 (system/app accts)">
      <unix-def:user_id operation="pattern match" datatype="string">^(0*[0-9]{0,2}|^0*[0-4][0-9][0-9])$</unix-def:user_id>
    </unix-def:password_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:11502" version="1" comment="UID = 65534 (nfs nobody system acct)">
      <unix-def:user_id datatype="string">65534</unix-def:user_id>
    </unix-def:password_state>
    <unix-def:runlevel_state id="oval:mil.disa.fso.rhel:ste:44100" version="1" comment="starts and not kills">
      <unix-def:start datatype="boolean">true</unix-def:start>
      <unix-def:kill datatype="boolean">false</unix-def:kill>
    </unix-def:runlevel_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:7900" version="1" comment="match top level shell path">
      <ind-def:subexpression operation="pattern match" var_check="at least one" var_ref="oval:mil.disa.fso.rhel:var:7900" />
    </ind-def:textfilecontent54_state>
    <lin-def:rpminfo_state xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.rhel:ste:3200" version="1">
      <lin-def:release datatype="string" operation="pattern match">^5\.</lin-def:release>
    </lin-def:rpminfo_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:12900" version="2" comment="File has mode 0644 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:13000" version="2" comment="File or directory owned by root">
      <user_id datatype="string" operation="equals" entity_check="all" var_check="all">0</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:13100" version="2" comment="File or directory owned by root, bin, or sys">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <ind-def:variable_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:14200" version="2" comment="non-empty, absolute path, or self-reference, or $1 for pathmunge, or $HOME">
      <ind-def:value operation="pattern match">^["']?/|^"?[$]PATH"?$|^"?[$][{]PATH[}]"?$|^"?[$]1"?$|^"?[$]HOME</ind-def:value>
    </ind-def:variable_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:30800" version="2" comment="server args has -u 077">
      <unix-def:server_arguments datatype="string" operation="pattern match">(^|[ 	])-u[ 	]+0?077([ 	]|$)</unix-def:server_arguments>
    </unix-def:xinetd_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:30801" version="2" comment="vsftp good umask">
      <subexpression datatype="string" operation="pattern match">0?077</subexpression>
    </textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:2400" version="2" comment="Default comment, please change">
      <uexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</uexec>
      <gread datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gread>
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <gexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gexec>
      <oread datatype="boolean" operation="equals" entity_check="all" var_check="all">false</oread>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
      <oexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:4100" version="3" comment="0640 or less permissive">
      <suid datatype="boolean" operation="equals" entity_check="all" var_check="all">false</suid>
      <sgid datatype="boolean" operation="equals" entity_check="all" var_check="all">false</sgid>
      <uexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</uexec>
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <gexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gexec>
      <oread datatype="boolean" operation="equals" entity_check="all" var_check="all">false</oread>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
      <oexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</oexec>
    </file_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:5700" version="2" comment="password starts with dollar sign or underscore, is an x or *, or begins with !">
      <password datatype="string" operation="pattern match" entity_check="all" var_check="all">^\$|^_|^x$|^\*$|^!</password>
    </password_state>
    <shadow_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:5701" version="2" comment="shadow password starts with dollar sign or underscore, is an x or *, or begins with !">
      <password datatype="string" operation="pattern match" entity_check="all" var_check="all">^\$|^_|^x$|^\*$|^!</password>
    </shadow_state>
    <shadow_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:5900" version="3" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm">
      <password datatype="string" operation="pattern match" entity_check="all" var_check="all">^(!!|\$[56]\$|[*x]$)</password>
    </shadow_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:5901" version="3" comment="The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm">
      <password datatype="string" operation="pattern match" entity_check="all" var_check="all">^(!!|\$[56]\$|[*x]$)</password>
    </password_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:11300" version="3" comment="disabled password hash">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">^(x|!)$</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:11400" version="3" comment="gshadow allowed hashes">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">^$|^x$|^!$|^!!$</subexpression>
    </textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:29901" version="7" comment="sendmail DaemonPortOptions addresses">
      <ind-def:subexpression datatype="string" operation="pattern match">^(localhost|localhost\.localdomain|127\.0\.0\.1|::1)$</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:29902" version="7" comment="postfix inet_interfaces addresses">
      <ind-def:subexpression datatype="string" operation="pattern match">^(localhost\.localdomain|localhost|127\.0\.0\.1|::1|loopback-only)</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <ind-def:textfilecontent54_state xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:29903" version="7" comment="postfix smtp_client_restrictions permit only, or permit first">
      <ind-def:subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">[ ]*permit[ ,]+</ind-def:subexpression>
    </ind-def:textfilecontent54_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:12600" version="1" comment="All system start-up files must be owned by root or bin.">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1)$</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:12700" version="1" comment="All system start-up files must be owned by a system group.">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0?[0-9]|[1-9][0-9]|[1-3][0-9][0-9]|4[0-9][0-9])$</group_id>
    </file_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:30600" version="1" comment="good shell for ftp account">
      <unix-def:login_shell datatype="string" operation="pattern match">^(/bin/false|/dev/null|/usr/bin/false|/bin/true|/sbin/nologin)$</unix-def:login_shell>
    </unix-def:password_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:31400" version="1" comment="uucp service disabled">
      <unix-def:disabled datatype="boolean">true</unix-def:disabled>
    </unix-def:xinetd_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:7100" version="1" comment="home dir not /">
      <unix-def:home_dir operation="not equal">/</unix-def:home_dir>
    </unix-def:password_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:4300" version="1">
      <group_id datatype="string" operation="pattern match" var_ref="oval:mil.disa.fso.rhel:var:4300" var_check="at least one" />
    </password_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:8700" version="3" comment="File has mode 640 or less permissive">
      <unix-def:suid datatype="boolean" operation="equals">false</unix-def:suid>
      <unix-def:sgid datatype="boolean" operation="equals">false</unix-def:sgid>
      <unix-def:uexec datatype="boolean" operation="equals">false</unix-def:uexec>
      <unix-def:gwrite datatype="boolean" operation="equals">false</unix-def:gwrite>
      <unix-def:gexec datatype="boolean" operation="equals">false</unix-def:gexec>
      <unix-def:oread datatype="boolean" operation="equals">false</unix-def:oread>
      <unix-def:owrite datatype="boolean" operation="equals">false</unix-def:owrite>
      <unix-def:oexec datatype="boolean" operation="equals">false</unix-def:oexec>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:8701" version="3" comment="File name is wtmp">
      <unix-def:filename datatype="string" operation="equals">wtmp</unix-def:filename>
    </unix-def:file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:13500" version="2" comment="All skeleton files must be group-owned by root, bin, sys, system, or other.">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^([0-9]|[1-9][0-9]|[1-4][0-9][0-9])$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:13400" version="2" comment="All skeleton files and directories must be owned by root or bin">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1)$</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:13300" version="2" comment="All skeleton files must have mode 0644 or less permissive.">
      <uexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</uexec>
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <gexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gexec>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
      <oexec datatype="boolean" operation="equals" entity_check="all" var_check="all">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:9100" version="1" comment="The NIS/NIS+/yp command files must have mode 0755 or less permissive">
      <suid datatype="boolean" operation="equals" entity_check="all" var_check="all">false</suid>
      <sgid datatype="boolean" operation="equals" entity_check="all" var_check="all">false</sgid>
      <gwrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</gwrite>
      <owrite datatype="boolean" operation="equals" entity_check="all" var_check="all">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:8500" version="2" comment="All system files, programs, and directories must be owned by a system account">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^0*([0-9]|[1-9][0-9]|[1-4][0-9][0-9])$</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:8600" version="2" comment="System files, programs, and directories must be group-owned by a system group">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^0*([0-9]|[1-9][0-9]|[1-4][0-9][0-9])$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:31100" version="2" comment="File has mode 0755 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <unix-def:xinetd_state id="oval:mil.disa.fso.rhel:ste:31200" version="2" comment="xinetd user tftp">
