<notegroup>
<!-- This file enables documentation of how the RHEL 5 STIG requirements
     will be migrated to consensus for RHEL 6. -->


<note ref="811" auth="GG" rule="service_auditd_enabled">This is covered in RHEL 6 content</note>

<note ref="778" auth="GG" rule="securetty_root_login_console_only">This is covered in RHEL 6 content</note>

<note ref="768" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="766" auth="GG" rule="accounts_passwords_pam_faillock_deny">This is covered in RHEL 6 content</note>

<note ref="762" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29376" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29289" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29288" auth="GG" rule="audit_rules_kernel_module_loading">This is covered in RHEL 6 content</note>
<note ref="29286" auth="GG" rule="audit_rules_kernel_module_loading">This is covered in RHEL 6 content</note>
<note ref="29284" auth="GG" rule="audit_rules_kernel_module_loading">This is covered in RHEL 6 content</note>
<note ref="29281" auth="GG" rule="audit_rules_kernel_module_loading">This is covered in RHEL 6 content</note>

<note ref="29279" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29275" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29274" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29272" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29261" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29259" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29257" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29255" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29253" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29252" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29251" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>
<note ref="29250" auth="GG" rule="audit_dac_actions">This is covered in RHEL 6 content</note>

<note ref="29249" auth="GG" rule="">This is not covered in RHEL 6 content</note>
<note ref="29248" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29247" auth="GG" rule="audit_network_modifications">This is covered in RHEL 6 content</note>
<note ref="29246" auth="GG" rule="audit_network_modifications">This is covered in RHEL 6 content</note>

<note ref="29245" auth="GG" rule="audit_rules_time_clock_settime">This is covered in RHEL 6 content</note>

<note ref="29244" auth="GG" rule="audit_rules_time_stime">This is covered in RHEL 6 content</note>

<note ref="29243" auth="GG" rule="audit_rules_time_settimeofday">This is covered in RHEL 6 content</note>

<note ref="29242" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29241" auth="GG" rule="">This is not covered in RHEL 6 content</note>

<note ref="29240" auth="GG" rule="audit_rules_file_deletion_events">This is covered in RHEL 6 content</note>

<note ref="29239" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>
<note ref="29238" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>
<note ref="29237" auth="GG" rule="">This is not covered in RHEL 6 content</note>
<note ref="29236" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>

<note ref="931" auth="VP">
This is not in the RHEL 6 content.  Nosuid / nodev checks address perms on NFS shares.
</note>

<note ref="1026" auth="VP">
This is not in the RHEL 6 content.  The requirements SSL / Localhost will be addressed via the Web Stig, there is no need (IMHO) to require this twice.
</note>

<note ref="1047" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="4387" auth="VP">
This is covered in the RHEL 6 content. The check CCE-3987-5 meets this requirement
</note>

<note ref="4392" auth="VP">
This is not covered in the RHEL 6 content.  This check is entirely manual and shouldn't be added to RHEL 6 content
</note>

<note ref="4395" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="4397" auth="VP">
This is covered in the RHEL 6 content.  CCE-4191-3
</note>

<note ref="4399" auth="VP">
This is covered in the RHEL 6 content by setting NIS to disabled.
</note>

<note ref="4427" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="4428" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="4690" auth="VP">
This is covered in the RHEL 6 content.  By applying patches, this requirement will be addressed
</note>

<note ref="4691" auth="VP">
This is covered in the RHEL 6 content.  By applying patches, this requirement will be addressed
</note>

<note ref="4695" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="4697" auth="VP">
This is not covered in the RHEL 6 content.  There is a check to disable a GUI, but a GUI is sometimes required for install of 3rd party apps (Oracle, Weblogic, etc)
</note>

<note ref="4702" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  CCE-3919-8 is set vsftpd to off
</note>

<note ref="11976" auth="VP">
This is covered in RHEL 6 content in a slightly different manner. CCE-4092-3 sets pass max days in /etc/login.defs, not shadow.
</note>

<note ref="11980" auth="VP">
This is covered in RHEL 6 content in a slightly different manner.  CCE-17248-6 states a *.*, which would include the authpriv being submitted to the loghost.  The audit.rules settings are not called out
</note>

<note ref="11980" auth="VP">
This is not covered in the RHEL 6 content.
</note>

<note ref="11983" auth="VP">
This is not covered in the RHEL 6 content.  This will have to be a manual check IF it is to be included.
</note>

<note ref="11984" auth="VP">
This is not covered in the RHEL 6 content.  Default settings from RH should be acceptable for this and should be covered in the rpm verify check.
</note>

<note ref="11985" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="11987" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  NIS+ is to be set to disable / erased.
</note>

<note ref="11988" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  CCE-TODO requires .rhosts file to be removed.
</note>

<note ref="11989" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  CCE-TODO requires .rhosts file to be removed.
</note>

<note ref="11990" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="11995" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="11996" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="11999" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="12002" auth="VP">
This is covered in the RHEL 6 content.  CCE-4236-6
</note>

<note ref="12004" auth="VP">
This is covered in RHEL 6 content in a slightly different manner.  CCE-17248-6 states a *.*, which would include the authpriv being submitted to the loghost.  The audit.rules settings are not called out
</note>

<note ref="12010" auth="VP">
This is covered in the RHEL 6 content.  CCE-4236-6
</note>

<note ref="12011" auth="VP">
This is not covered in the RHEL 6 content.  The RHEL 6 requirement is to disable FTP
</note>

<note ref="12014" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="12017" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="12023" auth="VP">
This is covered in the RHEL 6 content.  
</note>

<note ref="12028" auth="VP">
This is covered in the RHEL 6 content.  This is a manual check.  Previously have addressed this with DISA about this that HBSS (which is required on systems) meets this requirement.
</note>

<note ref="12030" auth="VP">
This is not covered in the RHEL 6 content. 
</note>

<note ref="12030" auth="JB">
It is impossible to express network access rules
for a particular use case in a baseline.  Keep best
practice suggestions in a howto guide.
Furthermore, iptables obsolete TCPwrappers.
</note>

<note ref="22301" auth="VP">
This is covered in the RHEL 6 content. CCE-14735-5
</note>

<note ref="22302" auth="VP">
This is covered in the RHEL 6 content. CCE-14063-2
</note>

<note ref="22303" auth="VP">
This is covered in the RHEL 6 content. CCE-14063-2
</note>

<note ref="22304" auth="VP">
This is covered in the RHEL 6 content. CCE-14063-2
</note>

<note ref="22305" auth="VP">
This is covered in the RHEL 6 content. CCE-14063-2
</note>

<note ref="22306" auth="VP">
This is covered in the RHEL 6 content. CCE-14701-7
</note>

<note ref="22307" auth="VP">
This is covered in the RHEL 6 content. 
</note>

<note ref="22308" auth="VP">
This is not covered in the RHEL 6 content. 
</note>

<note ref="22308" auth="JB">
This is nice best practice for a howto guide,
but it is unreasonable to dictate which groups
a site should use for its privileged users.
</note>

<note ref="22312" auth="VP">
This is not covered in the RHEL 6 content. This is a manual check.
</note>

<note ref="22339" auth="VP">
This is covered in the RHEL 6 content. 
</note>

<note ref="22347" auth="VP">
This is covered in the RHEL 6 content. CCE-14300-8
</note>

<note ref="22348" auth="DS">
Password hashes are not stored in /etc/group. 
</note>

<note ref="22349" auth="VP">
This is not covered in the RHEL 6 content. 
</note>

<note ref="22351" auth="VP">
This is not covered in the RHEL 6 content.  This is a manual check.  This check typically fails with accounts for Oracle (ora:dba) is a good example of this.
</note>

<note ref="22358" auth="VP">
This is not covered in the RHEL 6 content.
</note>

<note ref="22369" auth="VP">
This is not covered in the RHEL 6 content.
</note>

<note ref="22374" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  RHEL 6 admin_space_left_action = ACTION
</note>

<note ref="22375" auth="VP">
This is covered in the RHEL 6 content in a slightly different manner.  RHEL 6 admin_space_left_action = ACTION
</note>

<note ref="22376" auth="VP">
-w /usr/sbin/useradd -p x -k useradd - Not in RHEL 6 
-w /usr/sbin/groupadd -p x -k groupadd - Not in RHEL 6
-w /etc/passwd -p a -k passwd  - Is in RHEL 6
-w /etc/shadow -p a -k shadow  - Is in RHEL 6
-w /etc/group -p a -k group    - Is in RHEL 6
-w /etc/gshadow -p a -k gshadow - Is in RHEL 6
</note>

<note ref="22377" auth="VP">
-w /usr/sbin/usermod -p x -k usermod - Not in RHEL 6
-w /usr/sbin/groupmod -p x -k groupmod - Not in RHEL 6 
-w /etc/passwd -p w -k passwd - Is in RHEL 6
-w /etc/shadow -p w -k shadow - Is in RHEL 6
-w /etc/group -p w -k group   - Is in RHEL 6
-w /etc/gshadow -p w -k gshadow - Is in RHEL 6 
</note>

<note ref="22378" auth="VP">
-w /usr/bin/passwd -p x -k passwd - Not in RHEL 6
</note>

<note ref="22382" auth="VP">
-w /usr/sbin/userdel -p x - Not in RHEL 6 
-w /usr/sbin/groupdel -p x - Not in RHEL 6
</note>

<note ref="22383" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22385" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22391" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22397" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22404" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22405" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22408" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22409" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22410" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22411" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22414" auth="VP">
This is covered in RHEL 6 content 
</note>

<note ref="22415" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22416" auth="VP">
This is covered in RHEL 6 content 
</note>

<note ref="22417" auth="VP">
This is covered in RHEL 6 content 
</note>

<note ref="22418" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22419" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22421" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22422" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22429" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22430" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22431" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22432" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22433" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22434" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22440" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22447" auth="VP">
This is covered in RHEL 6  content in a slightly different manner.  CCE-3765-5 sets SNMP to disabled
</note>

<note ref="22448" auth="VP">
This is covered in RHEL 6 content in a slightly different manner.  CCE-3765-5 sets SNMP to disabled
</note>