      <unix-def:user datatype="string">tftp</unix-def:user>
    </unix-def:xinetd_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:31201" version="2" comment="disabled shells">
      <unix-def:login_shell operation="pattern match">^(/bin/false|/dev/null|/sbin/nologin)$</unix-def:login_shell>
    </unix-def:password_state>
    <unix-def:password_state id="oval:mil.disa.fso.rhel:ste:31202" version="2" comment="non-empty home dir">
      <unix-def:home_dir datatype="string" operation="pattern match">^.+$</unix-def:home_dir>
    </unix-def:password_state>
    <unix-def:xinetd_state version="2" id="oval:mil.disa.fso.rhel:ste:31203" comment="tftp disabled">
      <unix-def:disabled datatype="boolean" operation="equals">true</unix-def:disabled>
    </unix-def:xinetd_state>
    <password_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:11000" version="3" comment="All users must be assigned a home directory in the /etc/password file.">
      <home_dir datatype="string" operation="pattern match" entity_check="all" var_check="all">.+</home_dir>
    </password_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15200" version="1" comment="/etc/shells file exists">
      <filename datatype="string" operation="equals" entity_check="all" var_check="all">shells</filename>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15400" version="1" comment="Shell files must be owned by root or bin">
      <user_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1)$</user_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15500" version="1" comment="Shell files must be group-owned by user root, bin, or sys">
      <group_id datatype="string" operation="pattern match" entity_check="all" var_check="all">^(0|1|3)$</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15600" version="1" comment="File has mode 0755 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:15401" version="1" comment="filter symbolic links">
      <type datatype="string" operation="equals" entity_check="all" var_check="all">symbolic link</type>
    </file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:15700" version="1" comment="non-devices">
      <unix-def:type operation="pattern match">^(regular|directory|named pipe|symbolic link|socket)$</unix-def:type>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:15701" version="2" comment="authorized world writable in /dev">
      <unix-def:path operation="pattern match">^/dev/?$</unix-def:path>
      <unix-def:filename operation="pattern match">^(full|random|zero|null|tty|ptmx|vsock)$</unix-def:filename>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:15702" version="1" comment="authorized world writable in /selinux">
      <unix-def:path operation="pattern match">^/selinux/?$</unix-def:path>
      <unix-def:filename>null</unix-def:filename>
    </unix-def:file_state>
    <unix-def:file_state id="oval:mil.disa.fso.rhel:ste:15703" version="1" comment="not world writable">
      <unix-def:owrite datatype="boolean">false</unix-def:owrite>
    </unix-def:file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:10300" version="6" comment="File has mode 644 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:27700" version="6" comment="Group-owned by user lp">
      <group_id datatype="string" operation="equals">7</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:25601" version="6" comment="File owned by user bin">
      <user_id datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:25600" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:25800" version="6" comment="File has mode 440 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uwrite datatype="boolean" operation="equals">false</uwrite>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:27600" version="6" comment="File owned by user sys">
      <user_id datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:27600" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:27601" version="6" comment="File owned by user lp">
      <user_id datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:27601" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:27800" version="6" comment="File has mode 664 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:30500" version="6" comment="File has mode 640 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19700" version="6" comment="File has mode 700 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:19800" version="6" comment="File has mode 755 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <owrite datatype="boolean" operation="equals">false</owrite>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:38100" version="6" comment="File owned by group root">
      <group_id datatype="string" operation="equals">0</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:20001" version="6" comment="File owned by group sys">
      <group_id datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:38100" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:20002" version="6" comment="File owned by group bin">
      <group_id datatype="string" operation="equals" var_ref="oval:mil.disa.fso.rhel:var:20001" />
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:300" version="6" comment="File has mode 400 or less permissive">
      <suid datatype="boolean" operation="equals">false</suid>
      <sgid datatype="boolean" operation="equals">false</sgid>
      <uwrite datatype="boolean" operation="equals">false</uwrite>
      <uexec datatype="boolean" operation="equals">false</uexec>
      <gread datatype="boolean" operation="equals">false</gread>
      <gwrite datatype="boolean" operation="equals">false</gwrite>
      <gexec datatype="boolean" operation="equals">false</gexec>
      <oread datatype="boolean" operation="equals">false</oread>
      <owrite datatype="boolean" operation="equals">false</owrite>
      <oexec datatype="boolean" operation="equals">false</oexec>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:10200" version="1" comment="File owned by group bin">
      <group_id datatype="string" operation="equals">1</group_id>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.rhel:ste:10201" version="1" comment="File owned by group sys">
      <group_id datatype="string" operation="equals">3</group_id>
    </file_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:34700" version="1" comment="if present, must be no">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">[ ]*[Nn][Oo][ ]*$</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.rhel:ste:2000" version="1" comment="check for /usr/bin/logger">
      <subexpression datatype="string" operation="pattern match" entity_check="all" var_check="all">^/usr/bin/logger[ ]</subexpression>
    </textfilecontent54_state>
  </states>
  <variables>
    <constant_variable id="oval:mil.disa.fso.rhel:var:4602" version="2" datatype="string" comment="Banner Pattern">
      <value>^[ 	
&#xD;]*You[ 	
&#xD;]+are[ 	
&#xD;]+accessing[ 	
&#xD;]+a[ 	
&#xD;]+U\.S\.[ 	
&#xD;]+Government[ 	
&#xD;]+\(USG\)[ 	
&#xD;]+Information[ 	
&#xD;]+System[ 	
&#xD;]+\(IS\)[ 	
&#xD;]+that[ 	
&#xD;]+is[ 	
&#xD;]+provided[ 	
&#xD;]+for[ 	
&#xD;]+USG[-—]authorized[ 	
&#xD;]+use[ 	
&#xD;]+only\.[ 	
&#xD;]+By[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+\(which[ 	
&#xD;]+includes[ 	
&#xD;]+any[ 	
&#xD;]+device[ 	
&#xD;]+attached[ 	
&#xD;]+to[ 	
&#xD;]+this[ 	
&#xD;]+IS\),[ 	
&#xD;]+you[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+the[ 	
&#xD;]+following[ 	
&#xD;]+conditions:[ 	
&#xD;]+-The[ 	
&#xD;]+USG[ 	
&#xD;]+routinely[ 	
&#xD;]+intercepts[ 	
&#xD;]+and[ 	
&#xD;]+monitors[ 	
&#xD;]+communications[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+for[ 	
&#xD;]+purposes[ 	
&#xD;]+including,[ 	
&#xD;]+but[ 	
&#xD;]+not[ 	
&#xD;]+limited[ 	
&#xD;]+to,[ 	
&#xD;]+penetration[ 	
&#xD;]+testing,[ 	
&#xD;]+COMSEC[ 	
&#xD;]+monitoring,[ 	
&#xD;]+network[ 	
&#xD;]+operations[ 	
&#xD;]+and[ 	
&#xD;]+defense,[ 	
&#xD;]+personnel[ 	
&#xD;]+misconduct[ 	
&#xD;]+\(PM\),[ 	
&#xD;]+law[ 	
&#xD;]+enforcement[ 	
&#xD;]+\(LE\),[ 	
&#xD;]+and[ 	
&#xD;]+counterintelligence[ 	
&#xD;]+\(CI\)[ 	
&#xD;]+investigations\.[ 	
&#xD;]+-At[ 	
&#xD;]+any[ 	
&#xD;]+time,[ 	
&#xD;]+the[ 	
&#xD;]+USG[ 	
&#xD;]+may[ 	
&#xD;]+inspect[ 	
&#xD;]+and[ 	
&#xD;]+seize[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS\.[ 	
&#xD;]+-Communications[ 	
&#xD;]+using,[ 	
&#xD;]+or[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on,[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+are[ 	
&#xD;]+not[ 	
&#xD;]+private,[ 	
&#xD;]+are[ 	
&#xD;]+subject[ 	
&#xD;]+to[ 	
&#xD;]+routine[ 	
&#xD;]+monitoring,[ 	
&#xD;]+interception,[ 	
&#xD;]+and[ 	
&#xD;]+search,[ 	
&#xD;]+and[ 	
&#xD;]+may[ 	
&#xD;]+be[ 	
&#xD;]+disclosed[ 	
&#xD;]+or[ 	
&#xD;]+used[ 	
&#xD;]+for[ 	
&#xD;]+any[ 	
&#xD;]+USG-authorized[ 	
&#xD;]+purpose\.[ 	
&#xD;]+[-—]This[ 	
&#xD;]+IS[ 	
&#xD;]+includes[ 	
&#xD;]+security[ 	
&#xD;]+measures[ 	
&#xD;]+\(e\.g\.,[ 	
&#xD;]+authentication[ 	
&#xD;]+and[ 	
&#xD;]+access[ 	
&#xD;]+controls\)[ 	
&#xD;]+to[ 	
&#xD;]+protect[ 	
&#xD;]+USG[ 	
&#xD;]+interests[—-]+not[ 	
&#xD;]+for[ 	
&#xD;]+your[ 	
&#xD;]+personal[ 	
&#xD;]+benefit[ 	
&#xD;]+or[ 	
&#xD;]+privacy\.[ 	
&#xD;]+[—-]Notwithstanding[ 	
&#xD;]+the[ 	
&#xD;]+above,[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+does[ 	
&#xD;]+not[ 	
&#xD;]+constitute[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+PM,[ 	
&#xD;]+LE[ 	
&#xD;]+or[ 	
&#xD;]+CI[ 	
&#xD;]+investigative[ 	
&#xD;]+searching[ 	
&#xD;]+or[ 	
&#xD;]+monitoring[ 	
&#xD;]+of[ 	
&#xD;]+the[ 	
&#xD;]+content[ 	
&#xD;]+of[ 	
&#xD;]+privileged[ 	
&#xD;]+communications,[ 	
&#xD;]+or work product,[ 	
&#xD;]+related[ 	
&#xD;]+to[ 	
&#xD;]+personal[ 	
&#xD;]+representation[ 	
&#xD;]+or[ 	
&#xD;]+services[ 	
&#xD;]+by[ 	
&#xD;]+attorneys,[ 	
&#xD;]+psychotherapists,[ 	
&#xD;]+or[ 	
&#xD;]+clergy,[ 	
&#xD;]+and[ 	
&#xD;]+their[ 	
&#xD;]+assistants\.[ 	
&#xD;]+Such[ 	
&#xD;]+communications[ 	
&#xD;]+and[ 	
&#xD;]+work[ 	
&#xD;]+product[ 	
&#xD;]+are[ 	
&#xD;]+private[ 	
&#xD;]+and[ 	
&#xD;]+confidential\.[ 	
&#xD;]+See[ 	
&#xD;]+User[ 	
&#xD;]+Agreement[ 	
&#xD;]+for[ 	