<note ref="22449" auth="VP">
This is covered in RHEL 6 content in a slightly different manner.  CCE-3765-5 sets SNMP to disabled
</note>

<note ref="22455" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22456" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22457" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22458" auth="VP">
This is not covered in RHEL 6 content.  This is a manual check
</note>

<note ref="22461" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22462" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22463" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22470" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22471" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22472" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22473" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22474" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22475" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22485" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22486" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22487" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22488" auth="VP">
This is not covered in RHEL 6 content
</note>

<note ref="22490" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to disabled in RHEL 6 content
</note>

<note ref="22491" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to disabled in RHEL 6 content
</note>

<note ref="22499" auth="VP">
This is not covered in RHEL 6 content.  
</note>

<note ref="22500" auth="VP">
This is not covered in RHEL 6 content.  
</note>

<note ref="22501" auth="VP">
This is not covered in RHEL 6 content.  
</note>

<note ref="22506" auth="VP">
This is not covered in RHEL 6 content.  This is a manual check
</note>

<note ref="22507" auth="VP">
This is not covered in RHEL 6 content.  AIDE is set to be installed, but not configuration changes are set for the aide.conf in RHEL 6 content.
</note>

<note ref="22508" auth="VP">
This is not covered in RHEL 6 content.  AIDE is set to be installed, but not configuration changes are set for the aide.conf in RHEL 6 content.
</note>

<note ref="22511" auth="VP">
This is covered in RHEL 6 content. 
</note>

<note ref="22514" auth="VP">
This is covered in RHEL 6 content. 
</note>

<note ref="22524" auth="DS">
This is not covered in the RHEL6 content. AppleTalk support is not included in RHEL6.
</note>

<note ref="22530" auth="VP">
This is covered in RHEL 6 content. 
</note>

<note ref="22533" auth="VP">
This is covered in RHEL 6 content. 
</note>

<note ref="22539" auth="DS">
This is covered in the RHEL6 content. 
</note>

<note ref="22541" auth="VP">
This is not covered in RHEL 6 content. IPV6 is set to be disabled
</note>

<note ref="22542" auth="VP">
This is not covered in RHEL 6 content. IPV6 is set to be disabled
</note>

<note ref="22545" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to be disabled
</note>

<note ref="22546" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to be disabled
</note>

<note ref="22547" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to be disabled
</note>

<note ref="22548" auth="VP">
This is covered in RHEL 6 content in a slightly different way.
</note>

<note ref="22549" auth="VP">
This is covered in RHEL 6 content in a slightly different way.
</note>

<note ref="22550" auth="VP">
This is covered in RHEL 6 content
</note>

<note ref="22553" auth="VP">
This is not covered in RHEL 6 content.  IPV6 is set to be disabled
</note>

<note ref="22555" auth="VP">
This is covered in RHEL 6 content. 
</note>

<note ref="22556" auth="VP">
This is covered in RHEL 6 content. This is a manual check
</note>

<note ref="22557" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22558" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22563" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22564" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22565" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22567" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22568" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22569" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22571" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22572" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22573" auth="VP">
This is not covered in RHEL 6 content.
</note>

<note ref="22575" auth="VP">
This is not covered in RHEL 6 content.  *note* DISA FSO stated HBSS meets this requirement
</note>

<note ref="22577" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22582" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22583" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22586" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22587" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22588" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22589" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22598" auth="VP">
This is covered in the RHEL 6 content
</note>

<note ref="22665" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="22702" auth="VP">
This is not covered in the RHEL 6 content
</note>

<note ref="23732" auth="VP">
This is not covered in the RHEL 6 content.  FTP is set to be disabled in RHEL 6
</note>

<note ref="23736" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="23738" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="23739" auth="VP">
This is covered in the RHEL 6 content.
</note>

<note ref="23741" auth="VP">
This is not covered in the RHEL 6 content.
</note>

<note ref="23952" auth="VP">
This is not covered in the RHEL 6 content.
</note>

<note ref="23972" auth="VP">
This is not covered in the RHEL 6 content.  IPV6 is set to be disabled
</note>

<note ref="24331" auth="DS">
This is covered in the RHEL 6 content.  
</note>

<note ref="24384" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="24624" auth="VP">
This is covered in the RHEL 6 content.  
</note>

<note ref="27250" auth="VP">
This is not covered in the RHEL 6 content.  
</note>

<note ref="27283" auth="VP">
This is covered in the RHEL 6 content.  
</note>

<note ref="27284" auth="VP">
This is covered in the RHEL 6 content.  
</note>

<note ref="760,923,925,4246,4247,4248,4255,4357,4398,11986,12018,12020,12021,
22310,22311,22578,22579,27251,22579,22580,27251" auth="JB">
This is a manual/procedural check that requires human intervention.
How to handle this for a specific OS's STIG is currently under investigation.
</note>

<note ref="22578,22579" auth="18octDCM">
This was identified as no longer practical for most use cases.
</note>

<note ref="760,4398" auth="18octDCM">
This was identified as impractical/costly.
</note>

<note ref="923" auth="18octDCM">
This was identified as redundant to the integrity checking baseline requirements.
</note>

<note ref="925" auth="18octDCM">
This was identified as not indicative of the underlying driver behavior.
</note>

<note ref="22310,22311" auth="18octDCM">
This was identified as providing little confidence of proper system state, as
it is extremely difficult to query the system with any confidence.
</note>

<note ref="22363,22354,22355,22359,22360,22364" auth="JB">
This could be considered for a new group that involves ensuring LD_LIBRARY_PATH,
LD_PRELOAD, LD_AUDIT, and relative paths do not occur in a particular set of initialization files.
At the same time, this represents a level of misconfiguration-checking
that may not be appropriate for a baseline.
</note>

<note ref="22361" auth="JB">
Isn't this redundant to V-914 and V-915?
</note>

<note ref="12024" auth="JB">
This rule is made irrelevant by the advent of browser-based IM clients.
</note>


<note ref="12025" auth="JB">
The intent of the check is addressed effectively only by network traffic filtering/inspection.
</note>


<note ref="27285" auth="JB">
We are manually inspecting the well-formedness of certain configuration files? What?
</note>

<note ref="793,787,901,902,903,904,905,906,750,924,925,11982" auth="JB">
This will be superseded by a new section describing expectations for permissions
contained in certain important directories.
</note>

<note ref="924,925" auth="JB">
DAC permissions on device files do not relate to their behavior, which
depends on the implementation of the underlying device driver.
</note>

<note ref="22370,22371,22372,22365" auth="JB">
This is superseded by the system-wide check for improper permissions provided
by the package manager. Automating this check became possible with OVAL 5.8.
</note>

<note ref="775,786,792,821,822,828,829,831,832,837,838,840,841,842,843,848,849,
928,929,974,975,978,979,980,981,987,988,989,994,1025,1027,1028,1029,1054,
1055,1056,1058,1059,4335,4334,4336,4339,4089,4090,4091,4358,4361,4364,
4365,4367,4368,4369,4370,4371,4393,4394,4430,11997,12019,12038,12039,12040,
22294,22295,22296,22323,22324,22325,22327,22328,22329,22332,22333,22335,
22336,22337,22342,22343,22392,22394,22396,22398,22406,22423,22425,
22427,22435,22438,22444,22451,22453,22451,22492,22496,22559,22560,22561" auth="WS">
This is superseded by the system-wide check for improper permissions provided
by the package manager. Automating this check became possible with OVAL 5.8.
</note>

<note ref="774,784,788,823,824,899,900,4342,4385,22319,22320,22321,22322,23953,27275,27276,27279" auth="JB">
The security argument is not apparent or salient.
</note>

<note ref="22297,22309,22313,22314,22315,22316,22317,22318,22322,22326,22330,
22334,22338,22340,22344,22350,22352,22353,22356,22357,22362,22366,22367,
22373,22384,22386,22387,22388,22389,22390,22393,22395,22407,22424,22426,
22428,22436,22437,22439,22441,22442,22445,22446,22450,22452,22454,22489,22493,
22497,22498,22502,22503,22504,22505,22562,22566,22570,22574,22585,22595,22596" auth="JB">
Existence of an ACL is not necessarily a problem, and checking for existence of ACLs on a random selection of
files does not achieve any security goals. Alternatives include denying use of any ACLs unless documented, or simply dropping these rules entirely (preferred).
</note>

<note ref="756,763,773,783,785,797,798,800,806,807,808,847,867,913,4687,4688,11945,11947,11948,11972,11973,12003,22290,22341,22342,22343,22576,22584,24386" auth="JB">
This is covered in the RHEL6 content.
</note>

<note ref="805" auth="JB">
This is covered in the RHEL6 content for NFS mounts.  Need to investigate removable media (for which we put in a ticket for configuration options a long time ago).
</note>

<note ref="11945" auth="JB">
What is the distinction and purpose of different MAC levels?
</note>

<note ref="22292" auth="JB">
This is desirable but not practical in many environments.  Notably, many other OSes
do not even support this capability.
</note>

<note ref="12765" auth="JB">
This needs to be added to the RHEL6 content.
</note>

<note ref="825,907,910,916,917" auth="JB">
Is this a concern on a modern system?
</note>

<note ref="770,918,921,922" auth="JB">
This is covered in the RHEL6 content in a slightly different manner.
</note>

<note ref="827" auth="JB">
This needs to be added to the RHEL6 content, as well as a complete re-write of its CUPS section.
</note>

<note ref="12022" auth="JB">
This is covered in the RHEL6 content in a slightly different manner: iptables is required.
</note>

<note ref="1011,12005" auth="JB">
This is covered in the RHEL6 content in a slightly different manner: xinetd is required to be disabled, and inetd is not available as part of RHEL6.
</note>

<note ref="11940" auth="JB">
This could be covered in the RHEL6 content itself, though it seems more like something appropriate for a CTO
upon retirement of major OS releases?
</note>

<note ref="4688,4701" auth="JB">
This is covered in the RHEL6 content in a slightly different manner: xinetd services are not permitted.
</note>

<note ref="4701" auth="JB">
Finger is still part of RHEL, and so a separate rule could be created for this if we were so inclined.
</note>