&#xD;]+details\.[ 	
&#xD;]*$</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46808" version="1" datatype="string" comment="audit file pattern part 1">
      <value>(^|
)(-w[ 	]+[^ 	
&#xD;]+[ 	]+)*-w[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46809" version="1" datatype="string" comment="audit file pattern part 2 for write/append">
      <value>([ 	]+-w[ 	]+[^ 	
&#xD;]+)*([ 	]+-p[ 	]*wa)?([ 	]+-k[ 	][^ 	]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46800" version="1" datatype="string" comment="/etc/auditd.conf audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46808" />
        <literal_component>/etc/auditd.conf</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46809" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46801" version="1" datatype="string" comment="/etc/audit/auditd.conf audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46808" />
        <literal_component>/etc/audit/auditd.conf</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46809" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46802" version="1" datatype="string" comment="/etc/audit.rules audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46808" />
        <literal_component>/etc/audit.rules</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46809" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46803" version="1" datatype="string" comment="/etc/audit/audit.rules audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46808" />
        <literal_component>/etc/audit/audit.rules</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46809" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46810" version="1" datatype="string" comment="syscall audit pattern part 1">
      <value>(^|
)-[Aa][ 	
&#xD;]*exit,always</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46811" version="1" datatype="string" comment="syscall audit pattern part 2 arch required">
      <value>[ 	
&#xD;]+-F[ 	
&#xD;]*arch=</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46812" version="1" datatype="string" comment="syscall audit pattern part 3 b32">
      <value>b32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46813" version="1" datatype="string" comment="syscall audit pattern part 3 b64">
      <value>b64</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46814" version="1" datatype="string" comment="syscall audit pattern part 5">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*[ 	
&#xD;]+-S[ 	
&#xD;]*</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46815" version="1" datatype="string" comment="syscall audit pattern part 7">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*([ 	
&#xD;]+-k[ 	
&#xD;]*[^ 	
&#xD;]+)?[ 	
&#xD;]*(
|$)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46816" version="1" datatype="string" comment="admin syscalls">
      <value>stime</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46817" version="1" datatype="string" comment="admin syscalls">
      <value>settimeofday</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46818" version="1" datatype="string" comment="admin syscalls">
      <value>setdomainname</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46819" version="1" datatype="string" comment="admin syscalls">
      <value>sched_setparam</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46820" version="1" datatype="string" comment="admin syscalls">
      <value>sched_setscheduler</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46821" version="1" datatype="string" comment="admin syscalls">
      <value>adjtime</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46822" version="1" datatype="string" comment="admin syscalls">
      <value>sethostname</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46823" version="1" datatype="string" comment="admin syscalls">
      <value>clock_settime</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46804" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46805" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46806" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46807" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46824" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46825" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46826" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46827" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46828" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46829" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46830" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46831" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46832" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46833" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46834" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46835" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46836" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46837" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46838" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46839" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46840" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46841" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46842" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46843" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46844" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46845" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46846" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46847" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46848" version="1" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46849" version="1" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46850" version="1" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:46805" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46851" version="1" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46810" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46811" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46815" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49300" version="5" datatype="string" comment="audit file pattern part 1">
      <value>(^|
)(-w[ 	]+[^ 	
&#xD;]+[ 	]+)*-w[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49301" version="5" datatype="string" comment="audit file pattern part 2 for execute">
      <value>([ 	]+-w[ 	]*[^ 	
&#xD;]+)*([ 	]+-p[ 	]*[rwxa]*x[rwxa]*)([ 	]+-k[ 	][^ 	]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49302" version="5" datatype="string" comment="insmod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49300" />
        <literal_component>/sbin/insmod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49301" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49503" version="5" datatype="string" comment="rmmod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49300" />
        <literal_component>/sbin/rmmod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49301" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49404" version="5" datatype="string" comment="modprobe audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49300" />
        <literal_component>/sbin/modprobe</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49301" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49105" version="5" datatype="string" comment="syscall audit pattern part 1">
      <value>(^|
)-[Aa][ 	
&#xD;]*exit,always</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49106" version="5" datatype="string" comment="syscall audit pattern part 2 arch required">
      <value>[ 	
&#xD;]+-F[ 	
&#xD;]*arch=</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49108" version="5" datatype="string" comment="syscall audit pattern part 3 b32">
      <value>b32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49109" version="5" datatype="string" comment="syscall audit pattern part 3 b64">
      <value>b64</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49112" version="5" datatype="string" comment="syscall audit pattern part 5">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*[ 	
&#xD;]+-S[ 	
&#xD;]*</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:49113" version="5" datatype="string" comment="syscall audit pattern part 7">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*([ 	
&#xD;]+-k[ 	
&#xD;]*[^ 	
&#xD;]+)?[ 	
&#xD;]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49123" version="5" datatype="string" comment="init_module / noarch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49124" version="5" datatype="string" comment="init_module / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49125" version="5" datatype="string" comment="init_module / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49106" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:49105" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49226" version="5" datatype="string" comment="delete_module / noarch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49227" version="5" datatype="string" comment="delete_module / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49228" version="5" datatype="string" comment="delete_module / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49106" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:49105" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:49129" version="5" datatype="string" comment="init_module / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49112" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:49113" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:900" version="2" datatype="string" comment="partitions pattern">
      <concat>
        <literal_component>^[ 	]*[^ 	]+[ 	]+</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:901" />
        <literal_component>[ 	]+([^ 	]+)</literal_component>
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:901" version="1" datatype="string" comment="'primary' partitions">
      <value>/</value>
      <value>/tmp</value>
      <value>/home</value>
      <value>/var</value>
      <value>/var/log</value>
      <value>/var/log/audit</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:4700" datatype="string" version="4" comment="maxlogins pattern">
      <value>^[ 	]*\*[ 	]+hard[ 	]+maxlogins[ 	]+([0-9]+)[ 	]*$</value>
      <value>^[ 	]*\*[ 	]+-[ 	]+maxlogins[ 	]+([0-9]+)[ 	]*$</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:5000" version="4" datatype="int" comment="Number of unsuccessful login attempts for lock">