<note ref="835,4692,4694,12006" auth="JB">
Postfix is the mail server on RHEL 6, and items peculiar to sendmail no longer apply.
</note>

<note ref="4693" auth="JB">
This needs to be added, but adjusting for Postfix as the mail server on RHEL 6.
</note>

<note ref="4689" auth="JB">
Is this not redundant to the system-wide requirement for keeping patches up to date (V-783)?
</note>

<note ref="4696" auth="JB">
This package is only available in EPEL.  I suggest that this makes it out of scope.
</note>

<note ref="803,804" auth="JB">
Is this not redundant to the system-wide aide check (V-11945)?
</note>

<note ref="801,802" auth="JB">
Suggest that this be covered in the RHEL6 content in a slightly different manner: ensuring all setuid programs
are packaged (which implies vendor provenance).  Also, what is the goal of the documentation?
</note>

<note ref="769,794,795,796,11946,11977,11979,12024,12025,12049" auth="JB">
The intent or utility of the check procedure is not clear or not actionable.
</note>


<note ref="789,790,791,12026" auth="JB">
NIS/NIS+/yp should be disabled, as stated in a Rule in the RHEL 6 content.
NIS/NIS+/yp are obsolete and should not be running on any modern system.
</note>

<note ref="756" auth="1augDCM">
Note that sulogin may be going away in RHEL7. Shawn/Steve to followup.
Also, need to add in architecture specific details e.g. s390x
</note>

<note ref="1" auth="1augDCM">
Current mapping does not meet requirement as it works for passwords, not keys
Per Steve Grubb there is a patch coming to enable this through PAM, so we can map to met_inherently in RHEL 6.4
Put more mappings
Where requirement says "must provide.." that is a yes/no. We can map to met_inherently.
Poor CCI that can be restructured -- consider removing
Perhaps move this to OCIL as interview question
</note>

<note ref="1372,1373,21" auth="1augDCM">
Valid requirement but not applicable to STIG-server.
</note>

<note ref="765" auth="1augDCM">
Change check procedure to check audit logs, not lastlog
</note>

<note ref="769" auth="1augDCM">
/etc/pam.d/gdm can enforce this, update the check
</note>

<note ref="774" auth="1augDCM">
Update guidance to say "don't change from default homedir"
</note>

<note ref="775" auth="1augDCM">
chmod to 550 or more restrictive, not 700
</note>

<note ref="776" auth="1augDCM">
Reword to allow changes, but ensure we audit them. Language around MUST have absolute paths needs to stay. Path order must be vendor default.
</note>

<note ref="784" auth="1augDCM">
This is now default behavior, can be removed
</note>


<note ref="786" auth="1augDCM">
For filepermission checks, defer to common criteria accepted values
Need to ensure rpm verify flags such files
</note>

<note ref="22297,22309,22313,22314,22315,22316,22317,22318,22322,22326,22330,
22334,22338,22340,22344,22350,22352,22353,22356,22357,22362,22366,22367,
22373,22384,22386,22387,22388,22389,22390,22393,22395,22407,22424,22426,
22428,22436,22437,22439,22441,22442,22445,22446,22450,22452,22454,22489,22493,
22497,22498,22502,22503,22504,22505,22562,22566,22570,22574,22585,22595,22596" auth="1augDCM">
for all ACL content we will change to allow ACLs (via group prose) then mandate their audit (via a rule)
</note>

<note ref="366" auth="1augDCM">
change chkconfig off to chkconfig --del
</note>

<note ref="366" auth="1augDCM">
revisit polyinstantiation for RHEL7
</note>

<note ref="790" auth="1augDCM">
Installation of NIS will now be a CAT I finding. NIS to be added to banned package list
</note>

<note ref="24347" auth="1augDCM">
Language to be broadened to beyond just CAC cards per PKI-e
</note>

<note ref="984, 986" auth="1augDCM">
Disablement of at service to be implemented in RHEL6 STIG
</note>

<note ref="1023" auth="1augDCM">
News server content can be removed
</note>

<note ref="22291,22459,22460" auth="1augDCM">
This requirement can be removed
</note>

<note ref="22298" auth="1augDCM">
value of 10 is fine
</note>

<note ref="205" auth="1augDCM">
change value to 15
</note>

<note ref="199" auth="1augDCM">
DoD - 60
IC - 90 days
</note>

<note ref="1092" auth="1augDCM">
Update prose to 3
</note>

<note ref="22299" auth="1augDCM">
pam lastlog.so noupdate showfailed
touch /etc/hushlogins
</note>

<note ref="810,27276" auth="1augDCM">
disable account, not remove
set shell to nologin
</note>

<note ref="23953" auth="1augDCM">
met_inherently
</note>

<note ref="24357" auth="1augDCM">
change to audit dispatch not rsyslog audsp-auremote
</note>

<note ref="12049" auth="1augDCM">
update tool listing
allow install but allow access by priv users (root, chmod 700)
</note>

<note ref="12765" auth="1augDCM">
update to remove vendor specific language
</note>

<note ref="22355" auth="1augDCM">
also watch for LD_AUDIT
</note>

<note ref="814" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
appears to already exist. 
rule=audit_rules_unsuccessful_file_modification manual=no
</note>

<note ref="815" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
appears to already exist. 
rule=audit_rules_file_deletion_events manual=no
</note>

<note ref="818" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
appears to already exist. 
rule=audit_manual_logon_edits manual=no
Has no NIST controls associated
</note>

<note ref="819" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
appears to already exist. 
rule=audit_rules_dac_modification manual=no
</note>

<note ref="833" auth="KS">
Sendmail is no longer shipped by default.  Postfix is the default instead.
Equivalent check does not exist in the RHEL6 prose, it can be automated and 
the OVAL for it does not appear to already exist. 
rule=null manual=no
</note>

<note ref="834" auth="KS">
Sendmail is no longer shipped by default.  Postfix is the default instead.
Equivalent check does not exist in the RHEL6 prose, it can be automated and 
the OVAL for it does not appear to already exist. 
rule=null manual=no
</note>

<note ref="836" auth="KS">
Sendmail is no longer shipped by default.  Postfix is the default instead.
rsyslog is used instead of syslog
Check exists in multiple places in the RHEL6 prose, it can be automated and 
the OVAL for it appears to already exist. 
rule=postfix_logging manual=no
group=ensure_rsyslog_log_file_configuration (redundant?)
Has no cce associated
</note>

<note ref="850" auth="JB">
This is superseded by a stronger requirement to not permit remote X sessions.
Also, the RHEL 5 STIG text is wrong anyway.
</note>

<note ref="845" auth="JB">
A non-mess version of this check exists in the RHEL 6 content, but could
use further improvement. 
</note>

<note ref="845,850,903" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
</note>

<note ref="846" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
At the same time, does this check make sense?  Given the many security issues
present in ftp, does requiring credentials really provide authentication of
the user?
</note>

<note ref="901" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
By default new home directories will be given 700 perms.
</note>

<note ref="904,905" auth="JB">
A STIG is not an unconstrained search for potential misconfigurations.
If it were, there would far more files than these to consider.
</note>

<note ref="904,905,914,915,924,986,993,995,1021,1022,1046,4087,4268, 
4346,4357,4360,4366,11985,11986,11989,11995,12030,22302,22304,22308,
22348,22349,22374,22378,22382,22408,22415,22421,22430,22447,22448,
22449,22473,22475,22485,22486,22487,22488" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
</note>

<note ref="906" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for
it does not appear to already exist. 
rule=null manual=no
This check should be superseded by the system-wide check for improper 
permissions provided by the package manager. Automating this check became 
possible with OVAL 5.8
</note>

<note ref="907" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
This should not occur.  If such a case is identified it should be brought to
the vendor for correction as a bug in the product.
</note>

<note ref="923" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be entirely automated and 
the OVAL for it does not appear to already exist. 
rule=null manual=yes
A simple example, a cronjob can be made to look for devices and compare to 
previous lists but still requires someone to review it which is a manual 
process
</note>

<note ref="925" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist. 
rule=null manual=no
Check seems redundant with V-924
</note>

<note ref="932" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to already exist.
group=specify_anonymous_uid_gid manual=no
</note>

<note ref="933" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to already exist.
group=export_filesystems_read_only manual=no
</note>

<note ref="935" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to already exist.
rule=use_root_squashing_all_exports manual=no
</note>

<note ref="936" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
appears to already exist.
rule=use_nosuid_option_on_nfs_mounts manual=no
</note>

<note ref="940" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist.
rule=blank manual=no
There are some mentions in the RHEL6 prose (group=nfs_restrict_access_rpcbind) 
of using TCP Wrappers to protect certain versions of NFS but nothing specific 
which may be the intent as this check is not at all specific either.
</note>

<note ref="941,982,1204" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to exist.
group=ensure_rsyslog_log_file_configuration manual=no
</note>

<note ref="974" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
appears to already exist.
group=restrict_at_cron_users manual=no
</note>

<note ref="976,1010" auth="KS">
Partial check exists in the RHEL6 prose, it can be automated and the OVAL for it
appears to already exist.
rule=world_writable_files manual=no
Check is addressed by the world_writable_files_system_ownership rule to find
any files that are world writable but not system owned.  System file 
permissions are addressed through the rpm verification check
</note>

<note ref="977" auth="KS">
Partial check exists in the RHEL6 prose, it can be automated and the OVAL for it
appears to already exist.
rule=world_writable_files_system_ownership manual=no
Check is addressed by the world_writable_files_system_ownership rule to find
any files that are world writable but not system owned.  System file 
permissions are addressed through the rpm verification check
</note>

<note ref="983,1048,1049,1061,11981,11983,11984,11990,11994,12014,22351,
22369,22385,22391,22397,22405,22440,22471,22472,22567,22568,22569,22571,
22572,22573,22586,22587,22702,29289" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not appear to already exist.
rule=null manual=no
A new section targeting permissions in key directories will be added.
</note>

<note ref="984,985" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to exist.
rule=restrict_at_cron_users manual=no
This and others like it should be covered under a new section targeting 
permissions in key directories
</note>