      <value>3</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:5001" version="4" datatype="string" comment="pam_tally2 deny patterns">
      <value>^[ 	]*auth[ 	]+required[ 	]+pam_tally2\.so[^#]*[ 	]deny=([0-9]+)</value>
      <value>^[ 	]*auth[ 	]+requisite[ 	]+pam_tally2\.so[^#]*[ 	]deny=([0-9]+)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6400" version="4" datatype="string" comment="maxrepeat pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6401" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6402" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6403" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6404" />
        <literal_component>maxrepeat</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6405" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6406" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6401" version="4" datatype="string" comment="pam_cracklib.so pattern part 1">
      <value>^[ 	]*password[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6402" version="4" datatype="string" comment="pam_cracklib.so pattern part 2">
      <value>required</value>
      <value>requisite</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6403" version="4" datatype="string" comment="pam_cracklib.so pattern part 3">
      <value>[ 	]+pam_cracklib\.so</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6404" version="4" datatype="string" comment="pam_cracklib.so pattern part 4">
      <value>[ 	][^#&#xD;
]*[ 	]</value>
      <value>[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6405" version="4" datatype="string" comment="pam_cracklib.so pattern part 5">
      <value>=(-?[0-9]+)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6406" version="4" datatype="string" comment="pam_cracklib.so pattern part 6">
      <value>[ 	]</value>
      <value>$</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6800" version="4" datatype="int" comment="Number of passwords to remember">
      <value>5</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6801" version="4" datatype="string" comment="remember pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>remember</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6301" version="4" datatype="string" comment="pam_cracklib.so pattern part 1">
      <value>^[ 	]*password[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6304" version="4" datatype="string" comment="pam_cracklib.so pattern part 4">
      <value>[ 	]+[^
&#xD;]*[ 	]+</value>
      <value>[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6305" version="4" datatype="string" comment="pam_cracklib.so pattern part 5">
      <value>=(-?[0-9]+)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6306" version="4" datatype="string" comment="pam_cracklib.so pattern part 6">
      <value>[ 	
&#xD;]</value>
      <value>$</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6802" version="4" datatype="string" comment="pam_unix.so pattern part 2">
      <value>required</value>
      <value>requisite</value>
      <value>sufficient</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6803" version="4" datatype="string" comment="pam_unix.so pattern part 3">
      <value>[ 	]+pam_unix\.so</value>
    </constant_variable>
    <constant_variable datatype="string" comment="system command directories" version="2" id="oval:mil.disa.fso.rhel:var:8400">
      <value>/etc</value>
      <value>/bin</value>
      <value>/usr/bin</value>
      <value>/sbin</value>
      <value>/usr/sbin</value>
      <value>/usr/local/bin</value>
      <value>/usr/local/sbin</value>
      <value>/usr/kerberos/bin</value>
      <value>/usr/kerberos/sbin</value>
      <value>/usr/X11R6/bin</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:11100" version="1" datatype="string" comment="interactive (non-system/app) account home directories">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:11102" item_field="home_dir" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:14800" datatype="string" version="3" comment="root directory paths to check">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:14802" item_field="path" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:16800" version="2" comment="users home directory" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:16800" item_field="home_dir" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18100" version="1" datatype="string" comment="/usr/sbin/useradd audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/useradd</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18103" version="1" datatype="string" comment="/usr/sbin/groupadd audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/groupadd</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18200" version="1" datatype="string" comment="/usr/sbin/usermod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/usermod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18203" version="1" datatype="string" comment="/usr/sbin/groupmod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/groupmod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18300" version="1" datatype="string" comment="/usr/bin/passwd audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/bin/passwd</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18400" version="1" datatype="string" comment="/usr/sbin/userdel audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/userdel</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18401" version="1" datatype="string" comment="/usr/sbin/groupdel audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/usr/sbin/groupdel</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18102" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18101" version="1" datatype="string" comment="audit file pattern part 1">
      <value>(^|&#xD;)(-w[ 	]+[^ 	
&#xD;]+[ 	]+)*-w[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18102" version="1" datatype="string" comment="audit file pattern part 2 for execute">
      <value>([ 	]+-w[ 	]+[^ 	
&#xD;]+)*([ 	]+-p[ 	]*[rwxa]*x[rwxa]*)?([ 	]+-k[ 	][^ 	&#xD;]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18104" version="1" datatype="string" comment="audit file pattern part 2 for append or write">
      <value>([ 	]+-w[ 	]+[^ 	
&#xD;]+)*([ 	]+-p[ 	]*[rwxa]*(w|a)[rwxa]*)?([ 	]+-k[ 	][^ 	&#xD;]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18204" version="1" datatype="string" comment="audit file pattern part 2 for write">
      <value>([ 	]+-w[ 	]+[^ 	
&#xD;]+)*([ 	]+-p[ 	]*[rwxa]*w[rwxa]*)?([ 	]+-k[ 	][^ 	&#xD;]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18105" version="1" datatype="string" comment="/etc/passwd audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/passwd</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18106" version="1" datatype="string" comment="/etc/group audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/group</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18107" version="1" datatype="string" comment="/etc/shadow audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/shadow</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18108" version="1" datatype="string" comment="/etc/gshadow audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/gshadow</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18205" version="1" datatype="string" comment="/etc/passwd audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/passwd</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18204" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18206" version="1" datatype="string" comment="/etc/group audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/group</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18204" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18207" version="1" datatype="string" comment="/etc/shadow audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/shadow</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18204" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18208" version="1" datatype="string" comment="/etc/gshadow audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18101" />
        <literal_component>/etc/gshadow</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18204" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18800" version="4" datatype="string" comment="audit file pattern part 1">
      <value>(^|
)(-w[ 	]+[^ 	
&#xD;]+[ 	]+)*-w[ 	]+</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18600" version="4" datatype="string" comment="audit file pattern part 2 for write/append">
      <value>([ 	]+-w[ 	]+[^ 	
&#xD;]+)*([ 	]+-p[ 	]*wa)?([ 	]+-k[ 	][^ 	]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18510" version="4" datatype="string" comment="/etc/auditd.conf audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/etc/auditd.conf</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18511" version="4" datatype="string" comment="/etc/audit/auditd.conf audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/etc/audit/auditd.conf</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18512" version="4" datatype="string" comment="/etc/audit.rules audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/etc/audit.rules</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18513" version="4" datatype="string" comment="/etc/audit/audit.rules audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/etc/audit/audit.rules</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18805" version="4" datatype="string" comment="syscall audit pattern part 1">
      <value>(^|
)-[Aa][ 	
&#xD;]*exit,always</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18806" version="4" datatype="string" comment="syscall audit pattern part 2 arch required">
      <value>[ 	
&#xD;]+-F[ 	
&#xD;]*arch=</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18808" version="4" datatype="string" comment="syscall audit pattern part 3 b32">
      <value>b32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18809" version="4" datatype="string" comment="syscall audit pattern part 3 b64">
      <value>b64</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18812" version="4" datatype="string" comment="syscall audit pattern part 5">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*[ 	
&#xD;]+-S[ 	
&#xD;]*</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18813" version="4" datatype="string" comment="syscall audit pattern part 7">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*([ 	
&#xD;]+-k[ 	
&#xD;]*[^ 	
&#xD;]+)?[ 	
&#xD;]*(
|$)</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18500" version="4" datatype="string" comment="admin syscalls">
      <value>stime</value>
      <value>settimeofday</value>
      <value>setdomainname</value>
      <value>sched_setparam</value>
      <value>sched_setscheduler</value>
      <value>adjtimex</value>
      <value>sethostname</value>
      <value>clock_settime</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18501" version="4" datatype="string" comment="admin / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18500" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18502" version="4" datatype="string" comment="admin / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18808" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18500" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18503" version="4" datatype="string" comment="admin / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:18505" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18500" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18504" version="4" datatype="string" comment="admin / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18809" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18500" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18601" version="4" datatype="string" comment="/var/log/lastlog audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/var/log/lastlog</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18602" version="4" datatype="string" comment="/var/log/faillog audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/var/log/faillog</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18600" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18700" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18720" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18701" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18808" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18720" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18702" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:18505" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18720" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18703" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18809" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18720" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18704" version="4" datatype="string" comment="32-bit-only dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18721" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18705" version="4" datatype="string" comment="32-bit-only dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18808" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18721" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18706" version="4" datatype="string" comment="32-bit-only dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:18505" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18721" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18720" version="4" datatype="string" comment="dac syscalls">
      <value>chmod</value>
      <value>fchmod</value>
      <value>fchmodat</value>
      <value>chown</value>
      <value>fchown</value>
      <value>fchownat</value>
      <value>lchown</value>
      <value>setxattr</value>
      <value>lsetxattr</value>
      <value>fsetxattr</value>
      <value>removexattr</value>
      <value>lremovexattr</value>
      <value>fremovexattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18721" version="4" datatype="string" comment="32-bit dac syscalls">
      <value>chown32</value>
      <value>fchown32</value>
      <value>lchown32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18801" version="4" datatype="string" comment="audit file pattern part 2 for execute">
      <value>([ 	]+-w[ 	]*[^ 	
&#xD;]+)*([ 	]+-p[ 	]*[rwxa]*x[rwxa]*)([ 	]+-k[ 	][^ 	]+)?[ 	]*(
|$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18802" version="4" datatype="string" comment="insmod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/sbin/insmod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18801" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18803" version="4" datatype="string" comment="rmmod audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/sbin/rmmod</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18801" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18804" version="4" datatype="string" comment="modprobe audit file pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18800" />
        <literal_component>/sbin/modprobe</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18801" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18823" version="4" datatype="string" comment="init_module / noarch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18824" version="4" datatype="string" comment="init_module / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18808" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18825" version="4" datatype="string" comment="init_module / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:18505" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18826" version="4" datatype="string" comment="delete_module / noarch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18827" version="4" datatype="string" comment="delete_module / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18808" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18828" version="4" datatype="string" comment="delete_module / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:18505" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18829" version="4" datatype="string" comment="init_module / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18809" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>init_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:19600" version="1" datatype="string" comment="all system accounts except root">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:19606" item_field="username" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:19601" version="1" datatype="string" comment="cron.deny entries">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:19604" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:20100" version="1" datatype="string" comment="cron log path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:20100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:20101" version="1" datatype="string" comment="cron log file">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:20101" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:21200" version="1" datatype="string" comment="all system accounts except root">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:21201" item_field="username" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:21201" version="1" datatype="string" comment="at.deny entries">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:21100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:25000" datatype="string" version="1" comment="audit dir pattern">
      <concat>
        <literal_component>[^ ][ ]</literal_component>
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:25001" item_field="subexpression" />
        <literal_component>[ ]</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:28700" datatype="string" version="16" comment="alias exec paths">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:28700" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:28701" datatype="string" version="16" comment="alias exec files">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:28701" item_field="subexpression" />
    </local_variable>
    <local_variable datatype="string" comment="Mail log files' directories" version="2" id="oval:mil.disa.fso.rhel:var:29000">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:29001" item_field="subexpression" />
    </local_variable>
    <local_variable datatype="string" comment="Mail log files' filenames" version="2" id="oval:mil.disa.fso.rhel:var:29001">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:29002" item_field="subexpression" />
    </local_variable>
    <local_variable datatype="string" comment="mail log filenames with appended numeric wildcards" version="2" id="oval:mil.disa.fso.rhel:var:29002">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:29001" />
        <literal_component>($|\.[0-9]+$)</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:29100" version="1" datatype="string" comment="smtp log file path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:29100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:29101" version="1" datatype="string" comment="smtp log file filename">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:29101" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:29400" datatype="string" version="3" comment="all home dirs">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:29401" item_field="home_dir" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:36900" version="1" datatype="string" comment="exported directories">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:36900" item_field="subexpression" />
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:37400" datatype="string" version="1" comment="NFS mount options pattern">