<note ref="1013" auth="KS">
Check exists in the RHEL6 prose, it cannot be automated and the OVAL/OCIL for
it does not exist.
rule=bios_disable_usb_boot manual=yes
</note>

<note ref="1030" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to exist.
rule=smb_restrict_file_sharing manual=no
</note>

<note ref="1030" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
does not appear to exist.
rule=accounts_minimum_age_login_defs manual=no
</note>

<note ref="1032" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it
partially exists.
rule=accounts_minimum_age_login_defs manual=no
Guide and oval address changing the defaults but don't address the current
values
</note>

<note ref="1062" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for it 
not exist.
rule=null manual=no
Not sure what the argument is for singling these specific things out.
</note>

<note ref="4083" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=gconf_gnome_screensaver_idle_activation_enabled manual=no
</note>

<note ref="4084" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=accounts_password_pam_unix_remember manual=no
</note>

<note ref="4249" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=bootloader_password manual=no
</note>

<note ref="4250" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for it 
does not exist.
rule=null manual=no
System file permissions will be addressed through the rpm verification check
</note>

<note ref="4269" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated and the OVAL 
for it does not exist.
rule=null manual=yes
</note>

<note ref="4273,4274,4275,4276,4277,4278" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL 
for it does not exist.
rule=null manual=yes
This no longer ships in the default repo's.  Should be removed.
</note>

<note ref="4295" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=sshd_allow_only_protocol2 manual=no
</note>

<note ref="4298" auth="KS">
Check does not exists in the RHEL6 prose, it can be automated and the OVAL for 
it does not exist.
rule=null manual=no
We do have a section for addressing these sorts of items under the group 
root_logins, but this particular concern is not addressed.
</note>

<note ref="4301" auth="KS">
Check does not exists in the RHEL6 prose, it cannot be automated and the OVAL 
for it does not exist.
rule=null manual=yes
Cannot programmatically determine if a server is a "valid" DoD time source
without maintaining a exhaustive list of potentially sensitive information
</note>

<note ref="4304,22422" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for
it does not exist.
rule=null manual=no
This check doesn't actually determine if the file system is making use of 
journaling.  Is it necessary to carry this forward?
</note>

<note ref="4321" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=disable_smb_server manual=no
</note>

<note ref="4384" auth="KS">
Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=postfix_server_banner manual=no
</note>

<note ref="4387" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not exist.
rule=null manual=no
If we must include a section on ftp we should at least require it be done over
SSH.
</note>

<note ref="4392" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated and the OVAL 
for it does not exist.
rule=null manual=yes
This is not really feasible without maintaining an exhaustive list which 
constantly changes.  Also, why NMS?  We're allowed to run unauthorized s/w
on non-NMS systems?
</note>

<note ref="4395,22455" auth="KS">
Partial check does exists in the RHEL6 prose, it cannot be entirely automated 
and partial OVAL check for it does exist.
rule=rsyslog_send_messages_to_logserver manual=yes
We can verify that logs are sent to a remote server but we cannot determine in 
an automated fashion if it is "justified and documented using site-defined 
procedures."
</note>

<note ref="4397" auth="KS">
Partial check does exists in the RHEL6 prose, it can be automated an OVAL check 
for it appears to exist.
rule=disable_dhcp_client manual=no
</note>

<note ref="4399,11987,11988" auth="KS">
Check in the RHEL6 prose requires NIS not be installed, it can be automated and 
an OVAL check for it appears to exist.
rule=uninstall_ypserv manual=no
Let NIS die.
</note>

<note ref="4427,4428" auth="KS">
Check in the RHEL6 prose requires most if not all of these files be removed, 
it can be automated and an OVAL check for it appears to exist.
rule=no_rsh_trust_files manual=no
What "r-commands" are we suggesting be used with these? V-11988 wants these 
removed anyway.
</note>

<note ref="4430" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not exist.
rule=null manual=no
This is root:root by default.  A new section will be added discussing 
permissions on key files.
</note>


<note ref="4689" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not exist.
rule=null manual=no
Wouldn't this also be covered by V-783 on keeping the system patched?
</note>

<note ref="4689,4691" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and the OVAL for 
it does not exist.
rule=null manual=no
Wouldn't this also be covered by V-783 on keeping the system patched?
</note>

<note ref="4695" auth="KS">
Check does exist in the RHEL6 prose to deny use of TFTP, it can be automated 
and the OVAL for it does exist.
rule=tftp-server manual=no
Is it not necessary for other software on the system to be authorized and 
approved? 
</note>

<note ref="4697,12016,12017" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated 
and the OVAL for it does not exist.
rule=null manual=yes
Without knowing what hosts should be trusted we can't do this, we don't really
want to either.  X has numerous issues.  If remote connections to X must be 
used it should be tunneled over something such as SSH.
</note>

<note ref="4702" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated
and the OVAL for it does not exist.
rule=null manual=yes
No automated means to determine presence in DMZ. We should not be allowing FTP.
</note>

<note ref="11976" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=accounts_maximum_age_login_defs manual=yes
</note>