      <value>^[^ 	]+[ 	]+[^ 	]+[ 	]+nfs[ 	]+([^ 	]+)[ 	]+</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:42800" datatype="string" version="1" comment="CA cert file path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:42800" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:42801" datatype="string" version="1" comment="CA cert file">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:42801" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:42802" datatype="string" version="1" comment="CA cert dir">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:42804" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43100" datatype="string" version="1" comment="TLS cert file path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43101" datatype="string" version="1" comment="TLS cert file name">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43101" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43400" datatype="string" version="1" comment="TLS key file path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43400" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43401" datatype="string" version="1" comment="TLS key file name">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43401" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43500" datatype="string" version="1" comment="TLS key file path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43500" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:43501" datatype="string" version="1" comment="TLS key file name">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:43501" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46112" version="6" comment="Auditing pattern x86 (b32) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46113" version="6" comment="Auditing pattern x64 (b64) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46114" version="6" comment="Auditing pattern x86 (b32) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46115" version="6" comment="Auditing pattern x64 (b64) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46116" version="6" comment="Auditing pattern x86 (b32) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46117" version="6" comment="Auditing pattern x64 (b64) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46118" version="6" comment="Auditing pattern arch=(uname -m result) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46119" version="6" comment="Auditing pattern arch=(uname -m result) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46120" version="6" comment="Auditing pattern arch=(uname -m result) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46101" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46200" version="1" comment="Auditing pattern x86 (b32) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46201" version="1" comment="Auditing pattern x64 (b64) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46202" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46203" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46204" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46205" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46105" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46300" version="1" comment="Auditing pattern x86 (b32) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46301" version="1" comment="Auditing pattern x64 (b64) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46302" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46303" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46304" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46305" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46106" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46400" version="1" comment="Auditing pattern x86 (b32) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46401" version="1" comment="Auditing pattern x64 (b64) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46402" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46403" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46404" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46405" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46107" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46500" version="1" comment="Auditing pattern x86 (b32) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46501" version="1" comment="Auditing pattern x64 (b64) - Example Line 1 (0)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46102" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46502" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46503" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EPERM)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46103" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46504" version="1" comment="Auditing pattern x86 (b32) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46110" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46505" version="1" comment="Auditing pattern x64 (b64) - Example Line 2 (EACCES)" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46100" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46109" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46111" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46108" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46104" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46111" version="6" comment="Architecture x64 (b64)" datatype="string">
      <value>b64</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46110" version="6" comment="Architecture x86 (b32)" datatype="string">
      <value>b32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46109" version="6" comment="Audit rule pattern" datatype="string">
      <value>[ 	]+\-[Ff][ 	]*arch=</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46108" version="1" comment="Audit rule &quot;-S ftruncate&quot;" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*ftruncate</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46107" version="1" comment="Audit rule &quot;-S truncate&quot;" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*truncate</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46106" version="1" comment="Audit rule &quot;-S openat&quot;" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*openat</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46105" version="1" comment="Audit rule &quot;-S open&quot;" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*open</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46104" version="6" comment="Audit access &quot;-F exit=-EACCES&quot;" datatype="string">
      <value>[ 	]+\-[Ff][ 	]*exit=\-EACCES</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46103" version="6" comment="Audit access &quot;-F exit=-EPERM&quot;" datatype="string">
      <value>[ 	]+\-[Ff][ 	]*exit=\-EPERM</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46102" version="6" comment="Audit access &quot;-F success=0&quot;" datatype="string">
      <value>[ 	]+\-[Ff][ 	]*success=0</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46101" version="6" comment="Audit rule &quot;-S creat&quot;" datatype="string">
      <value>[ 	]+\-[Ss][ 	]*creat</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46100" version="6" comment="Audit rule &quot;-a exit,always&quot;" datatype="string">
      <value>^\-[Aa][ 	]*exit,always</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46603" version="1" comment="Enable auditing of deletions" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46600" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46601" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:46604" version="1" comment="Enable auditing of deletions" datatype="string">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46600" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:46602" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46602" version="1" comment="-S rmdir" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*rmdir</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46601" version="1" comment="-S unlink" datatype="string">
      <value>[ &amp;#x9;]+\-[Ss][ &amp;#x9;]*unlink</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:46600" version="1" comment="-a exit, always" datatype="string">
      <value>^\-[Aa][ &amp;#x9;]*exit,always</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47800" version="4" datatype="string" comment="syscall audit pattern part 1">
      <value>(^|
)-[Aa][ 	
&#xD;]*exit,always</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47801" version="4" datatype="string" comment="syscall audit pattern part 2 arch required">
      <value>[ 	
&#xD;]+-F[ 	
&#xD;]*arch=</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47802" version="4" datatype="string" comment="syscall audit pattern part 3 b32">
      <value>b32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47803" version="4" datatype="string" comment="syscall audit pattern part 3 b64">
      <value>b64</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47804" version="4" datatype="string" comment="syscall audit pattern part 5">
      <value>([ 	
&#xD;]+-S[ 	
&#xD;]*[^ 	
&#xD;]+)*[ 	
&#xD;]+-S[ 	
&#xD;]*</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47805" version="4" datatype="string" comment="syscall audit pattern part 7">
      <value>[ \n]+(-S[ \n]*[^ \n]+)*(.+)?[ \n]*( |$)</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47806" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47807" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47808" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47809" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47813" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47810" version="4" datatype="string" comment="32-bit-only dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47826" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47811" version="4" datatype="string" comment="32-bit-only dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47826" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47812" version="4" datatype="string" comment="32-bit-only dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47826" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47829" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47830" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47831" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47832" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47814" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47833" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47815" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47834" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47815" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47835" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47815" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47836" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47815" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47837" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47838" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47839" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47840" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47816" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47841" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47842" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47843" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47844" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47817" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47845" version="4" datatype="string" comment="32-bit-only dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47827" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47846" version="4" datatype="string" comment="32-bit-only dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47827" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47847" version="4" datatype="string" comment="32-bit-only dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47827" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47848" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47849" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47850" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47851" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47818" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47852" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47853" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47854" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47855" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47819" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47856" version="4" datatype="string" comment="32-bit-only dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47828" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47857" version="4" datatype="string" comment="32-bit-only dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47828" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47858" version="4" datatype="string" comment="32-bit-only dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47828" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47859" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47860" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47861" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47862" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47820" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47863" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47864" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47865" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47866" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47821" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47867" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47868" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47869" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47870" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47822" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47871" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47872" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47873" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47874" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47823" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47875" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47824" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47876" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47824" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47877" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47824" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47878" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47824" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47879" version="4" datatype="string" comment="dac / no arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47825" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47880" version="4" datatype="string" comment="dac / b32">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47802" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47825" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47881" version="4" datatype="string" comment="dac / arch">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:47800" item_field="processor_type" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47825" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:47882" version="4" datatype="string" comment="dac / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47800" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47801" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47803" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47804" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47825" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:47805" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47813" version="4" datatype="string" comment="dac syscalls">
      <value>chmod</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47814" version="4" datatype="string" comment="dac syscalls">
      <value>fchmod</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47815" version="4" datatype="string" comment="dac syscalls">
      <value>fchmodat</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47816" version="4" datatype="string" comment="dac syscalls">
      <value>chown</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47817" version="4" datatype="string" comment="dac syscalls">
      <value>fchown</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47818" version="4" datatype="string" comment="dac syscalls">
      <value>fchownat</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47819" version="4" datatype="string" comment="dac syscalls">
      <value>lchown</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47820" version="4" datatype="string" comment="dac syscalls">
      <value>setxattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47821" version="4" datatype="string" comment="dac syscalls">
      <value>lsetxattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47822" version="4" datatype="string" comment="dac syscalls">
      <value>fsetxattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47823" version="4" datatype="string" comment="dac syscalls">
      <value>removexattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47824" version="4" datatype="string" comment="dac syscalls">
      <value>lremovexattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47825" version="4" datatype="string" comment="dac syscalls">
      <value>fremovexattr</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47826" version="4" datatype="string" comment="32-bit dac syscalls">
      <value>chown32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47827" version="4" datatype="string" comment="32-bit dac syscalls">
      <value>fchown32</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:47828" version="4" datatype="string" comment="32-bit dac syscalls">
      <value>lchown32</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:7200" version="2" datatype="string" comment="root home dir">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:7200" item_field="home_dir" />
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:7400" version="2" datatype="string" comment="shell profile/rc files">
      <value>.bash_profile</value>
      <value>.bashrc</value>
      <value>.cshrc</value>
      <value>.tcshrc</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:7700" version="3" datatype="string" comment="root executable search path directories">
      <split delimiter=":">
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:7700" item_field="value" />
      </split>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:12400" version="2" datatype="string" comment="root executable ld_preload">
      <split delimiter=":">
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:12400" item_field="subexpression" />
      </split>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:13600" version="2" datatype="string" comment="global executable search path directories">
      <split delimiter=":">
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:13600" item_field="subexpression" />
      </split>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:13601" version="2" datatype="string" comment="global executable search path directories">
      <split delimiter=":">
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:13602" item_field="subexpression" />
      </split>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:13602" version="3" datatype="string" comment="global init files in /etc">
      <value>profile</value>
      <value>bashrc</value>
      <value>csh.login</value>
      <value>csh.cshrc</value>
      <value>environment</value>
      <value>.login</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:13603" version="2" datatype="string" comment="path patterns">
      <value>PATH=([^ 	]*)[ 	]*$</value>
      <value>setenv[ 	]+PATH[ 	]+([^ 	]*)[ 	]*$</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:17100" version="1" datatype="string" comment="system audit log path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:17102" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:17101" version="1" datatype="string" comment="system audit log file">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:17103" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:36100" version="1" datatype="string" comment="SSH Banner Path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:36100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:36101" version="1" datatype="string" comment="SSH Banner File">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:36101" item_field="subexpression" />
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:36102" version="1" datatype="string" comment="Banner Pattern">
      <value>^[ 	
&#xD;]*You[ 	
&#xD;]+are[ 	
&#xD;]+accessing[ 	
&#xD;]+a[ 	
&#xD;]+U\.S\.[ 	
&#xD;]+Government[ 	
&#xD;]+\(USG\)[ 	
&#xD;]+Information[ 	
&#xD;]+System[ 	
&#xD;]+\(IS\)[ 	
&#xD;]+that[ 	
&#xD;]+is[ 	
&#xD;]+provided[ 	
&#xD;]+for[ 	
&#xD;]+USG[-—]authorized[ 	
&#xD;]+use[ 	
&#xD;]+only\.[ 	
&#xD;]+By[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+\(which[ 	
&#xD;]+includes[ 	
&#xD;]+any[ 	
&#xD;]+device[ 	
&#xD;]+attached[ 	
&#xD;]+to[ 	
&#xD;]+this[ 	
&#xD;]+IS\),[ 	
&#xD;]+you[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+the[ 	
&#xD;]+following[ 	
&#xD;]+conditions:[ 	
&#xD;]+-The[ 	
&#xD;]+USG[ 	
&#xD;]+routinely[ 	
&#xD;]+intercepts[ 	
&#xD;]+and[ 	
&#xD;]+monitors[ 	
&#xD;]+communications[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+for[ 	