<note ref="11980" auth="KS">
Partial check for authpriv does exist in the RHEL6 prose, it can be automated 
and the OVAL for it does exist.
group=ensure_rsyslog_log_file_configuration manual=no
The authpriv portion seems to be covered in several different places (V-12004,
V-941).  The value provided by the second half of this is not apparent and not
in the RHEL6 prose.
</note>

<note ref="11996" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
appears to exist.
rule=disable_users_coredumps manual=no
</note>

<note ref="11999" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=sysctl_kernel_exec_shield manual=no
</note>

<note ref="12002" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=sysctl_net_ipv4_conf_all_accept_source_route manual=no
This check is split in the RHEL6 prose and addressed in the rule listed above 
and the sysctl_net_ipv4_conf_default_accept_source_route rule
</note>

<note ref="846,12010,12011,23732" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
appears to exist.
rule=uninstall_vsftpd manual=no
Per V-12010 don't allow FTP.  Lets get rid of these other random FTP rules.
</note>

<note ref="12023" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=sysctl_ipv4_ip_forward manual=no
</note>

<note ref="12028" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated and the OVAL 
for it does not exist.
rule=null manual=yes
Any automated effort to check this is at best a token effort.
</note>

<note ref="22301" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=gconf_gnome_screensaver_mode_blank manual=no
</note>

<note ref="22303" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=set_password_hashing_algorithm manual=no
</note>

<note ref="22305,22306,22307" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
group=password_quality_pamcracklib manual=no
The cracklib checks are in the RHEL6 prose.
</note>

<note ref="22312" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=no_files_unowned_by_group manual=no
</note>

<note ref="22339" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=userowner_shadow_file manual=no
</note>

<note ref="22347" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=accounts_password_all_shadowed manual=no
</note>

<note ref="22375" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
does exist.
rule=auditd_data_retention_space_left_action manual=no
</note>

<note ref="22376,22377" auth="KS">
Partial check does exist in the RHEL6 prose, it can be automated and a partial
OVAL for it does exist.
rule=audit_account_changes manual=no
Auditing of the files is in place but not the commands.
</note>

<note ref="22383" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=audit_rules_kernel_module_loading manual=no
</note>

<note ref="22404" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=service_kdump_disabled manual=no
</note>

<note ref="22409" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=iptables_icmp_disabled manual=no
This is accomplished by whitelisting specific types of icmp traffic.
</note>

<note ref="22410,22411" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sysctl_net_ipv4_icmp_echo_ignore_broadcasts manual=no
V-22410 and V-22411 are the same.
</note>

<note ref="22414" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sysctl_net_ipv4_conf_all_accept_source_route manual=no
This check is split in the RHEL6 prose into the above and the 
sysctl_net_ipv4_conf_default_accept_source_route rule.
</note>

<note ref="22416" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sysctl_net_ipv4_conf_all_accept_redirects manual=no
This check is split in the RHEL6 prose into the above and the 
sysctl_net_ipv4_conf_default_accept_redirects rule.
</note>

<note ref="22417" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sysctl_net_ipv4_conf_all_send_redirects manual=no
This check is split in the RHEL6 prose into the above and the 
sysctl_net_ipv4_conf_default_send_redirects rule.
</note>

<note ref="22418" auth="KS">
Partial check does exist in the RHEL6 prose, it can be automated and partial 
OVAL for it does exist.
rule=sysctl_net_ipv4_conf_all_log_martians manual=no
This check is split in the RHEL6 prose into the above but no equivalent rule 
exists for "default."
</note>

<note ref="22419" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sysctl_net_ipv4_tcp_syncookies manual=no
</note>

<note ref="22429" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=service_rpcbind_disabled manual=no
</note>

<note ref="22431,22432,22433,22434" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=uninstall_rsh-server manual=no
</note>

<note ref="22456,22461,22462,22463,22474" auth="KS">
Check does not exist in the RHEL6 prose, it can be automated and OVAL for it 
does not exist.
rule=null manual=no
No check exists for the client side.
</note>

<note ref="22457" auth="KS">
Check does not exist in the RHEL6 prose, it cannot be automated and OVAL for 
it does not exist.
rule=null manual=yes
No automated way to determine the management interface.
</note>

<note ref="22458,22459" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sshd_use_approved_ciphers manual=no
V-22458 and V-22459 are essentially the same.
</note>

<note ref="22470" auth="KS">
Partial check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sshd_limit_user_access manual=no
Prose focuses on blacklisting where we should prefer a whitelist.
</note>

<note ref="22489" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and OVAL for it does 
exist.
rule=sshd_enable_warning_banner manual=no
</note>

<note ref="780" auth="JB">
This is incoherent. There is no apparent relationship between the title, description, and
fixtext/checktext. The checking text lists user IDs in
/etc/passwd, which have nothing to do with group IDs.  If something coherent is
presented it could be considered for inclusion for RHEL 6, but even then, the
possibilities suggest checking for a highly unlikely configuration which is not
worth inclusion in a baseline.
</note>

<note ref="777" auth="JB">
This is redundant to another rule requiring that the path be the vendor default.
</note>

<note ref="776,812,761,781,782,813,4382,11975" auth="DS">
This is covered in the RHEL6 content.
</note>

</notegroup>