&#xD;]+purposes[ 	
&#xD;]+including,[ 	
&#xD;]+but[ 	
&#xD;]+not[ 	
&#xD;]+limited[ 	
&#xD;]+to,[ 	
&#xD;]+penetration[ 	
&#xD;]+testing,[ 	
&#xD;]+COMSEC[ 	
&#xD;]+monitoring,[ 	
&#xD;]+network[ 	
&#xD;]+operations[ 	
&#xD;]+and[ 	
&#xD;]+defense,[ 	
&#xD;]+personnel[ 	
&#xD;]+misconduct[ 	
&#xD;]+\(PM\),[ 	
&#xD;]+law[ 	
&#xD;]+enforcement[ 	
&#xD;]+\(LE\),[ 	
&#xD;]+and[ 	
&#xD;]+counterintelligence[ 	
&#xD;]+\(CI\)[ 	
&#xD;]+investigations\.[ 	
&#xD;]+-At[ 	
&#xD;]+any[ 	
&#xD;]+time,[ 	
&#xD;]+the[ 	
&#xD;]+USG[ 	
&#xD;]+may[ 	
&#xD;]+inspect[ 	
&#xD;]+and[ 	
&#xD;]+seize[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on[ 	
&#xD;]+this[ 	
&#xD;]+IS\.[ 	
&#xD;]+-Communications[ 	
&#xD;]+using,[ 	
&#xD;]+or[ 	
&#xD;]+data[ 	
&#xD;]+stored[ 	
&#xD;]+on,[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+are[ 	
&#xD;]+not[ 	
&#xD;]+private,[ 	
&#xD;]+are[ 	
&#xD;]+subject[ 	
&#xD;]+to[ 	
&#xD;]+routine[ 	
&#xD;]+monitoring,[ 	
&#xD;]+interception,[ 	
&#xD;]+and[ 	
&#xD;]+search,[ 	
&#xD;]+and[ 	
&#xD;]+may[ 	
&#xD;]+be[ 	
&#xD;]+disclosed[ 	
&#xD;]+or[ 	
&#xD;]+used[ 	
&#xD;]+for[ 	
&#xD;]+any[ 	
&#xD;]+USG-authorized[ 	
&#xD;]+purpose\.[ 	
&#xD;]+[-—]This[ 	
&#xD;]+IS[ 	
&#xD;]+includes[ 	
&#xD;]+security[ 	
&#xD;]+measures[ 	
&#xD;]+\(e\.g\.,[ 	
&#xD;]+authentication[ 	
&#xD;]+and[ 	
&#xD;]+access[ 	
&#xD;]+controls\)[ 	
&#xD;]+to[ 	
&#xD;]+protect[ 	
&#xD;]+USG[ 	
&#xD;]+interests[—-]+not[ 	
&#xD;]+for[ 	
&#xD;]+your[ 	
&#xD;]+personal[ 	
&#xD;]+benefit[ 	
&#xD;]+or[ 	
&#xD;]+privacy\.[ 	
&#xD;]+[—-]Notwithstanding[ 	
&#xD;]+the[ 	
&#xD;]+above,[ 	
&#xD;]+using[ 	
&#xD;]+this[ 	
&#xD;]+IS[ 	
&#xD;]+does[ 	
&#xD;]+not[ 	
&#xD;]+constitute[ 	
&#xD;]+consent[ 	
&#xD;]+to[ 	
&#xD;]+PM,[ 	
&#xD;]+LE[ 	
&#xD;]+or[ 	
&#xD;]+CI[ 	
&#xD;]+investigative[ 	
&#xD;]+searching[ 	
&#xD;]+or[ 	
&#xD;]+monitoring[ 	
&#xD;]+of[ 	
&#xD;]+the[ 	
&#xD;]+content[ 	
&#xD;]+of[ 	
&#xD;]+privileged[ 	
&#xD;]+communications,[ 	
&#xD;]+or work product,[ 	
&#xD;]+related[ 	
&#xD;]+to[ 	
&#xD;]+personal[ 	
&#xD;]+representation[ 	
&#xD;]+or[ 	
&#xD;]+services[ 	
&#xD;]+by[ 	
&#xD;]+attorneys,[ 	
&#xD;]+psychotherapists,[ 	
&#xD;]+or[ 	
&#xD;]+clergy,[ 	
&#xD;]+and[ 	
&#xD;]+their[ 	
&#xD;]+assistants\.[ 	
&#xD;]+Such[ 	
&#xD;]+communications[ 	
&#xD;]+and[ 	
&#xD;]+work[ 	
&#xD;]+product[ 	
&#xD;]+are[ 	
&#xD;]+private[ 	
&#xD;]+and[ 	
&#xD;]+confidential\.[ 	
&#xD;]+See[ 	
&#xD;]+User[ 	
&#xD;]+Agreement[ 	
&#xD;]+for[ 	
&#xD;]+details\.[ 	
&#xD;]*$</value>
    </constant_variable>
    <external_variable id="oval:mil.disa.fso.rhel:var:6500" version="1" datatype="string" comment="External variable for definition 20073" />
    <external_variable id="oval:mil.disa.fso.rhel:var:5800" version="1" datatype="string" comment="External variable for definition 20083 Password hashing algorithm" />
    <external_variable id="oval:mil.disa.fso.rhel:var:5200" version="1" datatype="string" comment="External variable for definitions 20098 20100 Inactivity timout" />
    <external_variable id="oval:mil.army.us.rhel5:var:20083" version="1" datatype="string" comment="External variable for definition 20083 Password hashing algorithm" />
    <external_variable id="oval:mil.army.us.rhel5:var:20084" version="1" datatype="int" comment="External variable for definition 20084 number of passwords to remember" />
    <local_variable id="oval:mil.disa.fso.rhel:var:6300" version="1" datatype="string" comment="ocredit pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>ocredit</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6200" version="1" datatype="string" comment="dcredit pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>dcredit</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6100" version="1" datatype="string" comment="lcredit pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>lcredit</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6000" version="1" datatype="string" comment="ucredit pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>ucredit</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:6600" version="1" datatype="string" comment="difok pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>difok</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:5600" version="1" datatype="string" comment="minlen pattern">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6301" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6302" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6303" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6304" />
        <literal_component>minlen</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6305" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:6306" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:18810" version="1" datatype="string" comment="syscall audit pattern part 4 arch required">
      <value>[ 	
&#xD;]+</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:18830" version="1" datatype="string" comment="delete_module / b64">
      <concat>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18805" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18806" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18809" />
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18812" />
        <literal_component>delete_module</literal_component>
        <variable_component var_ref="oval:mil.disa.fso.rhel:var:18813" />
      </concat>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6302" version="1" datatype="string" comment="pam_cracklib.so pattern part 2">
      <value>required</value>
      <value>requisite</value>
    </constant_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:6303" version="1" datatype="string" comment="pam_cracklib.so pattern part 3">
      <value>[ 	
&#xD;]+pam_cracklib\.so</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:11500" version="1" datatype="string" comment="all user home directories">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:11502" item_field="home_dir" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:7900" version="1" comment="root shell path pattern" datatype="string">
      <concat>
        <literal_component>^</literal_component>
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:7901" item_field="subexpression" />
        <literal_component>/?$</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:14200" version="2" datatype="string" comment="local executable search path directories">
      <split delimiter=":">
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:14200" item_field="subexpression" />
      </split>
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:14203" version="2" datatype="string" comment="path patterns">
      <value>PATH=([^ 	
&#xD;]*)[ 	
&#xD;]*$</value>
      <value>setenv[ 	
&#xD;]+PATH[ 	
&#xD;]+([^ 	
&#xD;]*)[ 	
&#xD;]*$</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:14202" version="2" datatype="string" comment="all user homedirs">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:14202" item_field="home_dir" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:4603" version="4" datatype="string" comment="gssftp FTP Banner Path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:4606" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:4604" version="4" datatype="string" comment="gssftp FTP Banner File">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:4607" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:4300" datatype="string" version="1" comment="regexp for all local groups">
      <concat>
        <literal_component>^</literal_component>
        <object_component object_ref="oval:mil.disa.fso.rhel:obj:4301" item_field="subexpression" />
        <literal_component>$</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:31100" version="2" datatype="string" comment="TFTP daemon path">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:31102" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:31101" version="2" datatype="string" comment="TFTP daemon file">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:31103" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:15400" version="1" datatype="string" comment="user ownership">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:15401" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:15401" version="1" datatype="string" comment="user ownership">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:15402" item_field="subexpression" />
    </local_variable>
    <constant_variable id="oval:mil.disa.fso.rhel:var:15700" datatype="string" version="1" comment="device paths">
      <value>/dev</value>
      <value>/selinux</value>
    </constant_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:25600" version="6" comment="UID for user bin" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:25601" item_field="user_id" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:27600" version="6" comment="UID for user sys" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:27601" item_field="user_id" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:27601" version="6" comment="UID for user lp" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:27602" item_field="user_id" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:38100" version="6" comment="GID for group sys" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:38100" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:20001" version="6" comment="GID for group bin" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:38102" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:26302" version="6" comment="list of filenames with log_on_failure" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:26306" item_field="filename" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:26301" version="6" comment="list of filenames with log_on_success" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:26305" item_field="filename" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:26300" version="6" comment="list of filenames with log_type" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:26304" item_field="filename" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.rhel:var:37200" version="1" comment="use to filter out entries with no (" datatype="string">
      <object_component object_ref="oval:mil.disa.fso.rhel:obj:37201" item_field="subexpression" />
    </local_variable>
  </variables>
</oval_definitions>

